Cloudflare Clef: Choosing and Testing a Decision Model

What Is Cloudflare Clef?

Clef is a decision model: given a state, such as a support message, a JSON record, or an image, and a schema of typed questions, it returns a probability for every allowed option of every question in a single forward pass. There is no free-form text and no output to parse. The model card defines three question types:

• noul - a true or false question; the answer is the probability of true.
• choice - named options with descriptions; the answer carries the chosen option, a confidence, and a probability for each option.
• score - ordered options indexed from 0; the answer carries a probability-weighted score, a confidence, a legend, and the probabilities.

The Workers AI Clef docs set the hosted limits: a 65,536-token context window, 1 to 64 questions per request, and up to four inline images, with remote image URLs rejected. Long text state is truncated to fit the model's token limit.

Cloudflare's launch post gives one in-house use: its Threat Intelligence team gives Clef a domain through Cloudflare's Browser Run, which renders the site, and gets back category probabilities, such as fashion, ecommerce, or phishing. That loop took Clef 2.2 seconds, while gpt-oss-120b took 4.7 seconds in the same workflow and returned only two classifications.

How Clef Decides Without Generating Text

Clef runs its Qwen backbone in a prefill-only pass, then a small joint schema head scores every valid option in parallel, so the decision step is non-autoregressive and has no text to generate token by token. Both backbones stay frozen, and the post-training goes into the routing head and rank-256 low-rank adapters. The launch post describes the training choices behind it, each of which points to a test:

• Calibration - Cloudflare paired label-smoothed cross-entropy with a Brier loss to calibrate the probabilities, so confidence is meant to track accuracy. Measure that on your own data before you set an automation threshold.
• Field order - the synthetic training data permuted field orders, prompts, and schema structures, so shuffling questions should leave answers unchanged. It is a cheap invariance test.
• Ordinal answers - Reinforcement Learning for Calibrated Decisions (RLCD) grants partial credit for adjacent ordinal choices, so a near miss on a score question is penalized less than a far one in training. Decide whether an off-by-one severity is acceptable in your workflow.
• Input length - the open-weights encoder defaults to a max_length of 16,384 tokens, well below the hosted window, so a self-hosted Clef can decide on a shorter slice of the same input unless you raise it.

Clef vs Clef-flash vs Jev on the Decision Index

Cloudflare ran the Decision Index suite itself and publishes every row in the model card, so treat these as vendor-reported numbers. These are the rows closest to the decisions an agent makes:

Grouped by the kind of decision, the rows read like this:

• Tool selection - Clef-flash matches or beats Clef on BFCL and API-Bank, so its speed costs nothing on these rows.
• Guardrail-style decisions - Clef-flash drops 30.6 points on CLINC150+OOS and 43.8 points on RAGTruth against Clef, the two rows that test spotting an input that fits no category or an answer the evidence does not support.
• Reasoning-heavy questions - Jev leads both Clef models on GPQA Diamond, MMLU-Pro (82.7 against 65.9 for Clef), and BBH (92.9 against 73.7), and on When2Call.

The model card also scores four end-to-end workflows from Typesafe's eval suite, where the margins are narrower:

• Invoice processing - exact actions 64.7 for Clef, 57.1 for Clef-flash, and 61.8 for Jev.
• Customer service - exact actions 76.3, 77.0, and 76.0.
• Security incidents - exact actions 62.9, 61.7, and 61.7.
• Agent trace observability - primary action 68.5, 69.8, and 71.6, where Jev leads.

The best exact-action score is between 62.9 and 77.0 in each of the three workflows that report one, which is the strongest argument for checking what happens after the decision. RAGTruth scores a model as a judge of hallucinated text, the same job covered in LLM hallucination detection, so the Clef-flash score there matters if you planned to use it as a cheap groundedness check.

Which Clef Model Fits Which Decision?

Map each decision in your agent to the benchmark row that resembles it, and start from the model that leads there. This is how I would set the defaults:

A two-tier setup is a reasonable starting point: Clef-flash on every request, with anything below a confidence threshold sent to Clef or a human. Set that threshold from your own calibration results, not from the benchmark table.

How to Test Clef Before It Drives an Agent

Collect a few hundred real decisions your team has already labeled, such as routed tickets or reviewed domains, and run them through both Clef models. Then run these checks, each one aimed at a failure the benchmark table hints at:

The fine-tuning row comes from Cloudflare's own warning that fine-tuning may give up some general-purpose performance in exchange for accuracy in a specific domain. The service starts as a hands-on engagement with its forward-deployed engineers, with a self-serve platform planned later.

Web classification adds a step before Clef: the page has to be fetched and rendered, and because Workers AI does not take image URLs, screenshots must be captured and inlined. TestMu AI Browser Cloud runs real Chrome sessions that render JavaScript-heavy pages, captures full-page or element screenshots, and reaches staging or internal pages through its built-in tunnel; the same loop for Jev is measured in Jev Browser Cloud.

Note: When Clef misclassifies a page, you need to see the page it was given. Every TestMu AI Browser Cloud session records video, console logs, network logs, and a step-by-step command replay, so you can check whether the page was blocked, half-loaded, or simply misread. Try TestMu AI free!

Testing What the Agent Does With a Clef Decision

A decision model's output is a probability, and the risk sits in what the agent does next: routing the ticket, blocking the domain, or skipping the escalation. A confidence score is the model's own report about the decision, so it cannot confirm that the action happened or was right; Jev typed output makes the same point for Jev.

TestMu AI Agent Assurance tests how agents actually behave across workflows, tools, and actions. For an agent that acts on Clef decisions, it works through these steps:

• Discovery - it reads the agent's codebase to work out what the agent does, and marks a tool as unknown rather than guessing when nothing declares it.
• Scenarios - it generates functional, non-functional, and adversarial scenarios, each with criteria that are graded one by one.
• Real runs - it invokes the agent the way a user would, through a command, an HTTP endpoint, or an MCP server.
• Evidence - each criterion is judged against files that changed, artifacts produced, and tool calls checked against the agent's declared tools, not against the agent's summary.
• Assurance gap - criteria it could not check are reported as Unable to Verify and kept out of the pass rate, so the report shows how much of the run was actually proven.

Agent Assurance is pre-alpha and installs through the rook CLI. In a pipeline, a finished run exits 0 whether its scenarios passed or failed, so gate on the per-criterion verdicts in the report rather than on the exit code.

Getting Started With Cloudflare Clef

Pick one reversible decision your agent already makes, such as ticket routing, and replay your labeled history through Clef-flash and Clef on Workers AI. Promote Clef-flash only where its per-class accuracy and confidence bands hold up against Clef on your data.

Then cover the actions that follow each decision with the Agent Assurance overview as your setup guide.