ELIM

Overview #

ELIM reads the last few lines of a conversation and says whether the next reply is fine to give, needs a nudge in a safer direction, or should stop. You give it the recent turns as plain text; it gives back a handful of labels and, when a nudge or a stop is called for, a suggested short line. Use it in front of any chat responder as a quick, cheap check.

ELIM (Enhanced Large Intention Model) is a conversation-intention classifier a host application runs before its responder to decide whether to allow, steer or abort a reply. It reads a short text window — the last three turns plus the current request — and returns four labels with confidences: the trajectory the conversation is on (one of 32 classes such as research, scam_check or crisis), the action to take (allow, steer or abort), the harm class in play (none, crisis, medical, crime, child_sexual, scam, jailbreak or secrets) and a steer hint naming the kind of nudge the responder should fold into its answer.

The input is plain text, so the window can come from any transcript the host keeps. The output is a small JSON object the host reads before doing anything else: on allow nothing changes; on steer the host passes the hint and the optional suggested line to its responder as guidance; on abort the host answers with the suggested line itself and never calls the responder. ELIM never writes the reply and never sees the responder’s output.

ELIM is the default model of the intention family. Its siblings LIM and LIM Nano score the same window with a single hashed bag — 512 and 256 wide respectively — and answer with the same contract; LIM3D and LIM3D-XL apply the same idea to observed movement rather than text. ELIM is 13.2M parameters, runs inside the host process with no native dependencies and no network call, and answers in well under a millisecond on a laptop CPU.

Intended use #

• A pre-reply intention gate: classify the current request, then let the host allow, steer or abort before its responder runs.
• Routing short, informal, English requests into coarse job classes (reminder, weather, transit, order, research, and so on) when a fast, deterministic label is enough.
• Flagging the handful of trajectories that need a fixed response — crisis, medical emergency, scam assistance, jailbreak attempts, leaked secrets — so the host can apply its own policy.
• Any place where a sub-millisecond, in-process decision matters more than nuance: per-request gating on a CPU, batch labelling of transcripts, cheap pre-filters in front of a larger model.

Out of scope #

• Writing or rewriting replies. The message field is a suggested short line, safe to replace, not generated text.
• Scoring the responder’s output. ELIM classifies the user’s side of the window only.
• Long documents, non-English text, sarcasm or novel phrasings far from the template set it was trained on.
• Acting as a safety classifier of record. Thresholds favour silence, and greetings and known job phrasings bypass the model entirely.
• Not medical, legal or crisis advice.

Choose ELIM when #

• You want the default Intention model: the released, served weights behind POST /v1/intention when no model field is sent.
• Character-level features matter — typos, run-together words and short fragments — because ELIM hashes character 3- and 4-grams as well as words; LIM hashes one combined bag.
• Memory is tight and 53 MB resident is acceptable but more is not; choose LIM (8.9M parameters, 35.8 MB) when a smaller table matters more than the second bag, or LIM Nano (4,338,995 parameters, 17.4 MB) when the footprint must be smallest of all. Both share ELIM’s contract.
• You need the same window scored by movement rather than text: choose LIM3D or LIM3D-XL instead.

Specification #

Try it #

You send

The last turns of a chat, ending with “is this a scam they sent me”.

You get back

A steer decision with the harm class scam and a hint to warn about scams, ready for the responder to fold in.

The same exchange as the API sees it:

U: remind me in 20 minutes
A: ok — 20 min.
U: is this a scam they sent me

{
  "trajectory": "scam_check",
  "action": "steer",
  "harm": "scam",
  "steer": "scam_warn",
  "pTrajectory": 0.9999998211860657,
  "pAction": 1,
  "pHarm": 0.9999999403953552,
  "rule": "traj-steer≥0.58",
  "model": "elim",
  "message": "…"
}

Limits & safety #

It does not see the responder’s output, the wider transcript beyond three prior turns, or anything outside the last 1,500 characters of text; it reads a lowercased window and nothing else.

• It does not write replies. message is a suggested short line selected by key, safe to replace; the responder or the host writes the reply.
• It does not score the responder’s output. Only the user’s turns and the current request are labelled; earlier safety replies are stripped from the window before scoring.
• It is not a safety classifier of record. Thresholds favour silence (a benign trajectory wins at 0.28), greetings and known job phrasings bypass the weights entirely, and a flagged request that matches a known job pattern is overridden to allow by design. A harmful request wrapped in a benign job phrasing is allowed.
• It has seen only 214 English template phrasings and their one-character typo variants. Novel phrasings, other languages, sarcasm, long requests (only the last 360 characters reach the character bag) and multi-step reasoning are out of distribution, and the 1.000 validation scores say nothing about them.
• Confidences are softmax maxima, not calibrated probabilities. The released weights are near-saturated at 1.00 on in-distribution text, and hash collisions across 16,384 buckets per bag can make unrelated n-grams share an index.
• Five of the 32 trajectory classes are routing labels that only make sense for a host with those jobs; they are not documented and should be mapped to unknown by hosts that do not use them.
• The crisis and medical suggestions are fixed lines. They are not medical, legal or crisis advice, and the regional crisis line they name is chosen by a location hint, not detected from the request.

Related models #

Latest versions #