Introducing Clef: our open-source decision models, and new RL fine-tuning platform

TL;DR

Cloudflare’s Workers AI team releases Clef and Clef-flash, two open-weights (Apache 2.0) decision models in the Jev-API-compatible mold, plus a managed RL fine-tuning service built on Cloudflare’s AI primitives (AI Gateway, Workers AI, Containers, Trainer, BYO Model). Both Clef variants are post-trained Qwen backbones — Clef on Qwen3.8-27B, Clef-flash on Qwen3.5-9B — frozen under rank-256 LoRA adapters, with a jointly-optimized two-stage attention routing head that scores schema choices non-autoregressively in a single prefill pass. Clef adds a vision encoder (first filed multimodal entry alongside Liquid’s d1) and extends context to 64k vs Jev’s 32k, trained with label-smoothed cross-entropy + Brier calibration loss followed by an RLCD-style reinforcement stage. The release is paired with a self-serve fine-tuning product that captures AI Gateway traffic → rollouts on Workers AI → Container-sandboxed scoring → weight update → BYO-Model redeployment.

Key claims

Clef is a frozen-Qwen3.8-27B backbone with a jointly-optimized two-stage attention routing head + rank-256 LoRA adapters; Clef-flash is the same recipe on Qwen3.5-9B [§How we trained Clef].
The decision step is non-autoregressive: a prefill-only pass over Qwen, then schema choices scored in parallel via “option-specific evidence routing, joint cross-field attention, and schema-bound scoring” rather than token-by-token generation [§How we trained Clef].
Post-training uses label-smoothed cross-entropy on valid schema outputs paired with a Brier loss for probability calibration, followed by Reinforcement Learning for Calibrated Decisions (RLCD) with partial credit for adjacent ordinal choices, full-record precision reward, and a reference penalty against distribution shift [§How we trained Clef].
Clef supports a 64k context window (vs Jev’s 32k) and a vision encoder for image classification; Clef-flash is text-only and latency-optimized [§How is Clef different from other decision models?].
Across 43 Jev Decision Index evals, Clef or Clef-flash leads 9 of 10 reported benchmarks (BFCL case-exact 98.47, ToolRet nDCG@10 66.43, API-Bank 91.93, Home appliances 82.95, BANKING77 90.93, CLINC150+OOS 66.77, BRIGHT 45.91, Amazon ESCI 57.39, PhishNChips 79.60), beating Jev in 3 of 4 of TypeSafe’s own workflow evals including Clef-flash on Invoice processing [§How is Clef different from other decision models? tables].
Clef beats peer decision models on latency except Laya: median 209.3 ms, p95 238.6 ms (Jev: 38.8 / 211.2 for Laya; Clef-flash p95 51.4 vs Jev 536.0) [§latency table].
Internal Threat Intelligence deployment: Clef classifies a domain in 2.2s including browser rendering vs 4.7s for gpt-oss-120b on the same workflow, and returns richer multi-category probabilities (~95% fashion / ~85% ecommerce / <1% phishing) [§What is a decision model?].
The companion RL service closes the loop end-to-end on Cloudflare primitives: AI Gateway auto-captures request/response pairs as training data, Workers AI generates rollouts against the base Clef model, Containers host RL sandboxes for scoring/replay, a new Trainer component updates weights, and BYO Model redeploys the fine-tuned checkpoint back to Workers AI [§Our new RL service].

Method

The model class is non-autoregressive decision scoring, not generation. The base Qwen backbone (3.8-27B for Clef, 3.5-9B for Clef-flash) is frozen; only a rank-256 LoRA adapter plus a two-stage attention routing head are trained. At inference, the backbone runs a prefill-only pass over the prompt + schema; then, in parallel over all valid schema choices, each option extracts prompt-relevant context, individual field parameters cross-attend with other fields and back to the original payload, and schema-bound scoring produces calibrated probabilities. Training is a two-stage recipe: supervised with label-smoothed cross-entropy over valid schema outputs plus a Brier calibration loss, followed by Reinforcement Learning for Calibrated Decisions (RLCD) with (a) partial credit for ordinally-adjacent choices, (b) full-record precision reward, and (c) a reference-model penalty against distribution shift. Synthetic datasets permute field orders, prompts, and schema structures. The design acknowledges the published prior art it builds on: the DiffusionGemma logprob-exposure experiment from Cloudflare’s own earlier demos and Matt Mastracci’s vLLM PR for DiffusionGemma inference.

The RL fine-tuning service is architecturally the same decoupled env-compute / training-compute pattern RL Environment Platforms tracks, but with Cloudflare’s existing primitives filling each role: AI Gateway as the dataset-capture layer, Workers AI as the rollout generator against the base checkpoint, Containers as the RL sandbox, a new in-house Trainer for weight updates, and Workers AI BYO Model as the redeployment surface. Initial delivery is via FDE engagement; a self-serve platform is forthcoming.

Results

Jev Decision Index: Clef or Clef-flash leads 9 of 10 reported benchmarks; Clef-flash exceeds Clef on CLINC150+OOS macro-F1 (89.27 vs 66.77) and ToolRet nDCG@10 (65.28 vs 66.43 Clef), suggesting the smaller model is more selective on retrieval-style decisions.
TypeSafe workflow evals: Clef beats Jev on 3 of 4 — Invoice processing (Clef-flash 61.8 vs Jev 57.1), Customer service (Clef 76.3 vs 76.0), Security incidents (Clef 61.7 tie with Jev). Clef-flash’s Invoice processing win is notable given the parameter gap.
Latency (median / p95 ms across 43 benchmarks): Clef 209.3 / 238.6, Clef-flash 51.4 p95 (median unreported in the extracted table), vs Laya 38.8 / 211.2, Jev 524.1 / 536.0. Laya remains the latency leader; Clef trades latency for quality in benchmarks Laya loses on.
Production latency (Threat Intelligence): Clef 2.2s end-to-end domain classification (fetch + render + classify) vs gpt-oss-120b 4.7s, roughly 2× latency reduction with multi-category structured output.

Why it’s interesting

Clef is the second filed open-weights multimodal decision model after Open d1: Edge decision models for text, vision, and audio Liquid Open d1, and the first in the class to publish both an explicit training recipe (frozen-backbone + LoRA + Brier calibration + RLCD) and a managed RL fine-tuning product on the same page — closing the “how do operators actually customize these” question that Introducing System One Models & Jev (Jev) and Laya — Non-Autoregressive System One Decision Model (open-source RLCD) (Laya) left to third parties. The RLCD recipe matches Laya’s reward structure almost exactly (strictly-proper scoring rule as the only reward, reference penalty against distribution shift), suggesting the training-side design of the class is converging even as backbones diverge. The fine-tuning service is also the first filed instance of applying the verifier-cheap / action-expensive env-platform recipe tracked under RL Environment Platforms to decision-model customization specifically — one layer up from the SETA / Toolathlon-GYM / OpenReward abstraction, where “the environment” is a captured AI Gateway trace rather than a Dockerized task.