Aikido Altar Shrinks GLM-5.3 to 328 GB for Local Cybersecurity AI
Aikido Security released Altar-1 on September 21, 2026, an open-weight cybersecurity model derived from Z.AI's GLM-5.3 for deployment inside customer-controlled infrastructure. The published checkpoint contains about 504 billion parameters after expert pruning, occupies 328 GB in its W4A16 form, and is documented for serving with vLLM on four NVIDIA H200 GPUs.
Altar targets organizations that want AI-assisted code and vulnerability analysis without sending source code or security findings to an external inference provider. Aikido says it is already deploying the model in its security products, including its on-premises Aikido Machine platform. Reuters independently reported the release and its local-deployment positioning on September 21.
The model is a substantial compression of GLM-5.3 rather than a new foundation model trained from scratch. GLM-5.3 has 753 billion parameters and 256 routed experts per layer. Altar keeps 168 of those 256 experts, while the router continues selecting eight experts per token. Aikido reports roughly 40 billion active parameters per token.
Altar-1 specifications
| Item | Altar-1 |
|---|---|
| Parent model | Z.AI GLM-5.3 |
| Parameters after pruning | ~504B |
| Routed experts retained | 168 of 256 per backbone expert layer |
| Experts active per token | 8 |
| Approx. active parameters | ~40B per token |
| Weight format | W4A16 / AWQ INT4 routed experts |
| Stored weights | 328 GB |
| Documented serving target | 4× NVIDIA H200 |
| Serving software | vLLM |
| Documented max model length in serving example | 131,072 tokens |
| License | Inherits the GLM-5.3 license |
Aikido starts from an AWQ INT4 GLM-5.3 checkpoint and applies Router-weighted Expert Activation Pruning, or REAP. The company's published size comparison lists full-precision GLM-5.3 at 1,506.7 GB, the unpruned AWQ INT4 checkpoint at 488.2 GB, and Altar at 328.0 GB. That makes Altar 32.8% smaller than the already-quantized parent checkpoint and 78.2% smaller than the full BF16 representation by stored-weight size.
The model card says only the routed experts use four-bit storage. Attention, the shared expert, dense layers and output head remain at higher precision. This distinction matters for capacity planning because a simple four-bits-per-parameter calculation does not describe the complete checkpoint.
What Aikido measured
Aikido evaluated Altar on its internal CVE rediscovery benchmark covering 32 known vulnerabilities across 30 repositories, with three runs per case. The company reports 60.4% average recall per run for Altar and at least one successful rediscovery for 23 of the 32 vulnerabilities.
The unpruned GLM-5.3 AWQ baseline averaged 61.5% recall and also covered 23 vulnerabilities. Full-precision GLM-5.3 averaged 65.6% recall and covered 25. Aikido therefore reports that Altar retained 23 of the parent's 25 covered vulnerabilities while reducing stored weights from the 488.2 GB quantized baseline to 328 GB.
These are Aikido-run measurements. The benchmark tests targeted rediscovery of known CVEs inside the company's code-analysis harness. It excludes blind vulnerability discovery across an entire codebase, exploit execution and fix-quality evaluation, so the figures should be interpreted within that scope.
A separate public fidelity study evaluates how different expert-pruning plans change GLM-5.3 output distributions. The Altar model card reports a KL divergence of 0.506 nats against full BF16 for its selected configuration and links the underlying study data.
Hardware requirements are still server-class
The 328 GB checkpoint remains far beyond a conventional single-GPU workstation. Aikido documents a four-H200 vLLM configuration and says that arrangement leaves capacity for a 128K-context KV cache at production batch sizes. Its model card currently specifies Hopper-class H100/H200 hardware for the documented serving path.
The reference vLLM command uses tensor parallelism across four GPUs and a maximum model length of 131,072 tokens. Operators evaluating other accelerator configurations should validate kernel support, aggregate memory, KV-cache requirements and throughput against their own workload instead of treating 328 GB as the complete runtime-memory requirement.
License and deployment boundary
Altar-1's Hugging Face model card marks the license as other and states that the model inherits the GLM-5.3 license. GLM-5.3 itself is distributed under Z.AI's GLM-5.3 license. Teams considering redistribution, commercial integration or derivative releases should review those exact terms before deployment; "open-weight" describes weight availability and does not establish an OSI-approved open-source software license.
For security teams with sufficient accelerator capacity, Altar's main deployment trade-off is concrete: Aikido has reduced the storage footprint of a 753B-parameter parent into a 328 GB security-oriented checkpoint while publishing both the weights and its compression methodology. Independent workload testing remains necessary because the security-performance evidence currently available is primarily Aikido's targeted CVE benchmark.
Sources
- Aikido Security — Altar release and benchmark methodology: https://www.aikido.dev/blog/aikido-altar-open-weight-ai-sovereign-security
- Aikido Security — Altar-1 model card, weights, deployment instructions and license inheritance: https://huggingface.co/AikidoSec/altar-1
- Z.AI — GLM-5.3 model card and license: https://huggingface.co/zai-org/GLM-5.3
- Public REAP fidelity-study data: https://huggingface.co/datasets/0xSero/glm-5.3-reap-fidelity-study
- Reuters — independent release corroboration: https://www.reuters.com/legal/litigation/belgiums-aikido-launches-cybersecurity-ai-model-demand-local-tools-grows-2026-09-21/