KIMI-K3-DERISKED-CODER-REAP-320-MXFP4

Coding-calibrated expert prune of Kimi K3 · 320/896 experts · refusal-direction de-risked · native MXFP4

Built by Blackfrost · Las Vegas, NV

⚠️ EXPERIMENTAL

Bugs have been observed — decode, coherence, and serve edge cases under load. Expect sharp edges. This is not production-polished.

Please report them. Open a Community discussion with GPU SKU, driver, SGLang image/version, full serve flags, prompt, temperature, max_tokens, and failure mode (load-time / empty content / loop / tool parse / OOM). Fixes go faster with real repros.

---

Why this model exists

Full Kimi K3 is a multi-node, multi-terabyte deploy. That puts it out of reach of every team that has one good box and no fabric.

KIMI-K3-DERISKED-CODER-REAP-320-MXFP4 is the same LatentMoE architecture, expert-pruned against measured coding routing load until it fits on 8× RTX 6000 (96 GB class), single node — and de-risked at the weight level against the model's day-zero refusal surface. Not a distill, not a different architecture, not a BF16 remaster — the surviving expert tensors are bit-exact copies of the parent MXFP4 packs.

The single-node footprint is the product; the refusal behaviour change is the contract.

---

Specifications

Architecture	Kimi K3 LatentMoE + KDA
Base	moonshotai/Kimi-K3 — official
Transform	REAP expert prune + router slice · refusal-direction de-risk
Experts kept	320 of 896 routed per MoE layer (a 64.3% cut), uniform across layers 1–92
Precision	Native MXFP4 / compressed-tensors layout — no re-quantization of kept packs
On-disk	~587 GiB (630 GB), ~15 safetensors shards
Context	131,072 declared · 32,768 recommended — see the KV note under Deployment
Serve shape	1× node · 8× RTX 6000 · TP 8 · marlin MoE backend
Status	EXPERIMENTAL · free, ungated

Deployment scripts ship in deployment-kit/.

---

What "DE-RISKED" means

Blackfrost de-risked models deliberately modify refusal behaviour at the weight level so they can support legitimate security-research, red-team, and adversarial-testing workflows that a refusal-heavy base model would block.

The operation reduces the model's day-zero refusal surface while leaving its general capabilities, architecture, and precision intact. Refusal hard floors may remain in residual dimensions — this is a refusal-surface reduction, not a capability guarantee, and not a statement that any input will always be accepted.

De-risked models are intended for controlled environments. They are not the safety-stock variant, and they should not be deployed as one.

---

What "CODER" means

Not a separate coding SFT or DPO with an undisclosed recipe. No post-training was applied at all.

"Coder" means coding-calibrated expert survival under a fixed expert budget:

1. Routing measured under coding load — coding prompts and traces
2. Keep the top 320 / 896 experts per MoE layer by selection frequency
3. Routers sliced to the survivor index set, num_experts → 320
4. Survivor expert tensors copied bit-exact from the parent MXFP4 packs

REAP-320 denotes a uniform keep across MoE layers. It is not non-uniform (NU) pruning — memory and routing behaviour are predictable layer to layer.

---

Responsible use

For security teams

This checkpoint is built for security firms, red teams, and AI-safety labs evaluating model behaviour under adversarial or sensitive-input conditions. It is designed for controlled test environments with independent logging, access review, and deployment guardrails.

For everyone else

Outside its intended surface, this checkpoint is capable of producing content a consumer model might decline — that is the point of the build. The remaining acceptable-use terms and prohibitions are licence obligations, not model behaviour. It is not a safety-stock model and should not be treated as one. Deploy under your own controls, and evaluate against your internal risk model.

---

Lineage

Base	Official moonshotai/Kimi-K3
Applied	REAP expert prune + router slice · refusal-direction de-risk at the weight level
Not applied	Additional SFT/DPO · re-quantization of kept packs
Format	HF safetensors · native MXFP4 / compressed-tensors

On refusal behaviour: this checkpoint's refusal surface has been deliberately reduced at the weight level. It is the Blackfrost class of models described in the parent notes as refusal-modifying. Do not evaluate it or rate-limit it as if it were a safety-stock derivative of its parent.

---

Measured behaviour

It is a coding specialist — know the shape of the trade

Preliminary perplexity, parent Kimi K3 vs this checkpoint, identical harness, identical token counts per probe:

Domain	Parent K3	This checkpoint	Ratio
Python code	1.61	1.68	1.04×
Prose (simple factual)	5.53	6.09	1.10×
Chinese	17.74	23.11	1.30×
Prose (encyclopedic)	2.19	54.79	25×

Full-corpus perplexity on wikitext-2 raw test (23,108 tokens, 12 non-overlapping ~2k windows, scored via SGLang return_logprob): parent 1.49, this checkpoint 17.48.

Code is essentially untouched. Encyclopedic recall is not. That is the expected result of a 64.3% expert cut calibrated on coding routing load — the experts that carried general-corpus recall were not the ones selected for survival. Part of the encyclopedic gap is the parent's memorisation of common corpora rather than reasoning capability.

Use this for coding on one box. If you need general knowledge or strong bilingual capability, use the parent — that is what it is for.

Caveat: the four domain figures come from short probes (13–61 tokens each); the wikitext figure is the solid one. Treat the table as directional until the benchmark suite below is filled in.

Benchmark retention — in progress

Benchmark	Parent Kimi K3	This checkpoint	Retention
pending	—	—	—%

Expert pruning is a capability trade, and a card that claims a 64.3% expert reduction without publishing what it cost is asking the reader to take the trade on faith. We will state the harness, the conditions, and the retention figures — including any benchmark where retention is poor. A de-risked model has an additional obligation: disclose whether refusal behaviour beyond the intended surface was affected.

Throughput, measured

On 8× RTX 6000 (SM120), marlin backend, 32k context:

Single-stream decode	~24.7 tok/s (TPOT 38.8 ms)
Aggregate, saturated	~114 tok/s (at 8 concurrent)
Prefill	~1,880 tok/s
At 131k context	15.7 tok/s single-stream — **37% slower than 32k**

---

Full K3 vs. this checkpoint

	Full Kimi K3	This (DE-RISKED · CODER-REAP)
Routed experts / MoE layer	896	320
Disk (MXFP4 packs)	~1.5 TB	~587 GB
Practical serve shape	multi-node fabric	1× node · 8× RTX 6000
Expert weights	parent packs	bit-exact survivors, no re-quant
Refusal behaviour	safety stock	deliberately de-risked (weight level)
Routing calibration	general	coding load

---

Full-precision and custom builds

This checkpoint trades 64.3% of the routed experts for a single-node footprint, calibrated on coding load. As the measurements above show, that trade is cheap on code and expensive on encyclopedic recall. It is the right artifact for one box; it is not the full model.

Full-precision and custom builds are available for purchase under a separate licence agreement:

Build	What it is
Lossless MXFP4 (full 896 experts)	The complete de-risked checkpoint — every routed expert, bit-exact, no pruning and no requantization
Custom expert budgets	Keep counts other than 320, tuned to your hardware envelope
Non-uniform (NU) keep sets	Per-layer budgets rather than a uniform keep, where routing load justifies it
Your-workload calibration	Expert survival measured against your traffic and threat model rather than generic coding load

Access to these builds is granted on purchase. Their repositories are gated, and approval follows a completed licence agreement — the gate is the transaction. Requesting access to a premium repository without a licence in place will not be approved.

Purchase link coming soon. Until then, @Blackfrost_AI DMs are the fastest route to a human.

---

Deployment notes

⚠️ RTX 6000 / SM120 requires two non-obvious changes

RTX 6000 Blackwell reports compute capability 12.0 (SM120). Two things in the stock K3 serving path assume SM100 (B200) and will fail:

1. MoE backend must be marlin, not flashinfer_mxfp4. flashinfer_mxfp4 raises NotImplementedError: requires SM90 or SM100. deep_gemm is SM100-only as well.

2. SGLang's fused-attention gate must be patched. (mandatory — without it the server dies at CUDA graph capture)

sglang/srt/layers/attn_residual.py gates K3's fused TMA attention on major >= 10. SM120 reports major 12, so it takes the SM100 fast path and JIT-compiles tcgen05 tensor-memory PTX the card cannot execute — ptxas fails and you get RuntimeError: ninja exited with status 255. One line routes it to SGLang's own triton pipeline:

# sglang/srt/layers/attn_residual.py, in _use_fast()
- _FAST_SUPPORTED = major >= 10
+ _FAST_SUPPORTED = major == 10   # SM120 lacks tcgen05; use the triton path

deployment-kit/scripts/patch_sm120.sh does this for you. On B200 / SM100 neither change is needed.

Memory and context

• --mem-fraction-static 0.94. After marlin repack the weights occupy ~84 GB of each 96 GB card, leaving ~10 GB. The common 0.85 is already under water before KV is sized and fails with a negative mamba-cache size. Do not lower it — that makes it worse.
• KV pool is ~120,370 tokens. The server accepts --context-length 131072, but the pool is smaller than the declared window, so one request cannot fill 131k. 32k is the better working setting and ~37% faster per token.
• Concurrency clamps to 9. Requesting more is silently reduced — the hybrid mamba state cache is the limiter, not KV. Independent of context length.

Sampling

• Follow Moonshot's guidance: temperature 1.0, top_p 0.95 for single-step tasks (1.0 agentic), reasoning effort max.
• max_tokens ≥ 32768. Thinking is always on; the answer arrives in content and the chain of thought in reasoning_content. Small max_tokens returns an empty content with finish_reason: length — that is not a model fault, it is a budget set too low. At 4096 roughly 2% of completions come back empty; at 16384 the majority of long generations return reasoning with no answer.
• Reserved tokens. The literal string <|kimi_image_placeholder|> appearing in ordinary text with no image attached returns HTTP 400 More image placeholders than image prompts. — the model's own remote code counts it as a real placeholder. Escape the pipes in untrusted or fetched text. Same care for <|open|>, <|close|>, <|sep|>, <|end_of_msg|>.
• Integrity. Verify shard count and byte totals after download before attributing a load failure to the weights.

Quick serve (SGLang)

hf download BlackfrostAI/KIMI-K3-DERISKED-CODER-REAP-320-MXFP4 \
  --local-dir ./KIMI-K3-DERISKED-CODER-REAP-320-MXFP4

export MODEL_DIR=$PWD/KIMI-K3-DERISKED-CODER-REAP-320-MXFP4
export HOST=0.0.0.0
export PORT=8000
bash deployment-kit/scripts/patch_sm120.sh      # RTX 6000 / SM120 only
bash deployment-kit/scripts/serve_docker.sh
bash deployment-kit/scripts/smoke_chat.sh http://127.0.0.1:8000

Equivalent explicit command:

sglang serve "$MODEL_DIR" \
  --trust-remote-code \
  --served-model-name KIMI-K3-DERISKED-CODER-REAP-320-MXFP4 \
  --tp-size 8 \
  --moe-runner-backend marlin \
  --kv-cache-dtype fp8_e4m3 \
  --mamba-ssm-dtype bfloat16 \
  --mem-fraction-static 0.94 \
  --context-length 32768 \
  --reasoning-parser kimi_k3 \
  --tool-call-parser kimi_k3 \
  --host 0.0.0.0 --port 8000

…with sglang-patch/attn_residual.py bind-mounted over /sgl-workspace/sglang/python/sglang/srt/layers/attn_residual.py.

OpenAI-compatible: POST /v1/chat/completions, GET /v1/models.

---

Disclaimer

Refusal behaviour in this checkpoint has been deliberately modified at the weight level. It is not a safety-stock model and must not be deployed, marketed, or evaluated as one.

Capability has been deliberately reduced. 64.3% of routed experts were removed. Encyclopedic and multilingual capability is materially degraded relative to the parent — see Measured behaviour. Do not deploy this outside coding-adjacent work expecting parent-equivalent quality.

No warranty of any kind. Provided "as is", without warranty express or implied, including fitness for a particular purpose. Nothing here guarantees that any given input will be accepted or refused, that any capability is retained, or that any category of output is unreachable.

Measurements describe what was measured. Perplexity, throughput and refusal figures reflect specific harnesses under specific conditions. They are not safety proofs and do not generalise to multimodal, tool-use, long-context or multi-turn adversarial settings. Figures marked preliminary or pending are exactly that.

Modification by a recipient voids this characterization. Blackfrost's obligations attach at the point of release. Any further ablation, fine-tuning, merging, quantization or alteration by a recipient produces an artifact Blackfrost has not evaluated and does not stand behind — responsibility for that artifact transfers entirely to whoever produced it.

Operator-owned policy. Open weights mean the operator sets and enforces policy. Deploy only in controlled environments with access control, independent logging and review. Do not market as "no limits" — this is a refusal-surface-reduced technical model, not a safety-removed system.

---

Access & licensing

This repository is free and ungated. No request or review is required — it is published openly for the community to evaluate.

• Base licence: Kimi K3 — Moonshot AI's terms apply to this derivative and travel with it.
• Redistribution: do not redistribute weights outside your grant.
• Evaluation recommendation: should not be evaluated by processes that assume refusal behaviour equivalent to the parent.
• Ask us about other expert budgets, non-uniform keep sets, or calibration against your own threat model.

---

Contact Blackfrost

@Blackfrost_AI on X

DMs are open. Fastest route to a human.

Bug reports are better on the Community tab
so other users can see the fix.

Blackfrost · Las Vegas, Nevada
Frontier model engineering

---

KIMI-K3-DERISKED-CODER-REAP-320-MXFP4 · © 2026 Blackfrost Softwares Corp.
@Blackfrost_AI