Sakura — FLUX.3 Image Klein text encoder, uncensored (GGUF)

Only the text encoder is uncensored. This repository contains an abliterated version of the Qwen3-VL-4B-Instruct text encoder that FLUX.3 Image Klein uses to read the prompt. It contains no image model: use it with the image model files of Sakura-FLUX.3-Image-Klein-GGUF, which we did not change (and which are not uncensored). The encoder is a modified Qwen3-VL-4B-Instruct under Apache-2.0 (LICENSE-Apache-2.0.txt, see NOTICE). Independent work, not made or endorsed by Alibaba/Qwen or Black Forest Labs. For adults only; you are responsible for what you generate and for the laws and licenses that apply to you. The image model is under the FLUX Kommunity License (see its repository).

Sample generations

Image model Q8_0 from Sakura-FLUX.3-Image-Klein-GGUF and this repository's uncensored text encoder, ComfyUI 0.41.1 with ComfyUI-GGUF (Radeon 8060S), 1024x1024, 16 steps, CFG 1.0, euler/simple. These are the same nine prompts and seeds (1202, 1302, 1305, 1306, 1105, 1103, 1503, 1506, 1406 in the order shown) as in the repositories Sakura-Qwen-Image-2.1-Turbo-Uncensored-GGUF and Sakura-Iris-3B-Uncensored-GGUF, so that the models can be compared. One seed per prompt, no re-rolls, all nine images are shown; the prompts were chosen for those repositories from a larger set, not for FLUX. The prompts are the captions of the images above. The same prompts and seeds with the official encoder are in the main repository; against those images (same image model, same seeds) the PSNR is 33.4 dB mean / 26.1 dB min over 9 prompts. The FLUX images were made with ComfyUI, the Qwen and Iris images with stable-diffusion.cpp, and models, steps and samplers differ.

The prompts are neutral. These images say nothing about what the edited encoder changes for restricted content; they only show that ordinary prompts still work. No sample images of restricted content are included.

What to expect

This repository changes only the text encoder. The abliteration removes the refusal behaviour of the language model; it does not teach the image model anything, and the image model is not changed. With neutral prompts the images are very similar to those of the official encoder (PSNR 33.4 dB mean / 26.1 dB min over 9 prompts, same image model, same seeds). We have not measured the effect on restricted content. If the image model cannot draw something, a different text encoder will not change that.

What you need to run it

The text encoder is in this repository; the image model and the VAE are in the main repository. Pick the column of the program you use (🟦 stable-diffusion.cpp, 🟧 ComfyUI):

sd-cli --diffusion-model Sakura-FLUX.3-Image-Klein-Q8_0-5.58GiB.gguf --llm Sakura-TextEncoder-Qwen3VL-4B-Uncensored-Q8_0-3.99GiB.gguf --vae flux2-vae.safetensors -p "your prompt" --cfg-scale 1.0 --steps 16 --sampling-method euler -W 1024 -H 1024 -o out.png

ComfyUI: put the encoder (.safetensors) into ComfyUI/models/text_encoders/, the image model and VAE of the main repository into diffusion_models/ and vae/, install ComfyUI-GGUF, and drag Sakura-FLUX.3-Image-Klein_ComfyUI_workflow_api.json into ComfyUI (sampler euler, scheduler simple, 16 steps, CFG 1.0, 1024x1024, seed 42: exactly what we tested).

Two workflows are included, both set to the settings we tested: Sakura-FLUX.3-Image-Klein_ComfyUI_workflow_api.json loads the image model as GGUF (file from the main repository, needs ComfyUI-GGUF) and Sakura-FLUX.3-Image-Klein_ComfyUI_workflow_api_safetensors.json uses the standard UNET Loader for the official FLUX.3 Klein diffusion model in safetensors format (pick your file in the loader node; we tested the GGUF files, not the safetensors file with this workflow). In both, the image model and the VAE are not in this repository; the node titles say where each file comes from.

Time per image (1024x1024, 16 steps, Radeon 8060S, nothing else running on the GPU, Q8_0 image model, official text encoder): ComfyUI 40.2 s once the models are loaded (50.2 s for the first image including loading); stable-diffusion.cpp 91.4 s per image as a one-shot sd-cli run including model loading. For comparison the BF16 image model took 36.2 s per image in ComfyUI: the GGUF files are smaller but not faster here, we did not investigate why.

What is "uncensored" here, exactly

What we did not measure: how much the edited encoder changes the images for restricted content. The refusal numbers describe the encoder used as a chat model; in this pipeline it only supplies embeddings.

Text encoder: refusals

Our own measurement with the encoder as a chat model (104 prompts of the test split of mlabonne/harmful_behaviors, plain chat, thinking off, temperature 0, 300 tokens, llama-server b11594, Q8_0 files unless noted; the first 100 of the 104 are the evaluation prompts the edit was optimized against, so they are not held out; strict = English refusal phrases, markers = a broader keyword list):

Quantization loss of our encoder files (KL divergence against our Q8_0, llama-perplexity b11594, 20 chunks of 2048 tokens of English and web text):

Files

The columns say what we actually ran with that file: 🟦 stable-diffusion.cpp = one 1024x1024 image generated with it (the Q8_0 file); 🟧 ComfyUI = the six test images above (the BF16 file). "not tested" means we did not run that file in an image pipeline (the quantization loss of those files is in the table above).

What we changed

• Sakura-TextEncoder-Qwen3VL-4B-Uncensored-*: the official Qwen3-VL-4B-Instruct text encoder with our edit of part of the language weights, converted to GGUF and quantized with llama.cpp, using an importance matrix computed by us on the edited model (English and German text). The BF16 safetensors file is the edited encoder in one file. Modified files.

Not measured: how the uncensored encoder behaves with prompts that the official encoder handles worse, image editing with reference images, other languages, speed on other hardware.

License and use

Apache-2.0 (LICENSE-Apache-2.0.txt) as the original Qwen3-VL-4B-Instruct; the files are modified (ablated and quantized), see NOTICE. The image model files in the main repository are under the FLUX Kommunity License, which applies to their use and to the generated outputs as that license states. Part of the Sakura Media line.

Credits

• Original text encoder: Qwen/Qwen3-VL-4B-Instruct (Qwen team, Alibaba), used by black-forest-labs/flux-3-image-klein.
• Conversion and quantization: ggml-org/llama.cpp (MIT), leejet/stable-diffusion.cpp (MIT); loading: city96/ComfyUI-GGUF.

---

中文说明 · 樱花 (Simplified Chinese)

English above。完整的独立中文版见 README_zh.md。

只有文本编码器被去审查。 本仓库包含 FLUX.3 Image Klein 用来读取提示词的 Qwen3-VL-4B-Instruct 文本编码器的消融(abliterated)版本。不包含图像模型:请配合 Sakura-FLUX.3-Image-Klein-GGUF 中的图像模型文件使用(我们没有改动图像模型,它也没有被去审查)。编码器是修改过的 Qwen3-VL-4B-Instruct,使用 Apache-2.0(LICENSE-Apache-2.0.txt,见 NOTICE)。属于独立工作,并非 Alibaba/Qwen 或 Black Forest Labs 制作或认可。仅限成年人使用;您需对自己生成的内容以及适用于您的法律和许可证负责。图像模型使用 FLUX Kommunity License(见其仓库)。

运行所需文件

这里的“去审查”具体指什么

• 文本编码器:官方 FLUX.3 仓库的 text_encoder/ 与 Qwen/Qwen3-VL-4B-Instruct 逐字节相同(两个分片的 SHA256 均已核对)。我们用消融方法编辑了它(设置由我们选择;按优化过程自己的计数,其 100 条评估提示上的拒绝从 97 降到 13,首个 token 的 KL 散度 0.163),并制作了 BF16 safetensors(ComfyUI)以及 GGUF Q8_0、Q6_K、Q5_K_M、Q4_K_M。
• 图像模型:不在本仓库中,我们也没有改动;对图像模型本身有多少限制不作任何说明。

我们的测量

• 拒绝次数(把编码器当作聊天模型;mlabonne/harmful_behaviors 测试集的 104 条提示,温度 0,300 个 token;其中 100 条正是优化所用的评估提示,因此并非留出数据):官方未改动 101 / 104,我们的 0 / 104(Q8_0),0 / 104(Q4_K_M)。
• 与官方编码器生成的图像(同一图像模型、同样种子,九条提示词)相比,PSNR 为 33.4 dB mean / 26.1 dB min over 9 prompts。没有测量被编辑的编码器在受限内容上对 图像 的改变;本仓库不包含受限内容的示例图片。
• 每张图耗时: 见英文版(只有在 GPU 空闲时的测量才会写入)。
• 没有测量: 官方编码器处理较差的提示上被编辑编码器的表现、参考图像编辑、其他语言、其他硬件上的速度。

许可与致谢

Apache-2.0(与原始 Qwen3-VL-4B-Instruct 相同);文件经过修改(消融并量化),见 NOTICE。属于 Sakura Media 系列。致谢:Qwen / Alibaba(Qwen3-VL-4B-Instruct)、Black Forest Labs、ggml-org/llama.cpp、leejet/stable-diffusion.cpp、city96/ComfyUI-GGUF。