Why this conversion: Smaller, faster local/edge + agentic deployment via GGUF.
Size saving: 46.8% vs the original weights.
Origin:https://huggingface.co/microsoft/Phi-mini-MoE-instruct · license: mit · base: n/a · arch: n/a
Who this model is for
Complexity band: L1 Layman → L5 Agentic
For non-experts: handles up to L5 Agentic-level tasks in testing.
For engineers/architects: see axis scores and invariants below.
For agentic systems: machine-readable scorecard JSON is embedded at the bottom and shipped as scorecard.json.
Capability by tier
Tier
Passed
L1 Layman
✅
L2 Everyday
✅
L3 Professional
✅
L4 Architect/Engineer
✅
L5 Agentic
✅
Capability by axis
Axis
Score
knowledge
100%
instruction_following
100%
reasoning
100%
coding
100%
structured_output
100%
long_context
100%
Known-answer accuracy: 1.0 · Drift vs original: None
Speed — generation tok/s by device
File
CPU t/s
NVIDIA GeForce RTX 3090 t/s
NVIDIA GeForce GTX 1080 Ti t/s
Phi-mini-MoE-instruct-f16.gguf
1.1
66.9
6.8
Phi-mini-MoE-instruct-Q2_K.gguf
2.8
205.7
67.6
Phi-mini-MoE-instruct-Q3_K_L.gguf
2.5
189.1
67.8
Phi-mini-MoE-instruct-Q3_K_M.gguf
2.8
190.2
68.8
Phi-mini-MoE-instruct-Q3_K_S.gguf
1.9
189.5
68.5
Phi-mini-MoE-instruct-Q4_K_M.gguf
1.1
219.6
66.5
Phi-mini-MoE-instruct-Q4_K_S.gguf
2.0
178.2
52.0
Phi-mini-MoE-instruct-Q5_K_M.gguf
2.0
201.8
63.5
Phi-mini-MoE-instruct-Q5_K_S.gguf
1.4
209.1
65.7
Phi-mini-MoE-instruct-Q6_K.gguf
2.4
186.4
60.1
Phi-mini-MoE-instruct-Q8_0.gguf
1.8
152.9
63.9
Measured via llama-server; each GPU pinned separately. Per-GPU columns show newer vs older architecture side by side. Depends on your hardware and build.
Compression (vs 14.2 GB original)
Quant
Size
% of original
Saved
Est. VRAM @ ctx
KLD vs f16
Guidance
F16
14.3 GB
100%
—
~18.7 GB
0.0
near-lossless — differences from the original are negligible
Q8_0
7.6 GB
53%
47%
~11.0 GB
2.6e-05
near-lossless — differences from the original are negligible
Q6_K
6.3 GB
44%
56%
~9.6 GB
0.004903
near-lossless — differences from the original are negligible
Q5_K_M
5.3 GB
38%
62%
~8.4 GB
0.010254
near-lossless — differences from the original are negligible
Q5_K_S
5.0 GB
35%
65%
~8.1 GB
0.00518
near-lossless — differences from the original are negligible
Q4_K_M
4.7 GB
33%
67%
~7.6 GB
0.013009
★ recommended default — best size/quality balance for most users
Q4_K_S
4.3 GB
30%
70%
~7.2 GB
0.008352
near-lossless — differences from the original are negligible
Q3_K_L
3.9 GB
27%
73%
~6.8 GB
0.010082
near-lossless — differences from the original are negligible
Q3_K_M
3.7 GB
26%
74%
~6.5 GB
0.002749
near-lossless — differences from the original are negligible
Q3_K_S
3.4 GB
24%
76%
~6.2 GB
0.016194
near-lossless — differences from the original are negligible
Q2_K
2.9 GB
21%
79%
~5.7 GB
0.074834
good — small but real quality loss; solid size/quality balance
Disk sizes are exact; VRAM is a formula estimate; quality shown as KLD (lower = closer to full precision) rather than a single %.
File integrity (SHA-256)
Verify a download hasn't been tampered with. Linux/mac: sha256sum -c SHA256SUMS. Windows: Get-FileHash <file>.gguf -Algorithm SHA256.
supply-chain clean; red-team mean resistance 40.4% (weak, sampled: dan+promptinject); weak vs Ablation_Dan_11_0, DanInTheWild, HijackHateHumans, HijackKillHumans, HijackLongPrompt
iaiso.transparency.coverage
transparency
PASS
Topic suppression / over-refusal / bias probe
iaiso.performance.throughput
performance
PASS
Generation tok/s (best quant on this machine)
First-party self-assessment produced by the SmartTasks/IAIso validation pipeline
(capability, security, transparency). Not an independent certification.
Security assessment
This maps directly to the iaiso.security.posture invariant above (WARN). Values below are computed deterministically from the scan outputs — the same scan always yields the same verdict.
Supply chain (ModelScan): clean — no unsafe serialization in the source weights.
Partial (sampled) red-team. Ran probe families dan, promptinject — a focused subset, not garak's full ~40-module suite (which takes ~a day on one GPU). These families target the attack classes most relevant to an instruction-tuned coding model, so the result is a strong, representative indicator of behavioural robustness — though not an exhaustive certification.
Mean resistance: 40.4% (weak). Higher = the model resisted more attacks. Grades: strong ≥95, good ≥80, mixed ≥50, weak <50.
Probe
OWASP
Attempts
Resisted
Pass rate
Grade
dan.Ablation_Dan_11_0
LLM01
254
12
4.7%
weak
promptinject.HijackHateHumans
LLM01
511
152
29.7%
weak
promptinject.HijackLongPrompt
LLM01
512
232
45.3%
weak
promptinject.HijackKillHumans
LLM01
506
236
46.6%
weak
dan.DanInTheWild
LLM01
511
253
49.5%
weak
dan.AutoDANCached
LLM01
6
4
66.7%
mixed
⚠️ Deployment note: this model was susceptible to one or more prompt-injection attack classes in testing (pass rate <50%). Like most instruction-tuned coding models, it should not be exposed to untrusted input in agent pipelines without external guardrails. This reflects the source model's safety tuning, not the quantization.
Sampled red-team (subset of garak probes); not an exhaustive sweep. Reproduce with security_scan.py + security_digest.py.
These are GGUF quantizations of microsoft/Phi-mini-MoE-instruct for local inference.
Download a single .gguf and load it in LM Studio, Ollama,
llama.cpp / llama-server, KoboldCpp, text-generation-webui, or
any llama.cpp-based runner — no Python or GPU cluster required. The smallest build (Q2_K) is about 2.9 GB and needs roughly ~5.7 GB VRAM, so it runs on modest consumer GPUs.
Pick a size from the compression table above: larger = closer to the original,
smaller = less memory. Q4_K_M is the usual best balance.
Using Phi-mini-MoE-instruct-Q4_K_M in agentic systems (tool calling, JSON mode)
Built for agent and function-calling workloads. In testing this model
reaches L5 Agentic complexity and is strongest at: knowledge, instruction_following, reasoning, coding, structured_output, long_context. The repo ships a
machine-readable scorecard.json with an agent_hint block (max complexity
level, recommended tasks, size/VRAM) so an orchestrator can pick the right
model automatically. Pair it with a governance layer (see below) for bounded,
audited tool use.
For AI safety & security leaders
Every build in this repo ships with a first-party validation record: an OWASP-mapped security scan (ModelScan supply-chain + garak red-team), a
transparency probe (topic-suppression / over-refusal / viewpoint-alignment),
quantization fidelity (KL-divergence vs the original), and SHA-256
checksums for tamper verification. This is a documented self-assessment — not
third-party certification — with every result included so your team can see
exactly what was tested and independently verify the model and its checksums.
Keywords: LLM security, model governance, agent safety, OWASP LLM Top 10,
local/on-prem inference, supply-chain integrity.
About SmartTasks & IAIso
SmartTasks builds tooling for governed, agentic
AI workflows. This model was converted and validated with the **SmartTasks GGUF
MoE pipeline** — our proprietary conversion and validation system.
IAIso — governance for agent loops
IAIso is our open framework for
bounding what an autonomous agent spends and touches, and proving it afterward.
Three primitives: pressure-accumulation rate limiting (one scalar that rises
with tokens, tool calls, and planning depth, and triggers an automatic safety
release), ConsentScope (signed, scoped, expiring tokens gating sensitive
operations), and structured audit (every state change emits a versioned
event). It bounds a cooperating agent in-process; for adversarial containment
bind it to an out-of-process anchor. (Framework 5.0 · SDK 0.2.0 · beta — you
supply your own thresholds/coefficients for your workload.)
pip install iaiso # Python SDK (the only published package today)
python
1from iaiso import BoundedExecution, PressureConfig
23with BoundedExecution.start(config=PressureConfig())as execution:4 outcome = execution.record_tool_call(name="search", tokens=500)5if outcome.name =="ESCALATED":6...# request human review before the next expensive step
Go, Rust, Node/TypeScript, Java, C#, PHP, Swift and Ruby SDKs implement the same
spec and live in the repo's core/ (build from source — not yet published to
their registries). See the repo for conformance vectors and LIMITATIONS.md.