Kynox AI-1.0 -- unified medical-imaging ensemble

One endpoint, one contract, one report schema over a panel of frozen medical-imaging models. The panel is an implementation detail behind a single branded surface; consumers send a scan, receive a structured report.

What this repo actually is (read before loading)

This repo is not one set of weights and does not claim to be. It carries the fused ensemble artifact:

File Contents
manifest.json fused checkpoint manifest: contract hash, launch mode, modality routes, quorum, vote weights, per-task routes, external-bases policy
panel.json the full frozen-base routing table (33 routed bases, ~229.6B params, weighted)
contract.json the preprocessing contract the denoiser hook and serving agree on
adapters.json adapter registry state (0 trained adapters)
model_card.json parameter accounting and inventory
release.json version, totals, built-at
LICENSE proprietary terms for the ensemble contract

The frozen bases themselves are external references by HF id (they are hundreds of GB and remain under their own licenses). The artifact is one endpoint and one contract over an ensemble, not one merged model.

Because the bases are external, this artifact is loadable as-is: everything config-time is here; runtime pulls base weights from their upstream HF repos.

Advisory launch (state of the panel, in plain words)

  • 0/n adapters are trained. The last measured training run attempted 4 bases and failed 0/4 on dataset-loading bugs (wrong HF dataset configs / missing target columns -- evidence kept in the repo's panel_run.json).
  • The owner's launch decision (2026-10-23): serve the frozen bases anyway, stamped launch_mode: "advisory" in manifest.json. The fused loader's untrained-coverage gate is waived only for this stamped mode and replaces the refusal with a loud advisory component in every load report.
  • Every serialized report carries advisory_only: true and a panel_state: frozen-untrained:advisory field. IS_A_MEASUREMENT stays false on every quality claim until benchmarks run.
  • Override to strict on any deployment: -e KYNOX_LAUNCH_MODE=strict restores the refusal default (the panel then refuses to serve until trained).

Panel composition

  • Voters: 33 frozen bases (~229.6B params), medical-imaging-trained only; general-purpose VLMs were retired from voter seats on 2026-10-23.
  • Per modality: routes pick 4-6 voters per request from per-modality rosters (registry depth != residency); the roadmap is 10-15 pure-imaging voters per modality, ~50 unique models once fetches verify.
  • Text can never out-vote vision: the vision-majority cap bounds prose-tier weight per modality so vision-native evidence keeps >=50% of the weighted vote on every route (measured failure before the cap: text outweighed vision in 5/8 modalities).
  • Consensus across modalities/tasks: 5 served tasks (report, vqa, screening, segmentation, ehr_correlation); every task route can still reject a contested finding (load-time gate).
  • Writers: Lingshu-32B (drafter-1) + MedGemma-27B (drafter-2) -- prose producers only, they do not out-vote the panel.
  • Knowledge: MedCPT, BiomedBERT, SPECTER2 are retrieve-only (never vote, never write).
  • Modalities served: ct, mri, x-ray (cxr), pathology, ultrasound, mammography, retina, blood smear.
  • Denosier/reconstruction lane: preprocessor hook + contract hash, wired; MergeKit policy documented (composition for denoiser/adapter stacks only, never voters).

How to run it (built in, natively -- no panel code to write)

The container does the whole thing: CUDA + PyTorch base image, release build, load-time validation with the advisory stamp, then the API.

# 1. build the ensemble image
docker build -t kynox-ensemble:1.0 <this repo>/python/kynox-eval

# 2. run it on any NVIDIA GPU host -- ONE container, the whole experience
docker run --gpus all -p 8000:8000 -e HF_TOKEN=<your token> \
  -e KYNOX_API_KEY=<secret> \
  -v kynox-hf-cache:/root/.cache/huggingface \
  kynox-ensemble:1.0

# Modal account (owner's runtime lane): one command, same image
modal deploy scripts/modal_serve.py

Endpoints: GET /v1/healthz (carries panel_state), GET /v1/model, GET /v1/supported, GET /v1/voices (named voice presets), POST /v1/analyze (studies[] or inline base64; returns the fused report with findings, annotatable_findings, confidence, ICD-10 candidates, condition notes). Unified chat surface (OpenAI-SHAPED format, NO OpenAI cloud β€” every model behind it is open-source HF): GET /v1/models, POST /v1/chat/completions (text; one image with optional modality_hint β€” the scan auto-route reads the pixels and routes it, audio-in with whisper-large-v3-turbo, video parts, named voice to talk back; 262k session retention, barge-in retain-tail-then-finish, languages en/en-NG/ha/ig/yo/zu/sw with country defaults NG -> Nigerian English, text style mirrors the speaker), POST /v1/audio/speech (named presets, local TTS), POST /v1/audio/transcriptions (capture), POST /v1/warmup + GET /v1/warmup (route pre-heat so the first real scan pays zero cold cost; server UP <= 120 s). Set KYNOX_API_KEY to require an API key on the chat surface. CPU-only smoke works: healthz/model/supported/models/voices serve without weights.

Boot gate: on startup the container builds release artifacts if missing, then -- when a fused checkpoint is present -- runs full load validation (contract agreement, denoiser-contract match, per-route adapter coverage, quorum rejectability, task-route rejectability, vote-weight completeness). It refuses to serve on any structural failure.

Verification duties (what "loads natively" is verified by)

  • manifest.json is schema-checked and validated at load; it refuses to load when panel, adapters and disagreeing hashes are fused together.
  • Every modality route must have > quorum voters (a quorum that cannot reject a contested finding is a vote counter, not a safety control).
  • Task-conditioned routes must individually be able to reject.
  • Vote weights must cover every tier present on a route (no accidental full-strength voters).

Limitations (all current, all enforced)

  • Untrained panel (advisory). Findings are uncalibrated; confidence has no measured calibration; treat every output as a second-opinion draft for a clinician, never autonomous diagnosis.
  • No measured benchmarks yet. Eval cards ship in smoke mode. Projections live on a separate endpoint (/v1/projection) so they cannot be quoted as measurements.
  • Gated bases need the deployer's HF token (MedGemma license gates demo publication too).
  • Genomics is a documented non-goal (datasets stay quarantined; no genomic expert is routed).
  • Speech is open-source-only, pulled at first GPU boot. Capture = openai/whisper-large-v3-turbo (MIT). Talking voices = 8 named presets (5 female + 3 male incl. deep bass) via hexgrad/Kokoro-82M (Apache-2.0); the guaranteed Nigerian accent activates locally with a ~30s reference clip per preset (myshell-ai/OpenVoiceV2, MIT). Until those snapshots are resident, lanes return an honest weights-pending state β€” never fake audio, and NO cloud API is called by this artifact at any time.
  • Scan auto-route is honest: retina/path/smear route from pixels; grayscale scans ask ONE question instead of shipping a fabricated guess; every auto-route is stamped on the downstream report.
  • Video is frames-first: chat accepts video parts and answers with the frames plan; server-side decode activates only where ffmpeg/opencv/av exists in the deploy.
  • Precision: bf16 reference everywhere; int8 (the best middle) for

    =14B generatives and writers (half of bf16 VRAM at ~99% quality – the "200-240 GB" ballpark); int4 never shipped on segmentation/calibration heads unmeasured (the rumour is TRUE for heads); fp32 rejected (2x VRAM, zero inference gain).

Boot budget: under 2 minutes, no error drain

  • Server is UP inside a 120-second budget (artifacts are pre-built into the image; the boot gate is structural, no weights). Route weights stream on demand; KYNOX_PREHEAT=routes (default) starts a background warmup at API startup so the first real scan pays zero cold cost. POST /v1/warmup / GET /v1/warmup expose the same mechanism (start + live progress per route).
  • Precision is operator-selectable via KYNOX_PRECISION (fp32|bf16|int8|int4). The owner pick (2026-10-24) is fp32, honoured first-class: a base too big for the GPU OOMs in seconds and reports degraded β€” capacity is never faked, and a boot never wastes 5-7 minutes discovering a bad fit.

Files

See ADAPTERS.md for the evidence-backed adapter state, summary_stats.md for honest statistics about the project state.

Disclaimer

Not for autonomous diagnosis. A qualified clinician must review every output. Outputs on African-population imaging may degrade outside the coronial training distributions of the frozen bases until the measured validation cohort completes.

Downloads last month

-

Downloads are not tracked for this model. How to track
Inference Providers NEW
This model isn't deployed by any Inference Provider. πŸ™‹ Ask for provider support