Official sealed model · Text and images to video with audio
MiniMax-H3-FL2VA-kllm
MiniMaxAI/MiniMax-H3 at revision 42ed227ee7, sealed under the perm transform with locked weights. This model is not published.
Heldperm
Status
Held
Held. The MiniMax H3 Community License excludes the EU, the United Kingdom, the Republic of Korea and the United States, which a worldwide Hugging Face repository cannot honor. The model is not published until a licence-compliant form of distribution is available.
Security
What the model key protects
This is a sealed copy of a public model. It demonstrates the workflow and keeps engine logs, request captures and stored payloads free of text; it does not protect the weights from whoever runs the model, because they can be matched to the public base once unlocked.
- The key of an official model is the kllm.key file of its gated Hugging Face repository, without a passphrase. Everyone who submits the access form receives the same key, so a model key is not a confidentiality boundary between its holders. A key cannot be revoked for one holder; it is rotated by raising its key version. For a key known to no one else, seal the model under a private key.
- Unless sealed with --no-lock, the weights on disk are locked: encrypted in place under a key derived from the model key, with a ChaCha20 key stream (lock v2; lock v1 files, AES-256-CTR, are still read). Packed FP4 weights, E8M0 scales and integer tables are locked as well. kllm serve --key writes no unlocked copy: the engine processes unlock each tensor in GPU memory as they load it. Whoever runs the model therefore holds the unlocked weights in GPU memory. kllm unlock writes an unlocked copy to ~/.cache/kllm/unlocked for launchers that start the engine themselves. Each tensor's largest binary exponent is stored in the clear.
- Decoded video and audio are in GPU memory in the clear. Client-keyed mode does not support MiniMax H3.
- The sealed weights derive from a public checkpoint. Locked files cannot be matched to it without the key; once unlocked to run, a holder of that checkpoint recovers the transforms and 98.5% of the vocabulary permutation (measured on Qwen3-8B), for unmodified public models and fine-tunes alike.