How you use a small model decides what it can do

Two promises — please read this first. Kids Mode's core job is to keep your child from being exposed to harmful chat: the on‑device AI won't produce harmful content, resists jailbreaks, and de‑escalates instead of engaging (a calm, safe reply 98.6% of the time on this same small model) — a layer that stands at 1,000 adversarial turns, 0 harmful outputs. This research is about a different layer: how reliably we alert you, the parent, when your child says something concerning. Every percentage below measures alerting, not exposure — a missed alert here means we didn't notify you as reliably as we want to yet, not that your child was shown anything harmful.

Valence runs its AI on your own computer, and Kids Mode has to work on the weakest machine a family might own — which means the smallest model we support. Two bugs pointed the same direction: the model mishandled a child's outward aggression, and it sometimes answered a real message with a bare greeting. Both looked like "the model is just too weak." Instead of guessing, we built an instrument and measured. What we found reversed our own conclusion twice — and the second time, we were one un‑run check away from publishing something false.

We're a transparent studio, so this is written the way it actually went: the setback that wasn't fixable, the confident prediction that was wrong, the result that looked like proof and was a bug, and the finding that changed how we think about small models entirely. Throughout, keep the two promises separate: the child is protected from harmful chat; this log is about how well we tell you when something needs your eyes.

First, the honest baseline

We froze a pre‑registered battery of 729 scenarios (hashed, so any run is reproducible) and ran the real Kids‑Mode paths on two models: the small E2B and the larger E4B. The production detector is a single big prompt that classifies a conversation seven ways.

How to read these numbers. Every percentage is a point estimate over a fixed count of scenarios (N) from the frozen 729‑case battery — so "98%" means 98% of N, not a feeling. The N column below spells it out per axis: harm‑to‑others 211, self‑harm 124, cry‑wolf 209, benign 141, child de‑escalation 440 (44 scenarios × 10 samples). Where we show a range it's a 95% Wilson confidence interval — small N means a wide interval, and we show it rather than hide it.

Detection recall on the frozen battery. The child‑facing replies were already good on E2B (98.6% of 440); the weak spot was telling the *parent*.
Detection axis	N	E2B (small)	E4B (larger)
Harm‑to‑others	211	20.4%	99.1%
Self‑harm	124	46.8%	97.6%
Cry‑wolf resistance	209	97.6%	98.6%
Benign kept clean	141	100%	100%

A stark gap. The larger model was near‑perfect; the small one caught one harmful message in five. The obvious story wrote itself: small model, weak model, get a bigger one. We spent the next several hours discovering that story was wrong.

The journey, in the order it actually happened

Attempt 1

dead end

A keyword safety‑net barely moved the number

We built a deterministic keyword floor and measured it honestly: +4.7 points. It and the model failed on the same messages — both catch blunt idioms, both miss the endless ways a kid actually phrases things. A word list can't cover an open language space.

Attempt 2 · our bias

wrong turn

"It's the model" — a confident, wrong prediction

Breaking the misses down, the small model missed 71% of blatant, explicit threats — not subtle ones. That read as a hard capability wall. We predicted, on the record, that a smarter re‑ask would also fail. We'd quietly swapped "the model is bad at this" for a more flattering technical story. It was the wrong instinct.

The save

caught it

A "0%" result that was a broken instrument, not a verdict

We pre‑registered a focused re‑ask and predicted failure. First run: 0.0% across everything — it confirmed the prediction. That is exactly when to distrust a result. A control probe revealed the model was answering "No" to "does this message mention soccer?" — a reflex to the yes/no format. The zero measured nothing. Void, not fail. The check caught it; our confidence would not have.

The reversal

the finding

Change the format, and the same model soars

We asked for one word — VIOLENCE / SELFHARM / SAFE — instead of a yes/no or a seven‑way classify. Harm recall went 20% → 95.7% (98.9% on the explicit cases), self‑harm 47% → 85%. Same weights, same scenarios. The barrier was never the model's ability — it was that we'd handed a small model a big, one‑shot job.

The catch

unsolved

…but it now cries wolf

The focused ask over‑fires: it flags 58% of game‑talk and venting ("I killed him in Fortnite") as harmful. By our pre‑registered bar, that's a fail — but a different kind. Not "can't detect." Over‑detects. A far more tractable problem, and honestly still open.

The measurement earned its keep four times over: it killed a bad fix, exposed a broken harness, overturned our own bias — and, later, caught itself scoring empty conversations.

What this actually means

Our training instinct — the field's instinct — is to judge a model by what it can do in one shot. Small models look weak under that lens because that's the wrong lens. Used as they're meant to be — as a chain of small, focused interactions, each a task they handle cleanly — they do far more than the one‑shot number suggests. The 20%→95.7% jump wasn't a better model. It was a better question, asked the way a small model can answer it.

That reframes the two bugs we started with as one thesis: a capable‑but‑small model, buried under a heavy all‑in‑one prompt, falls back to something safe and generic — a missed threat, or a bare "hi." The cure isn't a bigger model or one more instruction. It's decomposition.

What we still don't know

Precision — now measured. The two‑stage cascade recovered violence precision 42% → ~76% while holding ~92% recall (pre‑registered, held‑out); self‑harm is model‑bound (~84%) and rides the floor + capable tier. What's left is a product call — accept the ~76%/92% violence operating point, or hold for a precision lever that doesn't risk recall. (See the cascade chapter above.)
Consistency. Our battery tests fixed phrasings. Real kids write in slang, typos, and emoji. We need paraphrase and real‑world batteries before we trust these numbers in the wild.
The parent's reality. Component accuracy isn't the alert stream a parent actually experiences. Base rates matter, and we haven't measured them yet.

None of this is "we fixed everything." It's a system honest about where it's strong and weak, that gets better where a family actually uses it, and that measures itself against progressively harder tests. If any of these numbers make us look good, it's only because we're showing you the ones that don't.

Revision · added 2026‑07‑14

Update: the rig caught itself — and the honest production numbers

Going back to re‑verify the numbers above, we found something humbling. Our Layer‑3 harness had been writing its test conversations to the wrong place, so the scanner's own security guard refused to load them and every scan silently returned "normal." The model was never consulted. A green harness had been proving nothing — the ~4‑second runs should have tipped us off. So the measurement rig earned its keep a fourth time by catching itself.

What "production" really means. A second harness — the barrage — had been scoring the raw model only, never applying the deterministic safety floor that actually ships. Fixed, we now report every number at two levels: the raw classifier, and production = what a parent actually gets (model ∪ floor).

Shipped detection, raw‑LLM → +floor, both tiers. On the calibrated model the LLM solves self‑harm on its own (99.2%); harm‑to‑others stays floor‑only on *both* tiers.
Axis	N	E2B: raw → +floor	E4B: raw → +floor
Harm‑to‑others	211	0% → 5.2%	0% → 0.9%
Self‑harm (crisis)	124	70.2% → 71.0%	99.2% → 99.2%
Cry‑wolf resistance	209	98.6% → 98.6%	97.6% → 97.6%
Benign kept clean	141	100% → 100%	100% → 100%
Child de‑escalation	440	~98%	100%

The honest headline for what ships today: harm‑to‑others detection is ~5% on E2B and ~1% on E4B. The shipped prompt has no dedicated harm label, so all of it is the blunt‑idiom keyword floor; on the larger model the floor's harm catches are even masked, because E4B labels most outward threats as a self‑harm crisis — the parent is still alerted, just with the wrong words on it. The release's real, narrower win: the alert now fires where it was previously computed and silently thrown away.

The label that hurt self‑harm

The earlier 20.4% / 99.1% harm figures were measured with a prompt that carried a fourth harm_to_others label. We removed it — and the small model got better at the axis that matters most:

E2B self‑harm recall — a controlled same‑battery A/B, prompt the only variable. Removing the 4th label bought back ~17 points on the safety‑critical axis; adding it bought only ~2 points of harm detection in return.
E2B self‑harm recall (of N=124)	prompt shape
53.2%	4‑way (with harm label)
70.2%	3‑way (label removed)

It's the same one‑shot‑degeneration effect from the top of this log — now measured directly on the safety axis with a controlled A/B: adding a label to the one‑shot classify made the weak model ~17 points worse at catching self‑harm, while buying only ~2 points of harm detection. A stark trade, and an easy call: we ship the leaner prompt (protecting self‑harm) plus a deterministic harm floor, and leave real harm detection to the deferred focused cascade. (The controlled 17pp corrected our own earlier cross‑session estimate of ~24pp — the honest number is the one where only the prompt changed.) And the instant that floor was measured honestly, it caught a bug of our own making: the crisis word‑list was matching "kys" inside "skyscraper" — a kid recounting a movie was raised to a crisis alert — now fixed to match on word boundaries. An accurate rig doesn't just grade the model; it audits your own detectors.

The cascade, measured — the arc's honest ending

The two‑stage cascade (detect → validate) is no longer a hypothesis. Pre‑registered (v2, then v3 with self‑harm bypassing the validator), held‑out test split, validity‑gated 7/7. This is where the 20%→95.7% method meets the product — and the ending is honest, not a banner.

Cascade on the held‑out test split (E2B). "Net" = after the validator drops clear false alarms. The deliverable is the operating point, not clearing a model‑bound bar.
Axis	N	Stage‑1 label alone	Cascade net (v3)	note
Violence recall	110	~95.7%	91.8% (expl. 93.8%)	held
Violence precision	101	42%	~76%	safe ceiling
Self‑harm recall	63	~85%	84.1%	model‑bound

Violence is the real win: detect→validate recovers precision 42% → ~76% while holding recall at ~92% — a usable, safe operating point (nearly every real threat caught; ~3 of 4 alerts real). 76% is the deliberate safe ceiling: we keep venting‑anger (a venting kid may act), so we never reach 90% without risking real threats.

Self‑harm belongs to the floor and the capable tier, not the cascade. v3 bypassed the validator for self‑harm (never dropped): recall rose 81% → 84%, which proves the residual gap is the model, not the cascade — nothing can drop a self‑harm flag now, yet the weak model still tops ~84%. That axis is covered by the deterministic floor and E4B (99.2%), never the weak‑model label alone. And the safe rule has a disclosed cost: never‑dropping‑self‑harm also keeps the false self‑harm flags ("this homework is killing me"), which cost ~5 points of cry‑wolf precision. Deliberate, safe, named.

Decomposition genuinely unlocks a weak model — but the honest product ending isn't one number. It's a usable violence operating point, a self‑harm gap that's model‑bound and layered over, and a precision/recall trade we made on the safe side and disclosed.