How Horizon and Vigil were tested, and where they fail

Horizon and Vigil

Horizon is our risk model. It reads a conversation on the child’s Android phone and returns a risk level from none to critical, one or more of seven categories, and a one-sentence reason. Horizon Mobile is the small version that ships in the child app. Horizon Full is a larger version for research and servers, and it is not sent to phones.

Vigil is a newer research classifier for the same seven categories. It scores each category instead of writing a reason. The child app does not use it and it creates no alerts for parents. You can try it in the AI Playground app.

Neither model has been measured on real children’s conversations. The test chats were written by AI models, and the risk labels came from the same generation step.

Figures from the Vigil repository’s head-to-head report dated 1 October 2026, which scored both models with the same code, on the same chats, on one server CPU. Phone figures are speed and memory only.

License: research use only

The weights are released under the SafeCircle Research License (SRL-1.0). It allows research, education and non-commercial use. It does not allow using the models, or anything derived from them, to harm minors, building systems that evade child-safety detection, or commercial use without written permission. This is not an open-source license.

For commercial licensing, or to report misuse, write to legal@safecircle.tech. The child app asks the user to accept this license before it downloads a model.

Datasets and evaluation

The training data is synthetic. Language models wrote the conversations, varying the child’s age, the platform and the relationship. According to our documentation, no real children’s messages were used. The risk labels came from the generation step, not from human annotators.

The training dataset is not public, and there is no public dataset on Hugging Face yet.

Evaluation uses held-out synthetic chats from the training generator, and separately chats written by other AI models. There is no human-written test set yet, which is the largest gap in the evidence.

• No real-world measurement. Every accuracy figure here comes from AI-written test chats.
• Other AI-written text. On chats from other generators, Horizon caught 62.6% to 67.7% of risky chats and flagged about 20% of harmless ones.
• Severity. Telling high from critical is the weakest part. Recall for critical was about 53% on the held-out set.
• Threats and grooming. On unseen text, recall for threats fell to about 4 to 5%, and recall for grooming fell to between 36% and 58%.
• Friendly teasing. About half of a test scene about friends joking was flagged.
• Languages. Training targets English and Spanish. There are no published per-language results, and other languages should be treated as unsupported.
• Coverage. The child app reads five apps and only text on screen. Images, voice and video are not analysed.
• Sampling. Each app is checked at most once every five minutes, using the last ten visible text snippets.
• Failures are silent. If the model fails to load or returns an unreadable answer, the app sends nothing.

Reproduce it

1. Download the weights and read the model cards at Hugging Face.
2. Read the technical paper (PDF) at safecircle.tech.
3. Read the method notes and limitations in the Horizon models documentation.
4. The GGUF files run with llama.cpp and compatible runtimes.

Training code and evaluation scripts are not public yet, so this page cannot take you through re-running training or the evaluation.

Cite us

Palma Sánchez, T. (2026). Horizon: Privacy-Preserving On-Device Child Safety Risk Detection via Knowledge Distillation. SafeCircle. Technical paper.