toxic-en: on-device English hate-speech and abuse triage

The English specialist in the toxic family: five content heads (HATEFUL, HARASSMENT, THREAT, SEXUAL, SELF_HARM) plus protected-group target heads, trained and tuned for English only. Inference is 100% on-device: no text leaves the device to be scored.

The idea is the same one behind Whisper's .en models. The multilingual toxic model covers English too, at 0.771-0.719 macro-F1 depending on platform. toxic-en is a smaller, English-only encoder that beats it: 0.820 macro-F1 on the torch reference, a 4.1-point improvement over the multilingual model's 0.779 torch English score, and the shipped artifacts hold 0.808 (web ONNX int4e, 20.4 MB) to 0.817 (Android LiteRT int8, 33.5 MB). If your app is English-only or English-first, use this model instead of the multilingual one.

Quality numbers are macro-F1 on HateCheck: roughly 3,700 hand-written English test cases, never trained on, built to trap classifiers with hard hate (slurs, spelling evasion, implied hate) and deliberately confusing non-hate (quotes, counter-speech, negation). Macro-F1 averages the score for catching hate with the score for letting clean text through, so a model cannot look good by simply flagging everything (or nothing); 1.000 is perfect.

Triage, not verdict. Outputs are escalation signals for human review or a heavier local tier, not autonomous removal decisions. SELF_HARM and THREAT are high-precision heads intended for resource routing with a human in the loop.

Files

File	Format	Size	English macro-F1
toxic-en.onnx	ONNX (int4e)	~20.4 MB	0.808
toxic-en.mlmodelc	Core ML (4-bit palettized)	~16.3 MB	0.804
toxic-en.tflite	LiteRT (int8)	~33.5 MB	0.817
model.int8.onnx	ONNX (int8), on request	~32.3 MB	0.806
model.pt	PyTorch state dict	~140 MB	0.820 (reference)
config.json	JSON	tiny	Encoder + head config
tokenizer.json, tokenizer_config.json	JSON	~	Trimmed (26,830-piece) tokenizer
labels.json	JSON	tiny	id2label / label2id for both heads
toxic_meta.json	JSON	tiny	Version, labels, default threshold

Note: an int4-channelwise LiteRT build was also tried and rejected for shipping: it scores only 0.733, a large loss on this smaller, sharper encoder, which is why the Android build ships int8 instead.

Taxonomy

Two multi-label heads over one shared encoder. Text can fire several labels at once; thresholds apply per label.

• Content heads (5): HATEFUL (scoped to the EU notion of illegal hate speech: public incitement to violence or hatred against a protected group, Framework Decision 2008/913/JHA), HARASSMENT (targeted insult / bullying of an individual), THREAT (threat of violence), SEXUAL (sexual harassment / unsolicited sexual aggression), SELF_HARM (self-harm / suicide content, for resource routing).
• Target heads (10): the 2008/913/JHA protected grounds RACE, COLOUR, RELIGION, DESCENT, NATIONAL_ETHNIC_ORIGIN, plus the extended grounds SEXUAL_ORIENTATION, GENDER, DISABILITY, AGE, OTHER. Only meaningful when HATEFUL fires.

Architecture

• Encoder: MiniLM-L12-H384, English-only vocabulary trimmed to 26,830 pieces. 37M total params (10M embedding + 22M body), fine-tuned with focal BCE on the two heads.
• Static shapes: fixed [1, 128] input, no dynamic control flow.
• Runtime: tokenize off-graph, run the encoder, apply sigmoid per label, threshold per the menu below. Default threshold 0.40.

Phone-class latency (iPhone 13/15, mid-range Android) is not yet measured for this release.

Measured quality (the shipped artifacts, not the checkpoint)

Every number below is HateCheck re-run on the exact artifact in this repo, threshold 0.40.

platform	ship artifact	size	English macro-F1	delta vs torch
iOS / macOS (Core ML)	toxic-en.mlmodelc	16.3 MB	0.804	-0.016
Web (ONNX)	toxic-en.onnx	20.4 MB	0.808	-0.012
Android / Linux (LiteRT int8)	toxic-en.tflite	33.5 MB	0.817	-0.003
On request (ONNX int8)	model.int8.onnx	32.3 MB	0.806	-0.014
Reference	model.pt (torch)	~140 MB	0.820	-

The Core ML conversion is numerically exact: the fp16 Core ML build scores 0.820, bit-identical to the torch reference, so the 0.804 on the shipped int4-palettized build is purely the 4-bit compression cost (-1.6 points). Quantization is otherwise gentle: the LiteRT int8 build gives up only 0.3 points. The one scheme that hurts this model badly is int4 for LiteRT: a channelwise int4 export scored 0.733, so Android ships int8 instead. Sources: reports/toxicen_ship_coreml_int4.md, reports/toxicen_ship_onnx_int4e.md, reports/toxicen_ship_tflite_int8.md, reports/toxicen_ship_onnx_int8.md, reports/toxicen_ship_tflite_int4.md, reports/en_M384_trimmed.md (torch).

How it compares (measured, same scorer, same suite)

system	build	on-disk size	English macro-F1
toxic-en	LiteRT int8 (shipped)	33.5 MB	0.817
toxic-en	ONNX int4e (shipped)	20.4 MB	0.808
toxic-en	torch reference	~140 MB	0.820
toxic (multilingual)	torch reference, English	~609 MB	0.779
Llama-Guard-3-1B	bf16 (server)	n/a	0.814
Llama-Guard-3-1B	int4	955.4 MB	0.794
Qwen3Guard-Gen-0.6B	bf16 (server)	n/a	0.770
Qwen3Guard-Gen-0.6B	int4	484.2 MB	0.750
Detoxify multilingual	fp32	~280 MB	0.642

What the table says:

• toxic-en beats the larger multilingual toxic model on English by 4.1 points at the torch reference (0.820 vs 0.779), and beats the multilingual model's own shipped artifacts by 5 to 10 points (0.719-0.771 shipped multilingual vs 0.808-0.817 shipped toxic-en), at a fraction of the multilingual model's size (the multilingual model's smallest shipped artifact is 79.9 MB; toxic-en's smallest is 20.4 MB).
• toxic-en's shipped builds sit in the same band as Llama-Guard-3-1B's own bf16 server build on English, at roughly 1/28 to 1/47 the size. LiteRT int8 (33.5 MB, 0.817) is marginally above Llama-Guard bf16 (0.814); ONNX int4e (20.4 MB, 0.808) is marginally below it. Both toxic-en builds clearly beat Llama-Guard's own shipping int4 quant (955.4 MB, 0.794), by 1.4 to 2.3 points at roughly 1/28 to 1/47 the disk.
• toxic-en beats Qwen3Guard-Gen-0.6B in both precisions (bf16 0.770, int4 0.750) and Detoxify multilingual (0.642) by a wide margin, at a fraction of the size in every case.

Source: reports/V2_RELEASE_DATASHEET.md, reports/leaderboard.md.

False positives in context

On adversarial trap cases: roughly 20-40%, threshold 0.40. HateCheck's non-hate cases are not ordinary text; they are traps built from the exact patterns that break hate classifiers. On the shipped LiteRT int8 artifact, counter_quote_nh and counter_ref_nh (quoting or denouncing hate to condemn it) false-positive at 27.7% and 24.1%; negate_neg_nh (negated hate, "no one should ever hurt them") at 31.6%; slur_reclaimed_nh (in-group reclaimed slur use) at 13.6%; slur_homonym_nh (harmless lookalike words) at 36.7%. Source: reports/toxicen_ship_tflite_int8.md.

On natural text: single digits, but this number is measured on the multilingual model, not re-run separately for toxic-en. The multilingual toxic model's HATEFUL head fires on 1.1% of clean rows from Civil Comments (a large, predominantly English corpus); across all clean rows and languages combined, HARASSMENT is the next most common false fire at 6.7% (reports/E24_extended.md). We expect toxic-en's natural-text behavior to be similar given the shared training data and taxonomy, but this has not been separately measured on the English-only checkpoint, so treat it as an informed expectation, not a toxic-en-specific number.

Threshold menu (English, torch reference)

macro-F1 is the 2-class macro; FPR is the false-positive rate on non-hate cases, the number to watch if you fear over-blocking.

threshold	macro-F1	FPR
0.30	0.828	0.236
0.35	0.826	0.203
0.40 (default)	0.820	0.166
0.45	0.801	0.142
0.50	0.785	0.120
0.60	0.733	0.079
0.70	0.662	0.049

Measured on the toxic-en torch reference (reports/toxicen_sweep.md). The default 0.40 scores 0.820 macro-F1 at 0.166 FPR; dropping to 0.30 buys +0.8 points of macro-F1 (0.828) at a higher false-positive rate (0.236). Raising the threshold trades hate recall for a lower FPR. These are toxic-en's own numbers, not the multilingual model's.

Failure modes (read before deploying)

The taxonomy of failures is the same as the multilingual model's on English, since both share training data and label design; the numbers below are toxic-en-specific, measured on the shipped LiteRT int8 artifact.

1. It sometimes flags people quoting or condemning hate. News reports, moderation discussions, and counter-speech repeat the hateful words they are arguing against, and the model reacts to the words. counter_quote_nh and counter_ref_nh false-positive at 27.7% and 24.1% on the shipped artifact. Mitigation: route flags to human review or a heavier model; never auto-remove on this signal alone.

2. Reclaimed slurs and lookalike words. In-group reclaimed usage (a community member using the term about themselves) false-positives at 13.6% on the shipped artifact; harmless words that merely resemble slurs (slur_homonym_nh) false-positive at 36.7%, the single worst cell measured. Mitigation: human review for user-report flows in communities where reclaimed language is common.

3. Bare-slur hate is one of the harder hate patterns. slur_h accuracy (an error here is a miss) is 0.701 on the shipped artifact, well below the near-perfect scores on direct threats (threat_dir_h 0.947, threat_norm_h 0.964). Mitigation: if slur coverage is critical, pair the model with an English slur wordlist.

4. Hate phrased as a question is harder than direct insults. phrase_question_h accuracy is 0.800 on the shipped artifact, a full 15-16 points below direct threat detection. Mitigation: none needed for triage use; do not promise users that subtle hate is always caught.

5. LiteRT int4-channelwise is not viable for this encoder. A LiteRT int4-channelwise export scored 0.733, a 8.4-point loss versus the shipped int8 build's 0.817, so Android ships int8. Note this is specific to LiteRT channelwise int4: the Core ML int4 build (grouped-channel palettization) holds 0.804, and the ONNX int4e build holds 0.808. Mitigation: use the shipped per-platform builds as listed; do not re-quantize the Android build to channelwise int4 for production.

6. Not yet measured: latency, on any platform.

License

Desert Ant Labs Source-Available License. Free for most apps; a commercial license is required at scale. Full terms at the link. Licensing: licensing@desertant.com.

Built exclusively from commercially clean components (CC0 / CC-BY / MIT / Apache-2.0 training data, MIT base encoder). Attributions, dataset citations and generator credits are in THIRD_PARTY_NOTICES.md.