Mistral Large 4 weights: 1.06 TB at FP8, about 52 GB read a token, and a cyber lead its chart lacks

The FP8 weights are 1,060.6 GB, and each token reads about 52 GB of them

Mistral AI released the weights of Mistral Large 4, nicknamed Le Chonk, on 29 October 2026. The public file listing on Hugging Face, read from 18:25 GMT that day, gives the size of the official FP8 checkpoint as 1,060,554,587,912 bytes in 54 files, and of the NVFP4 checkpoint as 610,042,251,312 bytes in 32 files. That is 1,060.6 GB and 610.0 GB in decimal units, a ratio of 1.74 to 1 (derived). Mistral calls the model a 1 trillion parameter mixture of experts. Its own documentation page says 1.05 trillion, and from the model's configuration file the routed experts alone come to 1.029 trillion parameters (derived: 71 sparse layers times 128 experts times 113,246,208 parameters each).

The model card says 49 billion parameters are active for each token, or 52 billion with the embedding and output layers. A decoded token has to read those weights from memory, and from the configuration this site derives about 51.5 GB read per token at FP8 and about 33.9 GB at NVFP4 (both derived, method below). So the 1.74 times saving in storage becomes a 1.52 times saving in the bytes each token reads, because the attention blocks and the output layer stay in higher precision. Mistral's launch material gives neither number.

What this arithmetic does not establish is speed, accuracy or safety. Every speed figure below is a bandwidth ceiling, an upper bound that ignores batching, interconnect and expert placement. The rest of the briefing is about the claims on top of that arithmetic. Mistral's post says the model is the best open weight model for coding. Its own cyber chart, read as published, shows two other open weight models above it. The independent pages read on the day, from Artificial Analysis and Vals AI, put it behind several open weight rivals on their composite scores, at a cost per task that is sometimes several times higher. The model is French and the weights are free to run, with one licence condition that matters to anyone who hosts it for others.

What it takes to run: the weights fit, the margins do not

The model card's own serving command for the FP8 checkpoint uses 8 GPUs with tensor parallelism and sets the memory fraction to 0.85. On 8 NVIDIA H200 GPUs, NVIDIA's product page gives 141 GB and 4.8 TB/s each, so 1,128 GB and 38.4 TB/s together (derived). The FP8 weights fill 94.0% of that, leaving 67.4 GB for everything else. At the card's 0.85 setting only 958.8 GB is usable, 101.8 GB short of the weights (derived). Hugging Face's launch post says it ships a recipe on 8 H200 GPUs through its Inference Endpoints, with 131K tokens of context and up to 16 requests at once. The flags are not printed. Inference: the weights alone need at least 94.0% of that memory, so the recipe cannot use the card's 0.85; what it uses is not stated.

Zoom

How far the measured speed sits below the ceiling is the useful number. Hugging Face reports about 65 tokens a second for a single request on the 8 H200 recipe, and 120 to 138 on chat prompts where the draft head's guesses are accepted. Against the 745 tokens a second ceiling that is 8.7% for one request and 18.5% at the best chat figure (derived). The ceiling counts only the weight reads, which is why the gap is large: the all to all traffic between GPUs, the router, the indexer and the attention are not in it. Hugging Face also reports about 480 tokens a second in total across 1,000 ShareGPT conversations, which is a different thing: it is throughput, not the speed one user sees. Artificial Analysis measures 161.3 output tokens a second on Mistral's own API, on hardware and settings Mistral does not state.

Two smaller facts matter to a buyer. Mistral's card says an NVFP4 checkpoint targets Blackwell GPUs (B200, B300, GB200, GB300) and claims the same performance as FP8; the evaluation image on the NVFP4 card was not readable as text, so the size of any difference is not stated here. And the 2 bit files that run on a 512 GB Apple machine are made by the llama.cpp team, not by Mistral. Whether a 2 bit version holds the benchmark scores in the launch post is not stated anywhere.

The cache: 36,288 bytes a token, and what the card does not say about it

Hugging Face's post says the attention blocks combine Multi head Latent Attention with a sparse attention indexer, and the configuration shows how small that makes the cache. Each layer that keeps a cache stores 512 latent values plus 64 positional values per token, 576 in all (kv_lora_rank and qk_rope_head_dim in config.json). The kv_source_layers list shows that 63 of the 72 layers hold their own cache and 9 (layers 39, 43, 47, 51, 55, 59, 63, 67 and 71) read the cache of layer 35. That is 36,288 values a token. params.json sets an FP8 cache, so about 36,288 bytes a token, or 38.05 GB for one sequence of the full 1,048,576 tokens, and 76.1 GB if a server runs the cache in BF16 (all derived).

Zoom

For comparison, plain multi head attention at this layout (64 key value heads, key width 128, value width 128, 72 layers) would hold 1,179,648 values a token, 32.5 times as many (derived). That is the sense in which a 1 million token context is practical here at all. The sparse indexer caps what attention reads at 2,048 positions for each query, so the cache reads for one decoded token are at most about 74 MB (derived: 2,048 times 576 times 63 at one byte), small beside the 52 GB of weights. The indexer itself must still score earlier tokens, and the card does not state its key cache layout. If each of its 44 full layers kept one 128 wide FP8 key per token, that would add 5.91 GB at 1,048,576 tokens, 15.5% on top of the latent cache. That is an assumption, not a figure from the card, and it is not in the diagram.

What the cache arithmetic means for a deployer is concurrency. On the 8 H200 recipe, 67.4 GB is left after the FP8 weights. Sixteen requests each at the full 131K context would need 76.1 GB of FP8 cache (derived), more than is left, so the recipe depends on requests being shorter than that, on prefix sharing, or on a higher memory fraction than the card shows. The FP8 command on the model card does not set a cache type. The NVFP4 card does, with a flag that it calls needed for that checkpoint (kv-cache-dtype fp8_ds_mla). What a default FP8 server does about the cache type is not stated.

Who ran each number, and what the independent record shows

A vendor chart is a claim. Mistral's post is explicit about the leaders it claims: the best open weight model for coding, the lead on FrontierCode and Terminal-Bench, a tie on the Artificial Analysis Coding Agent Index, and a model card line that calls it state of the art among open weight models for security work. The table separates who ran each number from what the pages of the benchmark owners show. Cost per task is beside every score that has one.

Zoom

None of these is a finding that the model is poor at coding. The Coding Agent Index puts it at 48.3%, among the open weight models on that page, at a cost per task that is lower than GLM-5.3's and higher than the cheapest rows. It is a finding about the wording. Best open weight coding model is a statement about a 0.4 point lead on one private benchmark and a 1.4 point lead on another, with no intervals, set against composite indexes that rank it 8th of 19 and 17th of 30, and against two open weight rivals that cost far less per test.

The cyber claim: 51 in Mistral's chart, 82 in Hugging Face's post, 79.4 on the benchmark owner's page

Cybersecurity is the post's headline theme, so it is the claim worth reading line by line. Mistral's chart of the Artificial Analysis Cyber Index shows Mistral Large 4 at 51%. The bars beside it are 34, 36, 41 and 50 for four rivals and 56 and 57 for MiMo V2.6 Pro and DeepSeek V4.1 Flash 1017. Two open weight models are above it in Mistral's own chart. The model card nonetheless says state of the art among open weight models for security work.

Zoom

Hugging Face's launch post says something different about the same index. It says the model scores 82% on the test of reproducing and then patching a real vulnerability, the highest reported score on it within the index, and that it ranks among the top five models globally on the Cyber Index. Artificial Analysis's own CyberGym E2E page, read the same day, lists Mistral Large 4 (High), the released model, at 79.4% on that test and the Mistral Large 4 Preview at 81.7%. The preview is not an open weight model. Kimi K3.1 Pro, which Artificial Analysis's data does not mark as open weights, is first at 94.7%. On the Cyber Index itself the same data gives Mistral Large 4 (High) 50.9, seventh by index value among the models in the table. Among open weight models, 79.4% is the highest CyberGym score, but the margin over MiMo V2.6 Pro's 78.6% is one task of 131 (derived: 104 against 103).

Read the table by its parts. Mistral Large 4's Cyber Index is held down by DeepsecBench-AA, where it scores 15.0 against 24.9 and 26.2 for the two open weight models above it, while its CyberGym score is the best of the open weight group. That is a mixed profile, and it is what a defender needs to know before choosing the model for vulnerability triage rather than the one the headline suggests. Cost is not in the Cyber Index page text that was read: the cost per task chart on it is drawn by script, so no cyber cost figure is quoted here.

Two more differences between the posts are worth recording because they are the same kind. Mistral's post says the model resists 97.1% of attacks on the B3 agent security benchmark, against 93.3% for the preview. Hugging Face's post says 93.3% attack resistance on Lakera's B3 benchmark. 93.3% is the preview's figure in Mistral's chart and also GLM-5.3's. Hugging Face's post also contains a curl example whose model name is "muse-spark-open", which is a different vendor's model, apparently left over from another post's template. It is a small reason to read quickstart commands before pasting them. A reader who wants the Muse Spark Open numbers on the same terms can read this site's briefing on that release.

What Mistral says about safety, and what open weights change

Mistral's post makes three safety statements. First, an average refusal rate of 96.6% on malicious cyber requests, the highest it measures among open models, computed on the cyber related prompts of JailbreakBench, StrongREJECT and AgentHarm; its chart shows 94% for Kimi K3, 87% for GLM-5.3, 84% for Gemma 4 31B and 51% for DeepSeek V4 Pro. The post calls it a rate Mistral measures and gives no prompt count. Second, that the model handles legitimate defensive tasks without unnecessary refusals; Artificial Analysis records a refusal rate of 0 for it on CyberGym E2E, CWE-Bench-AA and DeepsecBench-AA, where several closed models are blocked on nearly all CyberGym tasks. Third, and the sentence that matters most: after the preview, Mistral monitored cyber related use in its live traffic and wrote that it sees "a potential for uplift to conduct real attacks" and is modifying its guardrails accordingly.

The post says that observation came from live traffic, which means the hosted service. It does not say whether the weights released today contain the modified guardrails, and the weights cannot be changed once downloaded. Mistral also says a specialised cyber variant is given to enterprise design partners under vetting and contractual safeguards, with testing restricted to owned or authorised systems. That variant is not what was released. The post and the model card publish no system card, no evaluation of how easily the refusals are removed by fine tuning, and no external red team report. Absence from those pages is not evidence that none exists, but none was found.

Mistral's post carries statements from about twenty named companies and bodies, including security vendors, a bank, an agency of the European Union and a cloud provider. They are endorsements of a kind the vendors chose to give, and most say tested, evaluating or experimenting rather than reporting a result. The statement from Booz Allen says the model matched recall rates of other frontier cyber models on its internal source code benchmark with a cost curve it calls compelling; it gives no figure. Cisco and Fortinet speak about open weight models in general; CrowdStrike says its work tests how well frontier AI reasons through vulnerabilities; Elastic says Mistral models are supported in its security product; Zscaler says its offerings now integrate with Mistral. None of the statements reports a measured result that can be checked.

What the UK AI Security Institute has published on open weight cyber risk

The launch has no UK angle of its own: the model is French, the post and card state no UK availability or data residency, and no UK regulator statement about it was found. The UK government's AI Security Institute has, however, published two pages on this very question, which are the nearest independent evidence on what the post's refusal figure means. Its blog of 17 July 2026 reports that the open weight models GLM-5.2 and DeepSeek V4 Pro perform like closed frontier models released 4 to 7 months before them on its cyber evaluations, narrower than the 6 to 10 months it measured through most of 2025. It adds that refusal training is "often easily reversible with access to the weights" and that its own tests of recent open weight models were largely unimpeded by safeguards.

The Institute says it will test further open weight models. A search of its site map, 218 pages, read on 29 October 2026, found no page naming Mistral or Mistral Large 4, so there is no UK government evaluation of this model to cite. The 96.6% refusal figure in the post is therefore a vendor measurement on public prompt sets, and the Institute's published findings on comparable models suggest it says little about a determined user with the weights.

"Open": what the label covers, and what the licence says

Mistral's post says the model is released with open weights and calls it "Fully open-weight" in the summary box at the top and "a modified MIT license" for the terms, with "a single condition". It uses the word sovereign throughout. The licence file is named the Mistral Ecosystem Open Weight License (the card's header says license: other), and Mistral's documentation page labels it version 26.10. The Hugging Face post calls it an MIT derivative that establishes limitations for model as a service offerings.

Read from the licence file itself, it grants use, copying, modification, merging, publication, distribution, sublicensing and sale of the model, including weights, parameters and configuration files, and permission to run, deploy, further train and make derivative works. Three conditions follow. First, the copyright notice stays in all copies. Second, if the licensee or any of its affiliates operates a Model as a Service business, the licensee must enter into a separate commercial licence with Mistral before using the model or its derivatives for any commercial purpose. Third, that second condition does not apply to internal use, defined as any use that does not make the model or its derivatives available to third parties, or to any use of the model accessed through Mistral's official products.

Three details differ from the post's one sentence summary. The condition reaches affiliates, so a group whose subsidiary runs an inference business is caught for the whole group. It covers any commercial purpose, not just the hosted service. And Model as a Service is defined broadly: giving a third party access for inference or post training by any means, such as an API or hosted endpoints, in a way that lets them exercise meaningful control over the inputs, parameters or training data. End user products with the capability embedded in specific features, and mere relaying of requests to models hosted by others, are excluded. This is this site's reading of the text, not legal advice, and where a particular business sits against that definition is a question for counsel. The licence does not name any host. The post says Microsoft Foundry offers the model and NVIDIA hosts it; the terms under which they do so are not stated.

There is no acceptable use policy in the licence file. The card's README adds one sentence, outside the licence, that the model must not be used in a manner that infringes a third party's rights. Artificial Analysis's page says commercial use is allowed with restrictions, and its charts have a separate category for open weights with commercial use restricted.

The Open Source Initiative's Open Source AI Definition, version 1.0, read in full, is stated only as a definition. It requires the freedom to use a system for any purpose without having to ask permission, and for the preferred form of modification to include data information sufficient for a skilled person to build a substantially equivalent system, the complete source code used to train and run it, and the parameters, all under approved terms. Against it, this release has parameters under a licence with a commercial permission step for one class of user, and the files read contain no description of training data and no training code. Mistral says a full technical report is coming soon. Mistral itself says open weight, not open source, which is the narrower claim.

Two other labels deserve the same test. Sovereign, in the post, rests on the model being trained from scratch in Europe with clear lineage from inception to release. The card says it was trained on 3,800 NVIDIA Grace Blackwell GPUs in Mistral's own datacenters in Europe. The location and the owner of the datacentres are stated; the accelerators are a US vendor's, and the data, the lineage documents and the training compute are not published. Defenders, in the post's tagline Trusted by Defenders, is addressed above: the measured cyber profile is mixed and the safety evidence is the vendor's own.

What the launch states, and what it leaves out

Mistral's interest is plain: it sells the hosted model through its API and Studio at 0.70 dollars per million input tokens, 0.07 for cached input and 2.10 for output, sells customisation through Forge and applied AI services, and the licence asks businesses that host the model for others to buy a commercial licence from it.

Technical details

The primaries print serving commands, configuration and file listings rather than indicators. Each block below is copied from the file named in its caption, read on 29 October 2026. They are what a deployer needs to size and pin the release. No exploit or weaponisation material is involved.

The serving command for the FP8 checkpoint on the model card. It sets 8 way tensor parallelism and a 0.85 memory fraction, which is the setting this briefing tests against 8 H200 memory.

docker run --runtime nvidia --gpus all \
  -v ~/.cache/huggingface:/root/.cache/huggingface \
  -p 8000:8000 \
  --ipc=host \
  vllm/vllm-openai:mistral-large-4 \
  --model mistralai/Mistral-Large-4-1T-A52B \
  --tensor-parallel-size 8 \
  --tool-call-parser mistral \
  --reasoning-parser mistral \
  --enable-auto-tool-choice \
  --gpu-memory-utilization 0.85

The NVFP4 command, which adds the cache type flag the card calls needed for that checkpoint and runs on 8 GPUs; the SGLang command on the same card uses 4.

docker run --runtime nvidia --gpus all \
  -v ~/.cache/huggingface:/root/.cache/huggingface \
  -p 8000:8000 \
  --ipc=host \
  vllm/vllm-openai:mistral-large-4 \
  --model mistralai/Mistral-Large-4-1T-A52B-NVFP4 \
  --tensor-parallel-size 8 \
  --kv-cache-dtype fp8_ds_mla \
  --tool-call-parser mistral \
  --reasoning-parser mistral \
  --enable-auto-tool-choice \
  --gpu-memory-utilization 0.85

The lines from config.json and params.json that fix the cache and the expert layout. The cache size in this briefing is derived from kv_lora_rank, qk_rope_head_dim, the 63 distinct entries of kv_source_layers and the FP8 cache setting; the expert arithmetic uses the others.

"dtype": "bfloat16",
"quant_method": "fp8",
"weight_block_size": [
"hidden_size": 6144,
"index_topk": 2048,
"kv_lora_rank": 512,
"max_position_embeddings": 1048576,
"moe_intermediate_size": 6144,
"n_routed_experts": 128,
"n_shared_experts": 1,
"num_attention_heads": 64,
"num_experts_per_tok": 4,
"num_hidden_layers": 72,
"qk_rope_head_dim": 64,
"vocab_size": 204800,

params.json:
"fp8_indexer": true,
"fp8_kv_cache": true

File sizes and revision identifiers as listed, so a deployer can record what was pinned. The Hugging Face programming interface gave these commit identifiers for the two repositories at the time of reading; they will change if Mistral updates the files. The release publishes no separate hash list or signature, so recording the revision and checking every shard size against the listing is the only provenance check available from the primary pages.

mistralai/Mistral-Large-4-1T-A52B (FP8)
  revision f12dabdc0c1e99e7f7924461a6f308859b05af4d
  54 safetensors shards, 1,060,554,587,912 bytes
  index metadata total_size 1,060,548,427,328

mistralai/Mistral-Large-4-1T-A52B-NVFP4
  revision bb6d00fe249b0e876f0cffc6b85014be02de3e68
  32 safetensors shards, 610,042,251,312 bytes
  index metadata total_size 610,030,457,408

The licence's definition of the one restricted business, as printed in the file. It is the text a lawyer should read before anyone hosts the model for a third party.

"Model as a Service" means giving a third party access to the Model or its derivative works for inference or post-training by any means (for instance via API or hosted endpoints), in a manner that allows such third party to exercise meaningful control over the inputs, parameters, or training data. This does not include (a) end-user products with model capabilities solely embedded within specific features or harnesses, or (b) mere relaying of requests to models hosted by others.

How the per token figures were derived. Experts: 113,246,208 parameters each, 5 active (4 routed and 1 shared) in each of 71 layers, 40.2 billion. The remainder of the card's 49 billion, 8.8 billion, is attention, the first dense layer, routers and the indexer, counted at one byte. The 1.26 billion parameter output layer is BF16, two bytes. For NVFP4 the experts are counted at 0.5625 bytes a parameter, which is what the file sizes imply (derived: the NVFP4 total minus the unchanged non expert bytes, over 1.029 trillion expert parameters, is 4.50 bits). The format's own definition was not read, so the one scale per 16 values is an inference from sizes. Result: 51.5 GB at FP8, 33.9 GB at NVFP4.

What to do, in order

The question the launch leaves open

Mistral says the model refuses 96.6% of malicious cyber requests. In the same post it says that, watching live traffic, it sees potential for uplift to conduct real attacks. The weights are now on any machine that downloaded them, and the refusals live in the weights. Which of those two statements does your risk register rely on, and who tested it on your own deployment?

Key facts