Clef-Flash: Cloudflare's 9B Decision Model, and What the Cloudflare in the Name Actually Means

Cloudflare/clef-flash is a 9-billion-parameter model that answers questions with probabilities instead of sentences. You hand it a state — text, JSON, an image, a video frame — plus a schema of up to 64 named questions, and it returns one score per allowed option in a single forward pass. There is no generated text to parse and no reasoning trace to read, because there is no text output path at all. It is the smaller half of a pair: Cloudflare/clef is the 27-billion-parameter sibling released alongside it, and a third family member, Cloudflare/clef-omni, adds audio input on a 30B mixture-of-experts backbone. All three come from Cloudflare itself, which is the fact most worth getting exactly right, because a reader arriving from a search for this model's name usually arrives with one of two assumptions — that Cloudflare/clef-flash is a Cloudflare-hosted copy of somebody else's model, or that Cloudflare is merely the host — and both are wrong in the same direction.

What Clef-Flash is, and what it is not

The vendor's own one-line description, repeated on both the Hugging Face model card and the Workers AI model page, is that it "turns a state and a schema of typed questions into decisions." That is a narrower claim than it sounds, and it is worth unpacking before any benchmark.

Each question in your schema declares one of three types:

• noul — a yes/no judgement that returns the probability the answer is true, with optional descriptions of what a yes and a no mean in this question's context.

• choice — a named option set of 2 to 255 entries, returning the winning option, a probability per option, and a confidence.

• score — an ordered rubric of 2 to 10 levels, returning a probability-weighted level that can land between levels, a legend mapping index to description, per-level probabilities, and a confidence.

A request carries 1 to 64 questions, and the answers come back in an answers object keyed by your question ids. Every option in every question is scored in the same pass, so the cost of a twelve-question schema is not twelve calls — it is one. What you get on the other side is a distribution, not a sentence, and your code thresholds it.

Two things follow that a reader comparing this against a chat model should internalise. First, there is no failure mode in which the model writes an explanation you then have to parse, because prose is not reachable. Second, and less comfortable: if the right answer is not in your option set, Clef-Flash has no mechanism to tell you. It scores the options you wrote. Nothing in the published request schema adds a "none of these" bucket unless you put one there yourself.

The Cloudflare in the name: three roles, one company

People search for this model with Cloudflare attached to it — cloudflare/clef-flash, and cloudflare clef flash in plain words. The prefix is worth spelling out, because it points at three separate layers and only one of them is hosting.

• The organisation that trained it. Clef-Flash is a Cloudflare model. Cloudflare's announcement post, "Introducing Clef: our open-source decision models, and new RL fine-tuning platform," published 1 October 2026 and bylined Michelle Chen, Alex Reneau and Kevin Flansburg, describes it as a Cloudflare-trained release and says the models were "post-trained" in-house from an upstream open-weight base. This is not a third-party checkpoint that Cloudflare picked up.

• The Hugging Face namespace. The weights live at huggingface.co/Cloudflare/clef-flash. That is why the string cloudflare/clef-flash circulates: it is a repository path, in the same form as any other org-owned repo. It is the most common reason the two words travel together, and it is not a hosting claim.

• The inference host, which is also Cloudflare. The served model id is @cf/cloudflare/clef-flash, run through Workers AI at api.cloudflare.com/client/v4/accounts/<account_id>/ai/run/@cf/cloudflare/clef-flash. So the hosting arrangement to describe is not "a Cloudflare-hosted model" in the neutral sense of a marketplace listing. It is the vendor serving its own weights on its own platform.

The practical consequence is this: the model, the licence grant, the API endpoint and the bill all resolve to one company, and a reader who assumed an independent hosting layer between them has no second supplier to fall back on for this checkpoint. The Apache-2.0 weights are the only escape hatch from that, and they are real — more on that below. What is not true, as far as any vendor page we can find states, is that Clef-Flash is offered through any other inference provider. Cloudflare's own material names no third-party platform, and we found none carrying it.

Size, architecture and licence

The numbers, from the model repository itself and from Cloudflare's documentation, both read today:

• Parameters — 9,409,813,744 in BF16, so "9B" is a round-down, not a stretch. The vision tower counts toward that total.

• Backbone — Qwen3.5-9B, frozen during post-training, including its vision encoder, stored as standard sharded safetensors. Four shards, roughly 18.8 GB of weights in total.

• The trained part — a "joint schema head," a small transformer head weighing 243.5 MB that reads the backbone's final hidden states, routes evidence from the state to each question, and scores every option of every question jointly. One logit per allowed option; softmax per question gives you the distribution.

• Training method, as Cloudflare describes it — the routing head optimised alongside rank-256 low-rank adapters over a frozen backbone, with label-smoothed cross-entropy for schema validity paired with a Brier loss aimed at probability calibration, plus a secondary objective Cloudflare calls Reinforcement Learning for Calibrated Decisions.

• Licence — Apache-2.0, "following the base model," in the card's own words. Commercial use is not restricted by the licence, and the weights are not gated: the repository downloads without an access request.

The shape of the thing — everything trained sits in a 243 MB head bolted to a frozen 18.8 GB backbone — is the reason to take the architecture description seriously rather than treating it as marketing. The model cannot have learned new world knowledge, because the knowledge-bearing weights never moved. What it learned is how to route evidence into a decision. That is a real capability and a bounded one, and it explains the benchmark pattern later in this page better than any accuracy claim does.

Context window and the output ceiling

This is the figure that has moved, and if you are sizing a prompt today you should read the current number rather than any number in circulation from the launch.

Cloudflare's Workers AI model page for @cf/cloudflare/clef-flash, read on 12 October 2026, states a context window of 24,576 tokens. The 1 October announcement post states something different — "our model has a 64k context window (compared to Jev's 32k)" — and the Hugging Face card's own encode_record helper defaults to max_length=16,384. For comparison, the Workers AI page for the 27B clef gives 65,536 tokens and the page for clef-omni gives 64,000.

The honest reading: the current vendor documentation for this specific model says 24,576, and the launch post said 64k. Those are the vendor's own two sources disagreeing with each other, and only one of them is the page a developer integrates against. If you built a prompt to a 64K budget on the strength of the announcement, the documented ceiling is now roughly a third of that. Check before you send.

Media inputs are billed and counted against that same budget, which is the detail that bites hardest. Images are tokenised by 32×32-pixel patch, with three marker tokens, and each image is capped at 1,024 tokens; an image over about one megapixel is scaled down, one under roughly 65,000 pixels is scaled up. If media tokens plus your question tokens exceed the window, the request fails outright. If they do not, the text state is truncated to fit the remainder — silently, from the end, with no error raised. A schema that fits one day will quietly lose part of its state on a document-heavy day.

Maximum output is not published. Cloudflare's model page states only that "Clef models do not charge for output tokens," and the response schema carries an usage.output_tokens field with no documented ceiling. That is not an omission to paper over with a guess: a non-autoregressive scorer does not have a decode budget in the sense an autoregressive model does, and the vendor documents no limit, so there is no limit to quote. If you need one, the thing to reason about is your option count and question count, not tokens out.

Modalities in, and exactly what comes back

The vendor's descriptions and the request schema agree on the input side and diverge slightly on one point, so here is the split.

• Inputs, per the model card — text, JSON or structured data of any shape, images, and video frame arrays. Text-only and multimodal records can be mixed in a single batch, and media parameters are passed through to the processor via an optional media_kwargs field.

• Inputs, per the Workers AI request schema — the documented parameter list exposes an images array and no video parameter, with a 4-image maximum, 4 MiB and 16 megapixels per image, 8 MiB total decoded, and a 13 MiB cap on the whole request body. Embedded bytes only: remote URLs are not accepted.

• Output — probabilities over the options you defined, in the answers object, in one of three shapes depending on the question type. No free-form text, no markdown, no tool calls.

Read that difference as a hosting-surface distinction rather than a contradiction. The checkpoint documents video frames; the Workers AI endpoint you call over HTTP documents images. If video is part of your plan, the pathway to check is the self-hosted one.

What Cloudflare claims, and what has actually been measured

Every number in this section comes from Cloudflare, and Cloudflare ran all of it. That is the single most important sentence on this page, so it is worth being specific about the machinery.

The benchmark suite is the Decision Index 0.2.1. The model card describes the results as "our internal run," and the public leaderboard it links is hosted at a Cloudflare-run address. The counterpart model throughout is TypeSafe's Jev, and the end-to-end business-workflow numbers come from Typesafe Evals. So the comparison is a vendor measuring its own model, on an index named for the competitor it is measured against, and publishing the result itself. There is no independent evaluation of Clef-Flash. Checking today: Artificial Analysis has no model page for it, and the LMArena text leaderboard lists no Cloudflare-labelled model at all. Where a vendor publishes no third-party score, saying so is the finding.

With that label attached, the decision-shaped results are genuinely strong: BFCL case-exact 98.8, API-Bank accuracy 93.1, ContractNLI macro-F1 84.3, RouterBench 79.9, FinEntity 97.1, and a home-appliance simulator case-exact of 97.7 — the last of which is fourteen points above the larger 27B Clef on the same row. General-knowledge rows hold up too: MMLU 91.8, ARC-Easy 99.5, ARC-Challenge 98.3, WinoGrande 97.5, HellaSwag 98.6, CLadder 97.7, and a ForecastBench Brier of 10.6, which is the best in its column and the kind of calibration number a probability-producing model should be judged on.

The losses belong in the same paragraph, and they have a shape. On CLINC150 with out-of-scope handling, Clef-Flash scores 66.8 macro-F1 against the 27B Clef's 97.4 and Jev's 89.3. On ANLI it gets 59.1 against Jev's 74.8. When2Call 65.6 against 81.0. GPQA Diamond 51.0 against 78.3. RAGTruth 35.6 against 76.5. And on POP909-CL, a chord-labelling benchmark, it returns 1.6.

A 66.8 on out-of-scope intent detection sitting beside a 97.7 on appliance control is not a smooth capability curve. It is the profile of a scorer that is very good at the classification shapes it was post-trained on and much weaker at declining to classify when the correct answer is "none of these" — which is, awkwardly, the exact judgement a routing layer or a triage pipeline needs most. The 1.6 on chord labelling is either a format mismatch or a genuine failure and the card does not distinguish.

Workflow results, from Typesafe Evals, are more mixed than the headline rows: invoice processing exact actions 57.1 against Clef's 64.7 and Jev's 61.8; customer service exact actions 77.0, ahead of both; security incidents 61.7; agent trace observability 69.8. The 27B sibling wins the workflow table three rows out of five.

Latency is where the model earns its name, and the same caveat applies. Median request latency 38.8 ms and p95 122.4 ms, measured by Cloudflare on Cloudflare infrastructure, against 209.3 / 238.6 for the 27B Clef. Absolute milliseconds from a vendor's own hardware are an upper bound on nothing and a lower bound on nothing; the ordering is the claim, and the ordering — roughly five times faster than its own larger sibling — is the architecture doing what it says.

How a reader actually calls it

Two routes exist, and they are genuinely different commitments.

The hosted route. Call it on Workers AI as @cf/cloudflare/clef-flash, from inside a Worker via the env.AI.run() binding, or over REST at the Cloudflare API endpoint with a bearer token. Required fields are model, state and questions; the model selector must match the pattern ^\s*(clef|clef-flash)\s*$, which is how the 27B and 9B variants are disambiguated on the same endpoint. Pricing on the Workers AI model page and the Workers AI pricing page is $0.038 per million input tokens, with media tokenised into input tokens at the same rate and no charge for output tokens.

The self-hosted route. The weights are Apache-2.0 and not gated, so you can run them yourself. The card documents a reference path of torch 2.11 and transformers 5.10.2 on a single H200, with pillow for image and video inputs, and points to an SGLang cookbook for launch commands on H200, B200 and B300. Served that way, the model answers at /v1/systemone.

That path is not incidental, because it is the reason this model is worth understanding rather than merely using. Clef-Flash is "fully compatible with Jev and SystemOne," in the card's words: it accepts a Jev/SystemOne request body and returns the same response body — model, answers keyed by question id, usage. The compatibility was deliberate enough that a later commit to the repository adds the systemone entry point explicitly. If your pipeline already asks a decision model questions in that shape, substituting this one is a model string and a URL, not a migration. That is a real reduction in switching cost, and it is the one architectural fact here that changes what a reader can do.

One routing note, stated as a fact rather than a pitch: OrcaRouter does not serve Cloudflare/clef-flash. We checked our live catalogue today and it is not there, and nothing in this page should be read as a claim that it is. What our catalogue does carry is the model Clef-Flash was built to be a drop-in for — TypeSafe's Jev 1.13 is on our catalogue at $0.042 per million input tokens on its pricing table (the page's quick-facts badge rounds that to $0.04), with a 65K-token context and the same POST /v1/systemone endpoint type. Because the two speak one wire format, the swap between them is a config change rather than a rewrite, which is exactly the reason to keep both reachable from one key instead of committing an architecture to whichever model shipped first. OrcaRouter runs on provider list price passed through at no markup, so a price move at either vendor is live on our side the same day.

What is still open

Three things, in the order they would change the picture.

Someone outside Cloudflare needs to reproduce the CLINC150 out-of-scope and home-appliance cells together, because they point in opposite directions and the published run gives no mechanism for either. If the 66.8 holds under independent testing, that is the most operationally important fact about Clef-Flash and it is not in the announcement's list of strengths.

The context window needs a single reconciled number from the vendor. Right now the model's own documentation page says 24,576 tokens, the launch post says 64k, and the bundled encoding helper defaults to 16,384. Anyone sizing a production prompt is choosing which of three vendor statements to believe.

And the category needs contact with real workloads at production volume. Cloudflare's framing is that decision models sit in the hot path — a domain-classification example in their post has Clef returning a verdict in 2.2 seconds against 4.7 seconds for a general-purpose model on the same job. That is a specific and testable claim about a specific workflow, and it will be settled by people running it, not by a table.