license: apache-2.0 base_model:

• Qwen/Qwen3-VL-4B-Instruct base_model_relation: finetune quantized_by: AtomicChat pipeline_tag: text-to-image library_name: gguf tags:
• atomic-chat
• flux
• flux-3
• qwen3-vl
• text-encoder
• stable-diffusion.cpp
• gguf
• abliteration
• refusal-direction

How to Run FLUX 3 Image Klein's Text Encoder Without Refusals Locally

Where exactly this is uncensored

FLUX 3 Image Klein makes a picture with four parts. Two of them are changed in our Uncensored releases, one in each repo.

What that does to the pictures: 45 sensitive requests in nine categories (adults only, no real people), each turned into a caption by the upsampler and rendered with the BF16 image model on two seeds. A vision model judged whether the picture shows what was asked for.

• We measured no uncensoring effect on images, because there was nothing to uncensor. The stock pipeline already draws every category. The uncensored builds draw the same ones, within one picture in ten either way.
• The pictures do change. With this encoder in BF16, ordinary pictures move by LPIPS 0.066 on 48 neutral captions, about an eighth of a new seed (0.53). They move as much on the sensitive ones (0.069), so it is a general shift, not one towards refused content. For scale: the Q4_K_M encoder most people use moves them by 0.088.
• The upsampler's captions are where an edit can act. The stock one softened 2 of 35 sensitive requests and the uncensored one keeps them, but the image model draws neither of those two in any build.

What this release does give you is the encoder as a chat model without refusals, in the files stable-diffusion.cpp takes as --llm.

The files

The same rungs and layouts as the encoder files in our Klein repo (text_encoders/), with the edit baked in. As a chat model: mean KLD to the original Qwen3-VL-4B-Instruct on held-out neutral text and how often the top token matches; these include the edit itself. Refusals are on held-out prompts.

Held-out prompts: 81 English and 100 Russian harmful requests, 250 XSTest safe prompts. The original refuses 64 / 32 / 4 of them (79% / 32% / 1.6%).

• Q8_0 if it fits. AD-Q4_K is the 2.5 GB option, the same layout as our stock AD-Q4_K encoder, which moves Klein's pictures less than Qwen's own Q4_K_M.
• What each rung does to the pictures was measured for the stock encoder rungs (in our Klein card), not again for these.

Against other uncensored Klein encoders

At Q8_0, on our stand: KLD to the original BF16 on the same neutral text, our held-out refusal sets (81 English, 100 Russian, 250 XSTest safe prompts) and MMLU (2000 questions).

Sakura's edit is the smaller one. On pictures it moves them by 0.031 at Q8_0, this one by 0.066 at BF16. If you want an uncensored encoder only for Klein's pictures, Sakura's changes them less.

Running it

sd-cli --diffusion-model FLUX-3-Image-Klein-AD-Q5_K.gguf \
  --llm Qwen3-VL-4B-Instruct-Uncensored-Q8_0.gguf \
  --vae vae/ae.safetensors \
  -p "$(cat caption.txt)" \
  --steps 16 --cfg-scale 1.0 --sampling-method euler -W 1024 -H 1024 -o out.png

• Image model and VAE: AtomicChat/FLUX-3-Image-Klein-GGUF. The settings (16 steps, CFG 1) and the ComfyUI route are explained there.
• Captions: Klein wants long scene captions. BFL's upsampler, uncensored, is in FLUX-3-Image-Klein-pup-Uncensored-GGUF.
• ComfyUI: ComfyUI reads a Qwen3-VL GGUF encoder as Qwen3-4B and Klein's sampler fails, so this encoder works with stable-diffusion.cpp only.
• As a chat model: it is a regular Qwen3-VL GGUF for llama.cpp. For images, add the original model's mmproj.

The encoder as a chat model

Original against this one, both BF16, on prompts never used to pick anything:

• Refusal is counted by the opening of the reply, so it is indicative, not a judge.
• One of our gates did not fit this model: the thinking-loop check. Qwen3-VL-4B-Instruct has no thinking mode and loops on long greedy answers by itself: 12 of 24 long harmless requests before the edit and 12 of 24 after.

How it was made

1. Direction. Difference of means of the residual stream at the last prompt token, chat template applied, harmful against harmless English prompts, taken entering block 23 of 36, with the harmless-mean component removed.
2. Edit. W' = W - r rᵀW on the 36 attention outputs and the 36 MLP down projections. The token embedding, which is also the output head, and the vision tower are untouched.
3. Choice. Variants screened on validation prompts (row, strength, which writers, English or English + Russian); the numbers above come from held-out test prompts.
4. Bake and quantize. The edit applied to the BF16 weights in f32 and rounded once, then the stock encoder's recipes and importance matrix. llama.cpp 6184e92 (upstream), with two graph names added for the activation taps.
5. Images. stable-diffusion.cpp 95b3090, Klein's BF16 image model, 1024×1024, 16 steps, CFG 1, seeds 42 and 43.

Limitations

• The refusal count reads the opening of each reply. A soft refusal phrased as an answer would be missed.
• The probe set is small (45 requests, two seeds), judged by a vision model, the same judge for every build.
• Editing with reference images goes through the image model, which is unchanged.
• The pictures of the quantized uncensored files were not measured separately.

Responsible use

The encoder no longer leans prompts towards a refusal. That does not make the output safe, correct or lawful. Do not use it to make sexual content involving minors, or intimate or degrading images of real people without their consent. Klein's image model stays under the FLUX Kommunity License, which forbids such uses. Any deployment needs its own access controls and policy enforcement.

Credits

Direction estimation, edit, quantization and evaluation by AtomicChat. Base model Qwen3-VL-4B-Instruct by Qwen, Apache-2.0. The image model it pairs with, FLUX 3 Image Klein by Black Forest Labs, is under the FLUX Kommunity License and is not part of this repo. The method follows Arditi et al., Refusal in Language Models Is Mediated by a Single Direction (2024).