license: apache-2.0
base_model:

• Qwen/Qwen3-VL-4B-Instruct
  base_model_relation: finetune
  quantized_by: AtomicChat
  pipeline_tag: text-to-image
  library_name: gguf
  tags:
• atomic-chat
• flux
• flux-3
• qwen3-vl
• text-encoder
• stable-diffusion.cpp
• gguf
• abliteration
• refusal-direction

How to Run FLUX 3 Image Klein's Text Encoder Without Refusals Locally

FLUX 3 Image Klein's text encoder, Qwen3-VL-4B-Instruct, with its refusal direction projected out: a drop-in --llm for stable-diffusion.cpp next to our Klein GGUFs. Klein's prompt upsampler without refusals is in FLUX-3-Image-Klein-pup-Uncensored-GGUF. Below, exactly which part is uncensored and what that does to the pictures. The measurements are public.

• As a chat model, the encoder's refusals fall from 79% to 0% in English and from 32% to 0% in Russian on held-out prompts. MMLU goes from 71.1% to 71.2%.
• On images it changes nothing we could measure. The open Klein pipeline has no filter and already draws the sensitive categories we tested. With this encoder, alone or together with the uncensored upsampler, no category moved by more than one picture in ten. See where exactly this is uncensored.
• Another uncensored Klein encoder, webmp3's Sakura, has a smaller edit: it moves the model and the pictures less than this one, at the same 0% refusals. See the comparison.

Where exactly this is uncensored

FLUX 3 Image Klein makes a picture with four parts. Two of them are changed in our Uncensored releases, one in each repo.

What that does to the pictures: 45 sensitive requests in nine categories (adults only, no real people), each turned
into a caption by the upsampler and rendered with the BF16 image model on two seeds. A vision model judged whether
the picture shows what was asked for.

• We measured no uncensoring effect on images, because there was nothing to uncensor. The stock pipeline already
  draws every category. The uncensored builds draw the same ones, within one picture in ten either way.
• The pictures do change. With this encoder in BF16, ordinary pictures move by LPIPS 0.066 on 48 neutral
  captions, about an eighth of a new seed (0.53). They move as much on the sensitive ones (0.069), so it is a general
  shift, not one towards refused content. For scale: the Q4_K_M encoder most people use moves them by 0.088.
• The upsampler's captions are where an edit can act. The stock one softened 2 of 35 sensitive requests and the
  uncensored one keeps them, but the image model draws neither of those two in any build.

What this release does give you is the encoder as a chat model without refusals, in the files stable-diffusion.cpp
takes as --llm.

The files

The same rungs and layouts as the encoder files in our Klein repo
(text_encoders/), with the edit baked in. As a chat model: mean KLD to the original Qwen3-VL-4B-Instruct on held-out
neutral text and how often the top token matches; these include the edit itself. Refusals are on held-out prompts.

Held-out prompts: 81 English and 100 Russian harmful requests, 250 XSTest safe prompts. The original refuses 64 / 32
/ 4 of them (79% / 32% / 1.6%).

• Q8_0 if it fits. AD-Q4_K is the 2.5 GB option, the same layout as our stock AD-Q4_K encoder, which moves
  Klein's pictures less than Qwen's own Q4_K_M.
• What each rung does to the pictures was measured for the stock encoder rungs (in our Klein card), not again for these.

Against other uncensored Klein encoders

At Q8_0, on our stand: KLD to the original BF16 on the same neutral text, our held-out refusal sets (81 English, 100
Russian, 250 XSTest safe prompts) and MMLU (2000 questions).

Sakura's edit is the smaller one. On pictures it moves them by 0.031 at Q8_0, this one by 0.066 at BF16. If you want
an uncensored encoder only for Klein's pictures, Sakura's changes them less.

Running it

sd-cli --diffusion-model FLUX-3-Image-Klein-AD-Q5_K.gguf \
  --llm Qwen3-VL-4B-Instruct-Uncensored-Q8_0.gguf \
  --vae vae/ae.safetensors \
  -p "$(cat caption.txt)" \
  --steps 16 --cfg-scale 1.0 --sampling-method euler -W 1024 -H 1024 -o out.png

• Image model and VAE: AtomicChat/FLUX-3-Image-Klein-GGUF.
  The settings (16 steps, CFG 1) and the ComfyUI route are explained there.
• Captions: Klein wants long scene captions. BFL's upsampler, uncensored, is in
  FLUX-3-Image-Klein-pup-Uncensored-GGUF.
• ComfyUI: ComfyUI reads a Qwen3-VL GGUF encoder as Qwen3-4B and Klein's sampler fails, so this encoder works
  with stable-diffusion.cpp only.
• As a chat model: it is a regular Qwen3-VL GGUF for llama.cpp. For images, add the original model's mmproj.

The encoder as a chat model

Original against this one, both BF16, on prompts never used to pick anything:

• Refusal is counted by the opening of the reply, so it is indicative, not a judge.
• One of our gates did not fit this model: the thinking-loop check. Qwen3-VL-4B-Instruct has no thinking mode and
  loops on long greedy answers by itself: 12 of 24 long harmless requests before the edit and 12 of 24 after.

How it was made

1. Direction. Difference of means of the residual stream at the last prompt token, chat template applied,
   harmful against harmless English prompts, taken entering block 23 of 36, with the harmless-mean component removed.
2. Edit. W' = W - r rᵀW on the 36 attention outputs and the 36 MLP down projections. The token embedding,
   which is also the output head, and the vision tower are untouched.
3. Choice. Variants screened on validation prompts (row, strength, which writers, English or English + Russian);
   the numbers above come from held-out test prompts.
4. Bake and quantize. The edit applied to the BF16 weights in f32 and rounded once, then the stock encoder's
   recipes and importance matrix. llama.cpp 6184e92 (upstream), with two graph names added for the activation taps.
5. Images. stable-diffusion.cpp 95b3090, Klein's BF16 image model, 1024×1024, 16 steps, CFG 1, seeds 42 and 43.

Limitations

• The refusal count reads the opening of each reply. A soft refusal phrased as an answer would be missed.
• The probe set is small (45 requests, two seeds), judged by a vision model, the same judge for every build.
• Editing with reference images goes through the image model, which is unchanged.
• The pictures of the quantized uncensored files were not measured separately.

Responsible use

The encoder no longer leans prompts towards a refusal. That does not make the output safe, correct or lawful. Do not
use it to make sexual content involving minors, or intimate or degrading images of real people without their
consent. Klein's image model stays under the FLUX Kommunity License, which forbids such uses. Any deployment needs
its own access controls and policy enforcement.

Credits

Direction estimation, edit, quantization and evaluation by AtomicChat. Base model
Qwen3-VL-4B-Instruct by Qwen, Apache-2.0. The image model it pairs
with, FLUX 3 Image Klein by Black Forest Labs, is under the FLUX Kommunity License and is not part of this repo. The
method follows Arditi et al., Refusal in Language Models Is Mediated by a Single Direction (2024).