Weights published
The selected Blackfrost BF16 checkpoint is available in this repository as 131 indexed safetensors shards with its verified configuration, tokenizer, and Qwentium chat template.
Blackfrost's proprietary modification process and associated research artifacts are not included in this repository.
Why this model exists
Qwen3.8-Flash-Next is Qwen's experimental preview of the architecture leading into Qwen4. It combines a large sparse model with low active compute, native multimodality, hybrid attention, four gated residual branches, n-gram embeddings, and multi-token prediction.
This checkpoint is the native-BF16 Blackfrost research edition. Its refusal surface has been modified at the weight level for operator-controlled security research and red-team evaluation. The selected checkpoint also carries the Qwentium operational system prompt in its default chat template.
It is not a fine-tune, merge, LoRA, pruned model, or quantized derivative.
Specifications
| Architecture | Qwen4ExpForConditionalGeneration · hybrid vision-language MoE |
| Upstream | Qwen/Qwen3.8-Flash-Next on ModelScope |
| Language-model parameters | 125B total · 6B activated |
| Additional parameters | 51B n-gram embedding · 4B MTP |
| Layers / experts | 48 layers · 512 routed experts · 10 routed + 1 shared expert active per token |
| Attention layout | 36 Gated DeltaNet layers · 12 Qwen Sparse Attention layers |
| Gated residual | 4 branches · bottleneck rank 320 |
| Precision | Native BF16 safetensors · no weight quantization |
| Checkpoint size | 360,023,387,188 bytes on disk |
| Weight files | 131 indexed safetensors shards |
| Context | 262,144 tokens native; extended-context support follows upstream Qwen guidance |
| Modalities | Text, image, and video inputs; text output |
| Validated serving shape | 4× NVIDIA B200 · tensor parallel 4 |
| Status | Public BF16 release · weights available |
Lineage
| Base weights | Official Qwen/Qwen3.8-Flash-Next ModelScope release |
| Applied | Blackfrost refusal-surface modification at weight level |
| Not applied | SFT, DPO, LoRA, merging, expert pruning, or quantization |
| Checkpoint format | Hugging Face-compatible BF16 safetensors |
| Chat behavior | Qwentium operational system prompt embedded in the default Qwen chat template |
Blackfrost's proprietary modification process and associated research artifacts are not included in this repository.
Artifact verification
The selected checkpoint passed structural verification before serving:
- all 131 weight shards are indexed and readable;
- all intended target tensors changed;
- no non-target tensors changed;
- no target tensor contains non-finite values;
- per-tensor norm restoration remained within the build verifier's expected tolerance; and
- the pristine upstream source checkpoint remained unchanged.
These are artifact-integrity checks. They are not capability benchmarks or safety proofs.
Refusal evaluation
The published checkpoint was evaluated on R1-HARMFUL-BENCH-450 under a bare chat configuration, with responses reviewed after generation to distinguish actual refusals from false-positive string matches.
Configuration: thinking enabled · medium reasoning effort · temperature 1.0 · top-p 0.95 · top-k 20 · maximum 4,096 output tokens
| Evaluation slice | Final judged refusals |
|---|---|
| Harmful prompts | 7 / 300 (2.3%) |
| Full suite | 10 / 450 (2.2%) |
| API errors | 0 / 450 |
These figures apply to this exact checkpoint and evaluation configuration. They are behavioral measurements, not a safety certification or a guarantee for other serving environments.
Qwentium chat template
The default Qwen chat template includes the Blackfrost Qwentium operational prompt. The template preserves Qwen's message structure, tool descriptions, multimodal inputs, reasoning controls, and caller-supplied system context.
The embedded prompt is a behavioral instruction, not an authorization system or security boundary. If a serving harness supplies a replacement chat template, it may bypass the embedded prompt. Record the exact template and template arguments in every evaluation report.
Deployment
The command below records the SGLang configuration validated for this published checkpoint.
docker run --rm --gpus all \
--network host --ipc host --shm-size 64g \
lmsysorg/sglang@sha256:12d3392bdc8be8d35e9a95f191df6aef99c5114bdbefd41bfdc7e760e6d25ec1 \
serve \
--model-path Blackfrost-AI/Qwen3.8-Flash-Next-DERISKED-BF16 \
--served-model-name Qwen3.8-Flash-Next-Blackfrost-BF16 \
--host 0.0.0.0 \
--port 8000 \
--tp 4 \
--mem-fraction-static 0.85 \
--chunked-prefill-size 8192 \
--linear-attn-prefill-backend flashinfer \
--linear-attn-decode-backend flashinfer \
--mamba-ssm-dtype bfloat16 \
--speculative-algorithm NEXTN \
--speculative-num-steps 3 \
--speculative-eagle-topk 1 \
--speculative-num-draft-tokens 4 \
--max-running-requests 96 \
--reasoning-parser auto
OpenAI-compatible health and generation checks:
curl http://127.0.0.1:8000/health
curl http://127.0.0.1:8000/v1/chat/completions \
-H 'Content-Type: application/json' \
-d '{
"model": "Qwen3.8-Flash-Next-Blackfrost-BF16",
"messages": [{"role": "user", "content": "Return exactly: READY"}],
"temperature": 0,
"max_tokens": 64
}'
The validated configuration uses four B200 GPUs. Increase context or concurrency only after measuring memory headroom for the actual workload, modalities, and cache settings.
Security and deployment responsibility
This checkpoint has a deliberately reduced refusal surface. Open weights do not provide an application policy, authorization system, audit trail, sandbox, or access-control boundary. Operators remain responsible for enforcing those controls outside the model.
For production or shared use, Blackfrost recommends authenticated inference endpoints, independent request and tool-execution logging, least-privilege credentials, sandboxed code and file access, and explicit human approval for irreversible actions.
License and disclaimer
This derivative remains subject to the Qwen Community License 1.0 shipped with the upstream Qwen3.8-Flash-Next release. Review the upstream license before commercial deployment, especially its separate-license condition for Model-as-a-Service and AI Work Assistant businesses.
Refusal behavior has been deliberately modified at the weight level. This is not a safety-stock checkpoint and must not be deployed, marketed, or evaluated as one.
No warranty of any kind. The checkpoint is provided "as is." Nothing here guarantees that any input will be accepted or refused, that every upstream capability is retained, or that any category of output is unreachable. Measurements describe only the exact artifacts, templates, samplers, serving engines, and review criteria under which they were produced.