A New Generation of Perspective API: Efficient Multilingual Character-level Transformers

In plain words

Online platforms need software that scores comments for toxicity in many languages at once. Most such systems are built for one language, and each one breaks a word into pieces using a fixed list of word fragments. Mixed-language posts, misspellings, emoji and deliberate character tricks fall outside those lists.

This paper describes the second generation of a toxicity scorer used in a public API. Its model reads the raw bytes of text instead of a fixed list of fragments. A learned step inside the model groups neighbouring bytes into useful chunks, so no vocabulary has to be built or shipped for each language. The model is first trained to rebuild text with some bytes hidden, using a large mix of platform comments and web text. It is then fine-tuned to output a score for each toxicity label.

The authors report that this single model beats the older in-house baseline on average, matches or beats a larger general multilingual model on average, and gains on mixed-language and obfuscated text. Results on out-of-domain text are mixed. The model was put into production for ten new languages in the public API. All reported results are the authors' own.

TL;DR

• UTC is a single multilingual model that reads UTF-8 bytes through a learned tokenizer and a T5-style encoder-decoder §3.
• It is pretrained with a span-denoising objective and then fine-tuned with a pooled, multi-label regression head §3.3 §3.4.
• Author-reported: the 102M model averages 0.910 AUC-ROC on production multilingual data, and the 268M model 0.919 tab. 1.
• No official code is linked. The paper gives the architecture and most hyperparameters, but the pretraining corpus is proprietary, so pretraining cannot be reproduced exactly.

Problem

Toxicity classifiers built on word pieces need a vocabulary per language or per domain. Monolingual models struggle with code-switching and cross-cultural text, and models built on fixed vocabularies are hard to move to new languages or tasks §1. Rigid vocabularies are also vulnerable to misspellings, emoji and obfuscation §1. The authors argue that a token-free model is more robust to these and that one model removes the need to keep vocabulary-matched checkpoints in step §1 §8.

Method

The model has three parts: a learnable tokenizer §3.1, a Transformer stack §3.2, and a reconfigurable Seq2Seq setup with a regression head §3.3. Pretraining uses a span-denoising loss §3.4. During fine-tuning the decoder is removed and the encoder is kept as the shared representation §3.3 §8.

1. Input. The text is encoded as UTF-8 bytes. Each byte id is embedded, giving a sequence of length L_bytes §3.1.
2. Learnable tokenizer (GBST). The module from Charformer groups bytes into latent subwords §3.1 eq. 1:
   1. For each block size b from 1 to M = 4, build strided block candidates after a 1-D convolution of size b + 1 §3.1 eq. 1.
   2. Score every candidate with one linear map, then repeat each sequence back to byte length, so each position has one candidate per block size §3.1.
   3. Take a softmax over block sizes at each position §3.1.
   4. Sum the candidates weighted by those softmax scores §3.1.
   5. Mean-pool the result down by a rate of 2 §3.1 §4.2.
3. Transformer stack. The latent subwords go into a standard Transformer with T5.1.1-style layout and T5-style relative attention biases instead of position embeddings §3.2 app. A.
4. Pretraining. The encoder-decoder is trained to rebuild masked spans of text, with teacher forcing. Span corruption averages 20 bytes and covers 15% of the input §3.4. The authors say this beats encoder-only (BERT-style) pretraining §3.3.
5. Fine-tuning head. For classification or regression the decoder is dropped. A dummy task prefix token is added before each example, following T5 §3.3. The encoder output goes through a GeLU MLP to d_model, then is pooled at the first position §3.3. A linear layer maps the pooled vector to k_r outputs, one per label §3.3.
6. Loss. The regression head is trained with sigmoid cross-entropy, so several labels can be on at once §3.3.

# Learnable tokenizer (GBST)  [§3.1]
# Input:  byte_embeddings (B, L_bytes, d_model)
# Output: latent_subwords (B, L_bytes / 2, d_model)  [§4.2]

def learnable_tokenizer(byte_embeddings):
    # 1. Strided block candidates for sizes b = 1..M, with M = 4.
    #    Each size first passes through a 1-D convolution of size b + 1
    #    [§3.1] [eq. 1]
    block_embeddings = []
    for b in range(1, M + 1):
        convolved = conv1d(byte_embeddings, kernel_size = b + 1)
        block_embeddings.append(strided_pool(convolved, block = b))
    # 2. One linear score per candidate; repeat each sequence back to
    #    byte length so every position has a candidate per block size [§3.1]
    scores = []
    for b in range(M):
        scores.append(repeat_to_length(linear(block_embeddings[b]), L_bytes))
        block_embeddings[b] = repeat_to_length(block_embeddings[b], L_bytes)
    # 3. Softmax over block sizes at each position [§3.1]
    weights = softmax(stack(scores), axis = block_size)
    # 4. Score-weighted sum over block sizes [§3.1]
    composed = sum(weights[b] * block_embeddings[b] for b in range(M))
    # 5. Mean-pool down to half the byte length [§3.1] [§4.2]
    return mean_pool(composed, rate = 2)

# Regression head for classification and regression  [§3.3]
# Input:  latent_subwords (B, L', d_model)
# Output: probabilities (B, k_r), one per label

def regression_head(latent_subwords):
    # 1. Encoder output, decoder removed at fine-tuning  [§3.3]
    encoded = encoder(latent_subwords)           # (B, L', d_model)
    # 2. GeLU MLP to d_model before pooling  [§3.3]
    projected = gelu_mlp(encoded)                # (B, L', d_model)
    # 3. First-position pooling, similar in spirit to BERT's CLS  [§3.3]
    pooled = projected[:, 0]                     # (B, d_model)
    # 4. Linear map to k_r labels, sigmoid per label  [§3.3]
    return sigmoid(linear(pooled))               # (B, k_r)

# Training loss for the regression head  [§3.3]
# Input:  probabilities (B, k_r), targets (B, k_r) in {0, 1}

def regression_loss(probabilities, targets):
    # 1. Sigmoid cross-entropy over the k_r labels  [§3.3]
    #    Reduction over batch and labels is not stated.
    return binary_cross_entropy(probabilities, targets)

Pretraining objective, as printed in the paper §3.3: a per-step, per-class sigmoid cross-entropy summed over decoder steps t and classes i:

L = -sum_t sum_i [ log(pi_i^t) + (1 - y_i^t) * log(1 - pi_i^t) ]

The printed form has no y factor on the first log term. See Pitfalls.

Model sizes §4.2:

• UTC: about 102M parameters when deployed, 24 encoder layers and 6 decoder layers.
• UTC† (the paper's dagger variant): about 268M parameters, 28 encoder layers.

Hyperparameters

Results

Author-reported. The core test is production-style multilingual toxicity classification. Scores are AUC-ROC on the Production-Multilingual evaluation set, which is derived from live API traffic, labelled offline by human annotators, and proprietary §5.1 tab. 1.

tab. 1 Production-Multilingual AUC-ROC by language. Perspective API covers only English and Russian here. "Custom mBERT" is the in-house baseline §4.2.

tab. 2 Jigsaw Multilingual Toxic Comments Challenge (JMTCC), AUC-ROC. The Perspective API value omits Turkish, which Perspective does not support §5.2. The Kaggle #1 parameter count is the authors' estimate from an ensemble description, not a stated figure §5.2.

tab. 3 Code-switching evaluation sets, AUC-ROC. JMTCC-CS is built from JMTCC and Production-CS from the production set §6.1.

tab. 4 TweetEval hate classification, macro F1. Rows marked zero-shot were not trained on TweetEval. The RoBERTa and BERTweet rows are fine-tuned English-only models §6.3.1.

tab. 5 CivilComments-WILDS subpopulation shift, accuracy as reported. Worst accuracy is the lowest of 8 identity groups. Gap is average minus worst §6.3.2.

tab. 6 Covert toxicity, AUC-ROC. Toxic-BERT and Covert-BERT are the baselines from the Covert Toxicity paper §7.1.

tab. 7 English HatemojiCheck (3,930 statements), accuracy and F1 in %. The text says these models were further fine-tuned on HatemojiTrain before evaluation, but the table's own caption describes only the check set. See Pitfalls §7.2.

tab. 8 Architecture ablation, fine-tuning speed on 64 TPU-v3 chips, batch 128, 512-byte inputs. The caption says these values correlate with serving latency; they are not serving measurements §8.

Other reported results §6.2 fig. 2 §6.4 fig. 5 fig. 6:

• Zero-shot on obfuscated English Civil Comments, UTC beats every baseline at every obfuscation rate above 0%. All models lose accuracy as the rate rises.
• After fine-tuning on Civil Comments with 30% obfuscation, UTC reaches 86.0 AUC-ROC and mT5-small reaches 84.5 §6.2.
• Identity-term bias (Subgroup, BPSN and BNSP AUC per language): the authors say the metrics stay above 0.7 across languages. Some Korean and Japanese terms, for example the term for homosexual, have BPSN AUC of 0.5 or below. The authors attribute this to false positives on non-toxic templates containing the term §6.4 fig. 5 fig. 6.
• Deployment §8: about 15 queries per second and about 200 ms median latency for the 10 new languages at writing. A load test of the 102M model gave 45 ms median at 1K QPS on one TPUv2 chip with batching.

Paper vs code

No official code.

Search done, step by step:

1. Links in the paper, abstract and metadata: the footnotes point to Mesh TensorFlow, the T5 library, the official Charformer implementation in google-research/google-research, the CLD3 language detector and dataset pages. None of these is code for UTC itself. The Charformer code is a dependency of the GBST module and was not cloned.
2. Project page: none linked in the paper.
3. GitHub search: perspective charformer returned 0 repositories. unified toxic content classification returned two third-party repositories, not from the authors, so they were not used. perspective api jigsaw org:google-research returned 0.

Perspective API is served as a hosted product, and the paper gives no link to weights or training code.

Pitfalls

• Pretraining is not reproducible from public data. Half the pretraining mix is the Perspective Pretraining Corpus, about 4.6B texts, which is proprietary. The paper also does not give the mC4 language list or per-language weights §3.4. Any reimplementation will train on a different mixture.
• Pretraining loss as printed is ambiguous. The formula in §3.3 has no y multiplier on the first log term. It is also a per-class sigmoid cross-entropy, while a byte decoder would normally use a softmax. The paper does not say which the pretraining decoder uses. The symbol L in the outer sum is not defined.
• Softmax index mismatch in the tokenizer. Step 3 takes a softmax over p_{0,i} to p_{M,i}, which has M + 1 entries. Step 1 enumerates block sizes 1 to M. Whether a size-0 block exists is not stated §3.1.
• Convolution size is given two ways. Section 3.1 uses a convolution of size b + 1 for each block size. Section 4.2 gives "convolution filter size 5". These match only if 5 means the maximum, which the paper does not say.
• Dummy prefix token placement. The paper adds a dummy task prefix token before each example, following T5 §3.3. Whether it comes before or after the learnable tokenizer is not stated.
• Regression head details missing. The reduction of the sigmoid cross-entropy is not stated. The number of labels k_r per task is not stated. Whether the GeLU projection is shared across tasks is not stated.
• Decoder depth for UTC†. The 268M model's decoder depth is not stated. Only its encoder depth (28) is given §4.2.
• Hatemoji fine-tuning is contradictory. The text in §7.2 says the models were further fine-tuned on HatemojiTrain before evaluation. The table caption that said so is commented out in the source, and the caption as published describes only the check set. HatemojiTrain is named, but its size and fine-tuning hyperparameters appear only in commented-out source text. Treat tab. 7 as ambiguous about whether that step was applied.
• Gap comparison uses different training. §6.3.2 says the UTC gap is almost half to a third of the DistilBERT gaps. The table gives about 0.58 of the DRO gap (19.9) and about 0.32 of the ERM gap (36.2). The DistilBERT baselines are English-only, while UTC was fine-tuned on Civil Comments first, so the comparison mixes training regimes.
• Code-switching is not uniform. On JMTCC-CS, the 102M UTC (.9191) is below mT5-base (.9393). The 268M UTC† is best on both sets tab. 3.
• Obfuscation dictionary is only in a figure. The substitution table is in fig. 3 and cannot be reproduced from text. The paper says a vowel may also be replaced by * or removed, and that substitutes are picked uniformly from the valid list for each character §6.2.
• Identity-term bias data availability. The multilingual template set is the authors'. The paper says the English version was released in 2021, but does not say the multilingual version is public §6.4.
• Latency and throughput numbers are not comparable. The 45 ms figure is a load test on one TPUv2 chip. The steps-per-second figures are training throughput on 64 TPU-v3 chips tab. 8 §8.
• Hidden costs. Pretraining took about 3 to 4 days on 64 TPU-v3 chips app. A. The paper does not say how inputs longer than the pretraining maximum (512 bytes) are truncated at fine-tuning or serving time.
• Stopping rule and schedule are not stated. Fine-tuning runs "until convergence" with a fixed constant learning rate of 1e-3 and no warmup mentioned §5 app. A.
• Source-only text. The LaTeX source contains commented-out passages, including a feed-forward equation set and a Hatemoji fine-tuning recipe. They are not part of the published paper and are not used here.

Lineage

• Builds on: Charformer (arXiv:2106.12672) for the learnable tokenizer §3.1, and T5 for the encoder-decoder setup, the dummy prefix token and the span-denoising pretraining §3.3 §3.4. The T5.1.1 layout is cited in app. A.
• Compared against: a custom multilingual BERT pretrained on the Perspective corpus §4.2; mT5-small and mT5-base §4.2; the Perspective API §4.2; Kaggle JMTCC top entries §5.2; Toxic-BERT and Covert-BERT from the Covert Toxicity work §7.1; the Hatemoji baseline from Kirk et al. §7.2; DistilBERT ERM and DRO on CivilComments-WILDS §6.3.2; RoBERTa-retrained and BERTweet on TweetEval §6.3.1.
• Superseded by: not stated.