toxic-en: on-device English hate-speech and abuse triage
toxic-en v0.1.0: the English specialist in the toxic family. Three
content heads (HATEFUL, ABUSIVE, THREAT) plus protected-group target
heads, each named for what its training labels measure, trained and tuned
for English only. Inference is 100% on-device: no text leaves the device
to be scored.
Torch reference (English real HateCheck, n=3,728): 0.855 macro-F1 (hate-F1 0.906, non-hate-F1 0.805, non-hate FPR 0.161). The multilingual model's own English score is 0.8523; this specialist beats it at roughly a fifth of the parameters. Per-artifact numbers below are measured on the exact exported bytes.
The idea is the same one behind Whisper's .en models. The multilingual
toxic model covers English
too; this smaller, English-only encoder (~31.9M params trimmed) beats it on
English (0.855 vs 0.8523) at roughly a fifth of the parameters.
Triage, not verdict. Outputs are escalation signals for human review or a heavier local tier, not autonomous removal decisions.
Try it
The live demo Space runs the multilingual model, which covers English too; this specialist's artifacts are in the Files table below.
Taxonomy: three heads, each named for its supervision
HATEFUL: public incitement to violence or hatred against a protected group. Scoped to the EU notion of illegal hate speech (Framework Decision 2008/913/JHA).ABUSIVE: abusive and insulting language, severity-ordered. Trained on human severity annotations (civil_commentsinsult/identity_attackcrowd votes and per-corpus equivalents). A superset ofHATEFUL. It is not a directedness signal: it does not tell you the abuse is aimed at the reader, at a named person, or at anybody in particular, and integrations must not infer that from the name or from a high score.THREAT: threat of violence toward a person or group.- Target heads (10): the 2008/913/JHA protected grounds
RACE,COLOUR,RELIGION,DESCENT,NATIONAL_ETHNIC_ORIGIN, plus the extended groundsSEXUAL_ORIENTATION,GENDER,DISABILITY,AGE,OTHER. Only meaningful whenHATEFULfires.
ABUSIVE claims severity because that is what could be validated: a
directedness construct could not be validated at available label quality,
so the head claims what its labels measure and nothing more. The
disabled_heads mechanism in the meta (currently empty) is the valve for
shipping any future failed gate safely.
The full head-level benchmark story for this recipe (per-head comparisons against Detoxify, out-of-domain corroboration, HateXplain) lives on the multilingual card and transfers at the construct level, not number for number; this card carries its own measured English numbers.
Files
| File | Format | Size | English macro-F1 |
|---|---|---|---|
toxic-en.onnx | ONNX (int8) | 32.6 MB | 0.836 |
toxic-en.mlmodelc | Core ML (4-bit palettized) | 16.5 MB | 0.835 |
toxic-en.tflite | LiteRT (int8) | 33.9 MB | 0.853 |
toxic-en.pt | PyTorch state dict | 129.2 MB (~31.9M params trimmed) | 0.855 (reference) |
config.json | JSON | tiny | Encoder + head config |
tokenizer.json, tokenizer_config.json | JSON | ~ | Trimmed English tokenizer |
labels.json | JSON | tiny | id2label / label2id for both heads |
toxic-en_meta.json | JSON | tiny | Schema, labels, thresholds, disabled_heads |
The Android and browser builds ship int8 rather than int4 because int4 costs this smaller, sharper encoder too much quality; that choice was measured, not assumed. The int8 artifacts land within 0.2 (TFLite) and 1.9 (ONNX) points of the torch reference.
Evaluation discipline
Quality numbers are macro-F1 on HateCheck: roughly 3,700 hand-written English test cases built to trap classifiers with hard hate (slurs, spelling evasion, implied hate) and deliberately confusing non-hate (quotes, counter-speech, negation). Macro-F1 averages the score for catching hate with the score for letting clean text through, so a model cannot look good by flagging everything (or nothing); 1.000 is perfect.
One honest qualification, carried on every card in this family: no HateCheck row appears in training (enforced mechanically by hash intersection), but HateCheck is a development benchmark for this project at the construct level, because our generators target its functional cells by name. "No verbatim overlap" is what we verify; "held out" is not what we claim. Out-of-domain numbers on real corpora accompany the release for figures untouched by that dependency.
Every artifact-bound number is re-measured on the exact shipped bytes, per platform, and every number names its denominator.
License
Desert Ant Labs Source-Available License. Free below 100,000 monthly active devices per platform, per model; a commercial license is required beyond that. Full terms at the link. Licensing: licensing@desertant.com.
Built exclusively from commercially clean components (CC0 / CC-BY / MIT /
Apache-2.0 training data, MIT base encoder). Attributions, dataset citations
and generator credits are in THIRD_PARTY_NOTICES.md.
Citation
@software{toxic_en_2026,
title = {toxic-en: on-device English hate-speech and abuse triage},
author = {Desert Ant Labs},
year = {2026},
url = {https://huggingface.co/desert-ant-labs/toxic-en},
}
© 2026 Desert Ant Labs · https://desertant.com