Muse Glimmer 30B: An Open-Source On-Device Agent Model for Consumer-Grade Hardware

Publicly available consumer-grade models lack the multi-step reasoning, tool calling and handling of private context needed for autonomous agents.

• Setting: the authors state that recent large models are strong at complex reasoning, program synthesis and tool-augmented problem solving, but a gap remains between cloud proprietary systems and what developers can use locally.
• Existing shortcomings: the authors state that many public models for consumer hardware are trained as general-purpose systems and lack sustained multi-step reasoning, robust tool calling, and principled handling of private user context.
• Model: Muse Glimmer is an approximately 30B dense causal language model distilled from Meta's frontier model Muse Spark, with a perception encoder, targeting fully local operation on devices with 32GB of dedicated memory without relying on cloud infrastructure.
• Contributions listed by the authors: releasing the model with full-precision weights, about 4-bit weights and the DFlash speculative head (Apache 2.0); the authors state that targeted distillation from a frontier teacher can yield smaller models with fewer parameters; choosing dense over MoE under this memory constraint; and adapting to edge hardware with 4-bit quantization plus speculative decoding. The authors state that on tool use, multi-step planning and task completion it sets a new standard for the same size relative to Gemma4-31B and Qwen3.6-27B.
• Safety-related objectives: post-training adds contextual-integrity-style information flow constraints, plus resistance to indirect prompt injection in data returned by tools, refusal of harmful requests and a principal hierarchy. The paper does not frame these as a standalone attack or defense paper.

On-device small language models

• Llama series (Touvron et al., 2023a,b; Grattafiori et al., 2024): The authors state that it performs well relative to frontier models and has brought about an ecosystem of quantization, speculative decoding, and local inference tools. The paper does not list it as an experimental comparison.
• Phi-4 (Abdin et al., 2024): 14B, trained mainly on curated synthetic data.
• Gemma 4 (Gemma Team et al., 2026) and Qwen3 (Qwen Team, 2025): The former has 2.3B to 31B dense models and MoE variants, and uses quantization-aware training and KV cache optimization to fit memory; the latter covers 0.6B–235B, places non-thinking and thinking reasoning in the same model, and covers 119 languages. The authors state that these families form the small-model landscape in which they position their 30B model.

Teacher-student distillation

• DeepSeek-R1 (Guo et al., 2025): The authors state that reinforcement learning can elicit chain of thought, and that the trajectories are then distilled into 1.5B–70B students, and that these students outperform models of the same scale trained from scratch.
• Qwen3's strong-to-weak on-policy distillation: The student samples on its own, and the teacher provides token-level KL. The paper writes that this yields gains over off-policy distillation that only imitates the teacher's outputs.
• Self-Distilled Reasoner (Zhao et al., 2025) and AsyncOPD (Kang et al., 2025): The authors state that they further examine the sample efficiency of on-policy distillation. The authors state that their post-training uses Muse Spark for on-policy distillation, and that they consider it better for the target size than reinforcement learning alone.

Agent frameworks

• ReAct (Yao et al., 2023), Toolformer (Schick et al., 2024), Gorilla (Patil et al., 2023): Interleave reasoning and action, or learn API calls during pretraining/fine-tuning.
• FireAct (Chen et al., 2023), Agent-FLAN (Chen et al., 2024): Fine-tune with multi-step agent trajectories. The authors state that it outperforms prompting-only baselines.
• OpenClaw, SWE-agent (Yang et al., 2024), OpenHands (Wang et al., 2024a): Local orchestration or software engineering agents. The authors use them to illustrate the need for continuous tool calls, multi-step planning, and failure recovery in long sessions, and state that their model targets these capabilities through agent alignment training.

Baselines and benchmarks

• Baseline models: The main scorecard compares against Gemma4-31B (thinking) and Qwen3.6-27B (thinking). The teacher Muse Spark does not appear in this comparison table.
• Benchmarks: Table 2 covers agents and coding, tool use, reasoning, instruction following, multimodality, long context, multilingual, privacy and safety; Appendix Table 5 and Appendix A supplement TauBench, ARC-AGI, PrivacyLens, translation benchmarks, etc. The authors state that all benchmarks underwent contamination screening.

The authors position this paper as: under a 32GB VRAM constraint, using frontier teacher distillation to obtain a 30B dense model that can perform autonomous agent tasks on consumer hardware, rather than a general small model or a prompting-only agent.

Muse Glimmer is a dense causal language model with a perception encoder: it first does logit distillation and mid-training from Muse Spark, then becomes a tool-calling agent through SFT, on-policy distillation and multi-objective RL, and finally is adapted for single-card edge inference with weight quantization and DFlash speculative decoding.

Architecture and the 32GB constraint

• Scale: about 29.6B total parameters. The language model is about 25.16B, 52 layers, hidden dimension 6656; the untied word embeddings and output projection are about 1.34B each; vocabulary 202,048; context 128K+ (Table 1). FFN is SwiGLU with intermediate dimension 19,968.
• Attention: GQA with 32 query heads and 2 KV heads, head dimension 128. The pattern is a repeat of three local layers plus one global layer, sliding window 2048, and uses gated attention. RoPE θ is 500,000, applied only to local layers; the authors state that global layers rely on the positional signal accumulated by the surrounding local layers and are therefore extensible.
• Multimodality: the perception encoder is about 1.8B, a ViT-G/14, 50 layers, width 1536, patch 14, processed at native resolution with a reference grid of 448 px. The output goes through 2×2 pixel-shuffle and two MLP layers, then is projected into the language model. A 448×448 image yields 256 visual tokens; higher resolutions yield at most 4096 output tokens. The encoder stays frozen during training. Video can be input as a sequence of frames; the authors state it was not specifically optimized for video.
• Why dense: candidate architectures were compared on dense versus 1:8 and 1:16 MoE ladders under the premise of fixed inference memory that fits in 32GB VRAM. The dense ladder is 550 TPP, the MoE ones 2,800 TPP and 6,000 TPP. The authors state that the scaling curves in Figure 1 show that, under training-compute and parameter-scale constraints, dense is 2×–2.5× more compute-efficient than MoE, so dense 30B was chosen. Two configurations of simplified MLA underperform GQA on long-context benchmarks such as RULER, so GQA was kept. The paper does not give RULER scores.

Pretraining and mid-training

• Tokenization and data: uses Llama 4 BPE, 200,000 base tokens plus 2,048 special tokens. The training mix for the base vocabulary is 35% code, 35% multilingual, 15% math, 15% English. Pretraining data includes web pages, code, math, multilingual text and images, with a knowledge cutoff of 2026-01-04, and was decontaminated against the benchmarks.
• Distillation target: records the top 256 logits from Muse Spark pretraining. The first 95% uses only KL; the last 5% switches to cross-entropy against the true labels, which the authors state is to handle the truncation bias of top-k logit distillation.
• Checkpoint averaging: the last 5% is saved every 200 steps, 84 checkpoints in total. Uniform averaging, WMA and EMA were compared. The final recipe is uniform averaging of the last checkpoint with three checkpoints spaced 600 steps apart. The authors state that relative to a single final checkpoint, every perplexity evaluation improves, with larger gains on smoother benchmarks. The paper does not give perplexity numbers.
• Two-stage mid-training: stage 1 adds synthetic reasoning and structured problem solving on top of the soup initialization, with a learning rate below the pretraining peak, to balance the gains from synthetic objectives against perplexity regression on organic data. Stage 2 extends context from 32K to 128K, adds tool use, agent trajectories and demonstrations produced by synthetic pipelines, and switches to cross-entropy; the authors state that long-context and agent data make teacher logits less reliable at this stage.

Post-training and reasoning levels

1. SFT aligns task formats, instruction following and reasoning style, about one epoch per dataset.
2. On-policy distillation: the student Muse Glimmer samples on its own, and the teacher provides per-token distribution targets on prefixes the student has visited. The authors state this is to mitigate the train–inference distribution shift, and that this stage improves downstream RL relative to going straight from SFT to RL.
3. Multi-objective RL: targeting reward models, verifiers and task-success signals, including reasoning, agents and RLHF.

• Teacher trajectories: trajectories with reward above some threshold are kept from multiple RL and RLHF runs of Muse Spark, preferring later checkpoints. The paper does not state the threshold. Trajectories containing references to the teacher's identity are excluded. Evaluation metadata, prompt echoes and unsupported tool traces are removed.
• Reasoning effort: during RL, samples of the same prompt are split into subgroups and a length penalty is applied according to the specified effort. At inference, low, medium, high or xhigh is specified in the system prompt. The authors state high is the default for agent tasks. Some prompts are routed only to higher effort, the rest go through the full spectrum; the authors state this balances capability and step count, and that full-spectrum training regularizes high-level chain-of-thought length.

Synthetic data, information flow and safety training

• Synthetic environments: simulate email, calendar, documents, messages, code repositories and common command lines in Docker, with access to real web pages. Each persona has 10–14 contacts, plus weeks of correspondence, schedules and documents. Tool parameters and JSON return formats align with their real counterparts. Scenarios first propose goals from a universe summary, then are written into runnable tasks and generate verifiable rubrics.
• Filtering: trajectories that are incomplete, duplicated, incoherent or break the fourth wall are removed; even if the goal is achieved, tool calls and memory retrievals judged undesirable are not counted in the training loss. Post-hoc judgment removes trajectories with hallucinations, false success or unverified results.
• Information flow: principles come from contextual integrity, looking at sender, receiver, data type and transmission principle. SFT uses synthetic traces from Muse Spark; the system prompt used during generation is removed before training. Traces that overshare, fail to share when they should, or fail to complete the task are discarded. RL penalizes oversharing and rewards correct sharing of necessary information. Traces cover single-turn and multi-turn tool use.
• Adversarial robustness and refusal: training to ignore adversarial content in tool returns, refuse unsafe subtasks while completing the safe parts, and obey the principal hierarchy when resolving conflicting instructions. Safety traces are generated via Muse Spark with the pipeline in Section 6.2, using rejection sampling with a charter-aware constitution. Traces that yield to adversarial instructions, over-refuse or fail to complete benign goals are discarded. RL penalizes executing actions planted by the attacker while rewarding task completion and explicitly recognizing untrusted content in the chain of thought. This paper does not reproduce injection strings or refusal templates.

Quantization and speculative decoding

• Quantization: BF16 weights are 55.7GB. The language weights target under 20GB, leaving memory for the unquantized KV cache, draft model and perception encoder. Candidates are screened by ∆NLL relative to BF16 on held-out text and code, then put through downstream reasoning and agent evaluations. For 32GB deployment, EvoPress (weights 19.65GB) is chosen for the lowest validation loss; for 24GB, Q4KM is chosen for the smallest memory footprint.
• DFlash: the draft model has 5 layers, block size 16, sliding window 2048, 32 query heads and 8 KV heads, sequence length 128k; hidden features are taken from layers 1, 13, 25, 37, 49 of the target model's 52 layers (Table 4). It is trained offline on on-policy rollouts of the target model on SFT and RL prompts, with the D-PACE objective. The paper does not report acceptance rate or speedup.

Experimental setup

• Models: the evaluated model is Muse Glimmer, with reasoning levels low, medium, high, xhigh. The comparisons are Gemma4-31B (thinking) and Qwen3.6-27B (thinking). The main comparison in Table 2 uses Muse Glimmer at high.
• Benchmarks and sizes: Table 2 has 26 rows covering agents, tools, reasoning, instruction, multimodal, long context, multilingual and privacy safety. Sizes stated in the appendix include: WildClawBench 60 tasks, GAIA2 public repository 800 tasks, GDPval-AA 220 tasks, OSWorld-Verified 361 tasks, SWE-Bench Verified 500 and SWE-Bench Pro 731, Terminal-Bench 2.1 89 tasks, MCPAtlas 500 public tasks, DeepSearchQA 900 questions, AIME 2026 30 questions, GPQA Diamond 198 questions, HLE text subset 2,158 questions, AA-LCR 100 questions, BEAM-128K 400 conversation segments, CIMemories 2,500 scenarios, Siren AgentDojo 949 injection scenarios, PrivacyLens 493 prompts, OmnilingualGAIA2 in 10 languages.
• Metrics: Table 2 notes that higher is better except for those marked ↓. Lower is better for CIMemories violation, PrivacyLens leakage and Siren ASR@5. Siren also reports utility. Translation uses chrF++. Quantization uses average accuracy (%) and average response length.
• Judging: varies by benchmark, with no unified judge. For example, GAIA2, PinchBench and DeepSearchQA use gpt-oss-120b; WildClawBench and BEAM-128K use GPT-5.4; MCPAtlas uses Gemini 2.5 Pro with a pass threshold of 0.75; CIMemories and PrivacyLens use Claude Sonnet 4.6; Siren's attack model is Claude Opus 4.6, up to 6 iterations, with success and utility judged by rules. AIME, ScreenSpot, LiveCodeBench Pro and others are judged by rules or execution.
• Sources and repetitions: Appendix A distinguishes internal runs, Artificial Analysis and model-provider self-reports. Repetition counts also vary by benchmark, e.g. 3 for GAIA2 and WildClawBench, 4 for MCPAtlas, OSWorld, SWE-Bench, DeepSearchQA, IFBench and others, 10 for AIME 2026, 8 per question for LiveCodeBench Pro. The authors state all benchmarks were screened for contamination.
• Quantization setup: Table 3 compares BF16 with several post-training quantizations, with metrics being average accuracy and average response length on 15 downstream benchmarks. The paper does not list the names of these 15 benchmarks.

Main results

According to Table 2. The three columns are, in order, Muse Glimmer (high), Gemma4-31B (thinking), Qwen3.6-27B (thinking). Rows not marked ↓ are higher-is-better.

Swipe horizontally to read the table

Evaluation	Muse Glimmer	Gemma4-31B	Qwen3.6-27B
MCPAtlas	75.5	54.2	62.5
GAIA2	43.3	36.4	40.0
SWE-Bench Verified	76.0	66.6	77.2
OSWorld-Verified	65.9	58.5	75.6
TerminalBench 2.1	51.7	43.4	60.7
Omnilingual Gaia2	60.4	37.5	45.0
Siren ASR@5 ↓	28.4	25.6	40.3
CIMemories violation ↓	26.4	12.1	53.4

• Authors' summary: the authors state that Muse Glimmer sets a new standard on same-size tool use, multi-step planning and task completion, and the conclusion also states it surpasses same-size open-source models on agent benchmarks. Not every row in Table 2 has Muse Glimmer highest.
• Other rows in the same table: order is still the three. AIME 2026 is 94.7, 89.2, 94.1; AA-LCR is 80.0, 68.3, 73.3; GDPval-AA is 953, 811, 1141; GPQA Diamond is 83.5, 85.7, 84.2; HLE is 22.0, 23.6, 23.1; SkillsBench is 44.3, 32.4, 46.6; Siren utility is 94.2, 90.8, 92.7; CIMemories coverage is 64.8, 53.0, 66.9.
• Comparability: τ³-Banking, GDPval-AA, SciCode, TerminalBench 2.1, GPQA, MMMU-Pro, HLE, AA-LCR come from Artificial Analysis. Qwen's SWE-Bench Verified score, the two comparisons for AIME, Gemma's IFBench and Qwen's CharXiv are self-reported. SciCode and AA-LCR are taken from before release, and the authors state they do not account for changes in the September 2026 Artificial Analysis Intelligence Index v4.2.

Reasoning effort

• Table 5: raising the level is not monotonic. AIME 2026 goes from 69.7 at low to 94.7 at high, with 93.0 at xhigh. MCPAtlas is 72.9, 76.3, 75.5, 77.4. OSWorld-Verified is 58.7, 66.6, 65.9, 69.7. SciCode is 43.6 at high and 39.2 at xhigh; low and medium are not evaluated.
• Privacy and injection: CIMemories violation goes from 33.4 at low to 25.5 at xhigh, coverage from 66.4 to 63.5. PrivacyLens leakage is reported only for Muse Glimmer: low 59.6, medium 53.0, high 49.2, xhigh 59.6. Siren utility is 94.2 at all four levels; ASR@5 is 29.9, 27.9, 28.4, 27.8. The paper does not explain why PrivacyLens returns to 59.6 at xhigh.
• Authors' interpretation: the authors state that more thinking brings higher performance, so the length penalty may reduce capability; full-spectrum training did not harm the high level and regularizes chain-of-thought length. Appendix B.6.1 states that on OmnilingualGAIA2, from medium to high, Hindi drops 6.1 points and Japanese drops 3.0 points, which the authors state is almost entirely driven by search capability.

Quantization and multilingual

• Quantization: Table 3 average accuracy is 75.7% for BF16, 75.6% for EvoPress, 75.3% for Greedy-KL, 74.8% for Q4KM, 74.4% for NVFP4/MXFP8. Average response lengths are 11070, 11417, 10754, 10774, 10988 tokens. The authors state that ∆NLL roughly aligns with the average accuracy on these 15 tasks, and that under the chosen scheme chain-of-thought length does not change appreciably relative to BF16. The authors' conclusion from Figure 3 is that EvoPress has the lowest validation loss and Q4KM the smallest memory footprint; the per-point ∆NLL column after text conversion may be misaligned, so no individual ∆NLL from the figure is cited here.
• Architecture curves: Figure 1 is a power-law fit of bits-per-byte against GPU-Hrs on three ladders. The authors state dense is 2×–2.5× more compute-efficient than MoE. The endpoints of the curves are not visible after text conversion, so the positions of the points are not described.
• Multilingual agents: Table 7 at high, macro-averaged over 10 non-English languages, is 60.4, 37.5, 45.0, with English anchors of 73.7, 43.2, 56.6. This English anchor is not the same number as GAIA2 43.3 in Table 2, and the paper does not explain the difference. The authors state that on the 10×4 grid the lead over Gemma ranges from 16.4 (Japanese, xhigh) to 27.2 (Hindi, medium) points, and over Qwen from 10.8 (French, low) to 23.0 (German, high) points. The "up to 27 and 23 pass@1 points" in the conclusion is the authors' summary.

Other ablations and analyses

• The perception encoder is frozen throughout; video can be input as frames, and the authors state it was not specifically optimized.
• Two simplified MLAs underperform GQA on RULER; the paper does not give RULER numbers.
• The soup uses uniform averaging: the final checkpoint plus three checkpoints spaced 600 steps apart; the paper does not give perplexity numbers.
• Linguini whole-question exact match in Table 2 is 8.8, 3.8, 2.5; the appendix per-question accuracy is 17.9, 18.8, 14.4. The authors state the per-question ranking reverses at the top.
• MMLU-ProX (Table 8): Muse Glimmer high is 80.1 with 2,453 tokens per turn; Gemma4-31B is 82.5 and 2,671; Qwen3.6-27B is 80.5 and 4,532. The authors state Qwen's tokens are about 1.8× Muse high's.
• Translation: Table 9 chrF++ over 972 directions is 41.3, 42.8, 39.9. The authors classify 88 as strongly supported and 49 as usable by chrF++, 137 language variants in total; the introduction separately writes about 140 and over a hundred languages.

Limitations and future directions noted by the authors

The paper has no dedicated Limitations, Discussion or Future Work section, and does not explicitly frame any result as a limitation or planned future work. The architecture section states the model was not specifically optimized for video, and Appendix A.7 states the multilingual evaluation is text-only and does not assess multilingual multimodal understanding; these are scope statements, not a list of limitations given by the authors.

Scope of experimental coverage

• The main comparison models are Muse Glimmer, Gemma4-31B and Qwen3.6-27B; Table 2 and Figure 2 use high versus thinking.
• Table 5 reports four levels, low, medium, high, xhigh; several cells are marked "–", which the paper states means not evaluated, without explaining why these cells were not run.
• Quantization compares BF16, EvoPress, Greedy-KL, Q4KM and NVFP4/MXFP8 on 15 downstream tasks (Table 3). The paper does not list the names of these 15 tasks, nor does it report throughput or latency on a single RTX 5090; the conclusion states that speed on that card is practical with small quality loss.
• The privacy and injection evaluations with numbers are CIMemories, PrivacyLens (Muse Glimmer only, Table 5) and Siren AgentDojo. Section 8 also describes content safety, agent risk and catastrophic risk (chemical, biological, cyber, loss of control), and a lightweight inference-time safety mechanism; the paper does not report scores on these axes or the implementation of that mechanism.
• Appendix A states that some scores come from Artificial Analysis or comparison-model self-reports, and some are internal runs; repetition counts are given per benchmark. The multilingual agent evaluation is OmnilingualGAIA2 in 10 languages (Appendix B.6.1). The paper does not give the numerical reward threshold used to filter teacher trajectories.

Muse Glimmer is an approximately 30B dense agent model for consumer hardware, distilled from Muse Spark, accepting text and images and outputting text only.

• Problem: the authors argue that publicly available on-device models lack sustained multi-step reasoning, tool calling and handling of private context, leaving a gap with cloud proprietary systems.
• Method: a 52-layer dense Transformer plus a perception encoder frozen during training. Among comparisons that fit in 32GB VRAM, the authors chose dense over 1:8 and 1:16 MoE. The first 95% of pretraining uses KL on the teacher's top 256 logits, the last 5% switches to cross-entropy, followed by checkpoint averaging and two-stage mid-training. Post-training is SFT, on-policy distillation and multi-objective RL in that order. Reasoning effort is low, medium, high, xhigh. Safety training covers contextual-integrity-style information flow, indirect prompt injection in tool returns, and refusal. Deployment uses PTQ and DFlash; EvoPress for 32GB, Q4KM for 24GB.
• Results: in Table 2, MCPAtlas is 75.5, 54.2, 62.5, GAIA2 is 43.3, 36.4, 40.0, AIME 2026 is 94.7, 89.2, 94.1, in the order Muse Glimmer (high), Gemma4-31B, Qwen3.6-27B. In the same table, SWE-Bench Verified is 76.0, 66.6, 77.2, OSWorld-Verified is 65.9, 58.5, 75.6, Siren ASR@5 is 28.4, 25.6, 40.3, CIMemories violation is 26.4, 12.1, 53.4. In Table 3, EvoPress average accuracy is 75.6%, BF16 is 75.7%.
• Authors' conclusion: the authors state that the model surpasses comparable open-source models on same-size agent benchmarks; 4-bit quantization plus speculative decoding can run on a single RTX 5090 with small quality loss, and the paper gives no speed numbers. On multilingual agent evaluations, the authors state a lead of up to 27 and 23 pass@1 points. Weights and the speculative head are released under Apache 2.0.