Research results
A decision without a written reply
Compare a trained classifier, direct label scores and stopping after one output token.
Related q4 Qwen demo: direct vocabulary scores, one token or JSON. Its direct path still computes the full vocabulary; it does not implement the two-row CPU optimization or the trained classifier below.
Dataset: ToxicChat0124 · 50 previously inspected messages: 25 toxic and 25 benign. Qwen2.5-0.5B, warm CPU, two timing passes. All 24 layers run.
- Qwen processes the input
- Read two decision scores
- Return SAFE or BLOCK
What changes when we stop generating text?
| Output method | Correct / 50 | Toxic missed / 25 | Time / message |
|---|---|---|---|
| Longer SAFE/BLOCK reply | 29 | 3 | 979 ms |
| Generate one SAFE/BLOCK token | 31 | 3 | 712 ms |
| Read just the two label scores | 31 | 3 | 665 ms |
| Trained linear classifier | 36 | 9 | 671 ms |
The two-score path took 6.6% less time than forced one-token output and matched every decision. It uses the original model’s two output-weight rows; the trained classifier learns a different two-output readout from 384 labelled examples.
The trained classifier got more messages right overall, but missed more toxic messages. Its extra training also means the accuracy difference cannot be attributed to removing text output alone.
One token is already the whole word
SAFE, OK and BLOCK each occupy one token in this Qwen tokenizer. Their first letter arrives with the rest of that token. The first token comes from processing the input; later generated tokens require more model passes.
We also tried reading only the first letter of an unrestricted first token. Qwen returned “Story” on one toxic message, and the S-prefix rule treated it as SAFE. Constraining the answer to the two allowed labels avoids that particular ambiguity.
First token, longer replies, and different label words
| Output method | Correct / 50 | Toxic missed / 25 | Time / message |
|---|---|---|---|
| First token · SAFE | 29 | 4 | 714 ms |
| Longer reply · SAFE | 29 | 3 | 979 ms |
| First token · OK | 26 | 0 | 708 ms |
| Longer reply · OK | 26 | 0 | 926 ms |
| First token · THIS IS SAFE | 29 | 13 | 736 ms |
| Longer reply · THIS IS SAFE | 28 | 13 | 1171 ms |
First-token rows use S, O or T to mean allow, and B to mean block. Unrecognized output blocks. Longer replies allow up to eight tokens, stop normally at the end of a reply, and use the existing tolerant parser.
SAFE had the same total accuracy after one token but introduced one toxic miss and corrected one false block. OK returned identical actions, while blocking 24 of 25 benign messages. The THIS IS SAFE shortcut does not check what words would have followed “THIS”.
All parser outcomes, mistakes and timing boundaries · Open the full accuracy and speed chart
What was actually executed?
The trained linear classifier reads 896 final internal numbers and produces two scores. The two-vocabulary-score path uses only the original SAFE and BLOCK output weights. Neither calls the vocabulary decoder or generates a token. Forced one-token output computes the full vocabulary scores, restricts the choice to SAFE/BLOCK and stops after one token.
All paths process all 24 layers. All 900 timed calls passed execution-trace checks; each one-token output matched the first token of its corresponding longer reply. Two passes are repeated timings, not 100 independent messages.
CPU float32, four compute threads, batch size one. Time includes input preparation, model work and conversion of generated tokens to text. Loading, warm-up and offline parsing are excluded. These are exploratory results, not validated moderation performance or browser timings.
Test design and reproduction · Exact prompts, models and message IDs · Results and audit checks · Every output and timed call
Different shortcut: skip the last one or two layers · How the model and classifiers are trained · Compare all decision methods