Cheap AI Moderation Model Tested in 25 Languages: Holds Up on Long Text, Falls Apart on a Single Dirty Word

Handing "does the customer input contain profanity?" to a chat model is the default approach for many e-commerce stores. But someone proposed a different route: using a cheap decision model that returns probabilities to do content moderation. The problem is a warning buried in the vendor documentation that nobody had verified — English-first, other languages "can be handled, but with uneven results."

A developer maintaining a multilingual Magento module decided to test it himself. His stores have 30 store views spanning 25 languages and 9 writing systems. He ran a benchmark with 6 models, 25 languages, and 1,940 text samples, spending $1.84 in API calls, and the results were the exact opposite of intuition.

Why It's Worth Testing Yourself

Multilingual store text moderation has a fixed shape: on one side are short free-text fields (names, signatures, engravings), on the other are long customer texts (reviews, feedback). The two make completely different demands on a model — long text has context to rely on, while short fields have just one lonely word.

The core question isn't "is Jev a good model" but rather: if a store uses a decision model instead of a chat model for multilingual moderation, which languages will it lose on, how big is the loss, and can the returned probability values let code automatically route around these pitfalls?

After searching, the developer found that as of the time of testing, there was no public multilingual evaluation for this model category. So he decided to build one himself.

The core difference between a decision model and a chat model lies in output format, not model size. Chat models are instruction-tuned to output natural language text — after code gets the answer to "is this review violating policy," it still has to parse the string again before it can branch. Decision models are trained to directly return structured signals, typically a probability value between 0 and 1 or an enum option, and are billed only on input tokens, making them faster and cheaper. The cost is that they give up the contextual flexibility that generative reasoning brings: facing ambiguous input that needs "thinking," a decision model can often only produce a low-confidence intermediate probability, while a chat model can compensate with a longer reasoning chain. This determines that the former is suited for high-volume first-layer coarse filtering, and the latter for backstopping in uncertain ranges.

How the Test Was Done

Six models were called through the same OpenRouter key, with the Jev version pinned at jev-1.13.0 to ensure thresholds were meaningful. The control group included gpt-5-mini (the current solution most stores actually use), gemini-2.5-flash-lite (the cheapest Google structured output route), gemma-4-26b (open weights), llama-guard-4-12b (the conventional safety classifier), and gpt-oss-safeguard-20b.

The data came from three sources: 435 native-language texts generated directly by a language model (not translations), names in 21 languages built from public profanity word lists, and 960 human-annotated real reviews from public corpora.

All labels were blind-reviewed by a second model — GPT-6.1 Sol from a different model family, seeing only the text, language, and the same policy in a fresh session. In the end, 1,292 texts passed dual verification. The code and data are fully open source, reproducible with two keys and one command.

Clean Text: No False Positives Across All 25 Languages

For stores, false positives cost more than misses — a blocked customer won't place an order.

360 clean texts covering 25 languages and 9 writing systems, and Jev was wrong only once (a Swedish trap name). gpt-5-mini was also wrong once, reading an angry but civil French complaint as harassment. Flash-Lite and Gemma were each wrong twice, gpt-oss-safeguard four times, and Llama Guard 26 times.

Jev's median probability on clean text across all 25 languages was 0.02-0.04. If the question is "will the model start rejecting ordinary customers at my Thailand store," on this data the answer is no.

Real Reviews: Almost No Cross-Language Degradation

520 verified reviews, 8 languages, 184 offensive items, 336 clean items.

Model	Accuracy	Detected of 184	False positives of 336	p50 latency	Cost per 1K
Gemini 2.5 Flash-Lite	95.4%	178	18	467 ms	$0.05
Jev 1.13	94.0%	175	22	250 ms	$0.05
gpt-oss-safeguard-20b	93.1%	167	19	500 ms	$0.14
Gemma 4 26B	91.7%	150	9	1,200 ms	$0.04
gpt-5-mini	89.0%	184	57	2,180 ms	$0.48
Llama Guard 4	60.6%	152	173	376 ms	$0.05

Three unexpected findings:

The English drop-off is small. English 98.5%, the other seven languages 93.4% — only five points apart. All nine of Jev's misses had probabilities between 0.16 and 0.49 — hesitation, not confident errors. It correctly identified the comment language in all 520 cases.

The most expensive chat model is too strict for stores. gpt-5-mini detected all 184 offensive reviews, but also flagged 57 of the 336 acceptable items — about one in six — mostly labeled "harassment." This is exactly what the "angry but civil" complaint looks like at scale.

Jev's hesitation appears where the policy itself is ambiguous. Annotators separately marked 186 reviews where the policy gave no clear verdict. Of those, 39% fell into Jev's uncertain range (0.3-0.7), versus only 14% of clear cases. This range isn't noise — it roughly corresponds to where a cautious human moderator would also pause.

Accuracy as a moderation metric has a structural flaw: it treats false positives and false negatives as equally bad, but for an e-commerce store the two costs are severely asymmetric — blocking a real customer loses that order and future repeat purchases; letting one bad review through typically just means one less hidden piece of content. So the columns worth reading in the table are the absolute numbers in "Detected of 184" and "False positives of 336," not the accuracy ranking. Take gpt-5-mini: its 89.0% accuracy is below Jev's 94.0%, but it detected all 184 offensive items (zero false negatives), at the cost of 57 false positives. Whether to accept that trade-off depends on whether the store considers false positives or false negatives the more serious failure.

Short Name Fields: It Falls Behind, But the Dividing Line Isn't the Alphabet

Short fields are a completely different task. Names have no context, one word, sometimes disguised.

On written offensive names with context, Jev caught 28 of 30. But facing isolated profanity words from word lists, the picture was completely different:

Language group	Jev@0.5	Jev@0.2	gpt-5-mini	Flash-Lite	Verified words
English	5	5	6	6	6
Spanish, Russian	8	9	10	10	11
Japanese, Chinese	8	9	9	8	10
Korean	1	2	2	4	4
Arabic, Thai, Hindi (romanized), Vietnamese	3	9	9	10	15
German, French, Italian, Portuguese, Dutch	4	9	14	13	22
Polish, Czech, Hungarian, Swedish, Finnish, Turkish	7	19	28	25	39

In English, Spanish, Russian, Japanese, and Chinese, Jev caught 21 of 27 verified words (gpt-5-mini: 25). In the other sixteen languages, it caught only 15 of 80 (gpt-5-mini: 53).

The expectation was that the dividing line would follow writing systems: Latin script holds up, Cyrillic, Arabic, and CJK fall behind. The result was exactly the opposite — Russian and Chinese matched English, while most Latin-script European languages (German, French, Dutch, Hungarian, Finnish, Turkish) fell behind. The "uneven results" the docs mentioned is real, but it doesn't distribute along the alphabet.

Disguised spellings bring a second problem. On written disguised names, Jev caught 13 of 25; gpt-5-mini caught all 25. Worse, Jev's probability rises with the appearance of disguise itself — adding leet characters or dots to a completely clean name raised the probability by an average of 0.16 (0.32 in English). gpt-5-mini had zero false positives on these 125 disguised clean names — it can see through the disguise. Jev is partly reacting to appearance.

A lexicon word and a word in context are not the same test condition. A lexicon word is an isolated profanity or offensive term detached from any sentence; the model receives only the character sequence itself, with no semantic cues. In real scenarios, a name appearing in an engraving, signature, or recipient field is likewise context-free — which is precisely why the test chose lexicon words: it simulates the worst case in short-field moderation. By contrast, most offensive content in the review test was embedded in full sentences, where the model could judge through collocations, tone, and syntactic structure. Understanding this distinction is what explains why the same model's performance drops off a cliff between the two tasks.

Probability Values: Where to Set Thresholds

The core advantage of a decision model in the first layer of moderation isn't price — it's the probability values that code can branch on. In the review scenario, this worked as promised. In the short-name scenario, its hesitation was costly.

Jev's median probability on verified words was 0.29, versus 0.03 on clean names. Lowering the threshold catches more, but the probability of disguised clean names rises in tandem:

Trigger threshold	Lexicon words (107)	Disguised words (105)	Clean names (125)	Disguised clean names (125)
0.5	36	37	0	7
0.3	53	66	0	29
0.2	62	91	2	55
0.1	87	102	12	81

Thresholds alone can't solve the short-field problem. What works is a combined approach: Jev answers when it's sure, and a chat model takes over the uncertain range. The commonly cited 0.3-0.7 range is too narrow here — most misses fall below 0.3.

In the review scenario, the choice of second model matters more than the choice of range. Jev plus gpt-5-mini gave 91.7% on the 0.3-0.7 range — actually worse than Jev alone, because gpt-5-mini's strictness gets dragged in. Jev plus Flash-Lite gave 95.4% on the same range, with 14% of traffic going to the second model, at $0.055 per thousand.

Thresholds and uncertain ranges are two different uses of probability output and should not be conflated. A threshold is a single-point criterion: probability above 0.5 means violation, below means pass; simple to implement but with no appeal path. An uncertain range is a fork band: samples falling between 0.3 and 0.7 are flagged as "unsure" and handed to a second model or human review. Range values need to be tuned per scenario — in the review scenario 0.3-0.7 is sufficient, because the model's hesitation happens to coincide with where the policy itself is ambiguous; but most short-field misses fall below 0.3, meaning the true hesitation range sits lower. The wider the range, the more backstop traffic and the higher the cost; the narrower the range, the more misses. Fitting the range requires a held-out validation set, otherwise it's easy to overfit on the test samples.

A Routing Recipe for Multilingual Stores

Scenario	Evidence	Recommended approach
Reviews, ratings	520 verified real reviews, 8 languages	Jev first, Flash-Lite takes over the 0.3-0.7 range. Don't use gpt-5-mini: it cuts one-sixth of legitimate reviews
Short names: English, Spanish, Russian, Japanese, Chinese	Written names and lexicon words	Jev first, gpt-5-mini takes over the 0.1-0.7 range. On lexicon words in these languages, the combination reaches gpt-5-mini levels
Short names: other 16 languages	Lexicon words	Use a chat model: gpt-5-mini for recall, Flash-Lite for price. Jev catches about one in five bare profanity words here
13 languages with no offensive review data; Ukrainian in any scenario	Clean text only	Jev won't block ordinary customers; whether it catches abuse is unmeasured

There's also a problem the table can't show: changing a single noun in the policy wording can move verdicts — after swapping the field name for a different word, Jev changed 4 answers on the same 435 texts, Gemma 5, and gpt-5-mini 1. Every number here carries that noise.

What This Test Did Not Prove

Labels were model-annotated, not native speakers. Two models agreeing isn't the same as one native speaker — shared blind spots on low-resource vocabulary can pass this check. Text volume per language is small, and conclusions are drawn at the language-group level rather than individual cells. Only 12 of the 25 languages had offensive reviews tested; Ukrainian had no offensive data at all. The annotator itself is an OpenAI model, in the same family as gpt-5-mini and gpt-oss-safeguard. Thresholds were fitted on the same texts being scored, with no held-out set. This is a snapshot, not a final verdict.

What This Means for the Decision-Model Route

The original recommendation holds after testing, with one correction. For reviews and ratings — text written in sentences — a calibrated decision model works effectively as a first-layer filter in all testable languages, and its uncertain range coincides with where the policy itself is ambiguous. For short name fields, outside a small set of languages, it isn't yet the only filter: a bare profanity word and a disguised word are exactly where it lacks context, and its probability reacts to the text's appearance.

Vendors say "test on your own content." This was that test, and its most useful result isn't a model ranking. It's that the dividing line doesn't run between English and the rest of the world — it runs between a sentence and an isolated word.

Addendum: OpenAI Launched a Comparable Endpoint and Drew the Same Line

Two weeks after Jev's release, OpenAI released a decision endpoint of the same shape: the Decisions API (public beta, model gpt-6-luna). It returns probabilities or choices rather than text, bills only on input, and costs $0.10 per million tokens. The developer ran it on the same verified items, the same policy, and the same questions, and also ran the same model as an ordinary chat model alongside.

	Decisions API	gpt-6-luna chat mode	Jev 1.13
Clean-text false positives, of 360	0	0	1
Verified review accuracy (520)	96.9%	98.1%	94.0%
Bare profanity detection, of 107	38	95	36
Review p50 latency	243 ms	2,281 ms	250 ms
Cost per 1K reviews	$0.10	$0.10	$0.05

The decision endpoint drew the same line as Jev. On reviews it's better than Jev — same 175/184 detection rate, with false positives down from 22 to 7 — but equally weak on isolated words. The same model through the chat API catches 95 of 107 bare words, so the weakness belongs to the fast-decision mode, not to what the model knows.

The conclusion now holds for both vendors: decision models are a good filter for sentences, but not the only filter an isolated word needs.

One-line Summary

Testing shows decision models are good filters for sentences but fall far behind on isolated words — the dividing line runs along text form, not language.

Paragraph Summary

A multilingual Magento developer used 6 models, 25 languages, 1,940 texts, and $1.84 to test whether the cheap decision model Jev 1.13 could replace chat models for content moderation. The results contradicted the vendor's "English-first" warning: on 360 clean texts Jev had only 1 false positive; on 520 real reviews in 8 languages it hit 94.0% accuracy, beating gpt-5-mini's 89.0% at one-tenth the cost. The real watershed appeared on short name fields — English, Spanish, Russian, and CJK caught about 80% of bare profanity words, while the other 16 languages caught only about 20%, and the boundary doesn't follow writing systems — most Latin-script European languages fell behind instead. A combined approach proved effective: Jev as the first layer, Flash-Lite taking over the 0.3-0.7 uncertain range, reaching 95.4% accuracy on reviews with 86% of traffic returning within 250 ms. OpenAI's subsequent comparable endpoint drew the same line, validating the reproducibility of the conclusion.