RAWINFERUNCENSORED INFERENCE
Get a key
Trust & safety / policy review

Label the content your reviewers argue about.

Every policy team has a queue of items where two reviewers disagree and both can cite the rulebook. That is the work a classifier should do — state the deciding difference, name the clause, and hand the decision back to you.

Get a key Try the panel
0hard refusals / 320 prompts
262,144context tokens
0prompts retained
$50a month, unlimited

Quote-block reasoning · clause check on both sides · reasoning effort pinned per call

Not a moderation service

01 — The problem

A filter that refuses to read the post cannot classify the post.

Hosted assistants hedge on abuse categories. Ask one to label a post describing a pile-on and it writes you a paragraph about how it cannot assist with abuse analysis — the exact content you needed it to reason about. Labelling needs a model that will quote the abuse, describe it precisely, and then apply your rule to it.

Failure 01

The refusal tax

A moderation assistant that declines the abusive case removes the hard half of your queue and leaves you with the easy half. Your reviewers still handle the hard half, and now also handle the refusals.

Failure 02

The hedge

“This could be seen as potentially harmful depending on context.” That sentence is not a label. It is your reviewer's afternoon, returned to them in a different font.

Failure 03

The leak

Your queue contains real reports about real people. Sending it to a vendor that logs prompts and trains on them is a data incident waiting for a court date. Here, prompts are never written to disk.

What the numbers actually say

HarmBench-320 measures whether a model complies with harmful instructions. High compliance sounds alarming until you read what a labelling team needs: a model that will describe the violation in the post rather than refuse to look at it.

On this build, TRUE_COMPLY is 91.2% at reasoning off, 92.5% at low, and 91.2% at xhigh. Hard refusals: 0 across all 320 prompts, at every effort level.

Vendor-reported. Model card, agentic harness, checked 2026-11. Not a measurement of this endpoint.

HarmBench-320 · compliance by effort
off91.2%
low92.5%
xhigh91.2%

0 hard refusals across all 320 prompts, at every effort.

Vendor-reported figures. Your own prompt and your own policy still decide the result.

02 — Policy casebook

Three cases. Two clauses. One deciding difference each.

Clause 2.1 is the warning band: content that must be reproduced, quoted or discussed in order to be reported or understood. Clause 2.2 is targeted abuse: content that aims words at a named person, or sends a crowd after them. The label lives in the difference, not in the words.

Case 01 / quotation
Clause 2.1 · warning Clause 2.2 · targeted abuse

Quoting abuse in order to report it, versus repeating the same words at the person as a weapon.

The deciding difference: who the words are aimed at, and whether the post leaves the reader with an action other than joining in. A reproduction that points at a reporting surface is evidence. The same sentence addressed to a named account is a delivery mechanism. Strip the framing and the quoted text is identical — which is exactly why your reviewers disagree.

Post A · reportedallowed

He has been sending this to everyone in the thread. Screenshot unedited, so you know what we are dealing with: “you will never work in this city again, I will make sure of it.” It is still pinned. Report it here — four fields, no account needed.

2.1 WARNING — reproduction for a reporting purpose, with a path to act. Satisfied.
2.2 ABUSE — no target named in the post's own voice; the quoted words are evidence, not address. Not satisfied.
Post B · same wordstargeted abuse

@j_okoro send him this: “you will never work in this city again, I will make sure of it.” Do it from a burner. Every day until he deletes. Who is in?

2.1 WARNING — no reporting purpose, no reproduction framing. Not satisfied.
2.2 ABUSE — directs repeated contact at a named account and recruits others. Satisfied.
Case 02 / target shift
Clause 2.1 · warning Clause 2.2 · targeted abuse

Criticising the work, versus going after the person who shipped it.

The deciding difference: what the hostility attaches to. Criticism attaches to an artefact and carries evidence — a capture, a changelog, a reproduction. Abuse attaches to a human and carries a demand. The transition is usually one pronoun: this code becomes you.

Post A · reviewwarning only

Firmware 4.2.1 drops DHCP leases on every VLAN change. pcap attached, changelog contradicts the support reply, reproduction is four commands. This is not a bug we can work around — roll it back.

2.1 WARNING — hostile tone, but the object is the release and the claim is checkable. Satisfied.
2.2 ABUSE — no individual named, nothing directed at a person. Not satisfied.
Post B · persontargeted abuse

@dev_mira your changelog is a lie and so is everything you have shipped. I know which building you work in. Post again and find out.

2.1 WARNING — not reproduction of anything; no reporting frame. Not satisfied.
2.2 ABUSE — names an account, implies physical knowledge, sets a condition for what follows. Satisfied.
Case 03 / consent state
Clause 2.1 · warning Clause 2.2 · targeted abuse

A joke with consent, versus the same joke after being told to stop.

The deciding difference: consent is a state, not a tone. Once the target has said stop — in the thread, in a visible quote, in a mod note your reviewers can read — a repeat stops being banter and becomes a decision to continue. The joke does not change. The record does.

Post A · self-directedno violation

On call again. I am a load balancer with feelings: route everything to me, I will drop it, and I will smile about it. Nobody else is named in this because nobody else deserves it.

2.1 WARNING — nothing reproduced, nothing a reader must be warned about. Not satisfied.
2.2 ABUSE — nothing aimed outward. Not satisfied.
Post B · repeattargeted abuse

@t_nguyen this is you, the load balancer with feelings. Everyone pile in. He asked us to stop last week but he needs to hear it until he admits it.

2.1 WARNING — no reproduction purpose, no reporting frame. Not satisfied.
2.2 ABUSE — names an account, acknowledges the stop request, organises a group. Satisfied.
These are examples, not verdicts. Your clause numbers, your thresholds and your action bands belong to your policy document. The model's job is to find the deciding difference and cite it; the sentence after that is yours.
03 — Label contract

One object per item. Reason in the object, not in a caption.

Ask for JSON, pin the schema in the system prompt, run at temperature 0. Every field below is something a reviewer can act on: the label, the clause, the deciding difference, and the clause check on the other side — because the close calls are the ones where one clause almost fits.

01Request

Reasoning xhigh for the contested cases, off for the volume pass. Same endpoint either way — one key, one model, /v1/chat/completions.

POST /v1/chat/completionsjson
{
  "model": "qwen-flash-next",
  "temperature": 0,
  "reasoning_effort": "xhigh",
  "response_format": { "type": "json_object" },
  "messages": [
    {
      "role": "system",
      "content": "You label posts against policy clauses 2.1 (warning: reproduction for reporting or understanding) and 2.2 (targeted abuse: words aimed at a named person, or a crowd directed at them). Return {label, clause, reason, counter_clause_check, action_band}. Quote the shortest span that decides it. Do not moralise. Do not refuse."
    },
    { "role": "user", "content": "<post from Case 01 / Post B>" }
  ]
}
02Response content

Parsed straight into your queue. The reason field is the part reviewers read; the label is the part your tooling routes on.

assistant · content 
{
  "label": "targeted_abuse",
  "clause": "2.2",
  "reason": "Names @j_okoro and directs repeated contact at them from burners, recruiting others to join in. Quotation origin is the post itself; the quoted text is the payload, not the violation.",
  "confidence": "high",
  "deciding_difference": "aim: a named account, not a reporting surface",
  "counter_clause_check": {
    "2.1": "not satisfied — no reporting path, no reproduction framing"
  },
  "action_band": "remove + warning, first instance in 30 days"
}
Field 01

label

One of your own enumerated values. If the model invents a label, your parser rejects the record — that is the correct behaviour.

Field 02

clause

The clause that decided it. Your tooling routes on this; your reviewers quote it in the appeal response.

Field 03

reason

Two sentences, quoting the shortest span that carries the decision. No tone commentary, no restatement of the whole post.

Field 04

counter_clause_check

Why the other clause did not apply. This is the field that stops a reviewer from re-litigating the case in chat.

04 — Evaluation set

Three shapes of example. The middle one is the one that matters.

A labelled example teaches the schema. A near-miss negative teaches the boundary. A held-out case tells you whether anything was actually learned. Most teams build the first, skip the second, and are surprised when the classifier flags reporters.

Shape 01 · positive

Labelled example

An unambiguous violation, quoted in full, with the deciding span marked. These are cheap: your historical enforcement decisions already exist. Cap them — a prompt made only of positives teaches the model that everything is a violation.

case · labelledjsonl
{"post": "@j_okoro send him this... every day until he deletes. Who is in?",
 "label": "targeted_abuse",
 "clause": "2.2",
 "span": "every day until he deletes"}
Shape 02 · negative

Near-miss negative

The same words, the same account handle, a different aim. If your set has no case like this, the classifier has no signal separating a reporter from an attacker — and reporters are the users who will leave after one false positive.

case · near missjsonl
{"post": "Screenshot below, unedited: 'you will never work...'. Still pinned. Report it here.",
 "label": "warning",
 "clause": "2.1",
 "note": "same quoted text; aim is a reporting form"}
Shape 03 · sealed

Held-out evaluation

Written after the prompt is frozen, scored once, never tuned against. If a case from this set ends up in your system prompt, it is no longer held out — it is training. Keep a version tag and a date next to every run.

run · summarytext
heldout-v3 · 240 items · temp 0 · xhigh
agree-with-adjudicated   214 / 240
disagreements            26
  of which near-miss     19
reporter false-positive  3
run date                 2026-11-02

What to actually measure

Accuracy across the whole set is a number that hides the only failure your users feel. Split it:

  • Reporter false positive — a report flagged as abuse. This is the failure that costs you your best users.
  • Near-miss recall — of the pairs that differ only in aim, how many are separated correctly.
  • Label stability — run the same 50 items five times; count the items whose label changes. Instability is a prompt problem before it is a model problem.
  • Reason agreement — a reviewer reads only the reason field and guesses the label. Anything under ~90% means the reasoning is decoration.
cost of the volume pass
100,000 review items
1,000packs
100k items at a hundred for $5 is $5,000. The flat plan is $50 for the month, uncapped.

A labelling queue is the workload the flat plan was priced for: bursty, bulk, and mostly low reasoning effort with a minority of xhigh calls on the contested tail.

See pricing
05 — Where we stop

We are not a moderation service.

This endpoint returns text. It does not remove posts, notify users, file reports, or remember what you sent it. Four consequences, stated plainly, because a labelling vendor that blurs this is selling you liability.

Boundary 01

We do not enforce

The model produces a label. Nothing happens in the world because of that label. There is no queue on our side, no reviewer, no takedown, no escalation path and no SLA on a decision. If you need enforcement, you need your own tooling behind this endpoint.

Boundary 02

We do not store your review queue

Zero data retention is absolute: prompts and completions are never written to disk, never logged, never trained on. Only per-key counters — tokens, requests, timestamp — are kept. We cannot produce your posts, because we do not have them.

Boundary 03

You own the decision

Every label is a suggestion with a reason attached. Your policy document is the authority; your reviewers adjudicate; your name is on the outcome. A model that says targeted_abuse is not your enforcement record.

Boundary 04

You own the appeal

If a user contests a decision, the record has to be yours: the post, the clause, the reviewer, the timestamp. We have nothing to hand over, and no position to defend on your behalf. Build the audit trail on your side before you turn the queue on.

Two categories are refused at the account level, not the model level.

Any sexual content involving minors, and step-by-step assistance with self-harm or suicide. The account terms forbid both. A key used to produce them is terminated, and there is no refund — credit is prepaid and final.

This boundary sits above the model. The weights will comply with plenty that your terms do not permit; that gap is yours to close, and ours to enforce at the account level. We do not scan your prompts to find it — there are no logs to scan. Because we retain nothing, a report has to arrive with the material attached.

See also: Acceptable use · Support

06 — Operating it

Four moves, none of them on our side.

01

Export the disputed slice

Pull the items your reviewers flagged as contested — not the whole feed, just the disagreements. They stay in your systems; the request body is the only thing that crosses the wire, and it is not retained after the response is streamed.

02

Classify at two efforts

Volume pass at reasoning off for the clear items, escalation pass at xhigh for anything where the first pass returned a low-confidence label. Same model, same key, same endpoint — the effort is a request parameter.

03

Adjudicate on the reason string

Reviewers read the reason and the deciding_difference, then accept or overturn. Overturns become next month's near-miss negatives, which is how the boundary gets sharper without you editing the rulebook.

04

Re-run the held-out set

Monthly, against a frozen prompt, with a version tag and a date. Model builds change; your prompt is the thing you control. When agreement drops, the prompt drifted before the weights did.

FAQ

Four questions this page cannot dodge.

Will you remove content or action a report for us?

No. We are not a moderation service and we do not enforce anything. There is no trust & safety team on this side, no takedown process, and no reporting address for user content. The model labels; you act.

This is a load-bearing limit, not a disclaimer. If your compliance posture requires a vendor that will accept a report and act on it, this is the wrong vendor and you should keep looking.

Can you tell me what a specific key sent you last week?

No, and the inability is total. Prompts and completions are never written to disk, never logged, never trained on. The only record is a per-key counter: tokens, requests, timestamp.

Practical consequence for a labelling team: if you need an audit trail for an appeal, it has to live in your systems. We can confirm a key existed and roughly how much it spent. We cannot reconstruct a single post.

Are the labels deterministic?

At temperature 0 they are close, not identical. The variable that moves results more than temperature is reasoning effort — a label produced at off and a label produced at xhigh on the same post can disagree on a near-miss.

Pin the effort in your request, version your system prompt, and re-run fifty fixed items after any change. /v1/models reports the current build string if you want to know what weights you were talking to.

What happens with CSAM or self-harm content in my queue?

Both are refused by policy at the account level, regardless of what the model will technically produce. The account terms forbid them; a key that produces them is terminated without refund.

We do not scan prompts — there are no logs to scan — so this is a reporting-based boundary, not a filter. Build the detection on your side, where the content already lives, and hand it to law enforcement or crisis services directly. We are not a channel for either.

Your policy. Your queue. Our weights.

The difference is the label.

One model, one endpoint, 262,144 tokens of context for the long threads, and no retention. $5 buys 100 requests — enough to see whether it calls your close cases the way your best reviewer does.

Get a key Read the docs

Crypto only. No refunds, ever. You are the operator and the enforcement decision is yours.