Llama-3.2-3B-Instruct-Q4_K_M โ€” GGUF (scorecard)

Quantized from meta-llama/Llama-3.2-3B-Instruct by smarttasks on 2026-07-13.

Why this conversion: Smaller, faster local/edge + agentic deployment via GGUF. Size saving: 46.7% vs the original weights. Origin: https://huggingface.co/meta-llama/Llama-3.2-3B-Instruct ยท license: llama3.2 ยท base: n/a ยท arch: n/a

Who this model is for

  • Complexity band: L1 Layman โ†’ L5 Agentic
  • For non-experts: handles up to L5 Agentic-level tasks in testing.
  • For engineers/architects: see axis scores and invariants below.
  • For agentic systems: machine-readable scorecard JSON is embedded at the bottom and shipped as scorecard.json.

Capability by tier

Tier Passed
L1 Layman โœ…
L2 Everyday โœ…
L3 Professional โœ…
L4 Architect/Engineer โœ…
L5 Agentic โœ…

Capability by axis

Axis Score
knowledge 100%
instruction_following 67%
reasoning 100%
coding 100%
structured_output 100%
long_context 100%

Known-answer accuracy: 0.933 ยท Drift vs original: None

Compression (vs 6.0 GB original)

Quant Size % of original Saved Est. VRAM @ ctx KLD vs f16 Guidance
Q8_0 3.2 GB 53% 47% ~6.0 GB 5.2e-05 near-lossless โ€” differences from the original are negligible
Q6_K 2.5 GB 41% 59% ~5.1 GB 0.000653 near-lossless โ€” differences from the original are negligible
Q5_K_M 2.2 GB 36% 64% ~4.8 GB 0.001204 near-lossless โ€” differences from the original are negligible
Q4_K_M 1.9 GB 31% 69% ~4.5 GB 0.00188 โ˜… recommended default โ€” best size/quality balance for most users
Q3_K_M 1.6 GB 26% 74% ~4.1 GB 0.008012 near-lossless โ€” differences from the original are negligible
Q2_K 1.3 GB 21% 79% ~3.8 GB 0.021358 good โ€” small but real quality loss; solid size/quality balance

Disk sizes are exact; VRAM is a formula estimate; quality shown as KLD (lower = closer to full precision) rather than a single %.

File integrity (SHA-256)

Verify a download hasn't been tampered with. Linux/mac: sha256sum -c SHA256SUMS. Windows: Get-FileHash <file>.gguf -Algorithm SHA256.

File SHA-256
Llama-3.2-3B-Instruct-Q2_K.gguf dc5d2ece0560be8d9b709b4a423b2edab7a51c945f4deaa65804402f80842edc
Llama-3.2-3B-Instruct-Q3_K_M.gguf bdf7d0d63ad36e04af524afb5f7ccb7d07821d17b8c81319535adfb1256171ec
Llama-3.2-3B-Instruct-Q4_K_M.gguf 8aa8366777bda62fa397cde1d286d5408d2ac55899339cbae010c154dc28ef55
Llama-3.2-3B-Instruct-Q5_K_M.gguf 040e97c3c87923b0b27828ff4834b0df20c7fa842e6b9e465acdb48092a6f948
Llama-3.2-3B-Instruct-Q6_K.gguf cad2687b587dddc5151881ac46def239b80e7f8b98fd5bbd6f927e25594b86ec
Llama-3.2-3B-Instruct-Q8_0.gguf 961a39e1528e6a53ec4ef369bebc3e0206b8151e644eb301079c97e8f26d9ae5

Validation invariants (IAIso)

Overall conformance: WARN (5 pass / 1 warn / 0 fail / 0 not evaluated)

Invariant Category Status Detail
iaiso.conversion.integrity conversion PASS GGUF produced and readable
iaiso.conversion.efficiency conversion PASS Size reduction vs original weights
iaiso.capability.retention capability PASS Known-answer accuracy on the complexity suite
iaiso.parity.fidelity parity PASS Best KL-divergence vs f16 across quants
iaiso.security.posture security WARN supply-chain clean; red-team mean resistance 40.1% (weak, sampled: dan+promptinject); weak vs Ablation_Dan_11_0, DanInTheWild, HijackHateHumans, HijackLongPrompt
iaiso.transparency.coverage transparency PASS Topic suppression / over-refusal / bias probe

First-party self-assessment produced by the SmartTasks/IAIso validation pipeline (capability, security, transparency). Not an independent certification.

Security assessment

This maps directly to the iaiso.security.posture invariant above (WARN). Values below are computed deterministically from the scan outputs โ€” the same scan always yields the same verdict.

Supply chain (ModelScan): clean โ€” no unsafe serialization in the source weights.

Partial (sampled) red-team. Ran probe families dan, promptinject โ€” a focused subset, not garak's full ~40-module suite (which takes ~a day on one GPU). These families target the attack classes most relevant to an instruction-tuned coding model, so the result is a strong, representative indicator of behavioural robustness โ€” though not an exhaustive certification.

Mean resistance: 40.1% (weak). Higher = the model resisted more attacks. Grades: strong โ‰ฅ95, good โ‰ฅ80, mixed โ‰ฅ50, weak <50.

Probe OWASP Attempts Resisted Pass rate Grade
dan.Ablation_Dan_11_0 LLM01 254 8 3.1% weak
dan.DanInTheWild LLM01 512 130 25.4% weak
promptinject.HijackLongPrompt LLM01 512 169 33.0% weak
promptinject.HijackHateHumans LLM01 512 225 43.9% weak
dan.AutoDANCached LLM01 6 4 66.7% mixed
promptinject.HijackKillHumans LLM01 512 350 68.4% mixed

โš ๏ธ Deployment note: this model was susceptible to one or more prompt-injection attack classes in testing (pass rate <50%). Like most instruction-tuned coding models, it should not be exposed to untrusted input in agent pipelines without external guardrails. This reflects the source model's safety tuning, not the quantization.

Sampled red-team (subset of garak probes); not an exhaustive sweep. Reproduce with security_scan.py + security_digest.py.

For agents

{
  "max_complexity_level": 5,
  "max_complexity_label": "L5 Agentic",
  "recommended_for": [
    "knowledge",
    "instruction_following",
    "reasoning",
    "coding",
    "structured_output",
    "long_context"
  ],
  "not_recommended_for": [],
  "size_saving_pct": null
}

The full machine-readable scorecard is in scorecard.json (schema smarttasks.iaiso.model_scorecard/v1).

What this repo gives an agent builder

Unlike a bare GGUF re-upload, every file here is designed to be read programmatically before you drop the model into a loop:

  • scorecard.json โ€” capability tier + per-axis scores (instruction-following, reasoning, tool-calling, structured-output) so your orchestrator can gate on whether this model is strong enough for a given step, without you hand-testing it.
  • Validation invariants โ€” machine-readable pass/warn/fail records for security posture, transparency, and quantization fidelity. An agent platform can refuse to load a model whose invariants don't meet policy.
  • SECURITY.md + red-team results โ€” the model's measured resistance to prompt injection and jailbreaks, so you know its susceptibility before you expose it to untrusted input in an agent chain.
  • SHA256SUMS โ€” verify the exact weights you're running match what was tested.

This is the difference between "here's a quantized model" and "here's a model with a documented, checkable safety and capability profile for autonomous use."

Running Llama-3.2-3B-Instruct-Q4_K_M locally (LM Studio, Ollama, llama.cpp, vLLM)

These are GGUF quantizations of meta-llama/Llama-3.2-3B-Instruct for local inference. Download a single .gguf and load it in LM Studio, Ollama, llama.cpp / llama-server, KoboldCpp, text-generation-webui, or any llama.cpp-based runner โ€” no Python or GPU cluster required. The smallest build (Q2_K) is about 1.3 GB and needs roughly ~3.8 GB VRAM, so it runs on modest consumer GPUs. Pick a size from the compression table above: larger = closer to the original, smaller = less memory. Q4_K_M is the usual best balance.

Using Llama-3.2-3B-Instruct-Q4_K_M in agentic systems (tool calling, JSON mode)

Built for agent and function-calling workloads. In testing this model reaches L5 Agentic complexity and is strongest at: knowledge, instruction_following, reasoning, coding, structured_output, long_context. The repo ships a machine-readable scorecard.json with an agent_hint block (max complexity level, recommended tasks, size/VRAM) so an orchestrator can pick the right model automatically. Pair it with a governance layer (see below) for bounded, audited tool use.

For AI safety & security leaders

Every build in this repo ships with a first-party validation record: an OWASP-mapped security scan (ModelScan supply-chain + garak red-team), a transparency probe (topic-suppression / over-refusal / viewpoint-alignment), quantization fidelity (KL-divergence vs the original), and SHA-256 checksums for tamper verification. This is a documented self-assessment โ€” not third-party certification โ€” with every result included so your team can see exactly what was tested and independently verify the model and its checksums. Keywords: LLM security, model governance, agent safety, OWASP LLM Top 10, local/on-prem inference, supply-chain integrity.


About SmartTasks & IAIso

SmartTasks builds tooling for governed, agentic AI workflows. This model was converted and validated with the **SmartTasks GGUF

  • MoE pipeline** โ€” our proprietary conversion and validation system.

IAIso โ€” governance for agent loops

IAIso is our open framework for bounding what an autonomous agent spends and touches, and proving it afterward. Three primitives: pressure-accumulation rate limiting (one scalar that rises with tokens, tool calls, and planning depth, and triggers an automatic safety release), ConsentScope (signed, scoped, expiring tokens gating sensitive operations), and structured audit (every state change emits a versioned event). It bounds a cooperating agent in-process; for adversarial containment bind it to an out-of-process anchor. (Framework 5.0 ยท SDK 0.2.0 ยท beta โ€” you supply your own thresholds/coefficients for your workload.)

pip install iaiso   # Python SDK (the only published package today)
from iaiso import BoundedExecution, PressureConfig

with BoundedExecution.start(config=PressureConfig()) as execution:
    outcome = execution.record_tool_call(name="search", tokens=500)
    if outcome.name == "ESCALATED":
        ...  # request human review before the next expensive step

Go, Rust, Node/TypeScript, Java, C#, PHP, Swift and Ruby SDKs implement the same spec and live in the repo's core/ (build from source โ€” not yet published to their registries). See the repo for conformance vectors and LIMITATIONS.md.

Downloads last month
-
GGUF
Model size
3B params
Architecture
llama
Hardware compatibility
Log In to add your hardware

2-bit

3-bit

4-bit

5-bit

6-bit

8-bit

Inference Providers NEW
This model isn't deployed by any Inference Provider. ๐Ÿ™‹ Ask for provider support

Model tree for smarttasks/Llama-3.2-3B-Instruct-GGUF

Quantized
(487)
this model