Open-weight moderation models land inside the proprietary error band on Bluesky posts

One decision rule across all three categories buys both failure modes at once. Because specificity beat sensitivity on rudeness, a violating rude post was likelier to slip past than a clean post was to be flagged ^[6]. On intolerance and threats that ordering flipped, so the false alarms concentrate there ^[6]. Zero-shot classification hands back a label, not a score, so the per-category adjustment has to be a per-category prompt, a different model on one category, or a second pass over one category's flags.

The overlap is between two sets. Four proprietary systems produced the 72 to 98 percent sensitivity band and three open-weight ones the 81 to 97 percent band ^[1][4]. At the floor the open-weight set looks better, by 9 points of sensitivity ^[4]. It is still a floor of 81 percent, or 19 violating posts in every 100 going through ^[1]. The open-weight specificity band tops out at 100 percent, and a classifier that flags nothing scores that as well. The models and the sample size are missing from the arXiv abstract, so the bands cannot be turned into a shortlist.

Sensitivity and specificity carry across prevalence, but the load on a review queue tracks it. The study sampled rule-violating posts in three categories plus a random draw of posts the Bluesky Moderation Service had not flagged ^[3], a higher violation rate than a live stream. Assume one post in a hundred breaks the rules, and treat that rate as an assumption rather than a measurement in the paper. At the bottom of the open-weight band, 91 percent specificity turns 99 clean posts into 8.91 flags while 81 percent sensitivity turns the single violation into 0.81 ^[2], so about 92 flags in 100 are wrong ^[3].

Ground truth here is two authors reading the criteria the moderation service publishes and annotating each post independently ^[2]. The paper also reports inter-rater agreement across human moderators and the LLMs ^[5]. Measured sensitivity therefore depends on which human the model is scored against, and that holds for an operator's own labels too.

Open-weight models small enough for consumer devices had been reported as inadequate for harmful content detection, or as needing fine-tuning first ^[7], while proprietary models had already beaten commercial moderation tools on accuracy ^[9]. The check that settles it for one platform is a few hundred of its own past decisions, labelled by category, with sensitivity and specificity computed for each category separately, since a pooled score averages the two failure directions together.