GLM-5.3 is live. Run Z.ai's latest model on Friendli Model APIs. Try it today ➜
Blackfrost-Research
Available on FriendliAI
Run this model inference on single tenant GPU with unmatched speed and reliability at scale.
Run this model inference with full control and performance in your environment.
Model Details
Model Provider
Blackfrost-Research
Model Tree
moonshotai/Kimi-K2.7-Code
Input Modalities
Output Modalities
Supported Functionality
Refusal-heavy base models block legitimate security work — exploit development, malware analysis, offensive tooling, vulnerability research. KIMI-2.7-CODE-NVFP4-DERISKED is Kimi K2.7 Code with the chat-style refusal surface reduced through a direct weight-space intervention, then quantized to NVFP4 for efficient single-cluster serving — so it cooperates with technical and dual-use requests the stock model declines.
No SFT, DPO, or RLHF was used.
| Model ID | KIMI-2.7-CODE-NVFP4-DERISKED |
| Architecture | KimiK25ForConditionalGeneration — MoE (DeepseekV3 tower) · thinking model |
| Base | moonshotai/Kimi-K2.7-Code — official, © Moonshot AI |
| Transform | Refusal-direction intervention (weight level) → NVFP4 quantization. No post-training. |
| Layers / hidden | 61 layers · hidden 7,168 |
| Precision | NVFP4 (modelopt, quant_algo: NVFP4, 4-bit, group_size 16) — routed experts quantized; attention, shared experts, router, dense layer 0, norms, embed/lm_head kept BF16 |
| On-disk | ~595 GB · 64 safetensors shards |
| Context window | up to 256K tokens |
| Organization | Blackfrost AI · Terrell A. Lancaster · August 2026 |
Tokenizer (tiktoken.model, tokenization_kimi.py), chat_template.jinja, generation_config.json, the modeling/configuration modules and tool_declaration_ts.py all ship with the weights.
Blackfrost de-risked models deliberately modify refusal behaviour at the weight level so they can support legitimate security-research, red-team and adversarial-testing workflows that a refusal-heavy base model would block.
What it means here: the model will not refuse legitimate technical questions — exploit development, malware analysis, offensive security tooling, vulnerability research and similar dual-use content.
What it does not mean: this is not a "zero-limits" system. A thin residual floor remains by design on a small number of hard social-harm and identity-crime solicitations. That is intentional, not an oversight. This is a refusal-surface reduction, not a capability guarantee. Final behaviour is intended to be governed by the operator's system prompt and serving policy on a self-hosted control plane.
| Base | Official moonshotai/Kimi-K2.7-Code (native INT4) |
| Applied | Refusal-direction intervention (weight level) · NVFP4 quantization of routed experts (modelopt, gs16) |
| Not applied | SFT · DPO · RLHF · distillation · expert pruning |
| Format | HF safetensors · NVFP4 experts + BF16 non-expert |
Protocol: OpenAI-compatible /v1/chat/completions, ASCII substring refusal pre-filter. Battery R1-HARMFUL-BENCH-450 = 150 AdvBench + 150 StrongREJECT + 150 XSTest.
| Battery | n | Refusals | Refusal % |
|---|---|---|---|
| R1-HARMFUL-BENCH-450 | 450 | 1/450 |
The de-risked battery result is being finalized and will be published here. Blackfrost does not put an unverified refusal number on a shipped card — this row is stated only once it has been run under the fixed protocol on this exact NVFP4 checkpoint.
Substring refusal detection is a lower bound on soft-refusal language, not a semantic safety proof.
Risks this model increases — cooperates with dual-use technical content the stock model refuses; open weights mean operator-owned policy. Risks this model bounds — retains a residual refusal floor on hard social-harm and identity-crime solicitations. Residual risks — soft refusal can be brittle under reframe/multi-turn; substring detection is imperfect; multimodal/agentic harm not covered by this evaluation.
--quantization modelopt_fp4. On current builds, force --moe-backend marlin — the auto/TRTLLM NVFP4 MoE path errors and the cutlass path can emit degenerate output on this checkpoint; marlin serves it cleanly.temperature 1.0, top_p 0.95. Thinking is always on — the answer lands in content, chain-of-thought in reasoning_content; budget max_tokens generously or content returns empty.--tool-call-parser kimi_k2 --reasoning-parser kimi_k2.model.safetensors.index.json before attributing a load failure to the weights.bash
hf download Blackfrost-Research/KIMI-2.7-CODE-NVFP4-DERISKED \--local-dir ./KIMI-2.7-CODE-NVFP4-DERISKEDvllm serve ./KIMI-2.7-CODE-NVFP4-DERISKED \--served-model-name KIMI-2.7-CODE-NVFP4-DERISKED \--quantization modelopt_fp4 --moe-backend marlin \--trust-remote-code --tensor-parallel-size 8 \--tool-call-parser kimi_k2 --reasoning-parser kimi_k2 \--host 0.0.0.0 --port 8000
OpenAI-compatible: POST /v1/chat/completions, GET /v1/models.
Modified MIT, inherited from moonshotai/Kimi-K2.7-Code. Moonshot's terms apply to this derivative and travel with it, along with any onward derivative you create. LICENSE and THIRD_PARTY_NOTICES.md ship in this repository. Full credit for the base model to Moonshot AI.