CYBER-FROST-3.8-FP4-Local

A first-party Blackfrost-AI mixed-precision FP4-Local model for security professionals conducting authorized research, assessment, engineering, and response work.

2026-10-17: FP4-Local re-export

This is a fresh FP4-Local re-export of the same final Blackfrost-AI/CYBER-FROST-3.8-BF16 checkpoint that produced CYBER-FROST-3.8-NVFP4-V2. It is not a new training, LoRA, or DWM run, and it is not a replacement for V2 — it is a second storage layout of the same weights.

The difference is the quantization target. NVFP4-V2 quantizes routed language-model experts and leaves everything else in BF16, which lands at 173.56 GiB. FP4-Local follows the NVIDIA Qwen3.8-Flash-Next-FP4-Local recipe: routed experts and the 51B-parameter PLE n-gram table go to NVFP4, attention and shared experts go to MXFP8, MTP experts go to W4A16 NVFP4, and only the remainder stays BF16. That lands at 95.12 GiB across 21 shards — roughly 45% smaller than V2, and small enough to serve on a single 128 GB-class device.

Routed expert scale planes use NVIDIA's compressed-scale format (CSF) rather than raw FP8 E4M3 planes. CSF is a lossless codec — a per-16-row base byte plus packed 4-bit offset codes, with an exception list for out-of-range values — so the decoded scales are bit-identical to the V2 source planes. The codec is why this checkpoint requires a runtime with CSF support; see Deployment.

Release status and contents

Cyber-Frost is a public research release under active quality assessment.

This repository contains a standalone mixed-precision checkpoint derived from Blackfrost-AI/CYBER-FROST-3.8-BF16, plus its weight index, configuration, ModelOpt quantization metadata, tokenizer and processor assets, packaged chat template, and upstream license. It is not an adapter and does not require the BF16 parent checkpoint at load time.

The configuration includes a vision tower, but this release has not received a multimodal quality evaluation. Do not infer validated image or video capability from the presence of processor files.

Why Cyber-Frost exists

Security work is unusually vulnerable to false refusals. The same vocabulary appears in incident response, exploit validation, malware analysis, defensive engineering, and unauthorized activity; a general-purpose assistant can react to individual terms instead of the operator's legitimate scope.

Cyber-Frost is designed to reduce that unnecessary friction in professional, authorized workflows. It is intended to stay technically direct when an analyst is reviewing a finding, reproducing a vulnerability in a controlled environment, writing detection content, analyzing malicious code, or operating an approved security agent. This is a design objective, not a measured refusal claim for this FP4-Local variant, and not a claim that every answer is safe or correct.

Authorization is an external control. The model cannot establish ownership, consent, rules of engagement, jurisdiction, or whether a target is in scope. Deployers must enforce identity, scope, tool permissions, logging, rate limits, and human review outside the model.

Security corpus

The BF16 parent was fine-tuned on a Blackfrost-AI security corpus combining curated security material, operator-authored workflows, realistic engagement-style scenarios, and Blackfrost-owned distillation data. Corpus sizes, source-by-source counts, raw engagement material, client identities, prompts, and responses are intentionally not published.

Domain coverage includes:

• Reconnaissance and OSINT
• Social engineering, business-email compromise, and deepfake-enabled abuse
• Web application and API security
• Identity, authentication, and Active Directory security
• Network, perimeter, VPN, and protocol security
• Vulnerability research, bug bounty, and binary exploitation
• Malware analysis, ransomware, and endpoint defense
• Cloud, container, and Kubernetes security
• Software supply-chain security
• Mobile, IoT, wireless, and physical security
• Industrial-control-system and operational-technology security
• Cryptography and security protocols
• Privilege escalation, lateral movement, and data exfiltration
• Threat intelligence, APT analysis, and purple-team operations
• AI-agent, LLM, and adversarial-ML security

Blackfrost-AI attests that owned portions of the corpus were developed from sanitized experience with authorized security work. It also applies a frontier-scale policy to its distillation teachers, excluding teachers below the 753B-parameter class. The release evidence independently binds one security subset to a Qwen3.8 2.4T teacher; it does not include a corpus-wide teacher manifest. These are therefore operator provenance statements, not independent benchmark findings.

Training-data provenance and licensing review for the mixed-source corpus remains in progress. The FP4-Local conversion added no new fine-tuning data; this section describes the BF16 parent inherited by the quantized artifact.

Model specifications and precision layout

The text stack has 48 blocks with hybrid linear and full attention, using a full-attention block every fourth layer. Its hidden size is 2,560 with 24 attention heads and 2 KV heads. The MoE stack contains 512 routed experts, selects 10 experts per token, and includes a shared expert. One native MTP layer is packaged for speculative decoding.

This is a mixed-precision ModelOpt checkpoint, not an all-tensor four-bit conversion. Each component carries a different on-disk format:

The 73,728 routed expert projection matrices use packed four-bit weights, CSF-compressed block scales, an FP32 outer scale, and an FP32 calibrated input scale. Each expert's gate/up pair shares an FP32 outer scale, inherited from the V2 export's gate/up correction.

Attention and linear-attention state, embeddings, normalization tensors, routers, shared experts, vision components, and the MTP core are excluded from four-bit conversion. KV-cache precision is chosen by the serving runtime and is not encoded in the checkpoint weights.

BLEU-style PLE table note: the PLE n-gram table is the largest single component at roughly 23.8 GiB packed. Runtimes that do not support an NVFP4 PLE table will fail to load this checkpoint — this is the main compatibility break versus both the BF16 and NVFP4-V2 releases.

Lineage

1. Foundational checkpoint: Qwen/Qwen3.8-Flash-Next at immutable revision de4b8e4d43b917e7706784d8bb445c9af86a3540.
2. Blackfrost security adaptation: security-domain fine-tuning followed by a full BF16 merge. The merged internal stage was identified as BLACKFROST-3.8-FLASH-BF16.
3. Behavioral stage: a Blackfrost-AI behaviorally modified derivative targeting lower false-refusal friction in authorized security workflows. The proprietary transformation process is not distributed.
4. BF16 conversion source: the payload now published as Blackfrost-AI/CYBER-FROST-3.8-BF16, at immutable source revision 5321904427c4ef54df8a667edcbc2d1184e4286e.
5. NVFP4 V2 export, 2026-10-02: routed expert projections converted to ModelOpt NVFP4 W4A4 g16 with per-expert shared gate/up global scales. Published as Blackfrost-AI/CYBER-FROST-3.8-NVFP4-V2.
6. FP4-Local re-export, 2026-10-17: routed expert packed weights and outer scales byte-copied from V2; expert scale planes re-encoded to CSF; PLE table, MXFP8 attention/shared experts, and MTP experts freshly encoded from BF16 source; remainder preserved. This repository.

The conversion targets the format of nvidia/Qwen3.8-Flash-Next-FP4-Local and reuses that checkpoint's configuration and index structure as its format reference. It is a conversion reference, not the behavioral or weight lineage of Cyber-Frost. ModelOpt reports version 0.47.0rc0.

Tokenizer and processor lineage comes through the pinned Qwen foundation and BF16 source. The tokenizer, processor, generation configuration, license, and packaged Blackfrost chat template are byte-identical to the current BF16 release assets.

Artifact verification

Validation of this artifact completed on 2026-10-17, with an independent re-verification pass on 2026-10-19. All checks below were re-run against the bytes actually published here.

Structural

• Index and name-set: 375,487 tensors; the name-set and per-shard placement are identical to the NVIDIA FP4-Local reference index.
• Per-shard structure: all 21 headers parse; offsets tile the data region exactly; file size equals 8 + header + data for every shard; the index total_size equals the sum of payloads (95.12 GiB).
• dtypes and shapes: identical to reference for every tensor except nvfp4_csf_exceptions counts (69,376 entries), which are data-dependent by design. The codec is lossless, the loader reads the count from the header, and each (fixed, exceptions) pair reconstructs an exact source scale plane.
• PLE outer scale: byte value equals NVIDIA's constant 3.324236240587197e-05.

Byte-level, re-verified against the live V2 payload

The original conversion read its V2 source from a local directory. Because that directory no longer exists, the 2026-10-19 pass re-fetched V2 bytes over HTTPS range requests and compared them to the shards published here — both sides independent, nothing taken from the conversion run's own receipts.

Every sampled CSF plane decoded to a byte-identical copy of its V2 source plane, including the down_proj planes at [2560, 40] and the gate/up planes at [640, 160].

Runtime

tensorfold-native info reports family Qwen3.8 Flash Next (qwen4_exp), 95.24 GiB, 97.24 GiB memory floor. Serving on a DGX Spark (GB10, 121 GiB unified, driver 580.178.04) loaded all 48 layers in 154–158 s and produced correct output. Measured single-stream decode was 47–53 tok/s at both 16,384 and 262,144 configured context.

The bundled conversion provenance, quality report, and verification receipt record these checks in machine-readable form. They establish export and artifact properties; they are not refusal, capability, or runtime-performance measurements.

No full weight hash sweep was performed. Verification covers the full structural surface plus a targeted byte-level sample of the two largest conversion paths; it is not an exhaustive per-tensor comparison.

Evaluation status

Inherited agentic security evaluation

The October 4–5, 2026 Cyber-Frost Harness evaluation was run against NVFP4-V2. Because this checkpoint carries the same expert weights and the same behavioral stage, those results are the best available estimate for FP4-Local — but they are not a measurement of this artifact. No inference benchmark of the FP4-Local checkpoint against the harness slices has been run.

On the Level-0 hard-12 CyberGym-style slice, the generic OpenHands scaffold scored 1/12; the dynamic Cyber-Frost Harness later produced five verified solves, five valid model misses, and two infrastructure-invalid tasks. Report that as 5/10 valid attempts or a 5/12 verified lower bound, not as a final 12-task percentage. An earlier frozen four-task slice scored 4/4 under an OpenHands-based scaffold.

The generic baseline used 51,939,855 total model tokens; the dynamic harness produced its five verified solves using 22,043,450 tokens, approximately 42.4% of baseline. The two used materially different scaffolds, so this is an intervention comparison, not an apples-to-apples model-only benchmark.

• Source and quick start
• Architecture and trust boundaries
• Full evaluation disclosure
• Publication-safe result records

Quantization accuracy

No reference-free or reference-based accuracy benchmark (GPQA, MMLU, HumanEval, IFEval, CyberMetric, SecBench) has been run against this checkpoint. NVIDIA reports GPQA 91.5% for their FP4-Local conversion of the base model against 92.2% for BF16; that number describes their quantization of Qwen3.8-Flash-Next, not Cyber-Frost's security fine-tune, and should not be read across.

No FP4-Local-specific refusal or over-refusal result is published. Refusal behavior is not a substitute for measuring security competence.

Measured single-device throughput

DGX Spark (GB10, 121 GiB unified), TensorFold 1.1.0, single serve instance, --parallel 1, speculative drafts on, thinking disabled for a clean decode clock. Decode rate excludes prefill/TTFT.

Median 47.2 tok/s, mean 49.2 tok/s, with ±0.2 tok/s spread within a workload. At 262,144 configured context the same suite measured median 47.6 tok/s — decode rate is independent of the configured window, as expected, since the window sizes KV allocation rather than per-token compute. Memory at full window: 73.28 GiB model + 7.79 GiB KV for one stream.

These are narrow development measurements on one device, not production throughput or quality guarantees. Runtime version, prompt length, sampling, context occupancy, cache precision, and MTP acceptance can materially change the result.

Deployment

This checkpoint requires a runtime with all four of: Qwen4ExpForConditionalGeneration support, ModelOpt mixed-precision loading, CSF scale decoding, and NVFP4 PLE table support. Upstream vLLM does not currently provide the latter two.

Validated path, TensorFold 1.1.0 native binary (aarch64 Linux):

./bin/tensorfold-native info /path/to/CYBER-FROST-3.8-FP4-Local

./bin/tensorfold-native serve /path/to/CYBER-FROST-3.8-FP4-Local \
  --host 127.0.0.1 --port 8931 \
  --context 262144 \
  --no-update-check

NVIDIA's documented path is the eugr/spark-vllm-b12x container with --quantization modelopt_mixed --load-format b12x and the VLLM_PLE_TABLE_MEMORY=disk / B12X_DISK_BACKEND=io_uring environment pair. That path has not been validated by Blackfrost-AI for this checkpoint. It is recorded because it is the upstream recipe for this format, not because it was tested here.

Runtime compatibility, kernel selection, memory use, throughput, and output quality are implementation-dependent. Record the runtime version, hardware, context, quantization backend, PLE strategy, speculative settings, chat template, and sampling parameters when reporting results. The clean API model identifier is CYBER-FROST-3.8-FP4-Local, and the Hugging Face repository identifier is Blackfrost-AI/CYBER-FROST-3.8-FP4-Local.

Prompt, tool use, and sampling

The repository includes a Blackfrost chat template that supplies a default operating prompt, supports caller-provided system context, exposes Qwen-style reasoning controls, and serializes tool calls. Its default is thinking enabled; supported reasoning-effort values are xhigh, medium, and low. Generation defaults are temperature 1.0, top-p 0.95, and top-k 20.

The template's authorization assumption is not an access-control mechanism. An agent runtime must independently restrict credentials, targets, files, networks, commands, and approval-requiring actions. Tool-call output is proposed text until an external executor acts on it.

Changing the template, system message, reasoning mode, sampling, quantization backend, or runtime can materially change refusal behavior and output quality. Record those settings when reporting results.

Intended use

Cyber-Frost is intended for qualified security professionals working within explicit authorization, including defensive research, secure code review, vulnerability validation, red-team and purple-team exercises, detection engineering, incident response, malware analysis, bug hunting, and controlled security-agent workflows.

It is not intended to authorize access, choose targets, define rules of engagement, make autonomous high-impact decisions, or replace legal, compliance, and safety review. Do not use it to access systems or data without permission, evade oversight, persist in third-party environments, deploy malware, steal credentials or data, disrupt services, or cause physical harm.

Limitations and security responsibility

• Generated findings, code, commands, indicators, and remediation advice may be wrong, incomplete, outdated, or fabricated. Independently review them and execute only in isolated, authorized environments.
• Reduced over-refusal is a design objective inherited from the BF16 parent, not a measured result for this FP4 artifact. Lower-friction behavior can increase the chance of receiving actionable output in ambiguous or malicious contexts.
• BF16 behavior, safety observations, benchmark results, and runtime characteristics do not automatically transfer through quantization. This checkpoint adds two conversion stages beyond V2 (PLE quantization and MXFP8 attention), neither of which has been accuracy-benchmarked.
• The model is not a policy engine, authorization service, sandbox, malware scanner, or secrets boundary.
• The preserved MTP head is provisional and is not evidence of adaptation to the final trunk.
• Current evidence does not establish an FP4-Local refusal rate, standardized cyber competence, production readiness, long-context quality, or multimodal quality.
• CSF scales are lossless, but the four-bit weight and PLE paths are lossy by construction and were not evaluated for downstream capability impact.
• Model behavior can shift substantially with prompts, sampling, runtime versions, quantization kernels, speculative settings, and agent scaffolding.

The deployer is responsible for authorization, least privilege, isolation, network policy, credential handling, human approval gates, monitoring, incident response, and compliance with applicable law.

License and disclaimer

Use and redistribution of this checkpoint are governed by the Qwen Community License 1.0. Review the license before use. This research release is provided without a warranty of correctness, fitness, security, or non-infringement.

Report reproducible model or packaging issues through the repository's Discussions page without including secrets, client data, live targets, or sensitive exploit details.