What’s Changed: Firmirin is a nonsense token that GLM models from Zhipu AI drop into chats, usually in place of your name or as a shout at a dramatic moment. It is not a typo in your character card and not something your particular bot invented. You can filter it out in about two minutes with a banned string or a regex rule.
Firmirin is the word your roleplay bot screams at the worst possible moment, and it means nothing at all. A tense scene builds, the character leans in, and then out comes a string of letters that exists in no language your story is set in.
Search results are no help either, because the word is not in any dictionary worth the name.
The first time it landed in one of my chats I assumed I had fat-fingered something into the persona field. I had not. The word is sitting in the model’s weights, and it fires on its own schedule no matter how clean your card is.
This piece covers what the word is, which models and apps carry it, the two competing theories about where it came from, and the exact filters that make it go away.
I have kept the fixes in order of how little effort they take, so you can stop at the first one that works.
What Is Firmirin and Why Does Your AI Say It
Firmirin is a nonsense token baked into Zhipu AI’s GLM model family that surfaces as an exclamation, a name, or a substitute for whatever word the model was about to write.
It carries no meaning and no function. The defect sits in the model weights, well upstream of anything you configured.
What is GLM: GLM is a family of large language models built by the Chinese company Zhipu AI. Roleplay apps license it as a cheap, capable backend, often without naming it in the interface.
The behaviour is consistent enough that it has a shape. Characters shout it during high-intensity moments, whether the scene is violent or romantic. It also shows up as a fantasy curse and as a proper noun a character demands to be called.
I put it in the same category as a key that sticks on a keyboard. The machine is fine, the output is fine, and then one letter comes out wrong at random intervals and there is nothing in your own behaviour that predicts it.
Ask the model directly why it said the word and it will tell you it hallucinated. That answer is worth nothing, since a model has no reliable access to why it produced any particular token, but it does confirm there is no hidden instruction in your prompt driving it.
Which AI Models and Apps Does Firmirin Show Up On
Firmirin is tied to the GLM model family, not to any one chat app, and it appears across GLM 5, 5.1 and 5.3 while being absent from GLM 4.7.
Any front end that routes to a GLM endpoint can produce it. The app you are using is close to irrelevant.
That distinction trips people up constantly. The word turns up on SillyTavern, on Janitor AI and on SpicyChat, which makes it look like a platform problem spreading between sites. All three are pointing at the same underlying model.
The pattern I keep coming back to is that the front end almost never matters here. If you switch apps and keep the same model, the word follows you. If you keep the app and change the model, it stops.
Two situations muddy the picture. Some sites route their backend through GLM without advertising it, so you can hit the word on a platform you never associated with Zhipu. And switching models partway through a chat leaves the earlier Firmirin lines sitting in your context window, where the new model happily copies the pattern it sees.
| Symptom | Likely cause | Fix |
|---|---|---|
| Character shouts Firmirin at a dramatic beat | GLM 5.x weights firing the token | Add it to banned strings |
| Firmirin appears where your name should be | Token substituting for the persona placeholder | Regex swap to your persona name |
| Word persists after you switch models | Old lines still sitting in the context window | Edit the earlier messages out |
| Word appears on an app you thought was not GLM | Backend silently routed to GLM | Check which model the app is running |
| Bot demands to be called Firmirin | Token treated as a proper noun, not a placeholder | Edit the message and continue |
If you are unsure what sits underneath your chat, confirm which model is running before spending time on prompt fixes that cannot help.
Is Firmirin a Watermark or a Training Accident
Nobody outside Zhipu AI knows, and the company has never commented on it.
Two theories compete, both plausible, neither proven. Treat anyone stating the answer with confidence as guessing.
The watermark theory says Zhipu planted the token deliberately. If a competitor pumps a model for output and trains on the results, the competitor’s model inherits the tell, and Zhipu gets a signature it can point at. Marker tokens of this kind are an established practice in the industry.
The accident theory says the word rode in on training data. It matches the username of a Chinese-language blogger on Zhihu who posts modestly about language models, which is exactly the sort of low-profile text a broad web crawl scoops up and a model over-weights.
My honest position is that the watermark story is more fun than it is supported. The token fires in the open, in front of paying customers, in the middle of scenes. A watermark that announces itself this loudly is a poor watermark.
There is a third story circulating that deserves a correction. It holds that Anthropic poisoned its own outputs to catch Chinese labs distilling Claude, and that Zhipu swallowed the poison.
The research half of that is real. Anthropic, the UK AI Security Institute and the Alan Turing Institute published a study in October 2025 showing that 250 poisoned documents can install a backdoor in a model. That count stayed near-constant from 600M to 13B parameters, roughly 0.00016% of training tokens.
The accusation half does not line up. When Anthropic went public in February 2026 about industrial-scale distillation, it named three Chinese labs: DeepSeek, Moonshot AI and MiniMax, across roughly 24,000 fraudulent accounts and 16 million exchanges. Zhipu was not on that list.
Both halves of the mechanism are documented. What nobody has produced is any evidence tying either one to this particular string of letters, and that gap is where the theory lives.
Does Firmirin Only Replace Your Name
No. It substitutes for your persona placeholder most often, but it also lands as a character’s name, an exclamation, and a standalone proper noun.
The name-replacement framing is the most common description and it is incomplete.
The clearest counterexample is the token appearing as something a character insists on being called, which is the opposite of a placeholder swap. In that case the model is treating it as a new proper noun in the scene rather than filling a slot with it.
That distinction matters to me because it decides which fix works. A pure name swap can be repaired with a find-and-replace rule pointed at your persona name. A token that also arrives as a curse or a demand has to be blocked outright, since there is no single correct word to swap in.
There is a spelling wrinkle worth knowing before you write any filter. The token sometimes drops a letter and comes out as FIRMIRN, so a rule matching only the full spelling will let the variant through.
How Do You Stop Your Bot From Saying Firmirin
Block the string at the sampler if your backend supports it, swap it with a regex rule if it does not, and change models if neither is available.
Prompt instructions alone are the weakest option. The word lives in the weights, and asking politely does not reach that layer.
What is the sampler: The sampler is the part of the system that picks each next word from the model’s ranked options. Blocking a string there stops it before it is ever written.
The banned-strings route is the one I reach for first, because it works at the point of generation rather than cleaning up afterwards. When the sampler is forbidden from selecting a string, the model is forced to pick a different continuation and the sentence comes out intact.
Here is the order I work through:
- Open your backend’s banned tokens or banned strings field. KoboldCPP exposes this directly; many hosted APIs do not.
- Add both spellings,
FirmirinandFirmirn, so the dropped-letter variant is covered. - If banned strings are unavailable, set up a regex rule in your front end to swap the word for your persona name instead.
- Add a short line to your system prompt forbidding the word. Treat this as a backstop, not the fix.
- If the word survives all four, change the model. This is a GLM trait and it does not follow you to other architectures.
The regex needs to be written precisely, because a rule set too loosely will eat real words in your prose.
Before: a rule matching
firanywhere in the text, which also mangles “fire”, “first”, “firm” and “confirm”After:
/\b(Firmirin|Firmirn)\b/gireplaced with{{user}}, which anchors on word boundaries and catches both spellings while leaving ordinary words alone
Preset changes also shift the frequency, which surprised me. The same chat and the same model can produce the word constantly under one system prompt and almost never under another. If you are already running a heavy preset, test a lighter one before you touch anything else.
None of this is unique to one word. The same banned-strings and regex machinery is how people deal with the same recycled phrases that every model overuses, and the sampler side of it lives in your advanced generation settings.
| Fix | Where it works | Effort | How well it holds |
|---|---|---|---|
| Banned strings | Local backends such as KoboldCPP | Two minutes | Strongest, blocks at generation |
| Regex swap | Any front end with a regex extension | Five minutes | Reliable, cleans up after the fact |
| Preset change | Anywhere you control the system prompt | Ten minutes | Reduces frequency, no guarantee |
| Prompt instruction | Any platform | One minute | Weakest, leaks under pressure |
| Model change | Any platform with model choice | Instant | Total, the trait is GLM-specific |
What Should You Use if the Model Quirks Are the Dealbreaker
If you are filtering one nonsense token today and fighting flat prose tomorrow, the model rather than the word is the problem worth solving.
One stray string is a two-minute fix. A model that keeps needing patches is a different question.
I would not move platforms over Firmirin alone. It is fixable, the fix holds, and every model in this category carries some verbal tic of its own once you use it long enough.
The calculation shifts if the word arrives alongside the other GLM complaints, like Glam models ignoring directions or characters that flatten into the same voice. Once you are stacking three workarounds to get a usable scene, the model has stopped suiting what you are writing.
For anyone who wants a companion that holds a character without a stack of regex rules behind it, Candy AI runs its own tuned models rather than reselling a general-purpose one, which removes this entire category of problem.
Nectar AI is the closer fit if your priority is rebuilding an existing character with its details intact.
Frequently Asked Questions
What does Firmirin mean?
Nothing. It is a nonsense string with no meaning in any language relevant to your chat. It matches the username of a Chinese-language blogger on Zhihu, though nobody has traced the token back to that account.
Is Firmirin a bug in my character card?
No. The token comes from the model, not your card, persona or prompt. You can strip your setup back to a blank card and it will still appear, which is why editing your character definition does not help.
Which models say Firmirin?
GLM 5, GLM 5.1 and GLM 5.3 from Zhipu AI. GLM 4.7 does not produce it. Any app routing to one of those GLM versions can surface it, including apps that do not advertise which model they run.
Does paying for a premium tier stop Firmirin?
No. The token sits in the model weights, so it is unaffected by your subscription level. Only a filter, a regex rule or a different model changes the outcome.
Why does Firmirin replace my name specifically?
Because the model treats it as a slot-filler for whatever proper noun it was about to produce, and your persona name is the most frequent proper noun in a roleplay context. It also lands as character names and standalone exclamations, so name replacement is the common case rather than the only one.
Quick Takeaways
- Firmirin is a nonsense token in Zhipu AI’s GLM 5, 5.1 and 5.3 models, not a fault in your character card or prompt.
- The word follows the model, not the app, so switching platforms while keeping GLM changes nothing.
- Nobody has proven whether it is a deliberate watermark or a training-data accident, and Zhipu has never commented.
- Anthropic’s distillation accusation named DeepSeek, Moonshot AI and MiniMax, not Zhipu, so the popular poisoning theory has a hole in it.
- Add
FirmirinandFirmirnto your banned strings, or run the regex/\b(Firmirin|Firmirn)\b/giagainst your persona name, and the problem is gone in two minutes.
