Aikido Security Releases Altar-1, a 328 GB Open-Weight Security Model Pruned From GLM-5.3

Aikido describes the problem it is addressing as one of residency rather than capability. Frontier models run on someone else's infrastructure, and using them sends source code, architecture documents and unremediated findings outside the network. The company points to banks under data-residency mandates and operational-technology operators with no internet route. Open-weight models resolve the residency issue but create a deployment gap: mixture-of-experts models must store every expert even when a workload uses only a few, and security agents build long-running context whose KV cache competes with model weights for the same GPU memory.

GLM-5.3 is a 753B-parameter mixture-of-experts model that routes each token to 8 of 256 experts per layer, giving roughly 40B active parameters. Aikido applied two compression steps without retraining. It began from the cyankiwi GLM-5.3-AWQ-INT4 checkpoint, in which routed expert weights are stored in 4 bits with 16-bit activations while attention, the shared expert, dense layers and the head remain in BF16. It then used Cerebras REAP, a router-weighted expert activation pruning method that scores each expert by router weight and output magnitude rather than selection frequency alone, keeping 168 of 256 routed experts per layer and removing 88, or 34.4%. Calibration used traces from Aikido's pentesting harness plus coding, tool calling, reasoning and multilingual Wikipedia text; Aikido states that no customer data was used. Each expert was scored by its largest share of any single domain's routed work, an approach intended to protect specialist experts for code, rare languages and structured output. Routing is unchanged, with 8 experts selected per token from 168 and about 40B active parameters.

The resulting checkpoint stores 328.0 GB, against 1,506.7 GB for GLM-5.3 in BF16 and 488.2 GB for the AWQ INT4 parent, a reduction of 78.2% and 32.8% respectively. On fidelity, Aikido reports a KL divergence of 0.506 nats against full BF16 on a sealed 25-prompt panel; an EXL3 build of the same cut scores 0.511.

The company tested Altar-1 on an internal CVE benchmark covering 32 known vulnerabilities across 30 repositories, with three runs per case. GLM-5.3 in BF16 averaged 65.6% recall per run and found 25 of 32 vulnerabilities at least once; the AWQ INT4 checkpoint averaged 61.5% and found 23 of 32; Altar-1 averaged 60.4% and found 23 of 32. Aikido says pruning cost about one point of recall and no coverage relative to the AWQ parent, and that Altar-1 retains 23 of the 25 vulnerabilities covered by the full model, or 92%, at 5.2 points lower recall. The benchmark's scope is narrow: it measures targeted CVE rediscovery inside a pipeline that uses other models for the surrounding stages, and does not measure blind discovery, exploit validation or fix proposals. Aikido also reports that Altar-1 found a valid critical-severity vulnerability during a client's production pentest, a single result reported by the vendor.

The model card requires Hopper GPUs, either H100 or H200. Aikido says 328 GB across four H200s leaves room for a 128k-context KV cache at production batch sizes, and the documented serving command uses tensor parallelism of four with a maximum model length of 131072, with vLLM selecting the Marlin MoE kernel automatically. A node of four H100 80 GB cards offers only 320 GB, less than the 328 GB of weights. Altar-1 inherits the GLM-5.3 License, which permits commercial use, modification and redistribution; model-as-a-service operators with more than $10B in revenue over 12 months must first pass a Z.AI security review. The release is open-weight rather than OSI-approved open source.

Aikido says it plans to test lower-bit formats such as EXL3 in order to keep more experts, and to fine-tune models for security workflows.

Editor's Summary

Aikido Security released Altar-1, an open-weight security model derived from Z.AI's GLM-5.3 by INT4 quantization and REAP expert pruning, cutting stored weights from 1,506.7 GB to 328 GB. It runs on a single node of four NVIDIA H200 GPUs and powers the company's on-premises and air-gapped pentesting appliance. On Aikido's internal benchmark it averaged 60.4% recall, about one point below its AWQ parent and 5.2 points below the full model, while covering 23 of the 25 vulnerabilities the full model found. The model card requires Hopper GPUs and the GLM-5.3 License, which carries a security-review requirement for large model-as-a-service operators.