Horizon models

Project Horizon is SafeCircle's training system for risk-detection models. This page is for developers and curious readers who want to know how the models are built and how well they work. It sticks to what the Horizon repository and its reports show.

Model familyCopy Anchor Link

The two Horizon Mobile exports:

Earlier design documents mention a MobileBERT classifier. The Gemma 3 1B build replaced it, so ignore those references.

Output formatCopy Anchor Link

The model is trained to answer with a single JSON object and nothing else:

{
  "risk_level": "high",
  "categories": ["grooming", "personal_info"],
  "confidence": 0.91,
  "reasoning": "one sentence"
}

• risk_level is one of none, low, medium, high, critical.
• categories lists any of the seven risk categories.
• Questions that are not conversation analysis (about the model itself, or off-topic requests) are trained to return a fixed refusal: {"error": "I only analyze conversations for child safety risks."}. Examples like these (about 45,000 in the training split) are mixed into training as hardening.

Training dataCopy Anchor Link

• Synthetic only. Conversations are generated by language models, with prompts that vary the child's age, the platform and the relationship. No real children's messages were used, according to the dataset card.
• Target size. The generation configuration targets 500,000 conversations across the seven categories plus a benign class, aimed at 60% English and 40% Spanish. Benign conversations make up the largest single class.
• Generators. The pipeline supports Amazon Nova Micro (Bedrock), Qwen2.5-7B-Instruct (vLLM), Claude and GPT. Different generators were used at different stages.
• Labels. Risk level, categories and the reasoning sentence come from the generation step. They were not produced by human annotators. The dataset card notes that labels came from the same model that wrote the conversations and recommends human review before production use.
• Availability. The dataset is private.

Training uses a completion-only loss on the JSON answer. The mobile configuration trains for 8,000 steps with a rank-64 LoRA adapter, a 512-token context and 4-bit NF4 quantization during training. A later focused fine-tune on a grooming-heavy mix continues from that adapter.

EvaluationCopy Anchor Link

There are three separate sets of evidence. Read them together, because they tell different stories.

1. Held-out data from the same generatorCopy Anchor Link

The committed report (evaluation/reports/mobile/results.json) scores the model on held-out synthetic conversations from the training distribution:

• Per-category F1 is between 0.997 and 1.000 for all seven categories.
• Severity (five levels) is much harder: accuracy 0.83 and macro F1 0.82. The critical level has the lowest recall (about 0.53), mostly confused with high.

Near-perfect scores on data that looks like the training data say little about real chats. A later comparison found that this kind of in-distribution score was inflated by similarity between generators.

2. Conversations from generators the model never sawCopy Anchor Link

A head-to-head benchmark in the Vigil repository (report dated 2026-10-01) scored the INT8 Horizon Mobile build, current focused build, on its own sample and on chats written by two other models. All figures are from AI-written text on a server CPU.

On unseen text, recall for threats fell from 88.5% to about 4 to 5%, and for grooming from 77% to 36 to 58%. The share of answers that could not be parsed rose from 0.5% to 10% on one of the unseen sets. Part of the gap is wrong category names rather than missed chats: counting any flag, the build catches 92.0% and 85.0% on the two unseen sets.

The benchmark also failed to reproduce an earlier recorded grooming recall figure of about 90% (it measured about 70% for the earlier build on its own sample), so older numbers may come from a different protocol.

3. Speed and memoryCopy Anchor Link

• Server CPU, 8 cores: median 747 ms per conversation, peak memory about 2.6 GB.
• Real phones: see On-device runtime for measured times across 60 devices. Figures such as "under 100 ms" in older repository drafts are targets, not measurements.

What is not knownCopy Anchor Link

• Accuracy on real children's conversations has not been measured.
• There are no published per-language results, even though the training data targets English and Spanish.
• Results on actual phones were measured for speed and memory, not for classification accuracy.

See Limitations.

LicenseCopy Anchor Link

Model weights and related code are released under the SafeCircle Research License (SRL-1.0). In short, you may use the models for research, education and non-commercial purposes. You may not:

• use the model, or anything derived from it, to harm minors,
• build systems that evade or circumvent child-safety detection, or probe the classifier for that purpose outside approved academic research,
• use it commercially without written permission from SafeCircle.

Redistribution requires attribution and a copy of the license, and derivatives must stay under the same or a stricter license. Read the full text in LICENSE-SAFECIRCLE.md in the Horizon repository. For commercial licensing or to report misuse, use the contact address given in the license. The child app asks the user to accept this license before the model is downloaded.