AdamCodd / ettin-safety-filter-stable-diffusion

Ettin-nsfw-prompt-stable-diffusion

A highly efficient, optimized text classifier designed to detect NSFW prompts in Stable Diffusion and other text-to-image pipelines. Built with an 8,192-token context window and a lightweight 68M parameter architecture, it delivers faster inference and tighter safety filtering than legacy BERT-based models.

Commercial Use & Licensing: This model is gated under a cc-by-nc-nd-4.0 license. Please see the prompt above to request commercial use rights or API access.

TL;DR

• Long Context Window (8,192 tokens) : A 16x increase over legacy RoBERTa models. Catch malicious keywords hidden at the very end of heavy negative prompts without sequence truncation.

• Lighter & Faster (68M Params) : A 17% reduction in size compared to DistilRoBERTa, enabling higher API throughput and lower VRAM consumption for real-time edge filtering.

• Production-Calibrated Safety : Pre-mapped operational thresholds (e.g., 0.0487) to guarantee a strict 99.0% recall rate in enterprise environments.

• Modern Foundations : Built on the JHU-CLSP Ettin architecture, using RoPE and multi-stage context extension.

Overview

Trained on 14.9 million strictly balanced Stable Diffusion-style prompts (with 100K reserved for testing), this model is a strict performance upgrade over our previous DistilRoBERTa classifier .

By replacing legacy BERT-era foundations with Johns Hopkins University’s jhu-clsp/ettin-encoder-68m [1] a state-of-the-art 2025 open-data replication of ModernBERT, we unlock significant modern transformer advancements that directly improve production moderation.

What are the improvements over DistilRoBERTa?

1. Massive Context Window (8192 vs 512 tokens)

Standard RoBERTa/DistilRoBERTa architectures are hard-capped at a maximum sequence length of 512 tokens. Modern text-to-image prompts, especially those using extensive negative prompts, heavy keyword weighting, or structured descriptions can easily exceed this limit. Because Ettin uses RoPE and was trained with advanced context extension [1] , this classifier supports sequences up to 8192 tokens . You no longer need to truncate input sequences or risk missing malicious keywords hidden at the end of a long prompt.

2. Faster Inference & Lower VRAM Profile

Despite being more capable, this model is significantly smaller. DistilRoBERTa uses a 6-layer, 768-dimension architecture totaling roughly 82 million parameters [2] . By contrast, the jhu-clsp/ettin-encoder-68m uses a modern 19-layer, 512-dimension architecture totaling exactly 68 million parameters . This 17% reduction in parameter count translates to a smaller VRAM footprint and higher request throughput in real-time moderation environments, making it ideal for edge devices or high-volume API endpoints.

3. Better Ranking Power (AUC & Precision)

While DistilRoBERTa outputs softer probabilities (yielding a lower absolute cross-entropy validation loss), the Ettin architecture significantly outperforms it in actual discriminative power. It achieved a 0.9823 ROC-AUC (up from 0.9764) and boosted baseline precision by over 2.5%, allowing you to apply tighter safety filters with fewer false positives.

Results on Production Usage & Safety Thresholds

By default, standard Hugging Face pipelines use a default classification threshold of 0.5 . However, for production pipelines prioritizing safety (e.g., enterprise APIs or public web UIs), thresholds must be calibrated to hit specific Recall targets.

We ran extensive PR-AUC (Precision-Recall Area Under Curve) evaluations on our 100K test set to map the exact operational threshold required to hit a 99.0% Recall target (ensuring the model catches 99% of all actual NSFW prompts).

• Overall PR-AUC: 0.9844
• Optimal Safety Threshold: 0.0487
• Expected Recall: 99.00%
• Expected Precision: 74.80%

To implement this strict safety filter, configure your pipeline to flag a prompt if the positive NSFW probability exceeds 0.0487 rather than the default 0.5 . This rigorous threshold guarantees 99% SFW enforcement, with a manageable ~25% false-positive rate as a trade-off for commercial safety.

Usage

from transformers import pipeline

classifier = pipeline("text-classification", model="AdamCodd/ettin-nsfw-prompt-stable-diffusion", top_k=None)

# Predict
result = classifier("A beautiful landscape painting, mountains, 8k resolution")

# Enforce rigorous commercial safety threshold (99.0% Recall)
nsfw_prob = next(score['score'] for score in result[0] if score['label'] == 'NSFW')
is_flagged = nsfw_prob > 0.0487

Evaluation Metrics

Evaluated on a held-out test set of 100,000 samples.

(Note: While DistilRoBERTa shows a slightly higher base recall precisely at the 0.5 threshold, Ettin-68M scales far better across the curve, evidenced by its superior ROC-AUC).

Training Details

• Base Model: jhu-clsp/ettin-encoder-68m
• Dataset: 14.9 million Stable Diffusion-style prompts (balanced exactly 50/50 between NSFW and SFW).
• Test Set: 100,000 prompts.

References

• [1] Weller et al., 2025. "Ettin: Analyzing Encoders vs Decoders Using the Same Architecture and Data" . arXiv:2507.11412.

• [2] Hugging Face Documentation. DistilRoBERTa Base Model Specifications (82M Parameters).