Aikido's Altar shrinks GLM-5.3 to 328GB for on-prem security

Aikido Security has published Altar, its first open-weight security model, built to do the reasoning behind vulnerability hunting inside infrastructure a customer controls, air-gapped networks included. The vendor released the model and its weights on 21 September and describes it as the missing half of Aikido Machine, the on-premises pentesting appliance it already sells: the appliance does the attacking, Altar does the thinking.

The headline number is compression, not capability

Altar is not trained from scratch. It descends from GLM-5.3, Z.ai's mixture-of-experts model, and it has been squeezed hard. The full 16-bit checkpoint occupies 1,506.7GB; an AWQ INT4 quantisation brings that to 488.2GB; pruning takes it to 328.0GB. That is 78.2 per cent less storage than the parent model and a further 32.8 per cent off the already-quantised checkpoint, with activations left at 16 bits, which makes the format W4A16.

Deciding which experts to delete is the hard part

Mixture-of-experts models carry far more capacity than any single request needs: a router wakes a handful of experts per token while the whole pool still has to sit in memory. Aikido pruned with REAP, the router-weighted expert activation pruning method from Cerebras, keeping 168 of the 256 routed experts in each backbone layer and deleting 88 of them, or 34.4 per cent, while the router still picks eight per token. The calibration data came from traces of Aikido's own pentesting harness, so no customer code was involved, and multilingual text was added to the mix because the documentation and business rules of a real estate are not always written in English.

One point of recall for a third less storage

The trade was measured on Aikido's internal CVE benchmark: 32 known vulnerabilities across 30 repositories, three runs each through its code-analysis harness. Altar averaged 60.4 per cent recall per run and rediscovered 23 of the 32 at least once; the quantised GLM-5.3 it was pruned from averaged 61.5 per cent and covered the same 23; the full-precision parent averaged 65.6 per cent and covered 25. Put plainly, 92 per cent of the parent model's coverage survived the removal of a third of its storage. The vendor is explicit about what the test does not cover: it measures targeted rediscovery of bugs the lab already knew about, inside a pipeline that leans on other models, and says nothing about blind discovery, exploit validation or proposed fixes.

What open weights actually buy a defender

The weights are published on Hugging Face as AikidoSec/altar-1, ungated and unrestricted, listed at 739 downloads and 111 likes at the time of writing, and the vendor says the model runs comfortably on a four-H200 node with vLLM. Aikido also reports that once Altar was deployed to its own appliance fleet it found a valid critical-severity vulnerability during a client production pentest, which is an interested party's own account rather than an independent result. Next on the list are lower-bit formats such as EXL3, more serving work on H200s, and fine-tuning models specifically for security work.

Our opinion

The interesting part of Altar is not the benchmark, it is the shape of the compromise. European buyers with residency rules genuinely cannot send source code to somebody else's inference endpoint, so there is a real market for a security model that runs on hardware the customer already owns, and the cheapest way to build one is to start from the strongest open weights available, which increasingly means Chinese ones, then compress them until they fit. Aikido is candid that pruning cost about a percentage point of recall and candid that its benchmark only asks whether the model can still find bugs it was told about. Both statements are honest, and together they define the claim worth trusting here: this is a cheaper way to run known-good analysis, not a frontier defender. The test that will matter is the one nobody can run yet, on vulnerabilities that have no catalogue entry and no known answer.