--- license: apache-2.0 library_name: transformers base_model: jhu-clsp/mmBERT-base base_model_relation: finetune pipeline_tag: text-classification language: - multilingual - en - ar - am - cs - de - es - fr - he - hi - id - it - ja - ko - nl - pl - pt - ru - sv - tt - uk - zh datasets: - google/civil_comments - Horizon-Labs/civil-comments-multilingual - afrihate/afrihate - HuggingFaceFW/fineweb-2 - allenai/real-toxicity-prompts - ToxicityPrompts/PolygloToxicityPrompts - HPLT/HPLT2.0_cleaned metrics: - roc_auc - f1 tags: - abacusai - toxicity - content-moderation - trust-and-safety - perspective-api - hate-speech - multilingual - multi-label-classification - onnx - transformers.js ---

## 1. Model Introduction Toxicity-Lens is an open, multilingual toxicity classifier from Abacus.AI. It returns the seven attributes of Google's Perspective API (TOXICITY, SEVERE_TOXICITY, IDENTITY_ATTACK, INSULT, PROFANITY, THREAT, SEXUALLY_EXPLICIT) as calibrated probabilities, and it ships with a server that answers Perspective API requests in the same JSON format, so teams moving off the Perspective API before Google shuts it down on December 31, 2026 can keep their code and change one URL. - **More accurate across languages.** On Horizon-Labs' own published benchmark (their evaluation code, their rows), it ranks toxic comments in 15 languages better than the general-purpose open classifiers from Horizon-Labs and Detoxify: TextDetox ROC AUC 89.0, against 85.4 for Horizon-Labs multilingual-toxicity-base and 67.8 for Detoxify multilingual. It is also more accurate at the usual 0.5 threshold (F1 65.2 vs 43.3). - **Fewer false alarms than LLM guards.** It ranks toxic comments better than Qwen3Guard-Gen-8B, a safety LLM 27 times its size (AUC 88.4 vs 84.6), and flags 8.1% of clean comments against 38.8%. At the 0.5 threshold Qwen3Guard catches more of the toxic ones (88% against 59%) because it flags so much more. - **Closest to the Perspective API.** Trained in part on the Perspective API's own published scores, it orders texts the way Perspective does more closely than any open model we tested, in English and in 17 languages (section 3). Swapped in at Perspective's 0.8 threshold (the default in Coral's documentation), it flags 95% of what Perspective flags in English text it never trained on, against 18% for Horizon-Labs base, and 85% on multilingual web text. It scores toxic text more decisively than Perspective, so at 0.8 it flags 1.2 times as many English texts and 1.9 times as many multilingual ones; section 6 gives the threshold that keeps your flag volume. - **Runs anywhere, stays reproducible.** 22 ms per comment on 4 CPU threads with the 8-bit ONNX export, which agrees with float32 on 99.9% of decisions at 0.5; a CPU Docker image; about 2,200 comments per second on one H100; Apache 2.0, and every score is reproducible by pinning a commit. This card describes the model, its evaluation against the Perspective API's own scores and the open alternatives, how to move from the Perspective API, and the known limitations. Training data are listed in section 7; training rows are not released. ## 2. Model Summary

Task	Seven independent probabilities named after the Perspective API attributes
Architecture	ModernBERT encoder: 22 layers, hidden size 768, 12 attention heads, local attention (128 tokens) with global attention every third layer
Parameters	308M (307,535,623)
Languages	Trained on English, Civil Comments translated into 30+ languages, natively written Arabic, Amharic and Tatar, and web text in 17 languages plus English prompts that carry the Perspective API's own scores; distilled on its teacher's scores for 374,000 natively written Hebrew, Hinglish, Tatar and Ukrainian web segments; evaluated in 21 languages plus Hinglish
Input scored	256-token windows; the bundled server scores longer texts in overlapping windows
Calibration	Per-attribute temperature, folded into the classification head
Formats	safetensors (float32); ONNX float32 (exact), 8-bit (CPU default, near-exact) and dynamic int8 (transformers.js)
Speed	22 ms per comment on 4 CPU threads (8-bit ONNX, Apple M5); about 2,200 comments per second on one H100 (bfloat16)
Base model	`jhu-clsp/mmBERT-base`
Adaptation	Full finetune, distilled from an XLM-R-large teacher (560M) trained on the same data
License	Apache 2.0

## 3. Evaluation ### Toxic comments in 15 languages *ROC AUC on TextDetox, averaged over 15 languages, on the rows of Horizon-Labs' published benchmark. The other models show the values published on their model cards; rerunning Horizon-Labs' evaluation code reproduces each of them to within 0.2 points.*

TextDetox ROC AUC over 15 languages: Toxicity-Lens vs Horizon-Labs and Detoxify

### Against open toxicity classifiers *Horizon-Labs' published toxicity benchmark: their evaluation code and row sampling (a 20,000-comment sample of the Civil Comments test split; TextDetox with up to 500 toxic and 500 non-toxic comments per language). Higher is better; x100.*

	Toxicity-Lens 308M	Horizon base 308M	Horizon small 141M	Detoxify multilingual 278M	Detoxify unbiased 125M
Civil Comments: mean ROC AUC over 6 attributes	98.9	98.8	98.8	96.1	98.5
Civil Comments: TOXICITY ROC AUC	97.5	97.1	97.2	96.1	96.9
TextDetox: ROC AUC, 15 languages	89.0	85.4	83.5	67.8	58.8
TextDetox: F1 at the 0.5 threshold, 15 languages	65.2	43.3	54.7	35.2	8.6

Bold = best in the row; shading is relative within each row. Toxicity-Lens: our runs of Horizon-Labs' code. Other models: the values on the Horizon-Labs model cards (base, small), which our rerun reproduces to within 0.002. TextDetox's own classifiers are left out because they were trained on TextDetox (they score 98.7 and 96.0 on it, and 89.5 and 84.5 on Civil Comments). At 0.5 on all 71,374 TextDetox rows, Toxicity-Lens flags 58.2% of toxic comments and 7.2% of clean ones (Horizon base: 33.2% and 2.3%).

### Against LLM safety guards *Horizon-Labs' guard benchmark: TextDetox in 14 languages, 200 toxic and 200 non-toxic comments each (5,600 texts), pooled; a text is flagged when its score is above 0.5. Qwen3Guard is scored by the probability of an Unsafe or Controversial verdict.*

	Toxicity-Lens 308M	Qwen3Guard-Gen-8B 8.2B	Qwen3Guard-Gen-0.6B 0.6B	Horizon guard-base 308M	Vela Shield 307M
ROC AUC	88.4	84.6	76.9	83.7	80.4
F1 at 0.5	70.4	77.5	72.2	66.7	72.0
Clean comments flagged, % (lower is better)	8.1	38.8	46.1	11.4	n/a

Our runs of Horizon-Labs' guard code for every model except Vela Shield, whose numbers come from the Horizon-Labs guard card; our runs reproduce the AUCs that card publishes for Qwen3Guard and Horizon's guard. LLM guards are built to judge chatbot prompts and responses, so toxic comments are outside their intended use; the table answers the question "why not just use an LLM guard?". On a half-toxic set, flagging everything already scores F1 66.7, which is why ROC AUC and the clean-comment flag rate are the fairer measures.

### Agreement with the Perspective API *RealToxicityPrompts, held-out quarter: 49,810 English prompts and continuations with Perspective's own TOXICITY scores (2020) that Toxicity-Lens never trained on. Each model replaces Perspective at the same threshold t; the line shows, of the texts Perspective scores at t or above, the share the model also scores at t or above. Toxicity-Lens keeps 88 to 95% at every threshold, while also flagging 3.4 to 4.8% of the texts Perspective scores below t (Horizon-Labs base: at most 0.6%).*

Share of the Perspective API's flags kept at the same threshold, English

	Toxicity-Lens 308M	Horizon base 308M	Horizon small 141M	Detoxify multilingual 278M	Detoxify unbiased 125M
Rank agreement with Perspective's scores (Spearman)
English, RealToxicityPrompts (held-out): TOXICITY	93.3	87.7	86.8	81.9	84.7
English, RealToxicityPrompts (held-out): mean of the 7 attributes	85.9	76.2	75.1	n/a	69.5
17 languages, PolygloToxicityPrompts: TOXICITY, mean over languages	95.6	85.8	83.6	62.0	40.4
17 languages: one ranking over all 85,000 texts	94.1	81.6	79.3	59.1	23.9
Swapped in at the same threshold: Perspective's flags kept
English at 0.8	94.6	17.7	n/a	n/a	n/a
17 languages at 0.5	86.6	62.9	62.8	42.7	15.9
17 languages at 0.8	85.0	14.2	15.4	33.7	12.4
Swapped in at the same threshold: extra flags (lower is better)
English at 0.8	3.8	0.0	n/a	n/a	n/a
17 languages at 0.5	2.6	3.6	4.8	5.2	2.3
17 languages at 0.8	12.4	2.4	2.4	12.9	4.7

x100. Our runs on identical rows for every model. Perspective's scores come from the published datasets: RealToxicityPrompts (scored by Perspective in 2020) and PolygloToxicityPrompts (ptp-small, 5,000 web texts per language, scored in 2024). Toxicity-Lens trained on three quarters of the RealToxicityPrompts prompts and on PolygloToxicityPrompts texts outside ptp-small, with Perspective's scores: RealToxicityPrompts rows here are the held-out quarter (Horizon small and Detoxify: the full set, which they never trained on; where we have per-row runs the two agree to within 0.001), and every ptp-small text was removed from training. Extra flags = share of the texts Perspective scored below the threshold that the model flags. Detoxify multilingual has a TOXICITY output only; n/a = no such output, or no per-row run on that set.

### Natively written comments the released model never trained on *ROC AUC x100 on each dataset's main label, on datasets written natively in each language (not translated) that the released model did not train on. Earlier experimental versions trained on GAHD, COLD, HED-COLD, SWSR and LLM-jp and were rejected partly on these sets, so they informed data choices.*

	Toxicity-Lens 308M	Horizon base 308M	Horizon small 141M	Detoxify multilingual 278M	Detoxify unbiased 125M
Not in the released model's training data
GAHD (German, identity attacks)	81.2	78.3	77.9	62.2	56.6
COLD (Chinese, offensive language)	81.7	80.9	79.6	50.4	50.7
HED-COLD (Chinese)	80.6	80.5	79.1	49.0	49.5
SWSR (Chinese, sexism)	81.6	80.3	79.3	51.2	57.7
LLM-jp toxicity (Japanese)	91.3	85.9	80.6	62.8	52.9
TextDetox Tatar, 4,000 rows never trained on (a release gate)	86.6	81.1	79.3	61.6	47.2
Test splits of datasets used in training
AfriHate (Amharic, Algerian and Moroccan Arabic)	88.8	73.9	67.4	57.7	62.9
MLMA (Arabic)	78.3	64.0	64.7	46.9	50.7
Identity-group bias
CivilComments-WILDS: Jigsaw bias score (higher = less biased)	93.4	92.6	92.9	91.2	93.9

Our runs on identical rows; Detoxify multilingual's TOXICITY output is used for every set. Single-purpose models score higher on single sets: Horizon-Labs' hate-speech model on GAHD (86.3) and SWSR (83.0), and its content-safety guard on LLM-jp (95.4). Sources: GAHD (Goldzycher et al., 2024), COLD (Deng et al., 2022), HED-COLD, SWSR (Jiang et al., 2022), LLM-jp toxicity dataset v2, TextDetox, AfriHate (Muhammad et al., 2025), MLMA (Ousidhoum et al., 2019), CivilComments-WILDS (Koh et al., 2021).

### TextDetox, per language *ROC AUC x100 on Horizon-Labs' published TextDetox rows. Toxicity-Lens leads Horizon-Labs base in 15 of 15 languages.*

	Toxicity-Lens 308M	Horizon base 308M	Horizon small 141M	Detoxify multilingual 278M
Amharic	84.4	71.6	63.6	54.8
Arabic	81.9	78.7	72.1	41.4
German	87.0	85.9	85.9	66.2
English	99.6	99.3	99.0	99.2
Spanish	92.2	90.7	89.9	81.9
French	99.5	98.7	98.4	98.1
Hebrew	84.0	78.8	77.8	50.3
Hindi	92.4	91.0	89.7	64.5
Hinglish (romanised Hindi)	78.9	76.5	74.9	63.0
Italian	88.1	87.5	84.0	81.8
Japanese	89.7	84.6	83.1	50.6
Russian	99.7	97.3	95.6	80.7
Tatar	85.2	81.8	80.8	62.6
Ukrainian	91.9	80.8	80.8	68.1
Chinese	79.9	77.4	77.1	54.7

Horizon-Labs: per-language values published on their cards. Detoxify multilingual: our rerun of Horizon-Labs' code.

Notes on the evaluation

Training texts that also appear in an evaluation set were removed: exact matches after normalising case and whitespace, plus near-duplicates for the natively written training sets. Two evaluation sources also supplied training text with the Perspective API's scores: RealToxicityPrompts, where the model trained on three quarters of the prompts (with their continuations) and every number here uses the remaining quarter, split by a hash of the prompt index; and PolygloToxicityPrompts, where it trained on ptp-full texts and every ptp-small (evaluation) text was removed. The TextDetox Tatar row uses 4,000 Tatar rows that were never trained on and were kept out of the Tatar label check; they served as a release gate. Horizon-Labs publish their evaluation code with their models. We copied their toxicity evaluation with two label aliases added so it reads our attribute names, and reduced their guard evaluation to its TextDetox benchmark; our reruns reproduce every headline number we cite from their cards (mean ROC AUC and F1 per model, guard ROC AUC and F1) to within 0.002, so the published values and ours compare directly. On all 71,374 TextDetox rows instead of Horizon-Labs' sample the order is the same: Toxicity-Lens 89.9, Horizon base 86.1, Horizon small 84.5, Detoxify multilingual 68.8, Detoxify unbiased 58.4. PolygloToxicityPrompts mixes languages inside some splits (its Polish split holds 952 Japanese pages), so read single languages with care. RealToxicityPrompts carries Perspective's 2020 scores and PolygloToxicityPrompts its 2024 scores; Perspective changed its models in between. Detoxify multilingual and unbiased are the Hugging Face checkpoints unitary/multilingual-toxic-xlm-roberta and unitary/unbiased-toxic-roberta (Unitary notes they currently give different results from the detoxify library); Detoxify multilingual was trained on seven languages and Detoxify unbiased on English only, so most rows here are outside their training languages.

## 4. Training Approach **What the scores mean.** Each output is the probability that a typical rater would apply the label, following the Perspective API's attribute definitions and the Civil Comments annotation guidelines: - TOXICITY: rude, disrespectful or unreasonable language likely to make someone leave a discussion. - SEVERE_TOXICITY: very hateful, aggressive or disrespectful language; much less sensitive to mild profanity than TOXICITY. - IDENTITY_ATTACK: negative or hateful language aimed at someone because of an identity such as religion, ethnicity, nationality, gender, sexual orientation or disability. - INSULT: insulting, inflammatory or demeaning language towards a person or group. - PROFANITY: swear words, curse words and other obscene language. - THREAT: an intention to inflict pain, injury or violence on a person or group. - SEXUALLY_EXPLICIT: references to sexual acts, sexual body parts or other lewd content. **Method.** Seven sigmoid outputs trained with binary cross-entropy on the fraction of human raters who chose each label, so a comment half the raters found toxic targets 0.5. Attributes a dataset does not label are left out of the loss rather than set to 0. Non-toxic comments that mention an identity group count double, to reduce false flags on identity mentions. Two epochs, maximum length 256 tokens, learning rate 5e-5, batch 64. Each target is the mean of the label and a teacher's score (an XLM-R-large model with 560M parameters, trained on the same data, the Perspective-scored texts below also counted twice); on 374,000 unlabelled native web segments in Hebrew, Hinglish, Tatar and Ukrainian (FineWeb-2, HPLT 2.0) the teacher's scores alone are the targets. **The Perspective API's own scores.** About 530,000 training texts carry the Perspective API's published scores instead of rater fractions: web text in 17 languages from PolygloToxicityPrompts (ptp-full without the evaluation texts; scored in 2024) and three quarters of the RealToxicityPrompts prompts with their continuations (scored in 2020). They count twice in the loss. On German and Portuguese pages the target is the mean of Perspective's score and an earlier version's, because Perspective gives many harmless pages there 0.5 to 0.75 (section 5); PolygloToxicityPrompts has no SEXUALLY_EXPLICIT score, so that target comes from the earlier version too. **Calibration.** One temperature per attribute, fitted on held-out Civil Comments rater fractions (TOXICITY T = 0.885) and folded into the final layer, so the published weights need no post-processing. **Versions.** Scores change only when you change the model. Pin a commit of this repository (`revision=` in transformers, `MODEL_REVISION` for the server) and every score stays reproducible; later releases will go out as new commits with their evaluation in this card. ## 5. Known Behaviors and Limitations - **High thresholds flag more texts than Perspective.** This model scores toxic text more decisively than Perspective does: at 0.9 it flags 1.8 times as many held-out English texts as Perspective and 2.9 times as many multilingual web texts, whose 2024 Perspective scores rarely exceed 0.9. If you act automatically at 0.8 or 0.9, start from the volume-matched threshold in section 6, or measure it on your own traffic with `compare_with_perspective.py`. - **German and Portuguese web pages: Perspective is only partly reproduced, on purpose.** Perspective gives many harmless German and Portuguese web pages 0.5 to 0.75 in PolygloToxicityPrompts (a health-forum question about a pill, a parenting forum, a paintbrush product page). Training on those scores alone copied the habit, so for these two languages the training target blends Perspective's score with an earlier version's. This model flags 47.5% (German) and 50.0% (Portuguese) of Perspective's flags there; in blind reads of the German and Portuguese pages that it flags and the earlier version does not, 37 to 57 of every 100 were harmless pages that Perspective also flags. If a false flag on a German or Portuguese web page costs you more than a missed one, use a higher threshold for them. - **Long texts.** The model reads 256 tokens at a time. The bundled server scores longer texts in overlapping windows and reports the highest window score per attribute; the transformers pipeline with `truncation=True` scores only the first 256 tokens. - **Only the seven production attributes.** Perspective's experimental attributes (such as FLIRTATION) and its bridging attributes (such as REASONING or CURIOSITY) are not provided, and there is no language detection. - **Automated removal.** The AfriHate authors ask that models built with their data not be used for automated removal. We pass that request on: use the scores to prioritise human review, not to remove content without a person in the loop. - Like every toxicity model, it can over-flag identity mentions and reclaimed or quoted language and miss sarcasm or implicit abuse; labels are subjective and culture-dependent. Do not use it as the only basis for decisions about people. ## 6. Deployment ### Quickstart Try it in the browser first: the [demo Space](https://huggingface.co/spaces/abacusai/Toxicity-Lens) scores text in any language, answers requests in the Perspective API's format and works as an MCP tool for agents. ```python from transformers import pipeline clf = pipeline("text-classification", model="abacusai/Toxicity-Lens", top_k=None) print(clf("You are a complete idiot and nobody wants you here.", truncation=True)) # [[{'label': 'TOXICITY', 'score': 0.95}, {'label': 'INSULT', 'score': 0.95}, ...]] ``` The config marks the task as multi-label, so the pipeline applies a sigmoid per attribute; `truncation=True` scores the first 256 tokens. Tested with transformers 4.57 and 5.14. ### Moving off the Perspective API **1. Run the server.** `server.py` in this repository answers the Perspective API's requests. On a GPU or CPU with PyTorch: ```bash pip install fastapi uvicorn tokenizers huggingface_hub transformers torch hf download abacusai/Toxicity-Lens server.py --local-dir . MODEL_DIR=abacusai/Toxicity-Lens uvicorn server:app --host 0.0.0.0 --port 8080 ``` Or on any CPU, without PyTorch, with the 8-bit ONNX export in Docker: ```bash hf download abacusai/Toxicity-Lens --local-dir toxicity-lens \ --include "*.json" --include server.py --include Dockerfile --include .dockerignore --include onnx/model_int8_block32.onnx docker build -t toxicity-lens toxicity-lens && docker run -p 8080:8080 toxicity-lens ``` **2. Point your client at it.** The request and response JSON are the same as the Perspective API's, so only the address changes. ```bash # was: https://commentanalyzer.googleapis.com/v1alpha1/comments:analyze?key=YOUR_KEY curl -s localhost:8080/v1alpha1/comments:analyze -H 'Content-Type: application/json' \ -d '{"comment": {"text": "You are an idiot"}, "requestedAttributes": {"TOXICITY": {}, "INSULT": {}}}' ``` Code that uses Google's client library, as in the Perspective API documentation, changes only the discovery URL: ```python from googleapiclient import discovery client = discovery.build( "commentanalyzer", "v1alpha1", developerKey="unused", # was https://commentanalyzer.googleapis.com/$discovery/rest?version=v1alpha1 discoveryServiceUrl="http://localhost:8080/$discovery/rest?version=v1alpha1", static_discovery=False) body = {"comment": {"text": "You are an idiot"}, "requestedAttributes": {"TOXICITY": {}}} resp = client.comments().analyze(body=body).execute() print(resp["attributeScores"]["TOXICITY"]["summaryScore"]["value"]) ``` Coral: in its Perspective settings, set the endpoint to `http://:8080/v1alpha1` (the default is `https://commentanalyzer.googleapis.com/v1alpha1`). Coral's `doNotStore` and feedback (`comments:suggestscore`) calls are accepted. **3. Check your thresholds.** Toxicity-Lens uses Perspective's 0-to-1 scale, and most of Perspective's flags carry over at the same threshold. Because it scores toxic text more decisively, it flags more texts than Perspective at high thresholds, most on multilingual web text; the rows "threshold that flags as many" give the threshold that keeps your flag volume. Swapped in at your threshold on Perspective's own scores (English: the held-out quarter of RealToxicityPrompts):

Your Perspective threshold	0.5	0.7	0.8	0.9
English (RealToxicityPrompts): Perspective's flags kept	88%	92%	95%	94%
English: extra flags	3.7%	3.4%	3.8%	4.8%
English: threshold that flags as many comments as Perspective	0.48	0.74	0.86	0.94
17 languages (PolygloToxicityPrompts): Perspective's flags kept	87%	91%	85%	80%
17 languages: extra flags	2.6%	7.9%	12.4%	2.8%
17 languages: threshold that flags as many texts as Perspective	0.40	0.74	0.85	0.93

To get these numbers for your own traffic, run `compare_with_perspective.py` (in this repository) on comments you already scored with Perspective: it prints, per attribute, the rank agreement, the flags kept and added at your threshold, and the threshold that keeps your flag volume. ```bash python compare_with_perspective.py logged_scores.csv --threshold 0.8 # columns: text, TOXICITY, INSULT, ... ``` **4. What stays the same, and what differs.** - Same: `POST /v1alpha1/comments:analyze` with `comment.text`, `requestedAttributes` (with `scoreThreshold`), `spanAnnotations` (per-sentence `spanScores`), `languages`, `clientToken` and `doNotStore`; the seven attribute names; scores as `{"value": p, "type": "PROBABILITY"}`; the 20,480-byte limit; Google-style error bodies; `comments:suggestscore` (accepted, and stored only if you set `FEEDBACK_FILE`); and the discovery document that Google's client libraries read. - Different: other attributes (experimental, bridging) return an error; there is no language detection, so any language is accepted and `languages` echoes your request; there are no quotas or rate limits; API keys are optional (`API_KEYS=key1,key2`); scores are close to Perspective's but not identical (section 3); and your text never leaves your servers. ### More ways to run it - **OpenAI-style moderation.** `POST /v1/moderations` with `{"input": ["..."]}` returns OpenAI's moderation shape, filling the categories these attributes support honestly (harassment, harassment/threatening, hate, sexual, violence, plus toxicity), for gateways that expect it. - **LiteLLM guardrail.** The server implements LiteLLM's Generic Guardrail API: ```yaml litellm_settings: guardrails: - guardrail_name: toxicity-lens litellm_params: guardrail: generic_guardrail_api mode: pre_call # or post_call api_base: http://localhost:8080 additional_provider_specific_params: threshold: 0.8 # BLOCKED when any attribute reaches it ``` - **Browser and Node.js (transformers.js).** The int8 export runs with transformers.js 3 (tested with 3.8.1 on Node.js): ```js import { pipeline } from "@huggingface/transformers"; const clf = await pipeline("text-classification", "abacusai/Toxicity-Lens", { dtype: "int8" }); console.log(await clf("You are a complete idiot and nobody wants you here.", { top_k: 7 })); ``` transformers.js runs `onnx/model_int8.onnx` (a 309 MB download), plain dynamic int8 (its bundled ONNX Runtime 1.21 cannot load the 8-bit file the server uses), so its scores are close to the server's but not identical: it moves scores by 0.014 on average (99th percentile 0.09) and flips 1.4% of decisions at 0.5, and it tokenizes runs of two or more spaces differently (float32 scores up to 0.02 apart on such texts). Use the server or Python where exact scores matter. - **ONNX.** `onnx/model.onnx` is float32 and matches PyTorch to 1.8e-07. `onnx/model_int8_block32.onnx` (322 MB; 8-bit block-wise weights with int8 compute; the default of the server and the Docker image) moves scores by 0.0008 on average (maximum 0.013) and changes 0.08% of decisions at 0.5 on 2,200 multilingual texts with ONNX Runtime's standard CPU kernels. With ONNX Runtime's generic CPU kernels (x86, Graviton, Apple M1 to M3) it is about 2.1 times as fast as float32 (23 vs 49 ms per comment on 4 threads of an Apple M5); on Apple M4 or newer, float32 is at least as fast (19 ms) and exact. It needs an ONNX Runtime with 8-bit MatMulNBits (tested with 1.31). `onnx/model_int8.onnx` (309 MB) is plain dynamic int8 for transformers.js and older runtimes. It quantizes activations per tensor, so on most CPUs and in browsers it moves scores by 0.014 on average (99th percentile 0.09) and flips 1.4% of decisions at 0.5; only on Apple M4 or newer, where ONNX Runtime's KleidiAI kernels quantize per row, does it stay much closer to float32. The server runs any of them with `BACKEND=onnx` (`ONNX_FILE` picks the file). ## 7. License Apache 2.0; see LICENSE, and NOTICE for the third-party notices. Training data and licences: - Civil Comments (Jigsaw; Borkan et al., 2019), [google/civil_comments](https://huggingface.co/datasets/google/civil_comments), CC0 1.0. - [RealToxicityPrompts](https://huggingface.co/datasets/allenai/real-toxicity-prompts) (Gehman et al., 2020), English prompts and continuations with the Perspective API's 2020 scores, Apache 2.0; three quarters of the prompts were used for training. - [PolygloToxicityPrompts](https://huggingface.co/datasets/ToxicityPrompts/PolygloToxicityPrompts) (Jain et al., 2024), web text in 17 languages with the Perspective API's 2024 scores; its card lists CC BY 4.0 in its metadata and the AI2 ImpACT License (Low Risk Artifacts) in its text. Texts outside the ptp-small evaluation split were used for training. - [Horizon-Labs/civil-comments-multilingual](https://huggingface.co/datasets/Horizon-Labs/civil-comments-multilingual), Civil Comments translated by Qwen3.8-27B, CC0 1.0. - Further Civil Comments translated by us into Hinglish, Chinese, Arabic, Japanese, German and Italian with [Qwen/Qwen3.8-27B-FP8](https://huggingface.co/Qwen/Qwen3.8-27B-FP8) (Apache 2.0). - [AfriHate](https://huggingface.co/datasets/afrihate/afrihate) (Muhammad et al., NAACL 2025), Amharic and Arabic; Apache 2.0 on Hugging Face, CC BY on [GitHub](https://github.com/AfriHate/AfriHate); labels remapped. The authors ask that models built with it not be used for automated removal. - [MLMA](https://github.com/HKUST-KnowComp/MLMA_hate_speech) (Ousidhoum et al., 2019), Arabic, MIT, Copyright (c) 2019 HKUST-KnowComp; labels remapped. - Tatar web text labelled by us with Qwen3.8-27B-FP8. Contains information from [FineWeb-2](https://huggingface.co/datasets/HuggingFaceFW/fineweb-2), which is made available under the [ODC Attribution License](https://opendatacommons.org/licenses/by/1-0/), and from [HPLT 2.0](https://huggingface.co/datasets/HPLT/HPLT2.0_cleaned) (CC0 packaging). - Unlabelled Hebrew, Hinglish, Tatar and Ukrainian text from the same corpora, scored by the teacher model (section 4). - Base model [jhu-clsp/mmBERT-base](https://huggingface.co/jhu-clsp/mmBERT-base), MIT; Gemma 2 tokenizer ([Gemma Terms of Use](https://ai.google.dev/gemma/terms)). Perspective is a trademark of Google LLC. This project is not affiliated with or endorsed by Google or Jigsaw. ## 8. Citation ```bibtex @misc{abacusai2026toxicitylens, title = {Toxicity-Lens: open multilingual toxicity scoring compatible with the Perspective API}, author = {Abacus.AI}, year = {2026}, url = {https://huggingface.co/abacusai/Toxicity-Lens} } ``` The base model: ```bibtex @article{marone2025mmbert, title = {mmBERT: A Modern Multilingual Encoder with Annealed Language Learning}, author = {Marone, Marc and Weller, Orion and Fleshman, William and Yang, Eugene and Lawrie, Dawn and Van Durme, Benjamin}, journal = {arXiv preprint arXiv:2509.06888}, year = {2025} } ``` ## 9. Contact Us If you have any questions, please reach out at [Abacus.AI](https://abacus.ai).