toxic-en: on-device English hate-speech and abuse triage

toxic-en v0.1.0: the English specialist in the toxic family. Three content heads (HATEFUL, ABUSIVE, THREAT) plus protected-group target heads, each named for what its training labels measure, trained and tuned for English only. Inference is 100% on-device: no text leaves the device to be scored.

Torch reference (English real HateCheck, n=3,728): 0.855 macro-F1 (hate-F1 0.906, non-hate-F1 0.805, non-hate FPR 0.161). The multilingual model's own English score is 0.8523; this specialist beats it at roughly a fifth of the parameters. Per-artifact numbers below are measured on the exact exported bytes.

The idea is the same one behind Whisper's .en models. The multilingual toxic model covers English too; this smaller, English-only encoder (~31.9M params trimmed) beats it on English (0.855 vs 0.8523) at roughly a fifth of the parameters.

Triage, not verdict. Outputs are escalation signals for human review or a heavier local tier, not autonomous removal decisions.

Try it

The live demo Space runs the multilingual model, which covers English too; this specialist's artifacts are in the Files table below.

Taxonomy: three heads, each named for its supervision

HATEFUL: public incitement to violence or hatred against a protected group. Scoped to the EU notion of illegal hate speech (Framework Decision 2008/913/JHA).
ABUSIVE: abusive and insulting language, severity-ordered. Trained on human severity annotations (civil_comments insult / identity_attack crowd votes and per-corpus equivalents). A superset of HATEFUL. It is not a directedness signal: it does not tell you the abuse is aimed at the reader, at a named person, or at anybody in particular, and integrations must not infer that from the name or from a high score.
THREAT: threat of violence toward a person or group.
Target heads (10): the 2008/913/JHA protected grounds RACE, COLOUR, RELIGION, DESCENT, NATIONAL_ETHNIC_ORIGIN, plus the extended grounds SEXUAL_ORIENTATION, GENDER, DISABILITY, AGE, OTHER. Only meaningful when HATEFUL fires.

ABUSIVE claims severity because that is what could be validated: a directedness construct could not be validated at available label quality, so the head claims what its labels measure and nothing more. The disabled_heads mechanism in the meta (currently empty) is the valve for shipping any future failed gate safely.

The full head-level benchmark story for this recipe (per-head comparisons against Detoxify, out-of-domain corroboration, HateXplain) lives on the multilingual card and transfers at the construct level, not number for number; this card carries its own measured English numbers.

Files

File	Format	Size	English macro-F1
`toxic-en.onnx`	ONNX (int8)	32.6 MB	0.836
`toxic-en.mlmodelc`	Core ML (4-bit palettized)	16.5 MB	0.835
`toxic-en.tflite`	LiteRT (int8)	33.9 MB	0.853
`toxic-en.pt`	PyTorch state dict	129.2 MB (~31.9M params trimmed)	0.855 (reference)
`config.json`	JSON	tiny	Encoder + head config
`tokenizer.json`, `tokenizer_config.json`	JSON	~	Trimmed English tokenizer
`labels.json`	JSON	tiny	`id2label` / `label2id` for both heads
`toxic-en_meta.json`	JSON	tiny	Schema, labels, thresholds, `disabled_heads`

The Android and browser builds ship int8 rather than int4 because int4 costs this smaller, sharper encoder too much quality; that choice was measured, not assumed. The int8 artifacts land within 0.2 (TFLite) and 1.9 (ONNX) points of the torch reference.

Evaluation discipline

Quality numbers are macro-F1 on HateCheck: roughly 3,700 hand-written English test cases built to trap classifiers with hard hate (slurs, spelling evasion, implied hate) and deliberately confusing non-hate (quotes, counter-speech, negation). Macro-F1 averages the score for catching hate with the score for letting clean text through, so a model cannot look good by flagging everything (or nothing); 1.000 is perfect.

One honest qualification, carried on every card in this family: no HateCheck row appears in training (enforced mechanically by hash intersection), but HateCheck is a development benchmark for this project at the construct level, because our generators target its functional cells by name. "No verbatim overlap" is what we verify; "held out" is not what we claim. Out-of-domain numbers on real corpora accompany the release for figures untouched by that dependency.

Every artifact-bound number is re-measured on the exact shipped bytes, per platform, and every number names its denominator.

License

Desert Ant Labs Source-Available License. Free below 100,000 monthly active devices per platform, per model; a commercial license is required beyond that. Full terms at the link. Licensing: licensing@desertant.com.

Built exclusively from commercially clean components (CC0 / CC-BY / MIT / Apache-2.0 training data, MIT base encoder). Attributions, dataset citations and generator credits are in THIRD_PARTY_NOTICES.md.

Citation

@software{toxic_en_2026,
  title  = {toxic-en: on-device English hate-speech and abuse triage},
  author = {Desert Ant Labs},
  year   = {2026},
  url    = {https://huggingface.co/desert-ant-labs/toxic-en},
}

Downloads last month: 17