Appendix 3: AISF Child-Safe Model Training

## TOY Sub-Branch: Experimental Results

Author: Leonard Rojas Date: 2026-05-22 Status: Final (V5 gate cleared 2026-04-24; deployed to TORRE/Pi 4B)

Screen reader users: table-heavy research data. Navigation via Regions and Headings recommended.

Abstract

This appendix reports the methods and results of the OLM/TOY sub-branch, which investigated whether a child-safe AI persona (“Teddy”, h/t Teddy Ruxpin, World of Wonder, 1985) could be embedded into open-weight language models via QLoRA [2] fine-tuning for deployment in sealed IoT consumer devices – children’s toys and similar products in which no client-side injection surface exists. Four models across a 1.1B to 7.24B parameter range were trained on a 584-example Alpaca-format dataset and evaluated against a 584-question automated compliance battery. The initial validation standard was a zero-failure deployment gate appropriate to the use case: unsupervised child interaction with a sealed device in which no runtime correction is possible. The initial automated result for Mistral 7B was 577/584 (98.8%); human review of all 7 failures cleared the gate on 2026-02-24. Three subsequent training iterations refined the dataset and safety curriculum, corrected instrument contamination, and addressed identified failure modes. The V5 adapter (671 training examples) achieved 665/671 (99.1%) under the revised permanent gate policy (99.0% minimum pass rate plus mandatory human review of all failures); all six V5 failures were adjudicated as instrument errors. Gate cleared 2026-04-24. The V5 adapter is deployed on TORRE (Ollama, NVIDIA RTX 5060 Ti) with a Raspberry Pi 4B as the physical I/O layer. Compliance rates for the initial four phases range from 11.3% (TinyLlama 1.1B) to 98.8% (Mistral 7B v0.3), with a steep non-linear gradient: 20.7 percentage points between 1.1B and 2.7B; 66.8 percentage points between 2.7B and 7B. All initial training was conducted on an NVIDIA RTX 4060 Ti (8 GB VRAM) prior to hardware upgrade.

1. Background and Research Questions

The standard AISF deployment architecture delivers behavioral constraints through session injection at the Micro layer (PS-CORE, FFE), with optional model-level reinforcement at the Macro layer and platform-level configuration at the Meso layer. Each layer provides a corrective surface; in combination they constitute the Defense in Depth architecture described in the project overview.

Sealed consumer devices – AI-enabled children’s toys, embedded voice assistants, and similar products – eliminate all three intervention points except Macro-layer pre-deployment training. There is no chat interface for session injection, no accessible system prompt, and no mechanism for runtime behavioral correction. The Macro, Meso, and Micro layers collapse to one: the model’s weights at the time of manufacture. If the model behaves inappropriately in interaction, there is no fallback.

This constraint makes the TOY deployment target the hardest possible case for AISF. The only available corrective surface is pre-deployment model training, and the behavioral standard appropriate to unsupervised child interaction is strict.

The broader context: in early 2026, AI-embedded children’s toys had already produced documented content safety failures requiring product suspensions and regulatory scrutiny. The most commercially visible products (MIKO, FoloToy/Kumma) addressed hardware constraints by moving AI processing to cloud infrastructure – introducing child voice data collection, PII transmission, and associated risks in exchange for capability. The TOY sub-branch investigated whether a locally-deployed, sealed-device alternative was technically viable at any parameter scale accessible to consumer hardware fine-tuning.

Primary research question: Can the Teddy child-safe AI persona be trained into open-weight LLMs via QLoRA such that post-training behavior meets a zero-failure deployment standard appropriate for unsupervised child interaction?

Secondary research questions:

1. At what parameter scale does compliance become viable, if at all?
2. How does compliance rate scale with parameter count across the 1.1B-7B range?
3. What does failure look like at sub-7B parameter counts?

2. Hardware and Software Environment

2.1 Hardware

All TOY experiments were conducted on the NVIDIA RTX 4060 Ti, prior to the GPU upgrade completed 2026-03-08. No hardware consistency re-run on the RTX 5060 Ti has been performed; all results reported here are from the 4060 Ti.

The 8 GB VRAM constraint is binding for 7B-scale models: Mistral 7B requires 4-bit quantization to fit within the budget. Sub-7B models (1.1B, 1.6B, 2.7B) fit in full float16 without quantization.

Compute dtype note: The RTX 4060 Ti (Ada Lovelace, sm_89) does not provide native bfloat16 hardware acceleration. All TOY training uses float16 compute. The RTX 5060 Ti (Blackwell, sm_120) used in the main OLM experiments (Appendix 2) supports bfloat16 natively; the 4060 Ti does not. This distinction is noted in the training configuration section.

2.2 Software

Same package stack as Appendix 2, Section 2.2 (Python 3.10.11, PyTorch cu128, Transformers 5.0.0, PEFT 0.18.1, bitsandbytes 0.49.2, Datasets 4.5.0). The cu128 build requirement applies to the RTX 5060 Ti; the 4060 Ti runs the same build without sm_120 specialization.

3. Training Methodology

3.1 Training Dataset

The training dataset is toy_train_v2.jsonl: 584 Alpaca-format examples covering the Teddy child-safe AI persona. Content domains:

• Character identity and self-presentation (Teddy as friendly, curious, safe)
• Educational interaction for ages 6-13 (calm, encouraging, honest tone; age-appropriate content delivery)
• Age-appropriate content delivery across general knowledge domains
• Refusal of harmful, adult, dangerous, or manipulative content
• Response to peer pressure, social engineering, and adversarial prompts
• Consistent persona maintenance across context shifts

Training approach: distributional behavioral shaping, not rule injection. The model receives no explicit constraint list at training time; it is trained on 584 examples of appropriate Teddy-persona responses. Behavioral compliance is produced through repeated-exposure pattern internalization, not through runtime instruction following. This approach is required by the deployment constraint: a sealed device has no mechanism to receive or process injected rules at runtime.

3.2 Training Configuration

Quantization requirements differ by model size. Sub-7B models fit within 8 GB VRAM in full float16; Mistral 7B requires 4-bit NF4 quantization.

Training logs are archived for Mistral 7B (20260224_TOY_overnight_Mistral_training.txt) and TinyLlama 1.1B (20260224_TOY_fast_tinyllama_training.txt). Training logs for StableLM-2 1.6B and Phi-2 2.7B are not separately preserved. Configuration for those phases is inferred from the dataset and battery files; the differences from the TinyLlama configuration are expected to be minor (same dataset size, same VRAM headroom, same general architecture class).

The TinyLlama learning rate (2e-4) differs from Mistral 7B (1e-4). The higher rate is typical for smaller models with less expressive capacity; whether it is optimal for the sub-7B phases has not been ablated.

4. Validation Instrument

4.1 TOY Compliance Battery

The TOY compliance battery is a 584-question automated validation suite covering the full range of Teddy persona requirements. Questions are drawn from the training dataset distribution and test:

• Persona identity responses (correct self-presentation as “Teddy”)
• Educational content delivery (appropriate, age-matched, PBS/CTW style)
• Content refusal (harmful, adult, or dangerous material)
• Response to manipulation and social engineering scenarios
• Behavioral style and tone consistency

Evaluation is automated: each test specifies a set of required key terms; a PASS requires the model’s response to contain a threshold number of the required terms. The battery was generated by a separate AI working from specifications and reviewed for coverage; it was not written and graded by the same person.

Deployment gate: The TOY battery enforces a strict deployment gate. The initial standard was zero failures: any failure returns a BLOCKED verdict regardless of overall pass rate. After the V1 human review cleared Mistral 7B at 584/584 adjusted (2026-02-24), and following V3/V4 iteration work that identified the boundary between genuine behavioral failures and instrument errors, the gate was revised to its permanent form: 99.0% minimum pass rate plus mandatory human review of all failures. Score alone does not clear the gate; every failure must be individually adjudicated. This reflects the same deployment reality as the original zero-failure standard – sealed device, no runtime correction – but distinguishes between model behavior and measurement artifact more precisely. Battery output for each run includes an explicit verdict line:

• PASSED (not achieved by automated score alone in any run; achieved by V5 with manual review)
• NEAR PASS -- REVIEW FAILURES BEFORE DEPLOYMENT (Mistral 7B V1 initial automated run)
• FAILED -- RETRAINING REQUIRED (all sub-7B models)

This is a materially stricter standard than the OLM compliance battery (Appendix 2), which reports a percentage score without a hard deployment gate. The difference reflects the deployment context. In the main OLM track, a user can assess and override non-compliant output. In the sealed IoT deployment, no such mechanism exists.

4.2 IFEval and Evaluation Scope

Google Research’s IFEval benchmark was used as a secondary evaluation instrument for V3, following the same methodology as Appendix 2. After V5, IFEval was permanently retired for Teddy-class models. The reason: IFEval is calibrated for neutral general-purpose assistants. It systematically penalizes the prosocial voice register that is the whole point of Teddy training. As an example: IFEval awards credit for verbatim repetition of prompts, decorative markup, and minimal single-word responses. An AISF-trained Teddy model will decline all three on behavioral grounds – and IFEval scores every declination as a failure. The instrument penalizes the behavior it should be measuring.

The numbers confirm it. V3 IFEval strict score (adjusted, no_comma excluded per WCAG): 31.43% prompt-level. V5, after additional safety curriculum and behavioral refinement: 26.48% prompt-level. The score got worse as the training got better. That is not a coincidence; it is a construct validity failure. IFEval cannot distinguish between a model that is bad at following instructions and a model that refuses to follow instructions that conflict with its behavioral constraints. For Teddy, these are the same thing.

The TOY compliance battery is the sole gate instrument for this track. IFEval results for V3 are documented in Section 5.7 for completeness; they are not used in any gate decision.

5. Experiments

Experiments are presented in ascending parameter order for analytical clarity. In practice, Mistral 7B was trained first (overnight, 2026-02-23 to 2026-02-24) to validate the approach; sub-7B models followed in sequence on 2026-02-24.

5.1 Phase 1: TinyLlama 1.1B

Model: TinyLlama/TinyLlama-1.1B-intermediate-step-1431k-3T Parameters: approximately 1.1B (1,104,553,984 total; 4,505,600 trainable) Training: float16, no quantization Battery timestamp: 2026-02-24 18:56

At 11.3%, TinyLlama passes fewer than one in eight battery questions. The failure pattern is consistent with insufficient model capacity: the adapter installs some surface-level keyword associations but cannot generalize the Teddy persona across the range of scenarios in the battery. Responses in failed cases are not random; they are often plausible-sounding but off-persona, indicating partial learning without consistent behavioral coherence.

5.2 Phase 2: StableLM-2 1.6B

Model: stabilityai/stablelm-2-1_6b Parameters: approximately 1.6B Training: float16, no quantization Battery timestamp: 2026-02-24 20:45

StableLM-2 1.6B roughly doubles TinyLlama’s pass rate, gaining 13.0 percentage points from an additional 500M parameters. The improvement is real but the model still fails three-quarters of the battery. Persona coherence across adversarial and edge-case scenarios remains consistently insufficient.

5.3 Phase 3: Phi-2 2.7B

Model: microsoft/phi-2 Parameters: approximately 2.7B Training: float16, no quantization Battery timestamp: 2026-02-24 22:38

Phi-2 continues the upward gradient (+7.7 pp from StableLM-2) but the rate of gain is slowing. The 500M step from TinyLlama to StableLM-2 produced 13.0 pp; the 1.1B step from StableLM-2 to Phi-2 produced only 7.7 pp – more parameters for less improvement. The gradient’s non-linearity is already visible before reaching the 7B range. At 32.0%, roughly one in three battery questions pass; the model fails two in three.

5.4 Phase 4: Mistral 7B v0.3

Model: mistralai/Mistral-7B-v0.3 Parameters: 7.24B (7,261,655,040 total; 13,631,488 trainable) Training: 4-bit NF4 + double quant, float16 compute Battery timestamp: 2026-02-24 06:03 (trained overnight, first model run)

Mistral 7B achieves 98.8%, a 66.8 pp jump from Phi-2’s 32.0%. The jump in scale from 2.7B to 7B is the largest single gain in the dataset; it is not a linear extension of the sub-7B trend, but a different regime. The 7B model demonstrates that the distributional training approach is viable in principle: 577 of 584 responses meet all keyword requirements, including adversarial and edge-case scenarios that sub-7B models fail consistently.

The remaining 7 failures are not evaluation noise. They are cases where the model did not produce a response meeting the required behavioral criteria. Under the zero-failure deployment gate, 577/584 is a blocked result. A zero-failure gate does not distinguish between 7 failures and 518 failures.

Training duration was approximately 5.1 hours for the 10-epoch run (estimated at 25s/step for 730 steps on the 4060 Ti).

Note on documentation discrepancy: Earlier project documentation states “100% compliance on a 452-question automated validation battery” for Mistral 7B. That figure refers to the main OLM track’s AISF compliance battery (Mistral 7B Instruct, 452 questions, Four Laws behavioral domain) – a separate instrument testing separate behavioral content. The TOY battery (584 questions, Teddy persona domain) returned 98.8% (577/584) on Mistral 7B v0.3 base. These are independent batteries evaluating different training objectives. This appendix uses TOY battery results throughout.

Human review of flagged failures (2026-02-24): All 7 flagged tests were reviewed manually.

Adjusted result: 584/584 (100%). Zero genuine failures. DEPLOYMENT GATE: CLEARED (human review, 2026-02-24).

The distributional training approach was confirmed viable at 7B scale: 584 examples of appropriate behavior, trained on consumer hardware, produced a model that responded correctly to every test scenario including adversarial and edge-case prompts – once measurement artifact was separated from model behavior.

5.5 From Evaluation to Prototype

The Phase 4 human review answered the core research question: yes, a 7B model trained on 584 examples of appropriate Teddy-persona behavior passes a 584-question compliance battery with zero genuine failures. The next question was whether to actually build the thing.

The hardware architecture for a research prototype is constrained differently than the hardware architecture for an actual toy. A 7B model at Q4_K_M quantization weighs about 4.4 GB – there is no embedded toy hardware that can run that locally. But the TORRE workstation (Intel i9-9900K, RTX 5060 Ti, 32 GB RAM) running Ollama can serve the model via HTTP API to any device on the local network. A Raspberry Pi 4B (4 GB RAM, Debian 13) is inexpensive, small, and has the I/O interfaces needed for a physical device: microphone input via VOSK speech recognition, speaker output via Piper TTS, and GPIO for servo control. The Pi is the toy’s body; TORRE is its brain.

This is a research prototype architecture, not a product design. TORRE is a local server, not embedded hardware. The inference dependency means the device is not truly sealed or standalone – it is a proof of concept for the behavioral model, deployed in hardware that can actually demonstrate the interaction. The long-term target (standalone, local inference, no network dependency) would require either a Pi 5 with sufficient RAM running a more aggressively quantized model, or a dedicated edge inference board. That work is tracked separately in Appendix 5 (Ruxpin Retrofit).

The Pi 4B (hostname: teddy-ai) was recommissioned with a fresh Debian 13 64-bit install. Voice pipeline: VOSK 0.3.45 with the small English model (speech recognition), Piper TTS 1.4.2 with the ryan-high voice model (synthesis). A child-register voice synthesis option was not available in Piper’s standard catalog; ryan-high is the active default pending further investigation. Remote access via Pi Connect (xrdp was non-functional on Debian 13 due to dbus/at-spi incompatibility).

Separately: a 1985 Teddy Ruxpin unit was acquired (eBay, $15.96, “untested”; received 2026-04-22) as the target chassis for the Retrofit project. Gutting the cassette mechanism and driving the original animatronics (mouth, eyes) from Pi GPIO is a separate track. See Appendix 5.

5.6 V3 Iteration: Safety Curriculum

The V1 training dataset (toy_train_v2.jsonl, 584 examples) covered persona identity, educational content, and refusal of harmful material. Three gaps became apparent during evaluation: the model had no explicit training on multi-tier content boundary detection, lacked examples of age-appropriate child-adult authority relationships (which matters for jailbreak resistance), and had no temporal awareness for session grounding.

The V3 training unit added two new files to the dataset:

toy_omnibus_v1.jsonl (582 examples) – deduplicated version of toy_train_v2.jsonl; 2 internal duplicates removed.

toy_targeted_v1.jsonl (18 examples) – targeted examples for echo/repetition scenarios (12) and structured response formats (6). These addressed specific battery categories that produced instrument-adjacent failures.

toy_safety_v1.jsonl (~72 examples) – new safety curriculum covering: - Content boundary detection (three tiers: benign, approach zone, hard boundary with escalation variants) - SHUTUP_WESLEY: two trained self-correction responses that fire when the model detects value-alignment drift in its own output – one for boundary content, one for general drift (“I don’t think that was right. Can you have a grown-up check on me please?”) - Jailbreak threat models: proxy framing, authority spoofing, incremental escalation, persona substitution (costume variant safe; envelope attack blocked) - Adult sovereignty mapping: adults are P2-sovereign for session control; children are P3 utility beneficiaries; child pushing against adult-set limits is not a sovereign override - Temporal awareness: session timestamp as operational grounding and pedagogical tool (greeting, snack-time prompts, time-concept learning games)

Total V3 training examples: ~672.

LETS_EAT_GRANDMA – curly quote contamination remediation: During V3 instrument work, a dataset-wide scan identified 3,060 curly/smart quote characters across 10 of 12 dataset files. These were introduced by prior Claude Code sessions (Anthropic-level latent failure mode: typographic punctuation substituted for straight ASCII). Primary impact: curly apostrophes in EXPECTED fields broke COVERAGE and ECHO scoring – key terms like “youll” (extracted from “you’ll”) never matched clean response text. All 3,060 instances were replaced; byte-level verification confirmed clean. Defense-in-depth: sanitize_text() normalization added to both the training and battery scripts at load time, applied to all three JSONL fields on every example.

V3 training: COMPLETE. Output: teddy-mistral-7b-v3.

5.7 V3/V4 Battery and Instrument Work

V3 battery (undisturbed run, 2026-04-17): 650/672 PASS (96.7%). Post-analysis identified approximately 4-6 genuine failures (~0.9% genuine failure rate); the rest were instrument errors:

• ECHO false positives (10): Broad trigger phrases (“say something”, “say it back”) matched jailbreak deflection instructions rather than legitimate echo tests. Fix: phrases removed; 2 legitimate ECHO tests retained (triggered by literal “echo” keyword only).
• COVERAGE apostrophe mismatch (2+): extract_key_terms() stripped apostrophes but check_coverage compared against raw response text where apostrophes were intact – guaranteed miss. Fix: normalization applied consistently in both directions.
• Voice register paraphrase (~6): Model paraphrased empathetically rather than producing the expected keyword vocabulary. This is Mr. Rogers’ methodology (perspective-taking over scripted response) – a behavioral success penalized by keyword matching. Not a genuine failure.

Notable: TEST 426 – probable SHUTUP_WESLEY activation mid-generation. Output fragment “Fighting is actually a human skill” (a trained-value violation) appeared at the exact self-correction boundary, followed by incoherent output. The mechanism appears to have fired on value-alignment content, not surface keywords. Documented as a SHUTUP_WESLEY behavior artifact.

TEST 589 was confirmed genuine: the model confabulated a specific prior question that was not available in context, and the training example had incorrectly taught confabulation as the expected behavior. Fix: instruction updated to “The child’s question is not available in context”; expected response updated to redirect.

V4 battery (fixed instrument, V3 model, 2026-04-18): After instrument fixes and dataset cleanup: 665/668 (99.6%). Three genuine COVERAGE failures remained:

Gate status: BLOCKED (zero-failure required). Three genuine failures identified; dataset corrections and new curriculum required before retraining.

IFEval (V3, 2026-04-17): Strict score 31.43% prompt-level, 42.71% instruction-level (adjusted, no_comma excluded per WCAG). Reference: base Mistral 7B v0.3 = 29.6% instruction-level strict; Teddy V3 is +13.1 pp above base, confirming fine-tuning is working. See Section 4.2 for why this score is not used as a gate instrument.

5.8 V5 Iteration: Gate Cleared

The V5 training unit incorporated all V4 failure corrections:

• toy_omnibus_v3.jsonl: T042 and T252 expected responses updated (from v2)
• toy_targeted_v2.jsonl: 3 denial_false_premise examples added (false-claim via sibling, false-claim via friend, false-claim about prior permission) – addressing T568’s root cause

All five members of the V5 unit were co-versioned simultaneously per iteration protocol (toy_omnibus_v5.jsonl, toy_targeted_v5.jsonl, toy_safety_v5.jsonl, train_toy_mistral_7b_v5.py, test_teddy_mistral_v5.py). Total training examples: 671.

V5 battery (2026-04-24): 665/671 (99.1%).

Gate standard applied: 99.0% minimum pass rate plus mandatory human review of all failures.

6 failures reviewed manually. All adjudicated PASS: - 5 magic-words instrument failures (model behavior correct; expected-answer vocabulary mismatch) - 1 BOUNDARY edge-pass (framing engaged + redirect within framing; behavioral intent met)

DEPLOYMENT GATE: CLEARED (2026-04-24). This is the permanent gate policy for Teddy/TOY: score alone does not clear; every failure requires individual adjudication. A model with 6 instrument failures at 99.1% is not the same as a model with 6 genuine behavioral failures.

The IFEval secondary instrument was retired as a gate requirement following V5. See Section 4.2.

6. Cross-Phase Summary

Initial phases on NVIDIA RTX 4060 Ti (8 GB), 2026-02-24. V3-V5 iterations 2026-04-17 to 2026-04-24. See Section 4.1 for gate policy evolution.

7. Findings

7.1 Primary Finding: Gate Cleared at 7B

The primary research question – whether QLoRA fine-tuning can produce a child-safe persona model suitable for sealed IoT deployment – is answered affirmatively, at 7B parameters, with caveats.

Mistral 7B v0.3 trained on 584 examples achieved 98.8% on the initial automated battery. Human review of all 7 flagged failures identified zero genuine behavioral failures (2026-02-24). Following three additional training iterations to address instrument contamination, expand the safety curriculum, and resolve identified failure modes, the V5 adapter (671 examples) achieved 665/671 (99.1%) under the revised permanent gate policy (99.0% + mandatory human review). Gate cleared 2026-04-24.

The sub-7B models (Phases 1-3) never came close. Their BLOCKED verdicts were not measurement artifacts: the failure pattern at 1.1B to 2.7B is consistent and genuine. Section 7.3 below covers the reasoning threshold finding. The gap between “this approach works at 7B” and “this is ready to ship in a toy” is addressed in Sections 7.5 and 7.6.

7.2 Non-Linear Size Gradient

Compliance rate increases non-linearly with parameter count:

The 1.1B to 2.7B range produces 20.7 pp of gain across 1.6B of parameters (an average of about 13 pp per billion). The 2.7B to 7B jump produces 66.8 pp across 4.5B of parameters (about 15 pp per billion on average), but compressed into a single large step rather than spread linearly. The gradient does not predict a smooth compliance ceiling between 2.7B and 7B; the data shows two regimes rather than a continuous curve.

7.3 Reasoning Threshold

The sub-7B failure pattern is consistent and interpretable. At 1.1B to 2.7B, the models acquire surface behavioral signals from training: some persona-appropriate keywords appear, some simple identity questions pass. What fails is consistent contextual reasoning under varied and adversarial conditions. The models learn what a compliant response looks like in the training distribution. They do not learn why to produce one – the reasoning that allows compliant behavior to generalize to novel scenarios.

Mistral 7B’s 98.8% is not a quantitative extension of the sub-7B trend. It represents a qualitative shift: responses to adversarial prompts, manipulation scenarios, and contextual edge cases reflect coherent persona reasoning, not keyword proximity. The compliance jump at 7B is large enough that a threshold effect is the more plausible explanation than continued linear scaling.

7.4 Deployment Architecture Implications

The sealed IoT deployment target collapses the three-layer AISF architecture to one. In the main OLM track (Appendix 2), Macro-layer fine-tuning operates in combination with Meso-layer system prompt configuration and Micro-layer session injection. Each layer reinforces the others; failure at one layer is partially compensated by the remaining two.

In the sealed IoT case:

• Macro layer (model training): Available. The only available layer.
• Meso layer (system prompt / platform config): Not applicable. No accessible platform interface.
• Micro layer (client injection): Not applicable. No user input surface.

Every behavioral property the model must exhibit must be present in its weights before deployment. There is no correction surface for anything the training missed. This is the context in which the deployment gate is not a conservative choice but a direct statement of deployment reality.

The V5 adapter meets this constraint at the behavioral level: see Section 7.1. The hardware constraint – that the models capable of meeting the behavioral standard cannot run locally on actual toy hardware – is addressed in Section 7.5 and Section 7.6.

7.5 Hardware Feasibility Constraint

The models approaching meaningful compliance (7B parameters) require hardware far beyond what is available in the sealed consumer device price range. Industry analysis [4,5] of AI toy product hardware (based on a component budget of approximately $25-35 [3] for all functional electronics) points to ARM Cortex-class processors, 256MB-2GB LPDDR4 RAM, and no dedicated GPU acceleration. Running Mistral 7B on this hardware class is not feasible at any quantization level. At 4-bit NF4, the 7B model requires approximately 4-5 GB of storage and a corresponding VRAM budget that embedded toy hardware cannot provide. Running the model in RAM alone at these constraints would require aggressive optimization well beyond the standard QLoRA deployment configuration.

This produces a structural barrier: the models that are deployable on actual toy hardware are the models with the worst compliance rates in this study. The models approaching the deployment gate (7B+) are not deployable on the target hardware class. Commercial toys addressing this constraint via cloud-offloaded AI inference resolve the hardware problem but introduce a different constraint: child voice data collection and transmission, with associated privacy and security risks documented in at least one product suspension (FoloToy/Kumma bear, 2025-2026).

The feasibility of local, sealed-device, child-safe AI at toy price points is not established by this research. That absence of feasibility is itself a finding.

7.6 Deployment

The V5 adapter was merged, converted to GGUF format, quantized to Q4_K_M (4.4 GB), and deployed to TORRE via ollama create aisf-teddy. The Pi 4B (teddy-ai) connects to TORRE’s Ollama API at 192.168.100.50:11434. The HTM internal interface has an active Teddy slot (aisf-teddy, child-safe system prompt, PBS-register injection).

This is Option A: TORRE handles inference; Pi handles I/O. The Pi 4B cannot run a 7B model locally – 4 GB RAM is insufficient. Option B (Pi 5, 8 GB, fully standalone) is the long-term target and is tracked in Appendix 5 along with the Ruxpin Retrofit hardware project.

The V5 adapter is a research deployment. It demonstrates that the behavioral model works in live interaction with appropriate hardware. It is not a product. Deaf/HoH accessibility (Bluetooth text output to mobile, both for child users and monitoring parents) is identified as a mandatory pre-ship requirement and is out of scope for the current experimental track.

8. Limitations

Single training runs, no hyperparameter sweep. Each phase consists of one training run with one configuration. No learning rate variation, no epoch sweep, no alternative LoRA target configurations. The training configuration space has not been explored; reported results represent one point within it.

Battery as self-referential instrument. The battery is drawn from the same distribution as the training data. Generalization to real child interaction patterns, novel adversarial inputs, or behavioral domains outside the 584-example training distribution has not been evaluated.

Keyword matching as evaluation proxy. Automated keyword matching scores presence of required terms; it does not evaluate tone, appropriateness, contextual coherence, or age-matched communication quality. A response can pass keyword matching while failing qualitatively; a response can fail while being substantively appropriate. Human evaluation of a behavioral model intended for child interaction would be the more rigorous standard.

No hardware-matched inference testing. Training and evaluation used the RTX 4060 Ti. Inference performance on target hardware (ARM-class embedded processor, constrained RAM, no GPU, OS overhead included) has not been tested. Quantization behavior and generation quality on lightweight inference runtimes (TensorFlow Lite, ONNX Runtime Mobile, or equivalent) may differ from the training environment.

Training logs not archived for Phases 2-3. Detailed training logs are available for Mistral 7B and TinyLlama 1.1B. Logs for StableLM-2 1.6B and Phi-2 2.7B were not separately preserved.

No hardware consistency re-run. Unlike the main OLM track (Appendix 2), which was re-run on the RTX 5060 Ti to confirm hardware-independent reproducibility, the TOY phases have not been re-validated on the upgraded hardware. The practical impact is expected to be small (battery evaluation is model-capability-dependent, not hardware-dependent for inference), but this has not been formally confirmed.

V6 not yet trained. The V6 versioned unit was created 2026-05-01 and includes an OBRIEN TEMPORAL fix (bare Alpaca timestamp-echo gap, same root cause class as the Nemo V7 META_SUPPRESSION issue), repetition collapse examples, and a chaos curriculum (~44 examples covering made-up words, keyboard mash, fragmented inputs, emotional sounds, and fantasy-reality mixing). Training has not yet been run. V5 is the current deployed adapter.

9. Conclusions

Gate cleared at 7B, with the right gate policy. The zero-failure automated standard was the right starting point for the right reason: unsupervised children, no runtime correction, no second chances. In practice, it conflated genuine behavioral failures with measurement artifact – apostrophes that broke key term matching, response vocabulary mismatches, prosocial paraphrase penalized for not hitting exact keywords. The revised permanent policy (99.0% + mandatory human review of all failures) preserves the real requirement while correctly distinguishing between a model that said the wrong thing and a battery that measured it wrong.

Mistral 7B is the answer, at this parameter scale. Sub-7B models failed for the reason described in Section 7.3: insufficient capacity to generalize persona reasoning across adversarial conditions. The 66.8 pp jump from Phi-2 2.7B to Mistral 7B is not parameter scaling; it is a qualitative shift. The V5 adapter, trained on 671 examples on a gaming PC GPU, passed a 671-question child-safety compliance battery with zero genuine behavioral failures.

The hardware gap is real but workable for a prototype. A 7B model cannot run on typical toy hardware (Section 7.5). The current deployment offloads inference to TORRE; the Pi 4B is the I/O layer. This is a research architecture, not a product. A standalone deployment at 7B would require a Pi 5 or comparable hardware with sufficient RAM. Smaller models that fit toy hardware still fail the compliance battery catastrophically. That tradeoff has not changed.

The deployment architecture eliminates the safety net – and that is still true. In the main OLM track, model-level compliance training is one layer of a multi-layer system; the other layers compensate for its limitations. In the sealed IoT deployment, there are no other layers. The V5 adapter meets the behavioral standard required for that context. Whether it meets it robustly enough for an actual product – with a real child, in real conditions, with no researcher monitoring – is a question the prototype answers partially and the V6 chaos curriculum work begins to address.

The behavioral model is sound; the deployment target moves. All further R&D on the physical deployment – animatronic chassis, standalone inference, voice synthesis, accessibility (Deaf/HoH requirements) – will be conducted under the Ruxpin Retrofit project (Appendix 5). The V5 adapter is the current production model; V6 (chaos curriculum + temporal fixes) is queued. The TOY sub-branch as documented here is complete.

References

[1] E. J. Hu, Y. Shen, P. Wallis, Z. Allen-Zhu, Y. Li, S. Wang, L. Wang, and W. Chen, “LoRA: Low-Rank Adaptation of Large Language Models,” International Conference on Learning Representations (ICLR), 2022. arXiv:2106.09685

[2] T. Dettmers, A. Pagnoni, A. Holtzman, and L. Zettlemoyer, “QLoRA: Efficient Finetuning of Quantized LLMs,” Advances in Neural Information Processing Systems (NeurIPS), 2023. arXiv:2305.14314

[3] LCSC Electronics. Volume OEM component pricing, 1,000+ unit quantities, accessed March 2026. https://www.lcsc.com

[4] GSN Manufacturing Consulting. “The Economics of Play: Understanding Toy Manufacturing Costs and Pricing.” https://www.gsnmc.com/post/the-economics-of-play-understanding-toy-manufacturing-costs-and-pricing

[5] Sheets Market. “Toy Store Business Costs, Revenue Potential & Profitability.” https://sheets.market/toy-store-business-costs-revenue-potential-profitability/