MiniMax · Video + audio · DiT pipeline
MiniMax H3 FL2VA
Multimodal text-and-image to video-with-audio pipeline, sealed end to end and served on SGLang.
Commands
Pull, seal and run
kllm pull downloads a library tag into the local store and records the hash of every file. Sealing and serving this pipeline use kllm seal and kllm serve.
# Download the library tag into the local store; a manifest records each file's hash
$ kllm pull minimax-h3:fl2va
# Print the local path and metadata
$ kllm show minimax-h3:fl2va
Requests to the running server
# Submit a job to SGLang's video endpoint
curl -s http://127.0.0.1:8000/v1/videos \
-H 'Content-Type: application/json' \
-d '{"prompt": "A red fox trots through fresh snow", "seed": 7, "task": "t2va", "conditions": [],
"target": {"short_edge": 768, "aspect_ratio": "16:9", "duration_seconds": 4.0}}'
# Poll until "status" is "completed", then download the video
curl -s http://127.0.0.1:8000/v1/videos/JOB_ID
curl -s http://127.0.0.1:8000/v1/videos/JOB_ID/content -o fox.mp4
Official sealed models
Official sealed model held
The kLLM team seals selected public models at a pinned revision under the perm transform, locks the weights and publishes them under ANetResearch on Hugging Face. Each model has its own model key, issued to approved applicants. The artifacts are rolling out; a repository is available once it appears in the organization.
| Repository | Base and revision | Modality | Licence | Transform | Client-keyed | Status |
|---|---|---|---|---|---|---|
| MiniMax-H3-FL2VA-kllm | MiniMaxAI/MiniMax-H3/FL2VA@42ed227ee7 | Text and images to video with audio | MiniMax H3 Community License | perm | No | Held |
- Each repository carries kllm-manifest.json: the base and its revision, the key fingerprint and key version, the kLLM version and the SHA-256 digest of every file.
- MiniMax-H3-FL2VA-kllm: Held. The MiniMax H3 Community License excludes the EU, the United Kingdom, the Republic of Korea and the United States, which a worldwide Hugging Face repository cannot honor. The model is not published until a licence-compliant form of distribution is available.
Library tags
Tags
Each tag pins an upstream Hugging Face revision, so the same alias downloads the same bytes on every host. Sizes and minimum GPU memory are taken from the kLLM library.
| Alias | Upstream | Size | Min. GPU memory | Transforms | Copy |
|---|---|---|---|---|---|
| minimax-h3:fl2vadefault | MiniMaxAI/MiniMax-H3/FL2VA | 144 GB | 163 GB | perm, orth |
Validated variants
Measured variants
Variants that the team has sealed and served, with their measured engines and hardware.
| Variant | Transforms | Engines | GPU | Sealing time | Input and output |
|---|---|---|---|---|---|
| MiniMax-H3 FL2VA | perm (recommended), orth | SGLang 0.5.21 (sglang serve --model-variant fl2va); vLLM not supported | One A40 48 GB with layer-wise offload | About 15 min on one A40 | Text and images in; video with audio out |
Measured results
Plain against sealed
Published measurements for this model, each with its conditions. Single runs; they do not generalize beyond the configurations shown.
End to end, plain against sealed (perm)
768p, 4 s, seed 7, one A40 48 GB per run with layer-wise offload, SGLang 0.5.21. Each pair ran at the same time on two GPUs of the same host; the two 49-step runs differ in what else the host was doing. Denoising took 24.80 s and 24.91 s per step.
| Steps | Plain (s) | Sealed perm (s) |
|---|---|---|
| 49 | 1287 / 1507 | 1262 / 1512 |
| 8 | 220.4 | 220.4 |
| 2 | 110.3 | 110.3 |
Drift of final latents against plain (relative L2 error, video / audio)
Same noise. The reference row swaps plain H3's attention from FlashAttention to PyTorch SDPA, a mathematically identical change.
| Run | After 1 step | After 7 steps | After 48 steps |
|---|---|---|---|
| Plain with SDPA instead of FlashAttention | 1.7% / 2.5% | 20.3% / 13.6% | 45.8% / 19.9% |
| Sealed perm (latents mapped back) | 1.5% / 2.5% | 16.4% / 10.8% | 42.8% / 10.8% |
| Sealed orth | 1.8% / 6.9% | 30.7% / 47.1% | Not run |
Optional INT8 DiT kernels (kllm serve --int8) reduced seconds per denoising step from 24.56 to 18.38 (-25%) on one A40. This is a kernel optimization separate from sealing, with measured numerical drift; only the attention part is verified to commute with perm.
Security
What sealing does not hide for this model
- Decoded video and audio are in GPU memory in the clear. Client-keyed mode does not support MiniMax H3.
- The sealed weights derive from a public checkpoint. Locked files cannot be matched to it without the key; once unlocked to run, a holder of that checkpoint recovers the transforms and 98.5% of the vocabulary permutation (measured on Qwen3-8B), for unmodified public models and fine-tunes alike.
- Unless sealed with --no-lock, the weights on disk are locked: encrypted in place with AES-256-CTR under a key derived from the model key. kllm serve --key unlocks them into ~/.cache/kllm/unlocked (KLLM_UNLOCKED_DIR, mode 0700) before the engine starts, so whoever runs the model holds the unlocked weights. Each tensor's largest binary exponent is stored in the clear.
- Every approved holder of an official model's key holds the same model key, and the team derives it from an offline master key. A model key is not a confidentiality boundary between its holders; for a key known to no one else, seal the model under a private key.
- Outside a confidential VM, kllm serve --key decrypts the tokenizer into host /dev/shm and offers no protection from the host. It is a development mode.