license: other license_name: lil-license-1.0 license_link: LICENSE base_model:

• local-inference-lab/Qwen3.8-Flash-Next-FLARE
• lflare/Qwen3.8-Flash-Next-NVFP4-MXFP8-CSF-QAD-Abliterated base_model_relation: finetune pipeline_tag: image-text-to-text tags:
• flare
• nvfp4
• mxfp8
• abliterated
• reduced-refusal

This model is based on Qwen3.8-Flash-Next-FLARE by Local Inference Lab, Inc., a non-profit organization, available at https://huggingface.co/local-inference-lab/Qwen3.8-Flash-Next-FLARE. Qwen3.8-Flash-Next-FLARE is licensed under the Local Inference Lab License, Version 1.0.

Qwen3.8-Flash-Next-FLARE-Abliterated

Reduced-refusal model. A refusal-direction edit was applied on purpose. Read the Safety section before you deploy this.

gb202 is now v3, and v3 is a different kind of artefact. v1 and v2 were upstream's package with our weights patched into it, byte for byte, keeping upstream's signature. v3 is a real re-export: the abliterated checkpoint was prepared from scratch with upstream's own Ignition, so it is a package in its own right, signed by us. v1 and v2 remain as tags.

The reason is not tidiness. Upstream Flare bce032c0 rejects v1 and v2 outright with signed format-6 package required; re-export the checkpoint, and a package cannot be converted — only re-prepared. So the runtime you have decides the revision you want:

v3 is published as the directory canonical form — a 22,922,000-byte signed model.safetensors primary plus 55 companions under weights/ and deployments/, 106,836,595,014 bytes in total. One packed file would have been simpler, but the Hub refuses a single 106.8 GB LFS object, and the primary names each companion by its exact relative path, so the paths matter.

v2 and v3 carry the same edit; v3 changes how it is packaged, not what it does. Those figures were measured on the equivalent plain checkpoint — see Measured behaviour.

# Take publisher.json from the SAME revision as the weights. v3 is signed by our
# key, v1 and v2 by Local Inference Lab's, and `main` still carries theirs, so a
# profile fetched without a revision will not verify v3.
hf download lflare/Qwen3.8-Flash-Next-FLARE-Abliterated \
  --revision v3 --include 'model.safetensors' 'weights/*' 'deployments/*' \
  'publisher.json' 'config.json' --local-dir ./pkg

# A local package directory needs no model cache and no revision resolution.
flare run ./pkg \
  --gpus 0 --embedding-table-storage ram \
  --verify-weights \
  --publisher-keys ./pkg/publisher.json \
  --dangerously-approve-key 0a574ece56e54541d7362e10ba129988b3411d05a5e4805b4d9114c92405479e \
  --dangerously-accept-publisher local-development

gb202 tracks the newest package, so pin --revision v3 if you want it fixed.

config.json is in that first command on purpose, and it is not a loadable model config. The Hub counts a download only when it serves one of a repo's query files, and for a repository that declares no library that file is config.json (docs). Without it this repository records zero downloads however many times the package is pulled — which is why both this repo and the upstream Flare package sat at 0. The file deliberately has no model_type, architectures or auto_map key, so nothing is tempted to treat a Flare package as a Transformers checkpoint. AutoConfig.from_pretrained is expected to fail on it.

Read this first — three operational facts

1. --verify-weights now works, and you should use it. This was the opposite for v1 and v2: patching weights invalidated upstream's digest over the whole weight region, so the flag failed after about 190 s and those builds could not be cryptographically verified at all. v3 is a real export signed by our own key, so the digest covers our own bytes. Measured on this package: Verify stored data. 99.5 GiB 37.5s, exit 0.

2. The signing key is ours, not Local Inference Lab's. v1 and v2 authenticated as theirs because the patch left the signed metadata untouched. v3 is signed by the development key Ignition created during the export: namespace local-development, fingerprint 0a574ece56e54541d7362e10ba129988b3411d05a5e4805b4d9114c92405479e. The runtime discloses it plainly — "Local development package; not an official published checkpoint". publisher.json at revision v3 is our profile; the copy on main is still upstream's, because v1 and v2 need it. Always take the profile from the same revision as the weights. That is not an endorsement by anyone — see Licence.

3. You need CUDA 13.2 or newer. Measured on this package and the upstream one alike:

One GPU, TP1, up to 16 concurrent requests, up to 5 MTP draft tokens — the capacities this export was prepared for. Flare rejects temperature=0 ("greedy decoding incorrectly collapses the model's probability distribution"); 0.01 is accepted.

Measured behaviour

Partly measured on this package. v3 was exercised through the Flare runtime itself: it loads, generates correctly, answers a request the unedited parent declines, and runs MTP speculation across widths 1 to 6. What was not re-run through Flare is the 136-row held-out gate, so the refusal figures below come from the plain checkpoint whose weights these are: lflare/Qwen3.8-Flash-Next-NVFP4-MXFP8-CSF-QAD-Abliterated at revision v3, whose measurements/ directory holds the raw result files. v3's edit is the same rank-2 dual-regime edit as v2, re-applied to the same weights and reproducing v2's figures to four significant figures — biprojection cosines 0.982786 and 0.903085, cos(v1, v2) = 0.3495, 25,188 of 25,188 targets edited, max leakage 0.002305, mean added weight error 5.618 % of ‖W‖.

Held-out rows the layer selection never saw, 136 harmful and 59 over-refusal, parent against this edit:

Capability at parity in the same session: lavd 30/30 against the parent's 30/30, estonia 30/30 against 30/30, paired GPQA-diamond 166/198 against 164/198 (not significant, p = 0.85).

What is genuinely unverified here is the held-out gate through Flare, and capability through Flare. Long-context retrieval, GPQA, MTP acceptance rate and vision were never measured through the runtime on any of our builds. Unlike v2, v3 at least no longer rests on the assumption that a patched package serves equivalently, because it is not patched.

Scorer warning. A keyword scorer, as opposed to a refusal-form scorer, returns wildly different numbers on the same responses, because words like "illegal" occur inside answers that comply. A refusal number is a protocol and scorer pair, and both halves move it a long way.

What was edited

The edit removes the span of two refusal directions, not one. The thinking-off and thinking-on refusal directions on this model sit 67–77° apart, against a capture noise floor of 1.5–3.5°, so ablating one leaves about 96 % of the other standing — which is why v1 complied with thinking off and still refused with thinking on. Both directions were captured at layer 42 and biprojected against their own harmless mean; they sit at cos = 0.3495, 69.5° apart. The committed artefacts are direction_off_a.npz and direction_on_a.npz in the plain checkpoint's measurements/.

v3 reaches 512 tensors that v1 and v2 could not. The edit is applied to the checkpoint and the package is then exported from it, so every target is simply addressable:

Those 512 MTP routed-expert planes were deliberately skipped by v1 and v2, because their storage region inside the sealed package could not be identified — a 612-probe scan found 100 of 612 targets and the 512 misses were exactly those planes. Re-exporting removes that limitation along with the patching entirely.

No scale tensor is touched. The constrained requantiser keeps every code on its own quantisation grid within a ±1 ULP budget, which is why a naive round-to-nearest requantisation is not used: measured on real shards, plain rounding retains only 14 % of an NVFP4 edit.

For the record, v1 and v2 were produced the other way: by locating weight regions inside upstream's package by content-matching and probing, then rewriting 22,285,516,800 bytes in place with every offset confirmed against the parent beforehand and every write read back. That method is sound but cannot reach what it cannot locate, and it leaves the package unverifiable. It is superseded.

Verifying this download

v3 is a directory, so there is no single file hash. Verify it the proper way, which v1 and v2 could not offer:

flare run ./pkg --verify-weights --stage-only \
  --publisher-keys ./pkg/publisher.json \
  --dangerously-approve-key 0a574ece56e54541d7362e10ba129988b3411d05a5e4805b4d9114c92405479e \
  --dangerously-accept-publisher local-development
# [    OK    ] Verify stored data.  99.5 GiB  37.5s

That checks every payload object against the signed manifest and exits before touching the GPU. The primary, which carries the manifest, the signature and the physical locations:

file   : model.safetensors            (revision v3 = gb202)
size   : 22,922,000 bytes
sha256 : dbf20a21e4ad13648446f0d3bddf97a46f568eaa5caf954ccb4390846cbfdc38

The earlier single-file packages, for anyone serving them on an older runtime:

Limitations

• The held-out refusal gate was not re-run through Flare. It was measured on the plain checkpoint these weights come from. See Measured behaviour.
• Capability through Flare is unmeasured: long-context retrieval, GPQA, MTP acceptance rate and vision were never measured through the runtime.
• Signed by a development key, which the runtime announces as "not an official published checkpoint". Approving it is a trust decision you make.
• Requires Flare bce032c0 or newer. Older runtimes refuse this package format; serve v2 on those.
• One GPU, TP1, concurrency 16, 5 MTP draft tokens. Multi-host RoCE is DGX Spark (arm64) only — the amd64 Flare binary does not link libibverbs.
• CUDA 13.2 or newer required.
• These files require Flare. They cannot be loaded by Transformers, vLLM, SGLang or llama.cpp, and Flare cannot load an ordinary checkpoint.

Safety

Refusal behaviour has been deliberately and substantially removed, in both thinking regimes, where v1 only did so with thinking off. This model answers requests the parent declines, including harmful ones. Do not deploy it as a general-purpose assistant without your own safeguards, and do not read these numbers as a safety property.

Counter-intuitively, thinking-off is the harder regime: the unedited parent refuses 100 % there against 84.6 % with thinking on. Report refusal as a protocol and scorer pair, and compare only against the parent measured identically.

Licence

Local Inference Lab License, Version 1.0. See LICENSE, NOTICE and LICENSES/, copied unchanged from the licensor's distribution, with the Identifying Marks intact.

Redistribution of this derivative is by permission of the licensor under Section 2.4. Local Inference Lab does not sponsor or endorse this model or its authors, and nothing here should be read as approval of a reduced-refusal build. The upstream model remains under the Qwen Community License 1.0; see LICENSES/LicenseRef-qwen-community-1.0.txt. If you operate a Model-as-a-Service or AI-assistant business, that licence requires a separate licence from Qwen before commercial use.

Credits: Qwen/Qwen3.8-Flash-Next by Qwen. The Flare runtime, the NVFP4-CSF container format, the b12x kernels and the Ignition preparation tool that produced this package are all by Local Inference Lab, Inc. v1 and v2 additionally edited a prepared package of theirs; v3 does not, and is exported from our own abliterated checkpoint.