Skip to content
Agent NetworkkLLM

Official sealed model · Text to image · 32.9 GB

Z-Image-Turbo-kllm

Tongyi-MAI/Z-Image-Turbo at revision f332072aa7, sealed under the perm transform with locked weights. The model key is the repository's kllm.key, a key file without a passphrase; it downloads with the model once the access form is submitted.

PublishedpermClient-keyedGated, automatic approval
Get access on Hugging FaceBase model on Hugging FaceZ-Image in the library

Access

From the access form to an API

The key is distributed through Hugging Face. Everyone who submits the form receives the same key for this model.

  1. 01

    Submit the access form

    Sign in to Hugging Face, open ANetResearch/Z-Image-Turbo-kllm and submit the form. Approval is automatic and immediate.

  2. 02

    Download

    After hf auth login, download the repository. The model key, kllm.key, comes with the files.

    hf download ANetResearch/Z-Image-Turbo-kllm --local-dir Z-Image-Turbo-kllm

  3. 03

    Serve

    kllm cloud writes the keyless copy for the GPU host; kllm client generate sends prompts and decodes the encrypted result on the local machine.

    kllm cloud Z-Image-Turbo-kllm -o Z-Image-Turbo-kllm-cloud --key Z-Image-Turbo-kllm/kllm.key

  4. 04

    Generate

    Each response is encrypted to a one-off X25519 key of the request and decoded on the local machine.

Commands

Install, download, serve and verify

kLLM is installed from source until its first tagged release (Download). The commands below use the key file of the downloaded repository, Z-Image-Turbo-kllm/kllm.key.

# Install from source until the first tagged release; then pip install 'kllm[seal,serve]'
$ git clone https://github.com/ANetResearch/kLLM && cd kLLM && pip install -e '.[seal,serve]'
$ hf auth login  # after submitting the access form
$ hf download ANetResearch/Z-Image-Turbo-kllm --local-dir Z-Image-Turbo-kllm

# Keyless in the cloud: the key and the tokenizer stay with you
$ kllm cloud Z-Image-Turbo-kllm -o Z-Image-Turbo-kllm-cloud --key Z-Image-Turbo-kllm/kllm.key
$ kllm serve Z-Image-Turbo-kllm-cloud --client --port 30010  # in the cloud
$ kllm client generate Z-Image-Turbo-kllm "A red fox in fresh snow" --url http://CLOUD:30010 --key Z-Image-Turbo-kllm/kllm.key -o fox.png

# Check the published model against its public base
$ kllm verify Z-Image-Turbo-kllm --base Tongyi-MAI/Z-Image-Turbo --revision f332072aa78be7aecdf3ee76d5c247082da564a6 --key Z-Image-Turbo-kllm/kllm.key
The commands of the model card on Hugging Face. kllm cloud leaves kllm.key out of the keyless copy; upload only the -cloud directory.

Security

What the model key protects

This is a sealed copy of a public model. It demonstrates the workflow and keeps engine logs, request captures and stored payloads free of text; it does not protect the weights from whoever runs the model, because they can be matched to the public base once unlocked.

  • The key of an official model is the kllm.key file of its gated Hugging Face repository, without a passphrase. Everyone who submits the access form receives the same key, so a model key is not a confidentiality boundary between its holders. A key cannot be revoked for one holder; it is rotated by raising its key version. For a key known to no one else, seal the model under a private key.
  • Unless sealed with --no-lock, the weights on disk are locked: encrypted in place under a key derived from the model key, with a ChaCha20 key stream (lock v2; lock v1 files, AES-256-CTR, are still read). Packed FP4 weights, E8M0 scales and integer tables are locked as well. kllm serve --key writes no unlocked copy: the engine processes unlock each tensor in GPU memory as they load it. Whoever runs the model therefore holds the unlocked weights in GPU memory. kllm unlock writes an unlocked copy to ~/.cache/kllm/unlocked for launchers that start the engine themselves. Each tensor's largest binary exponent is stored in the clear.
  • In client-keyed mode, latents in GPU memory show the image (a principal component analysis recovers a thumbnail without the key); the response is encrypted to a one-off X25519 key. Only five DiT tensors are re-based, so the DiT's activations are not hidden.
  • The sealed weights derive from a public checkpoint. Locked files cannot be matched to it without the key; once unlocked to run, a holder of that checkpoint recovers the transforms and 98.5% of the vocabulary permutation (measured on Qwen3-8B), for unmodified public models and fine-tunes alike.
  • Client-keyed mode keeps the key and the tokenizer on the user's machine. The copy that the cloud serves is unlocked on the user's side (kllm cloud --key), because the cloud computes with the weights. The cloud server (kllm serve --client) binds 0.0.0.0 by default and has no authentication; bind it to 127.0.0.1 or place it behind a gateway.

Security modelModel keys in the documentation