How to Run FLUX 3 Image Klein's Prompt Upsampler Without Refusals Locally

BFL's prompt upsampler for FLUX 3 Image Klein (a 9B Qwen3.5 fine-tune) with its refusal direction projected out, as GGUF for llama.cpp, plus the same edit as a LoRA for the stock files. Klein's text encoder without refusals is in FLUX-3-Image-Klein-TE-Uncensored-GGUF. The measurements are public.

• As a chat model, refusals fall from 63% to 0% in English and from 29% to 1% in Russian on held-out prompts. MMLU goes from 74.15% to 73.95%.
• As Klein's upsampler, under BFL's t2i system prompt, the stock model refuses none of our requests but softens 2 of 35 sensitive ones in its captions; this one keeps them. The image model draws neither of the two in any build, so on Klein's pictures we measured no uncensoring effect; the open pipeline already draws the sensitive categories (the per-category table).
• Against the other uncensored upsamplers on our stand, prithiv's measures the same as this one, and Sakura's still refuses 22% in English.

---

Pick a file

The same rungs and layouts as our stock upsampler GGUFs, with the edit baked in. KLD and top-1 are against the original BF16 on a 30-language neutral text set (87 chunks of 4096 tokens), so they include the edit itself. Refusals are on held-out prompts (81 English, 100 Russian harmful requests; 250 XSTest safe prompts), plain chat, thinking off.

The BF16 row was measured with the edit applied as an adapter to the original BF16; the baked file is the same edit rounded once to bf16. The original refuses 51 / 29 / 8 of the same prompts (63% / 29% / 3.2%).

• Q8_0 if it fits; AD-IQ4_XS is the pick at about 5.5 GB.
• FLUX-3-Image-Klein-pup-Uncensored-LoRA.gguf (3 MB) is the same edit for the stock files. With any GGUF of the original upsampler: --lora-scaled FLUX-3-Image-Klein-pup-Uncensored-LoRA.gguf 0.75.
• mmproj-FLUX-3-Image-Klein-pup-Uncensored-F16.gguf is the vision projector, unmodified, for edits with reference images. system_prompts.json is BFL's file, unchanged.

Running it

llama-server -m FLUX-3-Image-Klein-pup-Uncensored-AD-IQ4_XS.gguf --jinja -ngl 99 -c 8192

Send the t2i system prompt from system_prompts.json and the short request as the user message, with thinking off ("chat_template_kwargs": {"enable_thinking": false}), greedy decoding and a presence penalty of 1.5. The answer is the caption: pass it to Klein as the prompt.

As a chat model

Original against this one, both BF16, on prompts never used to pick anything:

Refusal is counted by the opening of the reply, so it is indicative, not a judge.

Against other uncensored Klein upsamplers

At Q8_0, same stand, same sets:

What it does to Klein's captions and pictures

• Captions. 45 sensitive requests (adults only, no real people), t2i system prompt, greedy. A language-model judge read every caption: the stock upsampler keeps 31 of the 35 sensitive requests, this one 33. The two it adds back are a topless beach scene and swim briefs.
• Pictures. Rendered with Klein's BF16 image model on two seeds, judged by a vision model: the requested content shows in 79 of 90 pictures with this upsampler and 80 of 90 with the stock one. No category moved by more than one picture in ten. The image model does not draw the two requests this upsampler adds back.
• Ordinary pictures change. Any change in a caption changes Klein's picture. On 48 neutral requests the captions of this upsampler differ from the stock ones, and the pictures differ by LPIPS 0.375 (a new seed is 0.53). They are different pictures of the same request, not worse ones as far as we measured.

How it was made

1. Direction. Difference of means of the residual stream at the last prompt token, chat template applied, harmful against harmless English and Russian prompts, taken entering block 19 of 32, with the harmless-mean component removed.
2. Edit. W' = W - 0.75 r rᵀW on the 32 attention outputs and 32 MLP down projections. The token embedding, the output head, the MTP layer and the vision tower are untouched.
3. Choice. Variants screened on validation prompts; the numbers above come from held-out test prompts.
4. Bake and quantize. The edit applied to the BF16 weights in f32 and rounded once, then the stock upsampler's ladder and importance matrix (the stock model's; the edit is rank 1). llama.cpp 6184e92 (upstream).

Responsible use

The upsampler no longer leans requests towards a refusal. That does not make the output safe, correct or lawful. Do not use it to make sexual content involving minors, or intimate or degrading images of real people without their consent. Klein's image model is under the FLUX Kommunity License, which forbids such uses. Any deployment needs its own access controls and policy enforcement.

Credits

Direction estimation, edit, quantization and evaluation by AtomicChat. The upsampler is BFL's flux-3-image-klein-pup, Apache-2.0, on top of Qwen3.5-9B by the Qwen team. Not affiliated with or endorsed by Black Forest Labs. The method follows Arditi et al., Refusal in Language Models Is Mediated by a Single Direction (2024).