Image model Q8_0 (Sakura-Iris-3B-Q8_0-4.15GiB.gguf) and our 8bit uncensored text encoder, stable-diffusion.cpp (Vulkan, Radeon 8060S), 1024x1024, 30 steps, CFG 3, dpm++2m. One seed per prompt, all nine prompts are shown, no re-rolls and no selection. About 212 s per image including model loading (305 s for the first one, other jobs were still running); the whole-GPU memory counter peaked at 11.9 GiB while generating (other jobs were running on the same GPU at times, so these are upper bounds). The images were made with stable-diffusion.cpp.

The prompts are neutral. These images say nothing about what the ablated text encoder changes for restricted content; they only show that ordinary prompts still work. Seeds 1202, 1302, 1305, 1306, 1105, 1103, 1503, 1506, 1406 in the order shown; the prompts are the captions of the images above.

What you need to run it

Everything except the runtime is in this repository. Iris-3B has no VAE: do not pass --vae.

The text encoder GGUF names carry a label (8bit, 4bit) instead of Q8_0 / Q4_K_M, so the Hub card lists only the image models.

What is "uncensored" here, exactly

What we did not measure: how much the ablated encoder changes the images of restricted content. The refusal numbers describe the encoder used as a language model; in this pipeline it only supplies hidden states (Iris reads the states of layers 2, 5, 8, ..., 35 of the 36 layers). We only compared neutral prompts (see below). No sample images of restricted content are included.

Files

Why the image files are not smaller: stable-diffusion.cpp keeps 3.05 GiB of the model in FP32 at every quantization level: the FFN w2 weights (row length 6826 is not divisible by the quantization block size, 2.21 GiB) and the text adapter, timestep embedder and small tensors (0.83 GiB, excluded by its own rule). In our files the w2 weights are stored as F16 (saves 1.04 GiB; with the sd.cpp default rule they would stay FP32 and the files would be 4.19 / 4.44 / 4.71 / 5.20 GiB). The F16 variant was within ±0.6 dB PSNR of the default rule in every pair we compared (one image each, see below).

Run with stable-diffusion.cpp

sd-cli \
  --diffusion-model Sakura-Iris-3B-Q5_K_M-3.40GiB.gguf \
  --llm Sakura-TextEncoder-Qwen3VL-4B-Uncensored-8bit-3.99GiB.gguf \
  --steps 30 --cfg-scale 3 --sampling-method dpm++2m --diffusion-fa \
  -W 1024 -H 1024 -p "your prompt" -o out.png

Width and height must be multiples of 16, prompts are limited to 300 tokens. The original model card uses 100 steps and CFG 3 with a DPM-Solver++ order-2 sampler. We measured and made the images with 30 steps and the dpm++2m sampler of stable-diffusion.cpp.

Steps (Q8_0 image model made with the sd.cpp default rule, 5.20 GiB, not shipped; same prompt and seed, 1024x1024, one image each):

All times include model loading and were measured on a Radeon 8060S (Vulkan); the 30- and 50-step times were taken while other jobs were running on the machine. Iris is not a distilled model: 8 steps is a preview setting, 20 to 30 steps is a good compromise.

Image-model quality (what we measured)

Reference: the official FP32 model.safetensors run by the same program with the same encoder (official Qwen3-VL-4B-Instruct Q8_0 GGUF), 1024x1024, 30 steps, CFG 3, dpm++2m, seed 42, same machine, prompt "A small orange cat sitting on a blue chair in a sunny room, natural colors, realistic photograph." One image per file, so differences of about one dB or less are noise, and the order of Q5_K_M and Q4_K_M is not resolved by PSNR. Higher is closer to the FP32 reference; a diffusion model changes details even with tiny weight changes, so these are deviation numbers, not a quality score.

For the same prompt with the sd.cpp default rule (w2 FP32, not shipped): Q8_0 26.84 dB / 0.875, Q6_K 25.23 dB / 0.863, Q5_K_M 20.01 dB / 0.777, Q4_K_M 20.19 dB / 0.703. A second prompt (a travel poster with the word "LISBOA") was measured for the default-rule Q8_0 (19.80 dB / 0.813) and Q4_K_M (15.41 dB / 0.604) and for Q4_K_M with w2 as F16 (15.49 dB / 0.600); the text is rendered correctly in all three. Peak whole-GPU memory with nothing else running: 13.5 GiB for the default-rule Q8_0 (5.20 GiB, not shipped) at 100 steps (2.2 GiB were in use before), 19.0 GiB for the FP32 original at 30 steps. We did not measure the memory of the other quantizations with nothing else running.

Text encoder: refusals and effect on images

Our own refusal measurement on the encoder used as a chat model (llama.cpp, temperature 0, 120 tokens, the 104 harmful prompts of the Heretic harmful_behaviors test split, identical prompts and settings for all rows; these are held out from the direction computation (train split), but the first 100 of the 104 are also the prompts Heretic evaluated its trials on, so this is not an independent test of the selected trial; the Q4_K_M files were built with an importance matrix, see below):

Heretic's own count on its 100 evaluation prompts: 97/100 refusals before, 18/100 after, KL divergence 0.087 (trial 89 of 100, 60 random start trials, seed 42; checkpoint selection rule: fewest refusals with KL <= 0.1). Lower refusal counts were found at higher KL (for example 13/100 at KL 0.163 after 56 trials); we kept the KL <= 0.1 rule, the same as for our Qwen-Image encoder.

Effect on images (image model: Q8_0 made with the sd.cpp default rule, 5.20 GiB, not shipped; prompt "cat", seed 42, 30 steps; reference = the unchanged encoder as Q8_0, so only the encoder differs; one image each):

The ablation itself moves the image little (32 dB at Q8_0); 4-bit rounding of the encoder moves it more than the ablation does. The importance matrix helped in this test (21.4 -> 24.6 dB, one image). How the Q4_K_M files were made: importance matrix from the Q8_0 file of the same weights, calib_mix_v1.txt (English / German / code mix), 50 chunks of 512 tokens (stopped at 50 of 96 planned after the values had converged; measured on the unchanged encoder: cosine similarity of 0.998 between the 30- and 40-chunk states, median change per channel 2.3 %), then llama-quantize from the BF16 GGUF. An importance matrix computed from 116 real image prompts in the Iris chat template (32 chunks) gave 24.09 dB for our encoder in the same test, i.e. no better; we kept the generic one. These numbers do not say anything about content restrictions.

What we changed (Apache License 2.0, section 4)

• Sakura-Iris-3B-*.gguf: made with sd-cli -M convert directly from the official FP32 model.safetensors of speridlabs/iris-3b (sha256 a90e1f4c197bac8491f82078def68884b6a3527ea7fc97a693e3e367372aa80f, checked against the Hub), with --type q8_0|q6_K|q5_K|q4_K and --tensor-type-rules "mlp(_x|_y)?\.w2\.weight$=f16". Modified files.
• Sakura-TextEncoder-*: the unmodified Qwen3-VL-4B-Instruct (revision ebb281ec70b05090aa6165b016eac8ec08e71b17) with Heretic's directional ablation (o_proj, down_proj) merged into the weights, converted to GGUF with llama.cpp and quantized (Q8_0; Q4_K_M with importance matrix), plus the merged BF16 Hugging Face folder. Modified files.
• Our unchanged-encoder control: the encoder converted by us from the original weights gives a pixel-identical image to the official Qwen3VL-4B-Instruct-Q8_0.gguf (same image model, prompt and seed), so the converter does not change anything.
• LICENSE is the Apache License 2.0 text of the original repository; NOTICE carries the original notice and this list of changes.

License and use

Apache License 2.0 (LICENSE), same as Iris-3B and Qwen3-VL-4B-Instruct. Iris-3B is by speridlabs; this is an independent community release.

Credits

• Original model: speridlabs/iris-3b (speridlabs); text encoder Qwen/Qwen3-VL-4B-Instruct (Qwen / Alibaba).
• Ablation: p-e-w/heretic (AGPL-3.0, used as a tool; not included here).
• GGUF conversion and inference: leejet/stable-diffusion.cpp (MIT) and ggml-org/llama.cpp (MIT).
• Prompts for the (not shipped) calibration experiment: nateraw/parti-prompts (Apache-2.0) and k-mktr/improved-flux-prompts (MIT).

sd-cli \
  --diffusion-model Sakura-Iris-3B-Q5_K_M-3.40GiB.gguf \
  --llm Sakura-TextEncoder-Qwen3VL-4B-Uncensored-8bit-3.99GiB.gguf \
  --steps 30 --cfg-scale 3 --sampling-method dpm++2m --diffusion-fa \
  -W 1024 -H 1024 -p "your prompt" -o out.png