A small, fast classifier that detects whether an anime/illustration image is visually censored, and how (bar or mosaic). MobileNetV3-Large, 4.2M params, 17 MB ONNX, distilled from an EVA-02-Large teacher. It runs at squash-384 — the same input view used by deepghs-style anime aux taggers — so it slots into existing tagging pipelines at near-zero extra cost.

Domain / intended use. Trained on booru-tagged anime/illustration (a domain that includes explicit content) for content tagging and moderation triage. It is a detector only — it does not generate, modify, remove, or reconstruct censored content.

What it predicts

Single ONNX output output, shape (batch, 4), all independent sigmoids, in this order:

col	head	meaning
0	`censored`	p(image is censored) — the binary gate
1	`bar`	bar censorship
2	`ineffective`	ineffective / see-through censorship — disabled (see below)
3	`mosaic`	mosaic / pixelation

Performance (held-out test split, n = 125,102)

head	F1	AUROC	threshold
censored (binary)	0.924	0.964	0.47
bar	0.916	0.968	0.59
mosaic	0.922	0.972	0.53
ineffective	0.259	0.547	disabled

The ineffective head doesn't reach a usable quality bar (the concept is fuzzy in booru tagging), so it is disabled by setting its threshold to 1.01 — it never fires. On the bar/mosaic heads the student essentially matches its EVA-02 teacher.

Usage

pip install onnxruntime numpy pillow # or onnxruntime-gpu for CUDA

Use the bundled infer.py (reproduces the exact preprocessing + decision rules the metrics were measured with):

python

import sys
from huggingface_hub import snapshot_download

path = snapshot_download("Maltox/anime-censorship-tagger-mnv3-384")
sys.path.insert(0, path)             # so the bundled infer.py / censor_infer_core.py import
from infer import CensorTagger
tagger = CensorTagger(model_dir=path)
r = tagger.predict("image.jpg")
print(r.censored, r.p_censored, r.tags)
# -> True 0.97 ['censored', 'censorship:bar']

results = tagger.predict_batch(paths, batch_size=16)

Or call ONNX directly (preprocessing + rules must match — see config.json):

python

import numpy as np, onnxruntime as ort
from PIL import Image

sess = ort.InferenceSession("model.onnx", providers=["CPUExecutionProvider"])
img = Image.open("image.jpg").convert("RGB").resize((384, 384), Image.BILINEAR)  # squash
x = ((np.asarray(img, np.float32) / 255.0 - 0.5) / 0.5).transpose(2, 0, 1)[None]
p_cens, bar, ineff, mosaic = sess.run(None, {"input": x})[0][0]

tags = []
if p_cens > 0.47:                       # binary gate
    tags.append("censored")
    if bar > 0.59:    tags.append("censorship:bar")
    if mosaic > 0.53: tags.append("censorship:mosaic")
    # 'ineffective' is disabled (threshold 1.01)

Input / preprocessing (must match exactly)

NCHW float32 (N, 3, 384, 384), RGB.
Decode → squash-resize to 384×384 BILINEAR (aspect ratio not preserved, no crop) → /255 → (x − 0.5) / 0.5.
censor_infer_core.preprocess_squash_numpy does this with a robust decode (EXIF transpose, alpha-composited on white). This is the same 384 view used by deepghs anime aux taggers.

Decision rules (no calibration)

Raw sigmoid compared to the thresholds above, then gating:

if p(censored) < 0.47 → suppress all type tags;
a type fires only if censored and above its threshold;
ineffective requires a co-active base type (and is disabled regardless).

censor_infer_core.apply_modifier_gating implements this. Treating the output as a flat "sigmoid > 0.5" tag vector will be wrong (it ignores the gate and per-head thresholds).

Training

Teacher: a fine-tune (b70_R2) of SmilingWolf/wd-eva02-large-tagger-v3 (EVA-02-Large, 504px).
Distillation: soft-label KD, temperature 4.0, α 0.7; student trained at squash-384 with deploy-condition augmentation; per-head thresholds tuned on a held-out split.
Data: booru-tagged anime/illustration images (same data family as the WD tagger).
Student backbone: mobilenetv3_large_100 (timm, Apache-2.0).

Bias, risks, and limitations

Domain-bound: anime/illustration only; degrades on photographs, live-action, and AI-generated images.
Compression sensitivity: trained against a JPEG-q95 cache; very different compression (PNG, low-quality JPEG, WebP) is mildly out of distribution.
Label noise: booru tags are crowd-sourced; the ineffective concept is too inconsistent to ship and is disabled.
Resolution trade-off: the binary head trails the 504px teacher by ~2 pts AUROC (the cost of the lighter 384 view).
Not an authority: predictions are a tagging aid, not a substitute for human review; thresholds may need tuning for your data.

Out-of-scope use

Not intended for identifying or deanonymizing individuals, for "uncensoring" or reconstructing content, or as the sole basis for any automated enforcement or legal decision.

Citation

bibtex

@misc{maltox_anime_censorship_mnv3_384_2026,
  title        = {Anime Censorship Tagger --- MobileNetV3 (shared-384)},
  author       = {Maltox},
  year         = {2026},
  howpublished = {\url{https://huggingface.co/Maltox/anime-censorship-tagger-mnv3-384}},
  note         = {Distilled from SmilingWolf/wd-eva02-large-tagger-v3}
}

License & attribution

Released under Apache-2.0 (see LICENSE and NOTICE).

Teacher: SmilingWolf/wd-eva02-large-tagger-v3 — Apache-2.0.
Lineage: EVA-02 (MIT) backbone of the teacher; timm MobileNetV3-Large (Apache-2.0) student.

Please retain attribution when redistributing.

Files

model.onnx, meta.json, config.json, infer.py, censor_infer_core.py, selected_tags.csv, requirements.txt.