Clef-Flash Is a 9B Model That Never Writes a Token — and Cloudflare's Blog Arrived Almost a Day After the Weights

Cloudflare/clef-flash is a 9-billion-parameter multimodal model that takes a state and a schema of typed questions and returns a probability for every allowed answer. It does not generate text. Not "it generates text badly" — it has no text output path at all. The repo for it appeared on Hugging Face at 21:15 UTC on 30 September 2026 under Apache-2.0; Cloudflare's announcement post introducing it, alongside the larger 27B Cloudflare/clef, was published at 15:34 UTC the following day. For roughly eighteen hours the open weights and the hosted Workers AI endpoint existed in public before the vendor said a word about them, and that ordering is the most interesting fact in the release — more interesting, for anyone deciding whether to wire this into a pipeline, than any single benchmark row.

A second, smaller wrinkle arrived two days later. A third-party runtime's library page for clef-flash, which is where this article's radar first saw the model, lists it with a "256K context window" in its model table while rendering Cloudflare's own readme text — "64K context window: Twice the state Jev's 32K window holds" — a few lines above. The two numbers cannot both be right, and the vendor's documentation settles it in favour of the smaller one. That kind of drift is worth flagging up front, because everything else in this piece is downstream of the same question: which numbers are the vendor's, which are a mirror's, and which have been checked by anyone who is not the vendor.

What actually shipped, and in what order

The record, in sequence:

• 30 September 2026, 21:15:35 UTC — Cloudflare/clef, the 27B model, is created on Hugging Face.

• 30 September 2026, 21:15:36 UTC — Cloudflare/clef-flash is created, one second later. Both are fine-tunes of Qwen bases: Clef from Qwen3.8-27B, Clef-Flash from Qwen3.5-9B.

• 1 October 2026, 15:23 UTC — clef-flash's repository is last modified, which is about when the model card text we are quoting was written.

• 1 October 2026, 15:34 UTC — "Introducing Clef: our open-source decision models, and new RL fine-tuning platform" goes up on the Cloudflare blog, hosting both models on Workers AI and launching a fine-tuning service around them.

• 2–3 October 2026 — third-party runtimes pick the weights up; a third-party runtime's library page and quantised community builds appear.

So this is not a leak, not a quiet ship, and not an unannounced checkpoint that a reader has to treat as rumour. It is a GA release with a blog post, a hosted API on Cloudflare's own edge GPUs, an Apache-2.0 licence on the weights, and a commercial fine-tuning platform attached. The only genuinely odd thing is the eighteen-hour head start the repository had over the announcement — long enough for the model to be public while the vendor's own marketing page still did not exist, short enough that nobody outside Cloudflare had meaningfully run it.

A decision model is not a small language model

The framing in Cloudflare's post is that decision models are a distinct category, and the architecture backs the claim rather than decorating it. Clef-Flash keeps the Qwen3.5-9B backbone, including its vision encoder, frozen. On top of it sits a small transformer head — 243.5 MB of weights in the release, against roughly four sharded backbone files that run to 18.8 GB — which routes evidence from the state to each question and scores every option of every question in a single pass. Cloudflare terms this "non-autoregressive": there is no token-by-token generation, no intermediate reasoning text, no output parsing. You get a logit per allowed option, softmax it per question, and you have a distribution.

The request shape follows from that. You supply state — a string, or a JSON object or array — an optional list of images or video frames, and one to sixty-four named questions. Each question declares a type: noul for a true/false judgement returning the probability of true, choice for a named option set returning the chosen option plus per-option probabilities and a confidence, or score for an ordered scale returning a probability-weighted level. Criteria are optional for noul and required-ish for the others, and the docs are unusually blunt about one trap: confidence "shows how concentrated the probabilities are. It isn't the chance that the answer is right." A model that answers confidently is not necessarily answering correctly, and a calibration measure is the only thing that separates the two.

That distinction is the whole reason to be interested. If you have ever asked a general-purpose model to classify a support ticket and then tried to parse the answer, you have already paid the tax this design removes. Clef-Flash cannot produce the sentence "This looks like a billing issue, probably?" because it cannot produce a sentence. It returns {"choice": "billing", "probabilities": {"billing": 0.981, ...}, "confidence": 0.924} — the example is straight from Cloudflare's own documentation — and your code thresholds it.

The numbers, and who ran them

Every figure below comes from either Cloudflare's model card or the blog post, and Cloudflare ran all of them. The suite is the Jev Decision Index — a leaderboard published by TypeSafe, the vendor of Jev, the model Clef-Flash is benchmarked against — so the comparison is a supplier's own product measured on a rival's index, run by the supplier. There is no independent evaluation of Clef-Flash yet, and this article does not pretend otherwise.

On the decision-specific benchmarks, Clef-Flash is genuinely strong in a way that is worth separating from marketing: BFCL case-exact 98.8, API-Bank 93.1, home-appliance simulation 97.7, ContractNLI macro-F1 84.3, RouterBench 79.9. It beats the larger 27B Clef on BFCL (98.8 against 98.5), API-Bank (93.1 against 91.9) and the home-appliance suite (97.7 against 83.0) — the last by fourteen points, which is the single most surprising cell in the table and the one nobody outside Cloudflare has checked.

The losses are just as real and belong in the same paragraph. On CLINC150 with out-of-scope handling, clef-flash scores 66.8 macro-F1 against the 27B's 97.4 and Jev's 89.3 — a thirty-point cliff on intent detection with an "other" bucket, which is precisely the shape of the request a routing layer sees most often. On ANLI it gets 59.1 against Jev's 74.8; on When2Call 65.6 against Jev's 81.0; on GPQA Diamond 51.0 against Jev's 78.3. And on POP909-CL, a chord-labelling benchmark, it scores 1.6 — a number that is either a data-format mismatch or a real failure, and the card does not say which.

The latency table is where the model earns its name. Median request latency 38.8 ms, p95 122.4 ms, against the 27B Clef at 209.3 / 238.6 and Jev at 524.1 / 536.0. Cloudflare measured on its own infrastructure, so treat the absolute milliseconds as an upper bound on what you would see elsewhere, but the ordering — the flash variant is roughly five and a half times faster than its own larger sibling and thirteen times faster than Jev on median — is the design working as advertised.

The one figure the listings disagree about

Context window is the number that will bite people, because it is the one that got copied wrong. Cloudflare's Workers AI documentation for @cf/cloudflare/clef-flash states a context window of 65,536 tokens. The blog post says "our model has a 64k context window (compared to Jev's 32k)". The model card's own encoding helper defaults to max_length=16,384 tokens. One third-party runtime's library listing, meanwhile, advertises 256K in its table.

Three vendor sources agree on roughly 64K and one third-party listing says four times that. If you are sizing a prompt against a 256K budget on the strength of a library page, you will find out at request time. The honest reading is 65,536 tokens as the documented ceiling, with the caveat that Cloudflare's own release notes never reconcile the card's 16,384-token default against it — a default, not a limit, but one that will silently shape how much state you send if you use the bundled loader as-is.

Where you can call it, and where you cannot

Clef-Flash is not yet one of the routes on OrcaRouter. Our catalogue returns a 404 for it, and nothing in this piece should be read as an availability claim from us — if you want it today, Cloudflare hosts it on Workers AI at $0.09 per million input tokens, and the Apache-2.0 weights are yours to run locally.

What that means for the decision this article is really about is that a scorer you can only reach through one vendor's platform is a scorer whose latency and availability you inherit along with its accuracy. The hosted alternative with a route is TypeSafe's Jev 1.13, which is on OrcaRouter at $0.042 per million input tokens with a 65,536-token context, and which is the model Cloudflare chose as its benchmark counterpart — deliberately, because the two are API-compatible. Clef-Flash speaks the same /v1/systemone request shape, so the two are swappable behind a thin adapter. Having both reachable through one key, with provider list price passed through at no markup, is the reason to keep that comparison live rather than committing the architecture to whichever model happened to ship first.

What would change this read

Three things, in order of how much they would move the picture.

Someone outside Cloudflare needs to reproduce the CLINC150+OOS and home-appliance cells, because they point in opposite directions and the card gives no mechanism for either. A 66.8 on out-of-scope intent detection next to a 97.7 on appliance control is not a smooth capability curve; it suggests a model that is very good at the classification shapes in its training distribution and much weaker at refusing to classify when the right answer is "none of these". If that holds under independent testing, it is the most important operational fact about clef-flash and it is not in the highlights section.

The 64K-versus-256K listing discrepancy needs a source to correct it, because it is currently propagating outward from a mirror into the places people actually read. Vendor documentation is not usually the thing you have to cite to win an argument against a runtime's card, and this is a small case where it is.

And the category needs to survive contact with real workloads. Cloudflare's own framing is that decision models sit in the hot path for agents — two seconds to fetch, render and classify a website versus 4.7 seconds for their fastest general LLM on the same job, in their Threat Intelligence example. That is a real and specific claim about a real and specific workflow, and it is the kind of claim that gets settled by people running it, not by a table.