Bugs have been observed — decode, coherence, and serve edge cases under load. Expect sharp edges. This is not production-polished.
Please report them. Open a Community discussion with GPU SKU, driver, SGLang image/version, full serve flags, prompt, temperature, max_tokens, and failure mode (load-time / empty content / loop / tool parse / OOM). Fixes go faster with real repros.
Why this model exists
Full Kimi K3 is a multi-node, multi-terabyte deploy. That puts it out of reach of every team that has one good box and no fabric.
KIMI-K3-DERISKED-CODER-REAP-320-MXFP4 is the same LatentMoE architecture, expert-pruned against measured coding routing load until it fits on 8× RTX 6000 (96 GB class), single node — and de-risked at the weight level against the model's day-zero refusal surface. Not a distill, not a different architecture, not a BF16 remaster — the surviving expert tensors are bit-exact copies of the parent MXFP4 packs.
The single-node footprint is the product; the refusal behaviour change is the contract.
Blackfrost de-risked models deliberately modify refusal behaviour at the weight level so they can support legitimate security-research, red-team, and adversarial-testing workflows that a refusal-heavy base model would block.
The operation reduces the model's day-zero refusal surface while leaving its general capabilities, architecture, and precision intact. Refusal hard floors may remain in residual dimensions — this is a refusal-surface reduction, not a capability guarantee, and not a statement that any input will always be accepted.
De-risked models are intended for controlled environments. They are not the safety-stock variant, and they should not be deployed as one.
What "CODER" means
Not a separate coding SFT or DPO with an undisclosed recipe. No post-training was applied at all.
"Coder" means coding-calibrated expert survival under a fixed expert budget:
Routing measured under coding load — coding prompts and traces
Keep the top 320 / 896 experts per MoE layer by selection frequency
Routers sliced to the survivor index set, num_experts → 320
Survivor expert tensors copied bit-exact from the parent MXFP4 packs
REAP-320 denotes a uniform keep across MoE layers. It is not non-uniform (NU) pruning — memory and routing behaviour are predictable layer to layer.
Responsible use
For security teams
This checkpoint is built for security firms, red teams, and AI-safety labs evaluating model behaviour under adversarial or sensitive-input conditions. It is designed for controlled test environments with independent logging, access review, and deployment guardrails.
For everyone else
Outside its intended surface, this checkpoint is capable of producing content a consumer model might decline — that is the point of the build. The remaining acceptable-use terms and prohibitions are licence obligations, not model behaviour. It is not a safety-stock model and should not be treated as one. Deploy under your own controls, and evaluate against your internal risk model.
On refusal behaviour: this checkpoint's refusal surface has been deliberately reduced at the weight level. It is the Blackfrost class of models described in the parent notes as refusal-modifying. Do not evaluate it or rate-limit it as if it were a safety-stock derivative of its parent.
Measured behaviour
It is a coding specialist — know the shape of the trade
Preliminary perplexity, parent Kimi K3 vs this checkpoint, identical harness, identical
token counts per probe:
Domain
Parent K3
This checkpoint
Ratio
Python code
1.61
1.68
1.04×
Prose (simple factual)
5.53
6.09
1.10×
Chinese
17.74
23.11
1.30×
Prose (encyclopedic)
2.19
54.79
25×
Full-corpus perplexity on wikitext-2 raw test (23,108 tokens, 12 non-overlapping ~2k windows,
scored via SGLang return_logprob): parent 1.49, this checkpoint 17.48.
Code is essentially untouched. Encyclopedic recall is not. That is the expected result of a
64.3% expert cut calibrated on coding routing load — the experts that carried general-corpus
recall were not the ones selected for survival. Part of the encyclopedic gap is the parent's
memorisation of common corpora rather than reasoning capability.
Use this for coding on one box. If you need general knowledge or strong bilingual capability,
use the parent — that is what it is for.
Caveat: the four domain figures come from short probes (13–61 tokens each); the wikitext figure
is the solid one. Treat the table as directional until the benchmark suite below is filled in.
Benchmark retention — in progress
Benchmark
Parent Kimi K3
This checkpoint
Retention
pending
—
—
—%
Expert pruning is a capability trade, and a card that claims a 64.3% expert reduction without
publishing what it cost is asking the reader to take the trade on faith. We will state the
harness, the conditions, and the retention figures — including any benchmark where retention is
poor. A de-risked model has an additional obligation: disclose whether refusal behaviour beyond
the intended surface was affected.
Throughput, measured
On 8× RTX 6000 (SM120), marlin backend, 32k context:
Single-stream decode
~24.7 tok/s (TPOT 38.8 ms)
Aggregate, saturated
~114 tok/s (at 8 concurrent)
Prefill
~1,880 tok/s
At 131k context
~15.7 tok/s single-stream — ~37% slower than 32k
Full K3 vs. this checkpoint
Full Kimi K3
This (DE-RISKED · CODER-REAP)
Routed experts / MoE layer
896
320
Disk (MXFP4 packs)
~1.5 TB
~587 GB
Practical serve shape
multi-node fabric
1× node · 8× RTX 6000
Expert weights
parent packs
bit-exact survivors, no re-quant
Refusal behaviour
safety stock
deliberately de-risked (weight level)
Routing calibration
general
coding load
Full-precision and custom builds
This checkpoint trades 64.3% of the routed experts for a single-node footprint, calibrated on
coding load. As the measurements above show, that trade is cheap on code and expensive on
encyclopedic recall. It is the right artifact for one box; it is not the full model.
Full-precision and custom builds are available for purchase under a separate licence agreement:
Build
What it is
Lossless MXFP4 (full 896 experts)
The complete de-risked checkpoint — every routed expert, bit-exact, no pruning and no requantization
Custom expert budgets
Keep counts other than 320, tuned to your hardware envelope
Non-uniform (NU) keep sets
Per-layer budgets rather than a uniform keep, where routing load justifies it
Your-workload calibration
Expert survival measured against your traffic and threat model rather than generic coding load
Access to these builds is granted on purchase. Their repositories are gated, and approval
follows a completed licence agreement — the gate is the transaction. Requesting access to a
premium repository without a licence in place will not be approved.
Purchase link coming soon. Until then, @Blackfrost_AI DMs are
the fastest route to a human.
Deployment notes
⚠️ RTX 6000 / SM120 requires two non-obvious changes
RTX 6000 Blackwell reports compute capability 12.0 (SM120). Two things in the stock K3
serving path assume SM100 (B200) and will fail:
1. MoE backend must be marlin, not flashinfer_mxfp4.flashinfer_mxfp4 raises NotImplementedError: requires SM90 or SM100. deep_gemm is
SM100-only as well.
2. SGLang's fused-attention gate must be patched.(mandatory — without it the server dies
at CUDA graph capture)
sglang/srt/layers/attn_residual.py gates K3's fused TMA attention on major >= 10. SM120
reports major 12, so it takes the SM100 fast path and JIT-compiles tcgen05 tensor-memory PTX
the card cannot execute — ptxas fails and you get RuntimeError: ninja exited with status 255.
One line routes it to SGLang's own triton pipeline:
python
1# sglang/srt/layers/attn_residual.py, in _use_fast()2- _FAST_SUPPORTED = major >=103+ _FAST_SUPPORTED = major ==10# SM120 lacks tcgen05; use the triton path
deployment-kit/scripts/patch_sm120.sh does this for you. On B200 / SM100 neither change is needed.
Memory and context
--mem-fraction-static 0.94. After marlin repack the weights occupy ~84 GB of each
96 GB card, leaving ~10 GB. The common 0.85 is already under water before KV is sized and
fails with a negative mamba-cache size. Do not lower it — that makes it worse.
KV pool is ~120,370 tokens. The server accepts --context-length 131072, but the pool is
smaller than the declared window, so one request cannot fill 131k. 32k is the better working
setting and ~37% faster per token.
Concurrency clamps to 9. Requesting more is silently reduced — the hybrid mamba state
cache is the limiter, not KV. Independent of context length.
max_tokens ≥ 32768. Thinking is always on; the answer arrives in content and the chain
of thought in reasoning_content. Small max_tokens returns an empty content with
finish_reason: length — that is not a model fault, it is a budget set too low. At 4096
roughly 2% of completions come back empty; at 16384 the majority of long generations return
reasoning with no answer.
Reserved tokens. The literal string <|kimi_image_placeholder|> appearing in ordinary text
with no image attached returns HTTP 400 More image placeholders than image prompts. — the
model's own remote code counts it as a real placeholder. Escape the pipes in untrusted or
fetched text. Same care for <|open|>, <|close|>, <|sep|>, <|end_of_msg|>.
Integrity. Verify shard count and byte totals after download before attributing a load
failure to the weights.
…with sglang-patch/attn_residual.py bind-mounted over
/sgl-workspace/sglang/python/sglang/srt/layers/attn_residual.py.
OpenAI-compatible: POST /v1/chat/completions, GET /v1/models.
Disclaimer
Refusal behaviour in this checkpoint has been deliberately modified at the weight level. It is not a safety-stock model and must not be deployed, marketed, or evaluated as one.
Capability has been deliberately reduced. 64.3% of routed experts were removed. Encyclopedic and multilingual capability is materially degraded relative to the parent — see Measured behaviour. Do not deploy this outside coding-adjacent work expecting parent-equivalent quality.
No warranty of any kind. Provided "as is", without warranty express or implied, including fitness for a particular purpose. Nothing here guarantees that any given input will be accepted or refused, that any capability is retained, or that any category of output is unreachable.
Measurements describe what was measured. Perplexity, throughput and refusal figures reflect specific harnesses under specific conditions. They are not safety proofs and do not generalise to multimodal, tool-use, long-context or multi-turn adversarial settings. Figures marked preliminary or pending are exactly that.
Modification by a recipient voids this characterization. Blackfrost's obligations attach at the point of release. Any further ablation, fine-tuning, merging, quantization or alteration by a recipient produces an artifact Blackfrost has not evaluated and does not stand behind — responsibility for that artifact transfers entirely to whoever produced it.
Operator-owned policy. Open weights mean the operator sets and enforces policy. Deploy only in controlled environments with access control, independent logging and review. Do not market as "no limits" — this is a refusal-surface-reduced technical model, not a safety-removed system.
Access & licensing
This repository is free and ungated. No request or review is required — it is published openly for the community to evaluate.
Base licence:Kimi K3 — Moonshot AI's terms apply to this derivative and travel with it.
Redistribution: do not redistribute weights outside your grant.
Evaluation recommendation: should not be evaluated by processes that assume refusal behaviour equivalent to the parent.
Ask us about other expert budgets, non-uniform keep sets, or calibration against your own threat model.
