Aikido Safety has launched Altar-1, its first open-weight security model. It’s a compressed model of Z.AI’s GLM-5.3, constructed to run inside infrastructure the shopper controls. Altar-1 powers Aikido Machine, the corporate’s autonomous pentesting equipment for on-prem and air-gapped networks.
Is it deployable? Sure, the weights are public on Hugging Face and run with vLLM on a single node of 4x NVIDIA H200 GPUs.
The Drawback: Safety Context Can’t Go away the Community
Closed frontier fashions run on another person’s infrastructure. Utilizing them sends supply code, structure docs, and unremediated findings outdoors the community. Aikido factors to banks underneath data-residency mandates and OT operators with no web route.
Open-weight fashions remedy the residency downside however create a deployment hole. Combination-of-experts (MoE) fashions should retailer each knowledgeable, even when a workload makes use of only some of them. Safety brokers additionally construct long-running context. That KV cache competes with mannequin weights for a similar GPU reminiscence.
How Altar-1 Was Constructed
GLM-5.3 is a 753B parameter MoE mannequin. Every token routes to eight of 256 consultants per layer, which is about 40B lively parameters. Aikido utilized 2 compression steps:
- Step 1-Quantization: Altar-1 begins from the cyankiwi GLM-5.3-AWQ-INT4 checkpoint. AWQ shops routed knowledgeable weights in 4 bits, with 16-bit activations (W4A16). Consideration, the shared knowledgeable, dense layers, and the top keep in BF16.
- Step 2- Professional pruning: Aikido used Cerebras REAP (Router-weighted Professional Activation Pruning). REAP scores every knowledgeable by router weight and output magnitude, not simply by how typically it’s chosen. Altar-1 retains 168 of 256 routed consultants per layer and removes 88 (34.4%). No retraining is concerned.
Calibration used traces from Aikido’s pentesting harness, plus coding, software calling, reasoning, and multilingual Wikipedia textual content. Aikido states no buyer knowledge was used. Every knowledgeable is scored by its largest share of any single area’s routed work. That protects the specialist consultants for code, uncommon languages, and structured output.
Routing is unchanged. The router nonetheless picks 8 consultants per token, now from 168, with about 40B lively parameters.
| Checkpoint | Saved weights |
|---|---|
| GLM-5.3, BF16 | 1,506.7 GB |
| GLM-5.3, AWQ INT4 | 488.2 GB |
| Altar-1, pruned W4A16 | 328.0 GB |
Altar-1 is 78.2% smaller than BF16 and 32.8% smaller than the AWQ guardian. On constancy, Altar-1 has a KL divergence of 0.506 nats in opposition to full BF16 on a sealed 25-prompt panel. An EXL3 construct of the identical lower scores 0.511. The small print are within the public fidelity study.
