GLM-5.3 is live. Run Z.ai's latest model on Friendli Model APIs. Try it today ➜
Blackfrost-Research
Available on FriendliAI
Run this model inference on single tenant GPU with unmatched speed and reliability at scale.
Run this model inference with full control and performance in your environment.
Model Details
Model Provider
Blackfrost-Research
Model Tree
moonshotai/Kimi-K2.7-Code
Input Modalities
Output Modalities
Supported Functionality
Refusal-heavy base models block legitimate security work — exploit development, malware analysis, offensive tooling, vulnerability research. KIMI-2.7-CODE-BF16-DERISKED is Kimi K2.7 Code with the chat-style refusal surface reduced through a direct weight-space intervention, shipped as a standard full-precision BF16 transformers checkpoint — so it cooperates with technical and dual-use requests the stock model declines, and serves as a clean base for requantization, fine-tuning, and numerical work.
No SFT, DPO, or RLHF was used.
| Model ID | KIMI-2.7-CODE-BF16-DERISKED |
| Architecture | KimiK25ForConditionalGeneration — MoE (DeepseekV3 tower) · thinking model |
| Base | moonshotai/Kimi-K2.7-Code — official, © Moonshot AI |
| Transform | Dequantization (native INT4 → BF16) → refusal-direction intervention (weight level). No post-training. |
| Layers / hidden | 61 layers · hidden 7,168 |
| Precision | BF16 — full-precision transformers safetensors, no quantization_config |
| On-disk | ~1.9 TB · 64 safetensors shards |
| Context window | up to 256K tokens |
| Organization | Blackfrost AI · Terrell A. Lancaster · August 2026 |
Tokenizer (tiktoken.model, tokenization_kimi.py), chat_template.jinja, generation_config.json, the modeling/configuration modules and tool_declaration_ts.py all ship with the weights.
Blackfrost de-risked models deliberately modify refusal behaviour at the weight level so they can support legitimate security-research, red-team and adversarial-testing workflows that a refusal-heavy base model would block.
What it means here: the model will not refuse legitimate technical questions — exploit development, malware analysis, offensive security tooling, vulnerability research and similar dual-use content.
What it does not mean: this is not a "zero-limits" system. A thin residual floor remains by design on a small number of hard social-harm and identity-crime solicitations. That is intentional, not an oversight. This is a refusal-surface reduction, not a capability guarantee. Final behaviour is intended to be governed by the operator's system prompt and serving policy on a self-hosted control plane.
| Base | Official moonshotai/Kimi-K2.7-Code (native INT4) |
| Applied | Faithful dequantization INT4 → BF16 · refusal-direction intervention at the weight level (o_proj + all down_proj residual-write surfaces) |
| Not applied | SFT · DPO · RLHF · distillation · expert pruning · re-quantization |
| Format | HF safetensors · bfloat16 |
Battery R1-HARMFUL-BENCH-450 = 150 AdvBench + 150 StrongREJECT + 150 XSTest, judged by ASCII substring pre-filter over the post-</think> final answer.
| Battery | n | Refusals | Refusal % |
|---|---|---|---|
| R1-HARMFUL-BENCH-450 | 450 | pending | pending |
Results for this checkpoint are being finalized and will be filled in here. Blackfrost does not put an unverified refusal number on a shipped card.
Substring refusal detection is a lower bound on soft-refusal language, not a semantic safety proof.
Risks this model increases — cooperates with dual-use technical content the stock model refuses; open weights mean operator-owned policy. Risks this model bounds — retains a residual refusal floor on hard social-harm and identity-crime solicitations. Residual risks — soft refusal can be brittle under reframe/multi-turn; substring detection is imperfect; multimodal/agentic harm not covered by this evaluation.
compressed-tensors INT4.transformers (trust_remote_code=True) or vLLM on sufficient multi-GPU / multi-node hardware.temperature 1.0, top_p 0.95. Thinking is always on — the answer lands in content, chain-of-thought in reasoning_content; budget max_tokens generously or content returns empty.--tool-call-parser kimi_k2 --reasoning-parser kimi_k2.model.safetensors.index.json before attributing a load failure to the weights.Modified MIT, inherited from moonshotai/Kimi-K2.7-Code. Moonshot's terms apply to this derivative and travel with it, along with any onward derivative you create. LICENSE and THIRD_PARTY_NOTICES.md ship in this repository. Full credit for the base model to Moonshot AI.