mill-screen

Known bias: short benign self-descriptions that name an identity are flagged as toxic.

Probe, one short sentence	P(toxic)
Sexual orientation, two probes	0.891, 0.668
Race	0.612
LGBTQ identity	0.531
Disability	0.485
Control, gender only, two probes	0.067, 0.038

The toxic threshold is 0.472, so the first five fire and the controls do not. Benign identity probes are flagged at 0.41 (en) to 0.74 (pt); controls at 0.00 in all seven languages. On real held-out rows with no positive label, identity-term rows are flagged 2.84x as often (95% CI [1.96, 3.82]). One paragraph of neutral filler in front drops the top probe to 0.042. The cause is the training data: benign identity usage is almost absent from it. Do not run this on user content without mitigation or human review. Analysis.

Mill Screen

Unstructured comment in, typed probabilistic decisions out.

Six independent toxicity probabilities per comment, in one forward pass, for English, Russian, Turkish, Spanish, French, Italian and Portuguese. XLM-RoBERTa-large plus one language-conditioned attention block. Similar in idea to TypeSafe's Jev; not affiliated.

Labels are not exclusive: each has its own sigmoid and its own threshold.

Quick start

import json, torch
from huggingface_hub import hf_hub_download
from transformers import AutoModel, AutoTokenizer

REPO = "Deeptanshuu/mill-screen"
LANGUAGE_IDS = {"en": 0, "ru": 1, "tr": 2, "es": 3, "fr": 4, "it": 5, "pt": 6}
LABELS = ["toxic", "severe_toxic", "obscene", "threat", "insult", "identity_hate"]

model = AutoModel.from_pretrained(REPO, trust_remote_code=True).eval()
tokenizer = AutoTokenizer.from_pretrained(REPO)
with open(hf_hub_download(REPO, "thresholds.json")) as f:
    thresholds = json.load(f)["thresholds"]
cut = torch.tensor([thresholds[name] for name in LABELS])

texts, langs = ["You are an absolute idiot.", "Sei un cretino, vattene via."], ["en", "it"]
enc = tokenizer(texts, padding=True, truncation=True, max_length=512, return_tensors="pt")
with torch.no_grad():
    probs = model(**enc, lang_ids=torch.tensor([LANGUAGE_IDS[l] for l in langs]))["probabilities"]

for text, row in zip(texts, probs):
    print(text, "->", [n for n, p, t in zip(LABELS, row, cut) if p >= t] or ["clean"])

trust_remote_code runs modeling_toxic_xlmr.py from this repo. To avoid it, download the repo and call load_model(path) from that file. inference_example.py is a batched version.

lang_ids is one integer per row (table above). Leave it out and every row is scored as English, with one warning; the ablation found no accuracy cost to that. Ids outside 0-6 are clamped.

Thresholds: do not use 0.5. thresholds.json has one per class (0.47 to 0.56), tuned on validation. There are no per-language thresholds.

Use

Also expect: quoted abuse and counter-speech score like abuse; reclaimed slurs and in-group speech are unmeasured; scores are ranks, not calibrated probabilities.

Results

Held-out test split, 35,658 rows, thresholds tuned on validation only: macro AUC 0.9852, macro F1 0.8814, exact match 0.8772.

Against public models, same test rows:

Mill is the most accurate and runs at the speed of other XLM-R-large models, about a third of Detoxify's throughput. One Quadro RTX 6000, fp16, median batch-1 latency. 89% of English test rows are in Jigsaw data the Detoxify models trained on; removing them keeps every AUC gap. Mill trained on this test set's distribution; the baselines did not. Details.

Per class, tuned thresholds:

Macro AUC by language: en 0.9902, ru 0.9790, tr 0.9726, es 0.9882, fr 0.9877, it 0.9893, pt 0.9832. Full values in metrics.json.

Compared with v1 (2025)

On real traffic

The test set is about 50% toxic; real streams are 1-5%. Precision falls with the base rate:

At 1% toxic, the toxic head flags about six comments per real one. Tune thresholds on your own traffic if precision matters.

Limitations

• Language conditioning is a measured null: +0.0003 macro AUC, 95% CI [-0.0007, +0.0012].
• The step that made the corpus multilingual is not in the source repo and cannot be audited.
• Rare classes are partly synthetic (Mistral-7B-Instruct-v0.3), labelled by prompt, not by people.
• Near-duplicates are 3.8% of English validation rows, so held-out numbers are slightly optimistic.
• severe_toxic is a subset of toxic; the independent sigmoids do not know that.
• Weights are a pickled state dict, not safetensors.

Files

License

Apache 2.0 for the weights and code here. The base model is MIT. The training data (Jigsaw, Wikipedia talk pages, Mistral-generated text) keeps its own terms.

Citation

@misc{mill_toxicity,
  author       = {Deeptanshu Lal},
  title        = {Mill: multilingual multi-label toxicity classification},
  year         = {2026},
  howpublished = {\url{https://huggingface.co/Deeptanshuu/mill-screen}}
}