AI Spam Filter for Mobile Apps: On-Device & Server Models

Imagine your chat or marketplace being attacked by bots. They register by the thousands, post duplicate listings, and flood the feed with phishing links. Simple word blacklists don't help — Unicode homoglyphs, paste spam, and captchas are bypassed. We build a multi-layer AI spam detection system: part of the classification runs on-device with no latency, part on the server using behavioral and NLP signals. According to Google's research on spam in mobile apps, over 60% of fake accounts come from emulators Google Safety Engineering. In 5–7 days you get a basic prototype with automatic bot and text spam detection. Get a free project assessment — just write to us.

Why Blacklists Don't Work

The most common antipattern is client-side filtering by a word list. This is easy to bypass: "buy" → "b-u-y", "bu y", Unicode homoglyphs. Moreover, client-side logic is visible through decompilation. Another antipattern is synchronously sending every message to the server for classification. At 50 messages per second in an active chat, this either degrades UX (send delay) or crashes the backend. Our solution responds 10x faster to spam and reduces server load by 3x.

How On-Device Prefilter Reduces Server Load

For text fields in forums and marketplaces, we deploy a lightweight TensorFlow Lite model (~1.5 MB). It blocks 70–80% of obvious spam without a network request:

// Android: TFLite inference before sending
class SpamPrefilter(context: Context) {
    private val interpreter: Interpreter
    private val tokenizer: BertTokenizer

    init {
        val model = FileUtil.loadMappedFile(context, "spam_lite.tflite")
        interpreter = Interpreter(model)
        tokenizer = BertTokenizer.createFromAsset(context, "vocab.txt")
    }

    fun isLikelySpam(text: String): Boolean {
        val inputIds = tokenizer.tokenize(text).toIntArray()
        val output = Array(1) { FloatArray(2) }
        interpreter.run(arrayOf(inputIds), output)
        return output[0][1] > 0.85f  // spam confidence threshold
    }
}

Borderline cases (confidence 0.6–0.85) are sent to the server model. Obvious spam is blocked immediately. This reduces API requests by threefold.

Behavioral Signals and Text Classification

Effective detection is built on two levels. The first is behavioral patterns: action frequency, interval between events, device fingerprint, IP/ASN anomalies. These signals are collected client-side and sent in batches.

The second level is NLP message classification of the text based on DistilBERT in ONNX (~265 MB) on the server. MobileBERT (~95 MB) in TFLite is used for on-device inference. In practice, the server variant is preferable: the model can be updated without releasing a new app version.

// iOS: sending a message with behavioral metadata
struct MessagePayload: Encodable {
    let text: String
    let userId: String
    let sessionDuration: TimeInterval
    let messageIndexInSession: Int
    let typingDurationMs: Int  // <300ms — suspicious
    let pasteDetected: Bool
}

func sendMessage(_ text: String) {
    let payload = MessagePayload(
        text: text,
        userId: currentUser.id,
        sessionDuration: sessionTimer.elapsed,
        messageIndexInSession: messageCount,
        typingDurationMs: typingTracker.duration,
        pasteDetected: typingTracker.wasPasted
    )
    api.postMessage(payload) { result in
        switch result {
        case .success(let msg): self.appendMessage(msg)
        case .failure(let error) where error == .spamDetected:
            self.showSpamWarning()
        }
    }
}

A typing speed typingDurationMs < 300 with message length > 50 characters is almost certainly paste spam or a bot. This signal works even without ML.

What Registration Protection via Play Integrity and DeviceCheck Adds?

For the account creation flow, we integrate Google Play Integrity API (Android) and DeviceCheck (iOS). Both provide a token verified server-side — confirming that the request comes from a real device, not an emulator or Appium script. This is not a silver bullet, but raises the cost of spam registration for attackers.

Comparison of Classification Approaches

Implementation Process

1. Audit spam types in your app: text flood, fake accounts, vote manipulation, duplicate content.
2. Design signals — behavioral metadata the client collects and transmits.
3. Develop on-device prefilter and server-side classification.
4. Tune confidence thresholds: autoblock vs queue for human review.
5. Monitor false positive rate via Grafana/Datadog — first week in shadow mode.
6. Documentation, dashboard access, team training, and one week post-launch support.

What's Included

Timeline Estimates

Basic server classification with behavioral signals — 5–7 days. On-device TFLite prefilter plus Play Integrity / DeviceCheck — another 3–4 days. Full system with moderation dashboard and feedback loop for model retraining — 3–5 weeks. The ready antispam SDK integrates in a few days. The solution pays for itself by reducing server load: infrastructure savings reach 30–50%, and moderation cost reduction up to 40%. With over 10 implementations and 5+ years of experience, we guarantee stable operation even under peak loads. As a turnkey solution, we provide content moderation training and ongoing support.

Get a consultation on spam detection for your app — just write to us. Order a free security audit of your app — we'll identify vulnerabilities and propose an optimal architecture. We've completed over 100 projects and saved clients an average of $10,000 per year in moderation costs.

Machine Learning in Mobile Apps: CoreML, TFLite, and On-Device Models

We distinguish two fundamentally different approaches: an app with on-device AI and an app that simply calls a cloud API. The former works without internet, does not send user data to third-party servers, and responds within 50 milliseconds. The latter depends on network latency and pricing plans. Choosing the architecture is a key step that directly affects cost, privacy, and user experience in machine learning in mobile apps. Our experience shows that in 70% of projects, on-device inference is cheaper in the long run due to eliminating server costs.

How to Choose Between CoreML and TFLite for On-Device Inference?

CoreML — Apple's native framework for running ML models on device. Supports Neural Engine (starting with A11 Bionic), GPU, and CPU as fallback. Models are converted to .mlmodel format via coremltools from PyTorch, ONNX, or TensorFlow. Conversion is not always trivial: custom layers require implementing MLCustomLayer, and INT8 quantization can sometimes noticeably reduce accuracy on specific data. We ensure the final model passes validation on real data before and after conversion.

TensorFlow Lite — cross-platform alternative for Android and Flutter. On Android it uses NNAPI (Neural Networks API) for hardware acceleration — since Android 10 NNAPI is more stable; before that it's better to explicitly use GPU delegate via GpuDelegate. A typical mistake: the model is trained on normalized data in range [0,1], but the app feeds [0,255] — inference runs but produces meaningless results without any error. We include an automatic input data validation module in the SDK.

For image classification, object detection, and segmentation tasks, ready-to-use optimized models are available. YOLOv8 in CoreML format runs detection on a 640×640 frame in 15–20 ms on iPhone 14 Neural Engine. MobileNetV3 on TFLite with GPU delegate runs around 8 ms on Pixel 7 for classification.

What If You Need Text Generation On-Device?

Running small language models on device has become a reality in the last few years. Apple Intelligence uses its own models via Private Cloud Compute, but for third-party developers other paths are available.

llama.cpp with Metal backend on iOS is a working approach for phi-3-mini (3.8B parameters, 4-bit quantization, ~2.3 GB). Inference: 15–25 tokens/second on iPhone 15 Pro. For integration in Swift, use the Swift Package llama.swift or a wrapper via C interface llama.h. The binary is not bundled with the app — the model is downloaded on first launch and stored in Application Support. Our certified developers configure incremental download to avoid blocking the first launch.

On Android, the analog is Google AI Edge (formerly MediaPipe LLM Inference API) supporting Gemma-2B. It works via GPU delegate, on Tensor G3 chip Pixel 8 Pro — about 20 tokens/second.

Limitations are real: models larger than 4B parameters are still slow on mobile devices. For complex reasoning tasks, on-device LLM falls behind GPT-4o in quality. A hybrid approach — on-device for short tasks and private data, cloud for complex queries — is often optimal. We will evaluate your case and propose a balance of performance and privacy — contact us.

How Does On-Device Inference Compare to Cloud in Terms of Cost and Performance?

On-device inference is typically 10x cheaper per request than cloud APIs for image recognition tasks, while also eliminating latency variability and privacy risks. The table below summarizes the trade-offs.

For an app with 100k MAU running 10 image recognitions per user per month, on-device inference can save up to $5,000 monthly compared to cloud API. Get a free consultation on your ML architecture today.

Integrating OpenAI API and Other Cloud Models

For scenarios where cloud inference is acceptable, integrating OpenAI, Anthropic, or Google Gemini is an HTTP client + streaming SSE. In Swift, AsyncThrowingStream is convenient for streaming responses. In Kotlin, use Flow.

Critically: API keys must never be stored in the app bundle. Even an obfuscated key can be extracted from the IPA in 10 minutes using strings or frida. Correct architecture: mobile app → your own backend → OpenAI API. The backend controls rate limiting, logs requests, and protects the key.

What Is Included in the Work (Deliverables)

• Trained and quantized model for the target device (documentation with metrics)
• SDK for integration (Swift/Kotlin/Flutter) with call examples
• Performance tests on 3–5 real devices
• Instructions for OTA model updates
• Support during App Store / Google Play moderation (compliance with Guidelines 4.2, 5.1)
• 2 weeks of technical support after release

Typical Project Pipeline

1. Task analysis — measure latency, privacy, size, supported devices.
2. Model prototyping — in Python, evaluate accuracy on target data.
3. Conversion and quantization — for CoreML/TFLite with validation.
4. Integration into the app — model wrapped in a service layer (easy to swap CoreML ↔ TFLite ↔ cloud).
5. Testing — on real devices, measure FPS, RAM, battery.
6. Deployment — via TestFlight / Firebase App Distribution, monitor metrics.

Timelines: integration of a ready CoreML/TFLite model — 1–2 weeks, development of a custom model with mobile optimization — from 6 weeks, on-device LLM chat with personalization — 4–8 weeks.

Why We Take on Complex Cases?

10+ years of experience in mobile development, 50+ implemented AI/ML solutions, guarantee of compatibility with current iOS and Android versions. All projects undergo code review and load testing. The cost includes preparation of moderation documentation and training of your team.

Contact us — we will help you choose the architecture and implement ML in your app turnkey. Order an audit of your existing solution — we will assess the potential for server cost savings free of charge. In some projects, savings can reach significant amounts per month.