Skip to content
Agent NetworkkLLM

Official sealed model · Text · 4.1 GB

Qwen3-1.7B-kllm

Qwen/Qwen3-1.7B at revision 70d244cc86, sealed under the perm transform with locked weights. The model key is the repository's kllm.key, a key file without a passphrase; it downloads with the model once the access form is submitted.

PublishedpermClient-keyedGated, automatic approval
Get access on Hugging FaceBase model on Hugging FaceQwen3 in the library

Access

From the access form to an API

The key is distributed through Hugging Face. Everyone who submits the form receives the same key for this model.

  1. 01

    Submit the access form

    Sign in to Hugging Face, open ANetResearch/Qwen3-1.7B-kllm and submit the form. Approval is automatic and immediate.

  2. 02

    Download

    After hf auth login, download the repository. The model key, kllm.key, comes with the files.

    hf download ANetResearch/Qwen3-1.7B-kllm --local-dir Qwen3-1.7B-kllm

  3. 03

    Serve with the key

    kllm serve unlocks each tensor in GPU memory as the engine loads it. No passphrase is asked for, and no unlocked copy is written to disk.

    kllm serve Qwen3-1.7B-kllm --key Qwen3-1.7B-kllm/kllm.key

  4. 04

    Use the endpoint

    The engine exposes an OpenAI-compatible API at http://HOST:8000/v1. In client-keyed mode, the local proxy serves it on 127.0.0.1:8001.

Commands

Install, download, serve and verify

kLLM is installed from source until its first tagged release (Download). The commands below use the key file of the downloaded repository, Qwen3-1.7B-kllm/kllm.key.

# Install from source until the first tagged release; then pip install 'kllm[seal,serve]'
$ git clone https://github.com/ANetResearch/kLLM && cd kLLM && pip install -e '.[seal,serve]'
$ hf auth login  # after submitting the access form
$ hf download ANetResearch/Qwen3-1.7B-kllm --local-dir Qwen3-1.7B-kllm

# With the key, on a machine you trust
$ kllm serve Qwen3-1.7B-kllm --key Qwen3-1.7B-kllm/kllm.key  # or --engine vllm

# Keyless in the cloud: the key and the tokenizer stay with you
$ kllm cloud Qwen3-1.7B-kllm -o Qwen3-1.7B-kllm-cloud --key Qwen3-1.7B-kllm/kllm.key
$ kllm serve Qwen3-1.7B-kllm-cloud --client  # in the cloud
$ kllm client proxy Qwen3-1.7B-kllm --url http://CLOUD:8000 --key Qwen3-1.7B-kllm/kllm.key

# Check the published model against its public base
$ kllm verify Qwen3-1.7B-kllm --base Qwen/Qwen3-1.7B --revision 70d244cc86ccca08cf5af4e1e306ecf908b1ad5e --key Qwen3-1.7B-kllm/kllm.key
The commands of the model card on Hugging Face. kllm cloud leaves kllm.key out of the keyless copy; upload only the -cloud directory.

Security

What the model key protects

This is a sealed copy of a public model. It demonstrates the workflow and keeps engine logs, request captures and stored payloads free of text; it does not protect the weights from whoever runs the model, because they can be matched to the public base once unlocked.

  • The key of an official model is the kllm.key file of its gated Hugging Face repository, without a passphrase. Everyone who submits the access form receives the same key, so a model key is not a confidentiality boundary between its holders. A key cannot be revoked for one holder; it is rotated by raising its key version. For a key known to no one else, seal the model under a private key.
  • Unless sealed with --no-lock, the weights on disk are locked: encrypted in place under a key derived from the model key, with a ChaCha20 key stream (lock v2; lock v1 files, AES-256-CTR, are still read). Packed FP4 weights, E8M0 scales and integer tables are locked as well. kllm serve --key writes no unlocked copy: the engine processes unlock each tensor in GPU memory as they load it. Whoever runs the model therefore holds the unlocked weights in GPU memory. kllm unlock writes an unlocked copy to ~/.cache/kllm/unlocked for launchers that start the engine themselves. Each tensor's largest binary exponent is stored in the clear.
  • To an operator who reads GPU memory, user text reduces to a substitution cipher over tokens: 23.8% of tokens were decoded by unigram frequency alone on Qwen3-8B.
  • The sealed weights derive from a public checkpoint. Locked files cannot be matched to it without the key; once unlocked to run, a holder of that checkpoint recovers the transforms and 98.5% of the vocabulary permutation (measured on Qwen3-8B), for unmodified public models and fine-tunes alike.
  • Client-keyed mode keeps the key and the tokenizer on the user's machine. The copy that the cloud serves is unlocked on the user's side (kllm cloud --key), because the cloud computes with the weights. The cloud server (kllm serve --client) binds 0.0.0.0 by default and has no authentication; bind it to 127.0.0.1 or place it behind a gateway.

Security modelModel keys in the documentation