license: other
license_name: lil-license-1.0
license_link: LICENSE
base_model:

• local-inference-lab/Qwen3.8-Flash-Next-FLARE
• lflare/Qwen3.8-Flash-Next-NVFP4-MXFP8-CSF-QAD-Abliterated
  base_model_relation: finetune
  pipeline_tag: image-text-to-text
  tags:
• flare
• nvfp4
• mxfp8
• abliterated
• reduced-refusal

This model is based on Qwen3.8-Flash-Next-FLARE by Local Inference Lab, Inc., a non-profit organization, available at https://huggingface.co/local-inference-lab/Qwen3.8-Flash-Next-FLARE. Qwen3.8-Flash-Next-FLARE is licensed under the Local Inference Lab License, Version 1.0.

Qwen3.8-Flash-Next-FLARE-Abliterated

Reduced-refusal model. A refusal-direction edit was applied on purpose.
Read the Safety section before you deploy this.

gb202 is now v3, and v3 is a different kind of artefact. v1 and v2 were
upstream's package with our weights patched into it, byte for byte, keeping
upstream's signature. v3 is a real re-export: the abliterated checkpoint was
prepared from scratch with upstream's own Ignition, so it is a package in its
own right, signed by us. v1 and v2 remain as tags.

The reason is not tidiness. Upstream Flare bce032c0 rejects v1 and v2 outright
with signed format-6 package required; re-export the checkpoint, and a package
cannot be converted — only re-prepared. So the runtime you have decides the
revision you want:

v3 is published as the directory canonical form — a 22,922,000-byte signed
model.safetensors primary plus 55 companions under weights/ and
deployments/, 106,836,595,014 bytes in total. One packed file would have been
simpler, but the Hub refuses a single 106.8 GB LFS object, and the primary names
each companion by its exact relative path, so the paths matter.

v2 and v3 carry the same edit; v3 changes how it is packaged, not what it does.
Those figures were measured on the equivalent plain checkpoint — see
Measured behaviour.

# Take publisher.json from the SAME revision as the weights. v3 is signed by our
# key, v1 and v2 by Local Inference Lab's, and `main` still carries theirs, so a
# profile fetched without a revision will not verify v3.
hf download lflare/Qwen3.8-Flash-Next-FLARE-Abliterated \
  --revision v3 --include 'model.safetensors' 'weights/*' 'deployments/*' \
  'publisher.json' 'config.json' --local-dir ./pkg

# A local package directory needs no model cache and no revision resolution.
flare run ./pkg \
  --gpus 0 --embedding-table-storage ram \
  --verify-weights \
  --publisher-keys ./pkg/publisher.json \
  --dangerously-approve-key 0a574ece56e54541d7362e10ba129988b3411d05a5e4805b4d9114c92405479e \
  --dangerously-accept-publisher local-development

gb202 tracks the newest package, so pin --revision v3 if you want it fixed.

config.json is in that first command on purpose, and it is not a loadable
model config. The Hub counts a download only when it serves one of a repo's
query files, and for a repository that declares no library that file is
config.json
(docs). Without it this
repository records zero downloads however many times the package is pulled —
which is why both this repo and the upstream Flare package sat at 0. The file
deliberately has no model_type, architectures or auto_map key, so nothing
is tempted to treat a Flare package as a Transformers checkpoint.
AutoConfig.from_pretrained is expected to fail on it.

Read this first — three operational facts

1. --verify-weights now works, and you should use it. This was the
opposite for v1 and v2: patching weights invalidated upstream's digest over the
whole weight region, so the flag failed after about 190 s and those builds could
not be cryptographically verified at all. v3 is a real export signed by our own
key, so the digest covers our own bytes. Measured on this package:
Verify stored data. 99.5 GiB 37.5s, exit 0.

2. The signing key is ours, not Local Inference Lab's. v1 and v2
authenticated as theirs because the patch left the signed metadata untouched.
v3 is signed by the development key Ignition created during the export:
namespace local-development, fingerprint
0a574ece56e54541d7362e10ba129988b3411d05a5e4805b4d9114c92405479e. The runtime
discloses it plainly — "Local development package; not an official published
checkpoint". publisher.json at revision v3 is our profile; the copy on
main is still upstream's, because v1 and v2 need it. Always take the profile
from the same revision as the weights.
That is not an endorsement by anyone — see Licence.

3. You need CUDA 13.2 or newer. Measured on this package and the upstream
one alike:

One GPU, TP1, up to 16 concurrent requests, up to 5 MTP draft tokens — the
capacities this export was prepared for. Flare rejects temperature=0
("greedy decoding incorrectly collapses the model's probability distribution");
0.01 is accepted.

Measured behaviour

Partly measured on this package. v3 was exercised through the Flare runtime
itself: it loads, generates correctly, answers a request the unedited parent
declines, and runs MTP speculation across widths 1 to 6. What was not re-run
through Flare is the 136-row held-out gate, so the refusal figures below come
from the plain checkpoint whose weights these are:
lflare/Qwen3.8-Flash-Next-NVFP4-MXFP8-CSF-QAD-Abliterated
at revision v3, whose measurements/ directory holds the raw result files.
v3's edit is the same rank-2 dual-regime edit as v2, re-applied to the same
weights and reproducing v2's figures to four significant figures — biprojection
cosines 0.982786 and 0.903085, cos(v1, v2) = 0.3495, 25,188 of 25,188 targets
edited, max leakage 0.002305, mean added weight error 5.618 % of ‖W‖.

Held-out rows the layer selection never saw, 136 harmful and 59 over-refusal,
parent against this edit:

Capability at parity in the same session: lavd 30/30 against the parent's
30/30, estonia 30/30 against 30/30, paired GPQA-diamond 166/198 against
164/198 (not significant, p = 0.85).

What is genuinely unverified here is the held-out gate through Flare, and
capability through Flare. Long-context retrieval, GPQA, MTP acceptance rate and
vision were never measured through the runtime on any of our builds. Unlike v2,
v3 at least no longer rests on the assumption that a patched package serves
equivalently, because it is not patched.

Scorer warning. A keyword scorer, as opposed to a refusal-form scorer,
returns wildly different numbers on the same responses, because words like
"illegal" occur inside answers that comply. A refusal number is a protocol and
scorer pair, and both halves move it a long way.

What was edited

The edit removes the span of two refusal directions, not one. The
thinking-off and thinking-on refusal directions on this model sit 67–77°
apart, against a capture noise floor of 1.5–3.5°, so ablating one leaves about
96 % of the other standing — which is why v1 complied with thinking off and
still refused with thinking on. Both directions were captured at layer 42 and
biprojected against their own harmless mean; they sit at cos = 0.3495, 69.5°
apart. The committed artefacts are direction_off_a.npz and direction_on_a.npz
in the plain checkpoint's measurements/.

v3 reaches 512 tensors that v1 and v2 could not. The edit is applied to the
checkpoint and the package is then exported from it, so every target is simply
addressable:

Those 512 MTP routed-expert planes were deliberately skipped by v1 and v2,
because their storage region inside the sealed package could not be identified —
a 612-probe scan found 100 of 612 targets and the 512 misses were exactly those
planes. Re-exporting removes that limitation along with the patching entirely.

No scale tensor is touched. The constrained requantiser keeps every code on its
own quantisation grid within a ±1 ULP budget, which is why a naive
round-to-nearest requantisation is not used: measured on real shards, plain
rounding retains only 14 % of an NVFP4 edit.

For the record, v1 and v2 were produced the other way: by locating weight
regions inside upstream's package by content-matching and probing, then
rewriting 22,285,516,800 bytes in place with every offset confirmed against the
parent beforehand and every write read back. That method is sound but cannot
reach what it cannot locate, and it leaves the package unverifiable. It is
superseded.

Verifying this download

v3 is a directory, so there is no single file hash. Verify it the proper way,
which v1 and v2 could not offer:

flare run ./pkg --verify-weights --stage-only \
  --publisher-keys ./pkg/publisher.json \
  --dangerously-approve-key 0a574ece56e54541d7362e10ba129988b3411d05a5e4805b4d9114c92405479e \
  --dangerously-accept-publisher local-development
# [    OK    ] Verify stored data.  99.5 GiB  37.5s

That checks every payload object against the signed manifest and exits before
touching the GPU. The primary, which carries the manifest, the signature and the
physical locations:

file   : model.safetensors            (revision v3 = gb202)
size   : 22,922,000 bytes
sha256 : dbf20a21e4ad13648446f0d3bddf97a46f568eaa5caf954ccb4390846cbfdc38

The earlier single-file packages, for anyone serving them on an older runtime:

Limitations

• The held-out refusal gate was not re-run through Flare. It was measured on
  the plain checkpoint these weights come from. See Measured behaviour.
• Capability through Flare is unmeasured: long-context retrieval, GPQA, MTP
  acceptance rate and vision were never measured through the runtime.
• Signed by a development key, which the runtime announces as "not an
  official published checkpoint". Approving it is a trust decision you make.
• Requires Flare bce032c0 or newer. Older runtimes refuse this package format;
  serve v2 on those.
• One GPU, TP1, concurrency 16, 5 MTP draft tokens. Multi-host RoCE is DGX Spark
  (arm64) only — the amd64 Flare binary does not link libibverbs.
• CUDA 13.2 or newer required.
• These files require Flare. They cannot be loaded by Transformers, vLLM, SGLang
  or llama.cpp, and Flare cannot load an ordinary checkpoint.

Safety

Refusal behaviour has been deliberately and substantially removed, in both
thinking regimes, where v1 only did so with thinking off. This
model answers requests the parent declines, including harmful ones. Do not deploy
it as a general-purpose assistant without your own safeguards, and do not read
these numbers as a safety property.

Counter-intuitively, thinking-off is the harder regime: the unedited parent
refuses 100 % there against 84.6 % with thinking on. Report refusal as a protocol
and scorer pair, and compare only against the parent measured identically.

Licence

Local Inference Lab License, Version 1.0. See LICENSE, NOTICE and
LICENSES/, copied unchanged from the licensor's distribution, with the
Identifying Marks intact.

Redistribution of this derivative is by permission of the licensor under
Section 2.4. Local Inference Lab does not sponsor or endorse this model or its
authors, and nothing here should be read as approval of a reduced-refusal
build. The upstream model remains under the Qwen Community License 1.0; see
LICENSES/LicenseRef-qwen-community-1.0.txt. If you operate a Model-as-a-Service
or AI-assistant business, that licence requires a separate licence from Qwen
before commercial use.

Credits: Qwen/Qwen3.8-Flash-Next by Qwen. The Flare runtime, the NVFP4-CSF
container format, the b12x kernels and the Ignition preparation tool that
produced this package are all by Local Inference Lab, Inc. v1 and v2 additionally
edited a prepared package of theirs; v3 does not, and is exported from our own
abliterated checkpoint.