Toxic: On-device Multilingual Hate Speech Detection
On-device multi-label classifier that flags hateful, harassing, threatening, sexual, and self-harm content across English, Spanish, Portuguese, French, German, Italian, Polish, and Dutch, so questionable text can be triaged before it ever leaves the device.
Toxic is an on-device multi-label classifier for hate speech, harassment, threats, sexual harassment, and self-harm across eight languages: English, Spanish, Portuguese, French, German, Italian, Polish, and Dutch. When the hateful head fires, ten target heads identify which protected ground the text targets: race, colour, religion, descent, national or ethnic origin, sexual orientation, gender, disability, age, or other.
The edge is size against quality. Toxic beats Llama-Guard-3-1B and Qwen3Guard-Gen-0.6B by 13 to 17 macro F1 points on the seven EU languages, and Detoxify by 30, at a fraction of their disk footprint (75.5 MB LiteRT, 66.7 MB Core ML, versus roughly 500 MB to 1 GB for the guard-model builds). Training data is commercially clean (CC0, CC-BY, MIT, Apache-2.0 only), so it can ship in a product without the licensing exposure of scraped hate-speech corpora.
Performance
Beats Llama-Guard-3-1B and Qwen3Guard-Gen-0.6B by 13 to 17 macro F1 points on the seven EU languages, at 6 to 14 times smaller: 75.5 MB LiteRT versus 500 MB to 1 GB for the guard-model builds.
Macro F1 at threshold 0.40 through the same HateCheck harness (internal). The 7-EU column is the average across Spanish, Portuguese, French, German, Italian, Polish, and Dutch. Toxic wins outright on 7 of 8 languages; Llama-Guard leads only on English.
| Model | 7-EU F1 | EN F1 | Size |
|---|---|---|---|
| Toxic (LiteRT int4) | 0.786 | 0.787 | 75.5 MB |
| Toxic (Core ML 4-bit) | 0.777 | 0.771 | 66.7 MB |
| Qwen3Guard-Gen-0.6B (bf16) | 0.652 | 0.770 | server |
| Llama-Guard-3-1B (bf16) | 0.649 | 0.814 | server |
| Llama-Guard-3-1B (int4) | 0.633 | 0.794 | 955 MB |
| Qwen3Guard-Gen-0.6B (int4) | 0.622 | 0.750 | 484 MB |
| Detoxify multilingual (fp32) | 0.487 | 0.642 | ~280 MB |
Internal evaluation on the HateCheck suite (roughly 3,700 hand-written test cases per language), never used for training. Competitors re-run through the same harness.
Use cases
Pre-send triage in messaging
Score outgoing messages on device before they leave the phone, so hateful, threatening, or harassing content can trigger an inline warning or a review path without ever reaching your servers.
Server-free comment triage
Run every incoming comment through Toxic locally in the client, flag likely hate speech for a moderator queue, and only escalate flagged text to a human. Cuts the volume that needs central moderation without a cloud call per message.
Route self-harm and threat signals to help
The self-harm and threat heads are separate from the hateful head, so a client can surface a crisis resource or an escalation path without conflating either signal with hate.
Eight languages in one model
A single 75 MB artifact covers English, Spanish, Portuguese, French, German, Italian, Polish, and Dutch. One integration for eight languages, with no per-language pipeline and no separate language detection step.
What it does
- Five multi-label content heads: hateful, harassment, threat, sexual, self-harm.
- Ten target heads on top of the hateful head: race, colour, religion, descent, national or ethnic origin, sexual orientation, gender, disability, age, other.
- Eight languages from a single artifact: English, Spanish, Portuguese, French, German, Italian, Polish, Dutch. Per-language threshold menu ships in the model metadata.
- Trained only on permissively licensed corpora (CC0, CC-BY, MIT, Apache-2.0), so it can ship in a commercial product.
- Runs fully on device: 66.7 MB Core ML (4-bit, ANE-optimized) or 75.5 MB LiteRT (int4 blockwise-32).
Specs
- Languages
- 8: English, Spanish, Portuguese, French, German, Italian, Polish, Dutch
- On-device size
- 66.7 MB Core ML (4-bit); 75.5 MB LiteRT (int4 blockwise-32)
- Backbone
- XLM-R-base with a trimmed 60,728-piece vocab, 12 layers, hidden 768, ~133M params
- Accuracy
- 0.786 macro F1 across 8 languages (LiteRT int4), 0.777 (Core ML 4-bit)
A moderation triage aid, not a verdict: escalate flags to a human reviewer or a heavier local tier instead of auto-removing. Under adversarial testing, Toxic can flag counter-speech, negated hate, reclaimed slurs, and short identity mentions in a meaningful share of cases, especially in English and German. For Dutch, German, and Polish, pair it with a per-language slur wordlist to catch bare slurs it misses.
FAQ
What is Toxic?
On-device multi-label classifier that flags hateful, harassing, threatening, sexual, and self-harm content across English, Spanish, Portuguese, French, German, Italian, Polish, and Dutch, so questionable text can be triaged before it ever leaves the device.
Does Toxic run on device?
Yes. Toxic runs entirely on device: inference happens locally with no server call, so data never leaves the device.
Is Toxic available yet?
Toxic is in closed beta. You can request early access from its page.
How much does Toxic cost?
Every model is free up to 100k monthly active devices per SDK. Unlimited inference per user. Contact us for custom licenses.
How accurate or fast is Toxic?
Beats Llama-Guard-3-1B and Qwen3Guard-Gen-0.6B by 13 to 17 macro F1 points on the seven EU languages, at 6 to 14 times smaller: 75.5 MB LiteRT versus 500 MB to 1 GB for the guard-model builds.
Early access
Tell us what you are building and we will get you set up.