DeepSeek V4

# Download the library tag into the local store; a manifest records each file's hash
$ kllm pull deepseek-v4:flash
# Start SGLang or vLLM in the background on 127.0.0.1 and open a chat
$ kllm run deepseek-v4:flash

Requests to the running server

# The local proxy listens on 127.0.0.1:8001 and tokenizes on your machine
curl http://127.0.0.1:8001/v1/chat/completions \
  -H 'Content-Type: application/json' \
  -d '{"model": "DeepSeek-V4-Flash-kllm", "messages": [{"role": "user", "content": "Hello"}]}'

• Each repository carries kllm-manifest.json: the base and its revision, the key fingerprint and key version, the kLLM version and the SHA-256 digest of every file.

Check a published model against its public base

With the model key, kllm verify seals the public base again under the same key and transform in a temporary directory and compares the result tensor by tensor, unlocked, together with the tokenizer, every other file and the manifest.

$ hf download ANetResearch/DeepSeek-V4-Flash-kllm --local-dir DeepSeek-V4-Flash-kllm
$ kllm verify DeepSeek-V4-Flash-kllm --base deepseek-ai/DeepSeek-V4-Flash --revision 60d8d70770c6776ff598c94bb586a859a38244f1 --key DeepSeek-V4-Flash-kllm/kllm.key

Commands for DeepSeek-V4-Flash-kllmThe catalog in the documentation

• To an operator who reads GPU memory, user text reduces to a substitution cipher over tokens: 23.8% of tokens were decoded by unigram frequency alone on Qwen3-8B.
• The sealed weights derive from a public checkpoint. Locked files cannot be matched to it without the key; once unlocked to run, a holder of that checkpoint recovers the transforms and 98.5% of the vocabulary permutation (measured on Qwen3-8B), for unmodified public models and fine-tunes alike.
• Client-keyed mode keeps the key and the tokenizer on the user's machine. The copy that the cloud serves is unlocked on the user's side (kllm cloud --key), because the cloud computes with the weights. The cloud server (kllm serve --client) binds 0.0.0.0 by default and has no authentication; bind it to 127.0.0.1 or place it behind a gateway.
• This architecture or checkpoint format is sealed with the perm transform only.
• Unless sealed with --no-lock, the weights on disk are locked: encrypted in place under a key derived from the model key, with a ChaCha20 key stream (lock v2; lock v1 files, AES-256-CTR, are still read). Packed FP4 weights, E8M0 scales and integer tables are locked as well. kllm serve --key writes no unlocked copy: the engine processes unlock each tensor in GPU memory as they load it. Whoever runs the model therefore holds the unlocked weights in GPU memory. kllm unlock writes an unlocked copy to ~/.cache/kllm/unlocked for launchers that start the engine themselves. Each tensor's largest binary exponent is stored in the clear.
• The key of an official model is the kllm.key file of its gated Hugging Face repository, without a passphrase. Everyone who submits the access form receives the same key, so a model key is not a confidentiality boundary between its holders. A key cannot be revoked for one holder; it is rotated by raising its key version. For a key known to no one else, seal the model under a private key.
• Outside a confidential VM, kllm serve --key decrypts the tokenizer into host /dev/shm and offers no protection from the host. It is a development mode.

Security modelMeasured limits in the documentation