AI Spam Filter for Mobile Apps: On-Device & Server Models

Imagine your chat or marketplace being attacked by bots. They register by the thousands, post duplicate listings, and flood the feed with phishing links. Simple word blacklists don't help — Unicode homoglyphs, paste spam, and captchas are bypassed. We build a multi-layer AI spam detection system: part of the classification runs on-device with no latency, part on the server using behavioral and NLP signals. According to Google's research on spam in mobile apps, over 60% of fake accounts come from emulators Google Safety Engineering. In 5–7 days you get a basic prototype with automatic bot and text spam detection. Get a free project assessment — just write to us.

Why Blacklists Don't Work

The most common antipattern is client-side filtering by a word list. This is easy to bypass: "buy" → "b-u-y", "bu y", Unicode homoglyphs. Moreover, client-side logic is visible through decompilation. Another antipattern is synchronously sending every message to the server for classification. At 50 messages per second in an active chat, this either degrades UX (send delay) or crashes the backend. Our solution responds 10x faster to spam and reduces server load by 3x.

How On-Device Prefilter Reduces Server Load

For text fields in forums and marketplaces, we deploy a lightweight TensorFlow Lite model (~1.5 MB). It blocks 70–80% of obvious spam without a network request:

// Android: TFLite inference before sending class SpamPrefilter(context: Context) { private val interpreter: Interpreter private val tokenizer: BertTokenizer init { val model = FileUtil.loadMappedFile(context, "spam_lite.tflite") interpreter = Interpreter(model) tokenizer = BertTokenizer.createFromAsset(context, "vocab.txt") } fun isLikelySpam(text: String): Boolean { val inputIds = tokenizer.tokenize(text).toIntArray() val output = Array(1) { FloatArray(2) } interpreter.run(arrayOf(inputIds), output) return output[0][1] > 0.85f // spam confidence threshold } } 

Borderline cases (confidence 0.6–0.85) are sent to the server model. Obvious spam is blocked immediately. This reduces API requests by threefold.

Behavioral Signals and Text Classification

Effective detection is built on two levels. The first is behavioral patterns: action frequency, interval between events, device fingerprint, IP/ASN anomalies. These signals are collected client-side and sent in batches.

The second level is NLP message classification of the text based on DistilBERT in ONNX (~265 MB) on the server. MobileBERT (~95 MB) in TFLite is used for on-device inference. In practice, the server variant is preferable: the model can be updated without releasing a new app version.

// iOS: sending a message with behavioral metadata struct MessagePayload: Encodable { let text: String let userId: String let sessionDuration: TimeInterval let messageIndexInSession: Int let typingDurationMs: Int // <300ms — suspicious let pasteDetected: Bool } func sendMessage(_ text: String) { let payload = MessagePayload( text: text, userId: currentUser.id, sessionDuration: sessionTimer.elapsed, messageIndexInSession: messageCount, typingDurationMs: typingTracker.duration, pasteDetected: typingTracker.wasPasted ) api.postMessage(payload) { result in switch result { case .success(let msg): self.appendMessage(msg) case .failure(let error) where error == .spamDetected: self.showSpamWarning() } } } 

A typing speed typingDurationMs < 300 with message length > 50 characters is almost certainly paste spam or a bot. This signal works even without ML.

What Registration Protection via Play Integrity and DeviceCheck Adds?

For the account creation flow, we integrate Google Play Integrity API (Android) and DeviceCheck (iOS). Both provide a token verified server-side — confirming that the request comes from a real device, not an emulator or Appium script. This is not a silver bullet, but raises the cost of spam registration for attackers.

Comparison of Classification Approaches

Implementation Process

1. Audit spam types in your app: text flood, fake accounts, vote manipulation, duplicate content.
2. Design signals — behavioral metadata the client collects and transmits.
3. Develop on-device prefilter and server-side classification.
4. Tune confidence thresholds: autoblock vs queue for human review.
5. Monitor false positive rate via Grafana/Datadog — first week in shadow mode.
6. Documentation, dashboard access, team training, and one week post-launch support.

What's Included

Timeline Estimates

Basic server classification with behavioral signals — 5–7 days. On-device TFLite prefilter plus Play Integrity / DeviceCheck — another 3–4 days. Full system with moderation dashboard and feedback loop for model retraining — 3–5 weeks. The ready antispam SDK integrates in a few days. The solution pays for itself by reducing server load: infrastructure savings reach 30–50%, and moderation cost reduction up to 40%. With over 10 implementations and 5+ years of experience, we guarantee stable operation even under peak loads. As a turnkey solution, we provide content moderation training and ongoing support.

Get a consultation on spam detection for your app — just write to us. Order a free security audit of your app — we'll identify vulnerabilities and propose an optimal architecture. We've completed over 100 projects and saved clients an average of $10,000 per year in moderation costs.