Introducing Aikido Altar: the model that makes sovereign security intelligence possible

What it is

Altar is an open-weight security model published under Aikido's HuggingFace organization, derived from GLM-5.3 and intended to run inside the Aikido Machine pentesting appliance in on-prem or air-gapped environments. The summary covers the compression pipeline; what it omits is the deployment envelope and the precise scope of the benchmark — both of which an engineer needs before acting.

Preconditions / deployment

Aikido states Altar "can be deployed and served comfortably using a 4-H200s node and the latest version of vLLM." Weights, model card, license, and serving flags are on the Altar model page under Aikido's org. Architecture after pruning: 168 of 256 routed experts retained per backbone expert layer (88 removed), with the router still selecting 8 per token from the smaller bank. Serving is AWQ W4A16 — four-bit expert weights, 16-bit activations, some weights kept at higher precision.

Benchmark scope — what the numbers do and do not mean

The 92% figure is narrower than a naive reading. On the internal benchmark (32 CVEs across 30 repos, three runs each):

• Full-precision GLM-5.3: 65.6% avg recall, covered 25/32
• Quantized GLM-5.3 AWQ (488 GB): 61.5% avg recall, covered 23/32
• Altar (328 GB): 60.4% avg recall, covered 23/32

So "92%" is 23 of the parent's 25 covered vulnerabilities, not 23 of 32. Against the already-quantized AWQ parent, pruning cost ~1 point of recall and lost zero coverage; the larger 5.2-point recall drop is measured against full precision.

Aikido explicitly bounds the benchmark: it measures targeted CVE rediscovery within a pipeline that uses other models for surrounding stages. It does not measure blind discovery across a whole codebase, does not execute exploits to validate findings, and does not evaluate the fix-proposal stage. Completed runs with no finding count as misses; incomplete runs are reported separately.

Caveats

The benchmark is internal and unpublished as raw traces (a "public fidelity study" and pruning toolkit are referenced but raw agent conversations are withheld). The one production result — a critical-severity finding "shortly after deployment" during a client pentest — is a single anecdote, not a measured rate. Aikido flags EXL3 lower-bit formats and fine-tuning as future work, meaning the current release is compression-only, with no security-specific training on top of GLM-5.3.