GLM-5

# Download the library tag into the local store; a manifest records each file's hash
$ kllm pull glm-5:5.3
# Start SGLang or vLLM in the background on 127.0.0.1 and open a chat
$ kllm run glm-5:5.3

Requests to the running server

# The local proxy listens on 127.0.0.1:8001 and tokenizes on your machine
curl http://127.0.0.1:8001/v1/chat/completions \
  -H 'Content-Type: application/json' \
  -d '{"model": "GLM-5.3-kllm", "messages": [{"role": "user", "content": "Hello"}]}'

• Each repository carries kllm-manifest.json: the base and its revision, the key fingerprint and key version, the kLLM version and the SHA-256 digest of every file.
• GLM-5.3 is licensed under the GLM-5.3 License, Copyright (c) 2026 Z.AI.

Check a published model against its public base

With the model key, kllm verify seals the public base again under the same key and transform in a temporary directory and compares the result tensor by tensor, unlocked, together with the tokenizer, every other file and the manifest.

$ hf download ANetResearch/GLM-5.3-kllm --local-dir GLM-5.3-kllm
$ kllm verify GLM-5.3-kllm --base zai-org/GLM-5.3 --revision ba32f8c19c8738e2c57c71798c601d477a7bf844 --key GLM-5.3-kllm/kllm.key

Commands for GLM-5.3-kllmThe catalog in the documentation

• To an operator who reads GPU memory, user text reduces to a substitution cipher over tokens: 23.8% of tokens were decoded by unigram frequency alone on Qwen3-8B.
• GLM-5's attention is less hidden than a Llama-style model's: the low-rank projections to the attention heads are left unchanged by sealing.
• The sealed weights derive from a public checkpoint. Locked files cannot be matched to it without the key; once unlocked to run, a holder of that checkpoint recovers the transforms and 98.5% of the vocabulary permutation (measured on Qwen3-8B), for unmodified public models and fine-tunes alike.
• Client-keyed mode keeps the key and the tokenizer on the user's machine. The copy that the cloud serves is unlocked on the user's side (kllm cloud --key), because the cloud computes with the weights. The cloud server (kllm serve --client) binds 0.0.0.0 by default and has no authentication; bind it to 127.0.0.1 or place it behind a gateway.
• This architecture or checkpoint format is sealed with the perm transform only.
• Unless sealed with --no-lock, the weights on disk are locked: encrypted in place under a key derived from the model key, with a ChaCha20 key stream (lock v2; lock v1 files, AES-256-CTR, are still read). Packed FP4 weights, E8M0 scales and integer tables are locked as well. kllm serve --key writes no unlocked copy: the engine processes unlock each tensor in GPU memory as they load it. Whoever runs the model therefore holds the unlocked weights in GPU memory. kllm unlock writes an unlocked copy to ~/.cache/kllm/unlocked for launchers that start the engine themselves. Each tensor's largest binary exponent is stored in the clear.
• The key of an official model is the kllm.key file of its gated Hugging Face repository, without a passphrase. Everyone who submits the access form receives the same key, so a model key is not a confidentiality boundary between its holders. A key cannot be revoked for one holder; it is rotated by raising its key version. For a key known to no one else, seal the model under a private key.
• Outside a confidential VM, kllm serve --key decrypts the tokenizer into host /dev/shm and offers no protection from the host. It is a development mode.

Security modelMeasured limits in the documentation