---
license: apache-2.0
base_model: Qwen/Qwen2.5-0.5B-Instruct
tags:
- gguf
- qwen2.5
- enclave
---

# qwen2.5-0.5b-gguf (Enclave model volume)

Curated model volume for [Enclave](https://enclave.host) confidential inference:
Qwen2.5-0.5B-Instruct at q4_k_m, **bundled with its `tokenizer.json`** so the
volume is self-contained. The upstream GGUF repo ships no tokenizer file, and
Enclave's `llm-chat` app tokenizes in-guest with the HF `tokenizers` crate,
which needs `tokenizer.json` alongside the weights.

Both files are unmodified byte-for-byte copies of their pinned upstream
sources — this repo only co-locates them.

## Provenance

| File | Upstream | Revision | sha256 |
|------|----------|----------|--------|
| `qwen2.5-0.5b-instruct-q4_k_m.gguf` | [Qwen/Qwen2.5-0.5B-Instruct-GGUF](https://huggingface.co/Qwen/Qwen2.5-0.5B-Instruct-GGUF) | `9217f5db79a29953eb74d5343926648285ec7e67` | `74a4da8c9fdbcd15bd1f6d01d621410d31c6fc00986f5eb687824e7b93d7a9db` |
| `tokenizer.json` | [Qwen/Qwen2.5-0.5B-Instruct](https://huggingface.co/Qwen/Qwen2.5-0.5B-Instruct) | `7ae557604adf67be50417f59c2c2f167def9a775` | `c0382117ea329cdf097041132f6d735924b697924d6f6fc3945713e96ce87539` |

`LICENSE` is the Apache-2.0 text as shipped by the upstream GGUF repo at the
same pinned revision.

## Usage on Enclave

Wrapped as a Tinfoil Modelwrap volume (dm-verity; the root hash is part of the
enclave measurement). Deployments attach it by name and the guest reads it at
`/models/<name>`; the host preloads the GGUF as the wasi-nn ggml graph. With
the tokenizer bundled, `llm-chat`'s default `tokenizer.json` lookup works with
no cross-volume configuration.