Aikido发布Altar-1：基于GLM-5.3剪枝的开源安全模型
Aikido Security Releases Altar-1: An Open-Weight Security Model Pruned From GLM-5.3 to 328 GB
MoE模型剪枝实战，给出了具体的量化、剪枝参数与性能损耗对比，对做私有化部署与安全Agent的同学有参考价值。
Aikido Security has released Altar-1, its first open-weight security model. It is a compressed version of Z.AI’s GLM-5.3, built to run inside infrastructure the customer controls. Altar-1 powers Aikido Machine, the company’s autonomous pentesting appliance for on-prem and air-gapped networks.
Aikido Security 发布了 Altar-1，这是其首款开源权重的安全模型。它是 Z.AI 的 GLM-5.3 的压缩版本，旨在运行在客户控制的内部基础设施中。Altar-1 为 Aikido Machine 提供动力，后者是该公司用于本地部署和物理隔离网络的自主渗透测试设备。
Is it deployable? Yes, the weights are public on Hugging Face and run with vLLM on a single node of 4x NVIDIA H200 GPUs.
可以部署吗？是的，权重已在 Hugging Face 上公开，并可在单个节点上使用 4 块 NVIDIA H200 GPU 配合 vLLM 运行。
The Problem: Security Context Cannot Leave the Network
问题：安全上下文无法离开网络
Closed frontier models run on someone else’s infrastructure. Using them sends source code, architecture docs, and unremediated findings outside the network. Aikido points to banks under data-residency mandates and OT operators with no internet route.
封闭的前沿模型运行在他人的基础设施上。使用它们会将源代码、架构文档以及未修复的发现发送到网络外部。Aikido 指出了受数据驻留法规约束的银行以及没有互联网路由的 OT（运营技术）运营商。
Open-weight models solve the residency problem but create a deployment gap. Mixture-of-experts (MoE) models must store every expert, even when a workload uses only a few of them. Security agents also build long-running context. That KV cache competes with model weights for the same GPU memory.
开源权重模型解决了驻留问题，但造成了部署差距。混合专家（MoE）模型必须存储所有专家，即使工作负载仅使用其中少数几个。安全代理还会构建长期运行的上下文。该 KV 缓存与模型权重争夺相同的 GPU 内存。
How Altar-1 Was Built
Altar-1 是如何构建的
GLM-5.3 is a 753B parameter MoE model. Each token routes to 8 of 256 experts per layer, which is about 40B active parameters. Aikido applied 2 compression steps:
GLM-5.3 是一个拥有 753B 参数的 MoE 模型。每个令牌在每个层路由到 256 个专家中的 8 个，这大约是 40B 的活跃参数。Aikido 应用了两个压缩步骤：
- Step 1-Quantization: Altar-1 starts from the cyankiwi GLM-5.3-AWQ-INT4 checkpoint. AWQ stores routed expert weights in 4 bits, with 16-bit activations (W4A16). Attention, the shared expert, dense layers, and the head stay in BF16.
- Step 2- Expert pruning: Aikido used Cerebras REAP (Router-weighted Expert Activation Pruning). REAP scores each expert by router weight and output magnitude, not just by how often it is selected. Altar-1 keeps 168 of 256 routed experts per layer and removes 88 (34.4%). No retraining is involved.
- 步骤 1-量化：Altar-1 始于 cyankiwi GLM-5.3-AWQ-INT4 检查点。AWQ 以 4 位存储路由专家权重，激活值为 16 位（W4A16）。注意力机制、共享专家、密集层和头部保持为 BF16。
- 步骤 2-专家剪枝：Aikido 使用了 Cerebras REAP（路由器加权专家激活剪枝）。REAP 根据路由器权重和输出幅度对每个专家进行评分，而不仅仅是根据被选择的频率。Altar-1 每层保留 256 个路由专家中的 168 个，移除了 88 个（34.4%）。不涉及重新训练。
Calibration used traces from Aikido’s pentesting harness, plus coding, tool calling, reasoning, and multilingual Wikipedia text. Aikido states no customer data was used. Each expert is scored by its largest share of any single domain’s routed work. That protects the specialist experts for code, rare languages, and structured output.
校准使用了来自 Aikido 渗透测试工具链的追踪数据，以及编码、工具调用、推理和多语言维基百科文本。Aikido 声明未使用任何客户数据。每个专家根据其在一个单一领域内路由工作中所占的最大份额进行评分。这保护了代码、稀有语言和结构化输出的专家型专长。
Routing is unchanged. The router still picks 8 experts per token, now from 168, with about 40B active parameters.
路由保持不变。路由器仍然为每个令牌选择 8 个专家，现在是从 168 个中选择，大约有 40B 的活跃参数。
| Checkpoint | Stored weights |
|---|---|
| GLM-5.3, BF16 | 1,506.7 GB |
| GLM-5.3, AWQ INT4 | 488.2 GB |
| Altar-1, pruned W4A16 | 328.0 GB |
| 检查点 | 存储权重 |
|---|---|
| GLM-5.3, BF16 | 1,506.7 GB |
| GLM-5.3, AWQ INT4 | 488.2 GB |
| Altar-1, 剪枝 W4A16 | 328.0 GB |
Altar-1 is 78.2% smaller than BF16 and 32.8% smaller than the AWQ parent. On fidelity, Altar-1 has a KL divergence of 0.506 nats against full BF16 on a sealed 25-prompt panel. An EXL3 build of the same cut scores 0.511. The details are in the public fidelity study.
Altar-1 比 BF16 小 78.2%，比 AWQ 父模型小 32.8%。在保真度方面，Altar-1 在封闭的 25 提示面板上与完整 BF16 相比的 KL 散度为 0.506 nats。相同切片的 EXL3 构建版本得分为 0.511。详细信息见公开保真度研究。
Benchmark Results
基准测试结果
Aikido team tested Altar-1 on its internal CVE benchmark. The benchmark covers 32 known vulnerabilities across 30 repositories, with 3 runs per case.
Aikido 团队在其内部 CVE 基准测试中评估了 Altar-1。该基准测试涵盖 30 个代码库中的 32 个已知漏洞，每种情况运行 3 次。
| Model | Avg recall per run | Found at least once |
|---|---|---|
| GLM-5.3, BF16 | 65.6% | 25 of 32 |
| GLM-5.3, AWQ INT4 | 61.5% | 23 of 32 |
| Altar-1 | 60.4% | 23 of 32 |
| 模型 | 每次运行的平均召回率 | 至少发现一次 |
|---|---|---|
| GLM-5.3, BF16 | 65.6% | 32 个中的 25 个 |
| GLM-5.3, AWQ INT4 | 61.5% | 32 个中的 23 个 |
| Altar-1 | 60.4% | 32 个中的 23 个 |
Compared with the AWQ checkpoint, pruning cost about 1 point of recall and no coverage. Compared with the parent, Altar-1 keeps 23 of 25 covered vulnerabilities (92%) at 5.2 points lower recall.
与 AWQ 检查点相比，剪枝导致召回率下降约 1 个百分点，覆盖率无变化。与父模型相比，Altar-1 保留了 25 个已覆盖漏洞中的 23 个（92%），召回率低 5.2 个百分点。
The benchmark’s scope is narrow. It measures targeted CVE rediscovery inside a pipeline that uses other models for the surrounding stages. It does not measure blind discovery, exploit validation, or fix proposals. Aikido also reports that Altar-1 found a valid critical-severity vulnerability during a client’s production pentest. That is a single result reported by the vendor.
该基准测试的范围较窄。它衡量的是在使用其他模型处理周围阶段的流水线内对已知 CVE 的定向重新发现。它不衡量盲盒发现、漏洞利用验证或修复建议。Aikido 还报告称，Altar-1 在一次客户的生产渗透测试中发现了一个有效的严重性漏洞。这是供应商报告的单个结果。
Deployment and License
部署与许可
The model card requires Hopper GPUs (H100 or H200). Aikido says 328 GB across 4x H200 leaves room for a 128k-context KV cache at production batch sizes.
模型卡片要求使用 Hopper GPU（H100 或 H200）。Aikido 表示，在 4x H200 上总共 328 GB 的显存，在生产批次大小下仍可为 128k 上下文的 KV 缓存留出空间。
vllm serve AikidoSec/altar-1 --tensor-parallel-size 4 --trust-remote-code --max-model-len 131072vLLM selects the Marlin MoE kernel automatically. A 4x H100 80 GB node has only 320 GB of memory, which is less than the 328 GB of weights.
vLLM 会自动选择 Marlin MoE 内核。一个 4x H100 80 GB 节点仅有 320 GB 内存，少于权重的 328 GB。
Altar-1 inherits the GLM-5.3 License. The license permits commercial use, modification, and redistribution. Model-as-a-Service operators with more than $10B in revenue over 12 months must first pass a Z.AI security review. Altar-1 is open-weight, not OSI-approved open source.
Altar-1 继承 GLM-5.3 许可证。该许可证允许商业使用、修改和再分发。过去 12 个月收入超过 100 亿美元的模型即服务（MaaS）运营商必须先通过 Z.AI 的安全审查。Altar-1 是开放权重模型，而非 OSI 批准的开源软件。
Altar-1 also powers Aikido Attack, AI Code Analysis, and Deep Review. Next, Aikido plans to try lower-bit formats like EXL3 so it can keep more experts. It also plans to fine-tune models for security workflows.
Altar-1 还驱动 Aikido Attack、AI 代码分析和 Deep Review。接下来，Aikido 计划尝试 EXL3 等低位宽格式，以便保留更多专家。它还计划针对安全工作流程微调模型。
Key Takeaways
关键要点
- Altar-1 compresses GLM-5.3 from 1,506.7 GB to 328 GB, a 78.2% cut.
- REAP pruning keeps 168 of 256 experts per layer, with 8 active per token.
- Recall drops from 65.6% to 60.4%, keeping 92% of the parent’s CVE coverage.
- It runs on 1 node of 4x H200 with vLLM, including air-gapped setups.
- The GLM-5.3 License allows commercial use, with a review clause above $10B revenue.
- Altar-1 将 GLM-5.3 从 1,506.7 GB 压缩至 328 GB，缩减了 78.2%。
- REAP 剪枝每层保留 256 个专家中的 168 个，每个 token 激活 8 个。
- 召回率从 65.6% 降至 60.4%，保留了父模型 92% 的 CVE 覆盖率。
- 它在包含气隙隔离设置的单节点 4x H200 上配合 vLLM 运行。
- GLM-5.3 许可证允许商业使用，但设有年收入超过 100 亿美元时的审查条款。
Check out the Model Weights and Technical Details. All credit goes to the researcher of this project. Also, feel free to follow us on Twitter and don’t forget to join our 150k+ML SubReddit and Subscribe to our Newsletter. Wait! are you on telegram? now you can join us on telegram as well.
查看模型权重和技术细节。所有功劳归于该项目的研究者。此外，欢迎在 Twitter 上关注我们，别忘了加入我们拥有 15 万+成员的 ML SubReddit，并订阅我们的新闻通讯。等等！你在 Telegram 上吗？现在你也可以在 Telegram 上加入我们了。
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力