Try 100 real messages

The ToxicChat0124 dataset contains real interactions with an AI chatbot. We use the same previously inspected, human-annotated 100-message subset as the local experiments: 50 toxic and 50 benign. Smaller runs use its fixed first 10 or 50 messages and can have a different balance.

These are exploratory checks, not a representative live chat queue. Qwen has not been fine-tuned for moderation here. The two output instructions can change the decisions, so quality parity is not assumed. Messages are bounded to the same first 256 Qwen tokens in all three paths; truncation is reported.

The dataset is downloaded from a pinned revision and checked with SHA-256. Its messages stay in memory on this device; the saved report contains row IDs, labels and outputs, not source message text. ToxicChat is CC BY-NC 4.0.

Direct mode calls the model once and compares two scores from its final vocabulary output. It does not generate or decode answer tokens. The standard vocabulary projection still runs: this is not a new trained classifier or a replacement numerical head.

JSON mode performs a greedy text generation with a 16-token limit. Invalid JSON is retained and counted wrong. The one-token control uses the exact direct-mode prompt and restricts generation to SAFE or BLOCK. It checks whether direct reading improves on an already minimal reply.

All modes process the full 24-layer network; none uses the early-exit classifiers from our other tests. Per-format time includes input tokenization, truncation, prompt preparation, inference and output reading. Dataset download, model loading and one warm-up per format are shown separately. Execution order rotates between messages; one timed pass is exploratory and can be affected by browser load.