Skip to content
Agent NetworkkLLM

Qwen · Text · Dense

Qwen2.5

Instruction-tuned causal language model with Q/K/V biases; sealed under orth or perm.

Official sealed: rolling outorthpermSGLangvLLMMeasured
Upstream on Hugging FaceRequest support for a variant

Commands

Pull, seal and run

kllm pull downloads a library tag into the local store and records the hash of every file. kllm run starts SGLang or vLLM in the background on 127.0.0.1 and opens a chat. kllm create seals a pulled model under a named key.

# Download the library tag into the local store; a manifest records each file's hash
$ kllm pull qwen2.5:7b
# Start SGLang or vLLM in the background on 127.0.0.1 and open a chat
$ kllm run qwen2.5:7b
The engine server exposes an OpenAI-compatible API on 127.0.0.1. Stop it with kllm stop.

Requests to the running server

# The local proxy listens on 127.0.0.1:8001 and tokenizes on your machine
curl http://127.0.0.1:8001/v1/chat/completions \
  -H 'Content-Type: application/json' \
  -d '{"model": "Qwen2.5-1.5B-Instruct-sealed", "messages": [{"role": "user", "content": "Hello"}]}'

Official sealed models

Pre-sealed under model keys

The kLLM team seals selected public models at a pinned revision under the perm transform, locks the weights and publishes them under ANetResearch on Hugging Face. Each model has its own model key, issued to approved applicants. The artifacts are rolling out; a repository is available once it appears in the organization.

Official sealed models of Qwen2.5
RepositoryBase and revisionModalityLicenceTransformClient-keyedStatus
Qwen2.5-7B-Instruct-kllmQwen/Qwen2.5-7B-Instruct@a09a35458cTextApache-2.0permYesRolling out
  • Each repository carries kllm-manifest.json: the base and its revision, the key fingerprint and key version, the kLLM version and the SHA-256 digest of every file.

Check a published model against its public base

With the model key, kllm verify seals the public base again under the same key and transform in a temporary directory and compares the result tensor by tensor, unlocked, together with the tokenizer, every other file and the manifest.

Verify Qwen2.5-7B-Instruct-kllm
$ hf download ANetResearch/Qwen2.5-7B-Instruct-kllm --local-dir Qwen2.5-7B-Instruct-kllm
$ kllm verify Qwen2.5-7B-Instruct-kllm --base Qwen/Qwen2.5-7B-Instruct --revision a09a35458c702b33eeacc393d103063234e8bc28 --key Qwen2.5-7B-Instruct-kllm.key
Under perm, every tensor must be equal to the bit; tensors that sealing rewrites in floating point may differ by one unit in the last place.

Apply for model keysThe catalog in the documentation

Library tags

Tags

Each tag pins an upstream Hugging Face revision, so the same alias downloads the same bytes on every host. Sizes and minimum GPU memory are taken from the kLLM library.

Library tags for Qwen2.5
AliasUpstreamSizeMin. GPU memoryTransformsCopy
qwen2.5:0.5bQwen/Qwen2.5-0.5B-Instruct1.0 GB4 GBorth, perm
qwen2.5:1.5bQwen/Qwen2.5-1.5B-Instruct3.1 GB6 GBorth, perm
qwen2.5:3bQwen/Qwen2.5-3B-Instruct6.2 GB9 GBorth, perm
qwen2.5:7bdefaultQwen/Qwen2.5-7B-Instruct15 GB20 GBorth, perm

Validated variants

Measured variants

Variants that the team has sealed and served, with their measured engines and hardware.

Measured variants of Qwen2.5
VariantTransformsEnginesGPUSealing timeInput and output
Qwen2.5-1.5B-Instructorth, permSGLang 0.5.21 (measured); vLLM not measuredOne A40 48 GB14–20 s (1–2B models)Text in, text out

Measured results

Plain against sealed

Published measurements for this model, each with its conditions. Single runs; they do not generalize beyond the configurations shown.

Qwen2.5-1.5B-Instruct on SGLang 0.5.21, plain against sealed

One NVIDIA A40 48 GB; bf16; random token ids, 1024 input / 128 output tokens; concurrency 1 runs 10 requests, concurrency 16 runs 128; GPU shared with another tenant's light job; single runs, no variance reported. Perplexity over 14690 tokens of the GPL-3, GFDL-1.3 and Apache-2.0 licence texts (tools/ppl.py).

Qwen2.5-1.5B-Instruct on SGLang 0.5.21, plain against sealed
TransformOutput tok/s, concurrency 16PerplexityMean |Δ log-prob|
Plain14431.4067-
perm14461.40670.014
orth14421.40810.021
Table · benchmarks/llm.sh

All published results

Security

What sealing does not hide for this model

  • To an operator who reads GPU memory, user text reduces to a substitution cipher over tokens: 23.8% of tokens were decoded by unigram frequency alone on Qwen3-8B.
  • The sealed weights derive from a public checkpoint. Locked files cannot be matched to it without the key; once unlocked to run, a holder of that checkpoint recovers the transforms and 98.5% of the vocabulary permutation (measured on Qwen3-8B), for unmodified public models and fine-tunes alike.
  • Client-keyed mode keeps the key and the tokenizer on the user's machine. The copy that the cloud serves is unlocked on the user's side (kllm cloud --key), because the cloud computes with the weights. The cloud server (kllm serve --client) binds 0.0.0.0 by default and has no authentication; bind it to 127.0.0.1 or place it behind a gateway.
  • Unless sealed with --no-lock, the weights on disk are locked: encrypted in place with AES-256-CTR under a key derived from the model key. kllm serve --key unlocks them into ~/.cache/kllm/unlocked (KLLM_UNLOCKED_DIR, mode 0700) before the engine starts, so whoever runs the model holds the unlocked weights. Each tensor's largest binary exponent is stored in the clear.
  • Every approved holder of an official model's key holds the same model key, and the team derives it from an offline master key. A model key is not a confidentiality boundary between its holders; for a key known to no one else, seal the model under a private key.
  • Outside a confidential VM, kllm serve --key decrypts the tokenizer into host /dev/shm and offers no protection from the host. It is a development mode.

Security modelMeasured limits in the documentation