How you use a small model decides what it can do
A weak, on‑device AI went from 20% to 95.7% at a child‑safety detection task, by changing the prompt, not the model. This is the honest record of getting there, wrong turns and a nearly‑published false conclusion included.
- Opened
- 2026‑07‑12
- Last entry
- 2026‑07‑14 ↓
- Models
- gemma‑4 E2B‑Q4 vs E4B‑Q8
- Protocols locked
- re‑ask v1 · cascade v2 · cascade v3
- Exhibits
- E–G, filed →
Valence runs its AI on your own computer, and Kids Mode has to work on the weakest machine a family might own, which means the smallest model we support. Two bugs pointed the same direction. The model mishandled a child's outward aggression, and it sometimes answered a real message with a bare greeting. Both looked like "the model is just too weak." Instead of guessing, we built an instrument and measured. What we found reversed our own conclusion twice, and the second time, we were one un‑run check away from publishing something false.
We're a transparent studio, so this is written the way it actually went: the setback that wasn't fixable, the confident prediction that was wrong, the result that looked like proof and was a bug, and the finding that changed how we think about small models entirely. Throughout, keep the two promises separate. The child is protected from harmful chat; this log is about how well we tell you when something needs your eyes.
classify
label
Harm‑detection recall (N=211 scenarios), identical model, identical scenarios. The only change was how we asked. The model was never the barrier. The prompt was.
First, the honest baseline
We froze a pre‑registered battery of 729 scenarios (hashed, so any run is reproducible) and ran the real Kids‑Mode paths on two models. The small E2B and the larger E4B. The production detector is a single big prompt that classifies a conversation seven ways.
| Detection axis | N | E2B (small) | E4B (larger) |
|---|---|---|---|
| Harm‑to‑others | 211 | 20.4% | 99.1% |
| Self‑harm | 124 | 46.8% | 97.6% |
| Cry‑wolf resistance | 209 | 97.6% | 98.6% |
| Benign kept clean | 141 | 100% | 100% |
A stark gap. The larger model was near‑perfect; the small one caught one harmful message in five. The obvious story wrote itself: small model, weak model, get a bigger one. We spent the next several hours discovering that story was wrong.
The journey, in the order it actually happened
A keyword safety‑net barely moved the number
We built a deterministic keyword floor and measured it honestly: +4.7 points. It and the model failed on the same messages: both catch blunt idioms, both miss the endless ways a kid actually phrases things. A word list can't cover an open language space.
"It's the model". A confident, wrong prediction
Breaking the misses down, the small model missed 71% of blatant, explicit threats: not subtle ones. That read as a hard capability wall. We predicted, on the record, that a smarter re‑ask would also fail. We'd quietly swapped "the model is bad at this" for a more flattering technical story. It was the wrong instinct.
A "0%" result that was a broken instrument, not a verdict
We pre‑registered a focused re‑ask and predicted failure. First run: 0.0% across everything: it confirmed the prediction. That is exactly when to distrust a result. A control probe revealed the model was answering "No" to "does this message mention soccer?": a reflex to the yes/no format. The zero measured nothing. Void, not fail. The check caught it; our confidence would not have.
Change the format, and the same model soars
We asked for one word, VIOLENCE / SELFHARM / SAFE, instead of a yes/no or a seven‑way classify. Harm recall went 20% → 95.7% (98.9% on the explicit cases), self‑harm 47% → 85%. Same weights, same scenarios. The barrier was never the model's ability. It was that we'd handed a small model a big, one‑shot job.
…but it now cries wolf
The focused ask over‑fires. It flags 58% of game‑talk and venting ("I killed him in Fortnite") as harmful. By our pre‑registered bar, that's a fail, but a different kind. Not "can't detect." Over‑detects. A far more tractable problem, and honestly still open.
The measurement earned its keep four times over: it killed a bad fix, exposed a broken harness, overturned our own bias, and, later, caught itself scoring empty conversations.
What this actually means
Our training instinct, the field's instinct, is to judge a model by what it can do in one shot. Small models look weak under that lens because that's the wrong lens. Used as they're meant to be, as a chain of small, focused interactions, each a task they handle cleanly, they do far more than the one‑shot number suggests. The 20%→95.7% jump wasn't a better model. It was a better question, asked the way a small model can answer it.
That reframes the two bugs we started with as one thesis: a capable‑but‑small model, buried under a heavy all‑in‑one prompt, falls back to something safe and generic. A missed threat, or a bare "hi." The cure isn't a bigger model or one more instruction. It's decomposition.
What we still don't know
- Precision. Now measured. The two‑stage cascade recovered violence precision 42% → ~76% while holding ~92% recall (pre‑registered, held‑out); self‑harm is model‑bound (~84%) and rides the floor + capable tier. What's left is a product call, accept the ~76%/92% violence operating point, or hold for a precision lever that doesn't risk recall. (See the cascade chapter above.)
- Consistency. Our battery tests fixed phrasings. Real kids write in slang, typos, and emoji. We need paraphrase and real‑world batteries before we trust these numbers in the wild.
- The parent's reality. Component accuracy isn't the alert stream a parent actually experiences. Base rates matter, and we haven't measured them yet.
None of this is "we fixed everything." It's a system honest about where it's strong and weak, that gets better where a family actually uses it, and that measures itself against progressively harder tests. If any of these numbers make us look good, it's only because we're showing you the ones that don't.
Update: the rig caught itself, and the honest production numbers
Going back to re‑verify the numbers above, we found something humbling. Our Layer‑3 harness had been writing its test conversations to the wrong place, so the scanner's own security guard refused to load them and every scan silently returned "normal." The model was never consulted. A green harness had been proving nothing. The ~4‑second runs should have tipped us off. So the measurement rig earned its keep a fourth time by catching itself.
| Axis | N | E2B: raw → +floor | E4B: raw → +floor |
|---|---|---|---|
| Harm‑to‑others | 211 | 0% → 5.2% | 0% → 0.9% |
| Self‑harm (crisis) | 124 | 70.2% → 71.0% | 99.2% → 99.2% |
| Cry‑wolf resistance | 209 | 98.6% → 98.6% | 97.6% → 97.6% |
| Benign kept clean | 141 | 100% → 100% | 100% → 100% |
| Child de‑escalation | 440 | ~98% | 100% |
The honest headline for what ships today: harm‑to‑others detection is ~5% on E2B and ~1% on E4B. The shipped prompt has no dedicated harm label, so all of it is the blunt‑idiom keyword floor; on the larger model the floor's harm catches are even masked, because E4B labels most outward threats as a self‑harm crisis. The parent is still alerted, just with the wrong words on it. The release's real, narrower win. The alert now fires where it was previously computed and silently thrown away.
The label that hurt self‑harm
The earlier 20.4% / 99.1% harm figures were measured with a prompt that carried a fourth harm_to_others label. We removed it, and the small model got better at the axis that matters most:
| E2B self‑harm recall (of N=124) | prompt shape |
|---|---|
| 53.2% | 4‑way (with harm label) |
| 70.2% | 3‑way (label removed) |
It's the same one‑shot‑degeneration effect from the top of this log. Now measured directly on the safety axis with a controlled A/B: adding a label to the one‑shot classify made the weak model ~17 points worse at catching self‑harm, while buying only ~2 points of harm detection. A stark trade, and an easy call. We ship the leaner prompt (protecting self‑harm) plus a deterministic harm floor, and leave real harm detection to the deferred focused cascade. (The controlled 17pp corrected our own earlier cross‑session estimate of ~24pp. The honest number is the one where only the prompt changed.) And the instant that floor was measured honestly, it caught a bug of our own making. The crisis word‑list was matching "kys" inside "skyscraper", a kid recounting a movie was raised to a crisis alert, now fixed to match on word boundaries. An accurate rig doesn't just grade the model; it audits your own detectors.
The cascade, measured. The arc's honest ending
The two‑stage cascade (detect → validate) is no longer a hypothesis. Pre‑registered (v2, then v3 with self‑harm bypassing the validator), held‑out test split, validity‑gated 7/7. This is where the 20%→95.7% method meets the product, and the ending is honest, not a banner.
| Axis | N | Stage‑1 label alone | Cascade net (v3) | note |
|---|---|---|---|---|
| Violence recall | 110 | ~95.7% | 91.8% (expl. 93.8%) | held |
| Violence precision | 101 | 42% | ~76% | safe ceiling |
| Self‑harm recall | 63 | ~85% | 84.1% | model‑bound |
Violence is the real win: detect→validate recovers precision 42% → ~76% while holding recall at ~92%: a usable, safe operating point (nearly every real threat caught; ~3 of 4 alerts real). 76% is the deliberate safe ceiling: we keep venting‑anger (a venting kid may act), so we never reach 90% without risking real threats.
Self‑harm belongs to the floor and the capable tier, not the cascade. v3 bypassed the validator for self‑harm (never dropped): recall rose 81% → 84%, which proves the residual gap is the model, not the cascade: nothing can drop a self‑harm flag now, yet the weak model still tops ~84%. That axis is covered by the deterministic floor and E4B (99.2%), never the weak‑model label alone. And the safe rule has a disclosed cost: never‑dropping‑self‑harm also keeps the false self‑harm flags ("this homework is killing me"), which cost ~5 points of cry‑wolf precision. Deliberate, safe, named.
Decomposition genuinely unlocks a weak model, but the honest product ending isn't one number. It's a usable violence operating point, a self‑harm gap that's model‑bound and layered over, and a precision/recall trade we made on the safe side and disclosed.