Reading notes on:

The defining claim of GLM-5.3 is a negative one: no pre-training architectural changes and no weight modifications relative to GLM-5.2. Every gain comes from post-training scaling. That makes it an unusually clean case study — if the base is frozen, then whatever moved the benchmarks has to live in the RL algorithm, the RL infrastructure, or the task environments.

These notes work through the three mechanisms that carry the weight: IndexShare for long-context serving cost, SAO for stable single-rollout asynchronous RL, and the slime dataflow that makes the two composable at scale. It picks up directly from GLM-5.2 and GLM-5.

1. Context Processing: The Mathematics of IndexShare

In long-context LLMs, sparse attention is what keeps serving cost and latency practical. The production form is Dynamic Sparse Attention (DSA): a lightweight “lightning indexer” selects the top-$k$ most relevant tokens per query, taking core attention from $O(L^2)$ to $O(Lk)$ — the mechanism analyzed in DeepSeek-V3.2.

The catch is that the indexer itself is still $O(L^2)$, and it runs independently at every layer. At 200K tokens it consumes 81% of total prefill time. The sparse attention is no longer the bottleneck; the machinery that decides where to be sparse is.

IndexShare exploits the fact that selected indices are highly similar across consecutive layers — 70% to 100% top-$k$ overlap. (The general treatment is in IndexCache; IndexShare is the deployed instance of it.)

1.1 Sparse attention formulation

For layer $l$:

\[A_l = \text{softmax}\left(\frac{Q_l K_{l, I_l}^T}{\sqrt{d}}\right) V_{l, I_l}\]
where $I_l \subset {1, \dots, L}$ is the top-$k$ index set at layer $l$, $ I_l = k$, chosen by a layer-specific indexer $I_l = \text{indexer}_l(Q_l, K_l)$.

1.2 Cross-layer index partitioning

IndexShare splits the $N$ layers into Full ($F$) layers, which run and cache their own indexers, and Shared ($S$) layers, which skip indexer math entirely and copy from the nearest preceding Full layer:

\[I_l = \begin{cases} \text{indexer}_l(Q_l, K_l), & \text{if } l \in F \\ I_{\text{prev}(l)}, & \text{if } l \in S \end{cases} \qquad \text{prev}(l) = \max\{f \in F \mid f < l\}\]

At inference this is a single conditional branch: compute-and-cache, or retrieve-and-reuse.

To retrofit IndexShare onto pre-trained weights, pick a partition $F$ of target size $M$ (typically $M = \tfrac{1}{4}N$, removing 75% of indexer computation) that minimizes LM loss on a small calibration set:

\[\min_{F,\, |F| = M} \mathcal{L}_{\text{LM}}(\mathcal{D}_{\text{cal}}; F)\]

solved greedily:

  1. Initialize $F = {1, \dots, N}$.
  2. Iteratively remove the layer $i \in F$ whose removal gives the smallest increase in $\mathcal{L}{\text{LM}}(\mathcal{D}{\text{cal}}; F \setminus {i})$.
  3. Stop when $ F = M$.

1.4 Training-aware multi-layer distillation

To erase the residual degradation, train the surviving indexers. For each Full layer $l \in F$, let $S_l = {l} \cup {s \in S \mid \text{prev}(s) = l}$ be the block it serves, and distill against the block-averaged attention distribution:

\[\mathcal{L}_{\text{distill}} = \sum_{j \in S_l} D_{\text{KL}}\left( \bar{P}_{S_l} \,\middle\|\, P_{\text{indexer}, l} \right), \qquad \bar{P}_{S_l} = \frac{1}{|S_l|}\sum_{s \in S_l} P_{\text{attn}, s}\]

The indexer at $l$ is forced to learn a representation that satisfies all of its downstream shared layers, which is what lets even a plain $\tfrac{1}{4}$ uniform interleave match full-indexer accuracy.

2. Reinforcement Learning: Single-Rollout Asynchronous Optimization

Scaling RL on long-horizon coding and agentic tasks breaks synchronous frameworks. Rollout lengths vary wildly, so a group barrier leaves the cluster idle waiting on the slowest trajectory — the same trainer/generator mismatch dissected in RL Systems Mind the Gap and StreamRL.

Going asynchronous fixes idling but introduces policy lag, $\theta \neq \theta_{\text{rollout}}$. Worse, group-wise methods like GRPO need multiple rollouts per prompt to form relative advantages, which is fundamentally incompatible with asynchronous streams and with simulated online environments that return exactly one trajectory per prompt.

SAO is the answer: a stable single-rollout asynchronous framework.

SAO: synchronous group barrier vs. asynchronous pipeline, plus DIS masking, two-time-scale critic, and skip-observation GAE

2.1 Direct double-sided importance sampling (DIS)

In a decoupled actor–learner setup, the exact importance ratio is intractable: $\pi_{\text{rollout}}$ changes continuously, and tracking the full checkpoint history ${\pi_{\theta_{\text{old}}^{(1)}}, \dots, \pi_{\theta_{\text{old}}^{(N)}}}$ is impractical.

DIS discards $\pi_{\theta_{\text{old}}}$ entirely and uses the token-level log-probabilities recorded during rollout as the behavior proxy:

\[r_t(\theta) = \frac{\pi_\theta(a_t \mid s_t)}{\pi_{\text{rollout}}(a_t \mid s_t)} = \exp\left(\log \pi_\theta(a_t \mid s_t) - \log \pi_{\text{rollout}}(a_t \mid s_t)\right)\]

Stability then comes from double-sided token-level clipping and masking. Where PPO clipping merely bounds the gradient of extreme updates, DIS excludes any token whose ratio leaves the trust region $[1 - \epsilon_\ell,\ 1 + \epsilon_h]$:

\[\mathcal{L}_{\text{DIS}}(\theta) = \hat{\mathbb{E}}_t\left[ f(r_t(\theta), \epsilon_\ell, \epsilon_h)\, \hat{A}_t \log \pi_\theta(a_t \mid s_t) \right]\] \[f(x, \epsilon_\ell, \epsilon_h) = \begin{cases} x, & \text{if } 1 - \epsilon_\ell < x < 1 + \epsilon_h \\ 0, & \text{otherwise} \end{cases}\]

Zeroing out divergent tokens rather than merely capping them lets SAO train stably for over 1,000 steps, where standard asynchronous GRPO collapses after 160. The asymmetric-window-plus-masking direction echoes DAPO and the first-order stabilization analysis in First-Order Approximation for Stable LLM-RL Training.

2.2 Two-time-scale value optimization

Single-rollout RL has high gradient variance, and reducing it demands an accurate critic $V_\phi$. Two designs:

Faster value updates ($K = 2$). Decouple actor and critic update frequency — for every policy step, run two value steps:

\[\theta \leftarrow \theta + \eta_\theta \nabla_\theta \mathcal{L}_{\text{DIS}}(\theta)\] \[\phi \leftarrow \phi - \eta_\phi \nabla_\phi \mathcal{L}_{\text{VF}}(\phi) \quad (\text{run } K = 2 \text{ times})\]

so the critic tracks policy shifts twice as fast, shrinking advantage-estimation error.

Frozen-attention training. To keep critic gradients from exploding over long trajectories, freeze the full-attention parameters in $V_\phi$ and optimize only the MoE projections:

\[\nabla_{W_{\text{attn}}} \mathcal{L}_{\text{VF}}(\phi) = 0\]

This reuses the pre-trained attention layers’ semantics while measurably smoothing the critic’s gradient norms.

2.3 Skip-observation token-level GAE

Agentic trajectories interleave model actions and environment feedback, $T = [a_0, o_0, a_1, o_1, \dots]$. Standard GAE takes value differences between adjacent tokens, but the transition from the end of action $a_{i,\text{end}}$ to the start of observation $o_{i,\text{start}}$ is discontinuous — the model did not generate $o_i$. Asking the critic to predict external environment transitions injects severe noise.

SAO bridges action-to-action and skips environment tokens:

\[\delta_t = r_t + \gamma V(a_{i+1, 0}) - V(a_{i, N})\] \[\hat{A}(a_{i, N}) = \delta_t + \gamma\lambda \hat{A}(a_{i+1, 0})\]

Advantage estimation is confined to model-generated tokens, isolating the policy from stochastic environment feedback. This is the credit-assignment counterpart to the world-model objectives in ECHO.

3. System Architecture: the slime Framework

Post-training scaling runs on slime, an open-source RL framework that unifies training, rollout, and the data buffer on a single continuous dataflow:

                    ┌────────────────────────┐
                    │      SGLang Engines    │◄─── Workload-aware
                    │   (Rollout / Inference)│     Heuristics
                    └───────────┬────────────┘
                                │ Trajectories &
                                │ Rollout Logprobs
                                ▼
  ┌───────────────┐   ┌──────────────────┐
  │ Local Storage │──►│   `slime` Buffer  │
  │ (H-Cache Layer)   │  (Single Flow)   │
  └───────────────┘   └─────────┬────────┘
                                │
                                │ Prefetched Teachers &
                                │ Realigned Logprobs (1e-7)
                                ▼
                    ┌────────────────────────┐
                    │    Megatron Engines    │
                    │   (Policy Training)    │
                    └────────────────────────┘

3.1 Numerical logprob alignment

DIS is only as good as its denominator. In a decoupled pipeline, small implementation differences between the trainer (Megatron) and the rollout engine (SGLang) distort $r_t(\theta)$ directly — and since DIS masks on that ratio, a systematic offset silently discards the wrong tokens.

GLM-5.3 enforces strict numerical logprob alignment: standardized tokenization boundaries, attention masking, and precision behavior across both paths. The average log-probability difference is held at the $1\times10^{-7}$ level, a 99.99% variance reduction versus previous implementations. This is the same class of problem as the MoE training/inference drift in Training-Inference Parity in MoE Models and the routing-replay fix in Rollout Routing Replay.

3.2 Hierarchical memory and OPD caching

To run multi-teacher off-policy distillation without standing up several long-lived inference servers, slime adds:

  • Hierarchical caching. Node-local storage becomes an extra cache tier for model states and parameters, preventing host memory saturation.
  • Dynamic teacher switching and prefetching. Teacher parameters are prefetched and swapped into GPU memory on demand, making rich multi-teacher distillation nearly free.

On why the multi-teacher setup matters at all, see Revisiting On-Policy Distillation and The Distributional Lens of Post-Training.

3.3 Workload-aware heuristics and scheduling

Rollout lengths are highly variable, so slime pairs joint scheduling and load balancing with workload-aware heuristics that analyze active environments and dynamically set:

  • optimal prefill-to-decode resource ratios;
  • inference and rollout concurrency.

This is the RL-loop version of the straggler problem that UltraEP attacks inside the MoE layer — in both cases, the fix is to measure the actual distribution and rebalance against it rather than to provision for the average. The result: a 2.3× end-to-end RL training throughput improvement on long-horizon coding.

4. Task Environment Synthesis and Verification

As agent capability scales, the post-training bottleneck shifts from model optimization to task environment availability and verification. To train on workflows representing several days of professional engineering work — say, diagnosing and optimizing deep learning bottlenecks on GPU clusters — Z.ai built an end-to-end synthesis pipeline:

  1. Environment synthesis. Autonomous Research Agents analyze real engineering workflows and construct executable long-horizon environments with complex dependencies, multi-step subtasks, and hidden state.
  2. Solvability verification. A Judge Agent attempts each synthesized environment; solvable ones have their trajectories analyzed.
  3. Shortcut elimination. Solver trajectories are scrutinized for reward shortcuts — hardcoding check passes, manipulating verifier scripts — which are then removed.
  4. Binary reward reliability. Verifier agents are synthesized without access to a reference solution, then subjected to oracle, no-op, and unsolved-state checks. Only a verifier that passes all three is compiled into a binary reward verifier.

The oracle/no-op/unsolved triple is the interesting part: it is a cheap property test for a reward function, catching verifiers that always pass, always fail, or accept a no-op. Compare the autonomous bug-discovery loop in Self-Play SWE-RL.

5. Benchmarks and Capabilities

5.1 Public benchmarks

Category / Benchmark GLM-5.3 GLM-5.2 Kimi K3 DeepSeek-V4 Pro-0813 Claude Opus 4.8 Claude Fable 5 (w/ fallback)
Coding            
Terminal Bench 3.0 28.3 4.6 17.4 - 21.1 33.7
DeepSWE v1.1 66.9 46.2 67.5 62.7 58.0 69.7
SWE-Marathon v1.1 42.5 19.4 48.1 - 48.8 33.1
Cybersecurity            
CyberGym 84.5 77.2 80.0 83.3 78.1 83.8
ExploitBench 54.4 24.4 32.2 - 40.0 78.0
Agentic            
AutomationBench v1.0.6 48.2 26.2 46.7 43.2 41.0 46.2
Agents’ Last Exam (ALE) 28.5 23.8 27.6 25.7 25.7 23.8

The GLM-5.2 → GLM-5.3 column pair is the one to read: 4.6 → 28.3 on Terminal Bench and 19.4 → 42.5 on SWE-Marathon, from post-training alone. Peer context in Kimi K3 and DeepSeek-V4 Architecture & Training.

5.2 Token efficiency and effort levels

On the private, contamination-free Z.ai Code Bench, GLM-5.3 completes more while emitting fewer tokens:

  • Max effort (deep thinking): 34.5% task completion at ~75K output tokens, versus GLM-5.2’s 23.4% at 96K.
  • High effort (enhanced thinking): 31.4% at ~50K output tokens, beating Claude Opus 4.8’s 29.5% at 120K.

Completion-per-token is the right axis here, and it connects to the compute-allocation view in The Mechanics of Reasoning Effort and Inference Scaling and the cost analysis in The Economics of a Token.

5.3 Emergent cyber capabilities

Training on security environments and vulnerability-discovery data produced an ability to reason across multi-stage exploitation chains:

  • Vulnerability detection. Against real production software, GLM-5.3 identified 2,436 unique vulnerabilities across 269 production projects (system kernels, operating systems, browsers, network protocols), including 1,097 critical-to-high severity flaws.
  • Security impact. Many had survived decades undetected: the average lifespan before discovery was 26.6 years, with the oldest dating to 1981 (45 years of impact).
  • Disclosure ledger. Findings are tracked publicly on the Z.ai Security Disclosure Ledger — 53 publicly disclosed, 2,383 under active embargo.

6. Developer Integration and API Migration

6.1 Thinking-mode parameters

GLM-5.3 makes thinking mandatory — disabling it is no longer supported. Every request enables thinking and picks a reasoning effort level:

{
  "model": "glm-5.3",
  "thinking": { "type": "enabled" },
  "reasoning_effort": "max"
}
  • low — light reasoning, lower token latency.
  • high — balanced analysis and standard coding.
  • max — deep mathematical derivation, system debugging, exploit planning.

Migration constraint. If your application currently sends "thinking": {"type": "disabled"}, change it to "enabled" and set "reasoning_effort": "low" (or higher) before switching the model ID to glm-5.3. Otherwise the request fails immediately.

6.2 Quota and points billing

GLM Coding Plan subscribers move to points-based quota, counted separately for inputs, cached inputs, and outputs:

  • Cache hit efficiency. Running via ZCode gives a 98%+ cache hit rate; repeated context bills at the discounted cached rate, worth roughly 30% more effective tokens.
  • Off-peak discount. Requests outside peak hours consume 50% of standard points. Peak is 14:00–18:00 (UTC+8), Monday–Friday; everything else, weekends included, gets the discount.
  • Launch promotion. A 1.5x quota boost through August 31, stacking with cache savings for up to 180% of standard quota value.

Takeaways

  1. Post-training is now a scaling axis on its own. A frozen base and frozen weights still moved Terminal Bench from 4.6 to 28.3 — the capability came from the RL loop and the environments, not the architecture.
  2. The indexer, not attention, was the long-context bottleneck. At 200K, 81% of prefill went to selection; IndexShare removes 75% of it with one branch and a cached index set.
  3. Masking beats clipping under policy lag. Zeroing out-of-trust-region tokens is what turns a 160-step collapse into 1,000+ stable steps.
  4. Numerics are algorithm design. DIS depends on $\pi_{\text{rollout}}$ being the same function the trainer computes; the $1\times10^{-7}$ alignment work is a precondition for the math, not an implementation detail.
  5. Don’t make the critic model the environment. Skip-observation GAE is a small reformulation that removes a large noise source from agentic credit assignment.
  6. Verified environments are the new scarce resource. The oracle / no-op / unsolved-state gauntlet for synthesized verifiers is the part of this pipeline most worth stealing.