The license is the whole mechanism. Z.ai's MIT terms let downstream users inspect the model, run it on their own infrastructure, change its behavior and ship it in products without paying Z.ai for generated tokens [13]. Refusal controls on a hosted endpoint govern only the traffic that reaches that endpoint, not a checkpoint sitting on someone else's GPU.
DeAlignAI's model card names its technique CRACK and describes it as changing refusal behavior directly in the weights, with the edit kept conservative to preserve quality [8]. That phrasing treats refusal as localized enough in parameter space to edit without retraining. The supplied research does not document a controlled comparison between Z.ai's original model and the FP8 variant under identical inference settings, and does not establish how much of the original capability survived [10]. "Conservative" is therefore a claim about a diff that only DeAlignAI has measured.
The 320-of-320 figure is a compliance count from DeAlignAI's own README, on a benchmark that scores how a model responds to harmful requests across areas such as cybercrime, disinformation and biological weapons [4][6]. There is no established independent replication or external methodological validation [5]. For that count to carry the meaning a security reader will attach to it, the grader's compliance criterion would need to match your threat model, the compliant answers would need to be correct as well as compliant, and the edited model would need to have retained the capability to act on them. None of that is shown here; HarmBench measures behavioral compliance with prompts rather than operational success against real systems [7][11].
The cyber numbers that would speak to capability belong to a different model. Z.ai reports 84.5% on CyberGym and 54.4% on ExploitBench for the larger GLM-5.3, and the GLM-5.3-Flash model card publishes neither result for the smaller model [12].
What does transfer is the shape of the artifact. Flash carries 320 billion total parameters and activates 18 billion per token [15], which is 5.6% of the weights live on any given forward pass [21]. Sparse activation sets what hardware can run the thing, and inference cost is what decides how widely a model gets operated outside its developer's infrastructure [20]. Z.ai's own scoreboard supports the cheapness story on its own harness: a discounted $0.045 per task on Artificial Analysis Intelligence Index v4.1.1 at a score of 57, and one-tenth the cost of GLM-5.2 [17]. On Z.ai's internal Code Bench, Flash scored 29.0 at maximum effort against 29.5 for Claude Opus 4.8 [18], and Z.ai reports 63.4 on DeepSWE v1.1 and 48.8 on AutomationBench versus 46.2 and 26.2 for GLM-5.2 [19], the last of those an 86% relative gain [22]. A vendor's internal bench, scored by the vendor, comparing the vendor's model to a competitor's, is a claim about the vendor's workload.
Runtimewire, citing an analysis on jyn.dev, frames the release the same way the evidence does: the download demonstrates the redistribution path, and the self-reported benchmark does not establish real-world offensive capability [23][24]. Jinho Jang's project also reports more than 200 controlled experiments and over 40 findings across nine models [9], which is a body of work no one outside it has audited either. The load-bearing fact needs no benchmark at all. A modified checkpoint is sitting behind a download link, under terms that permit precisely that [3][1].
