Z-Image-kllm

Tongyi-MAI/Z-Image (revision 04cc4abb7c), sealed with kLLM under the perm transform. The weights keep the original layout, file and tensor names, and any engine loads them, but every weight is encrypted in place under this model's key: without it the model computes nothing useful. kllm serve --key unlocks the weights and runs them with the permuted tokenizer in trusted.kllm, encrypted under the same key.

key fingerprint	38da-68a4-3762-9866 (key version 1)
modality	text to image
license	apache-2.0, the same as the base model

Getting the key

The key is issued by the publisher of this repository on request.

Running it

pip install 'kllm[seal,serve]'
huggingface-cli download ANetResearch/Z-Image-kllm --local-dir Z-Image-kllm

# keyless in the cloud: the key and the tokenizer stay with you
kllm cloud Z-Image-kllm -o Z-Image-kllm-cloud --key Z-Image-kllm.key   # unlocks; upload Z-Image-kllm-cloud only
kllm serve Z-Image-kllm-cloud --client --port 30010   # in the cloud
kllm client generate Z-Image-kllm "a red fox in fresh snow" --url http://CLOUD:30010 --key Z-Image-kllm.key

What this protects

The base model is public, so sealing it does not protect the weights. What it gives:

• Without the key, the files here are encrypted (AES-CTR under a key derived from the model key); they cannot be matched to the base, and they compute nothing useful.
• Engine logs, request captures and stored payloads hold permuted token ids, not text. Serving keyless (kllm serve --client), the cloud gets neither the key nor the tokenizer, and images come back encrypted to the requester.

Wherever the model is unlocked to run, the sealed weights are in the clear, and with the base model at hand they can be matched to it.

Against a cloud that deliberately analyzes GPU memory or token ids, this is not protection: token ids are a substitution cipher. See What the cloud can and cannot learn.

Checking it

With the key, rebuild the sealed weights from the public base and compare them tensor by tensor:

kllm verify Z-Image-kllm --base Tongyi-MAI/Z-Image --revision 04cc4abb7c5069926f75c9bfde9ef43d49423021 --key Z-Image-kllm.key

kllm-manifest.json lists the sha256 of every file here.