Roblox Open-Sources Three Safety Models for the ROOST Model Community

Roblox has contributed updated versions of three open-source trust-and-safety models to the ROOST Model Community, along with a new evaluation dataset other platforms can use to benchmark their own classifiers, the company announced August 19, 2026.

The release covers version 2.0 of Roblox’s PII Classifier, which detects attempts to share or solicit personal information in chat; version 2 of Roblox Sentinel, its early-warning system for child endangerment; and version 3 of its real-time voice safety classifier. Versions of all three already run in production on Roblox. ROOST, short for Robust Open Online Safety Tools, is the nonprofit Roblox joined as a founding member in early 2025 alongside Google, OpenAI, and others; its model community distributes open, inspectable safety models that any organization can deploy.

The headlining improvement belongs to the PII Classifier. Where version 1.0 evaluated messages in isolation, version 2.0 reads each target message inside its surrounding multi-user conversation, a change aimed at catching obfuscated bypass attempts that only make sense in context, such as a player spelling out an off-platform server invite across two turns. Synthetic training data expanded language support from 17 languages to 189, and the model’s F1 score on Roblox’s internal evaluation rose from 63.41 to 90.52. The model is built on the XLM-RoBERTa-Large architecture at roughly 560 million parameters and ships under the Apache 2.0 license, with sigmoid outputs across three categories: asking for PII, giving PII, and directing users off-platform.

A Benchmark Built Around Evasion

Alongside the model, Roblox published the Roblox PII Safety for Chat Benchmark, an evaluation-only dataset of 39,202 fully synthetic English conversations, split into 24,518 safe and 14,684 unsafe examples. The dataset card says no Roblox user chat data is included; every conversation was generated to model evasion techniques seen in online chat, including phonetic spelling, homoglyphs, letter spacing, reversed text, coded language, and information split across conversational turns.

The benchmark’s design targets a gap in existing PII evaluations, most of which test named-entity extraction: find the email address, tag the phone number. Online-chat risk often appears before any extractable identifier does, and identifier-like strings in games are frequently benign: song IDs, XP totals, server codes, roleplay addresses. Hard negatives in the dataset deliberately share surface signals with genuine violations, so a model that fires on keywords or numeric patterns fails. Only the target speaker is classified, meaning a model that flags an entire conversation whenever any participant mentions PII also fails the attribution task.

On the new benchmark, Roblox reports its v2 classifier posts an F1 of 0.8882 against 0.6469 for its own v1.0 and 0.6624 for Qwen3Guard-Gen-8B, the next-best model listed, with Meta’s Llama Guard 4 12B at 0.5456 and OpenAI’s privacy filter at 0.5816. Those figures are Roblox’s own reported results on its own benchmark, and the dataset card notes the synthetic distribution does not represent production traffic.

Sentinel 2.0 Cuts Tuning Sweeps From an Hour to Three Minutes

Roblox Sentinel, which flags early signals of potential child endangerment before messages become explicit, moves to version 2 with a reworked tuning pipeline. The number of combining functions, the aggregators that turn many per-observation scores into a single risk score, grows from two to six, and observations are now encoded once per sweep rather than recomputed for each configuration. In Roblox’s example, a sweep across 324 configurations finished in under three minutes, down from nearly an hour, and ROC-AUC rose from 0.894 on default settings to 0.996 with the best configuration the sweep identified.

The release notes document narrower breaking changes alongside the features. Python 3.10 is now the minimum version, arguments after the first are keyword-only on the main API calls, and several grid-search output columns were renamed after an index-size column silently overwrote an evaluation column in version 1.0. Version 2 also persists the corpus with saved indices, so score explanations name the matched text after a reload rather than a row number, and it ships Dockerfiles for GPU and CPU-only deployments.

The voice safety classifier, which Roblox says has been downloaded more than 72,000 times since it was first open-sourced in 2024, now moderates voice chat across 30 languages and eight violation categories with built-in language detection. The model card reports 61% recall at a strict 1% false-positive rate across all 30 languages, driven by machine-labeled training data scaled up with human labeling for quality. Although the underlying model grew from 94.6 million to 320 million parameters, model distillation keeps it fast enough for real-time detection. The card publishes per-language recall and precision figures and notes the classifier expects 16 kHz mono WAV input in segments up to 15 seconds, with a 30-second maximum.

The Release by the Numbers

• 17 → 189: language support in the PII Classifier, version 1.0 to 2.0
• 63.41 → 90.52: PII Classifier F1 score on Roblox’s internal evaluation
• 39,202: synthetic conversations in the new benchmark (24,518 safe, 14,684 unsafe)
• 2 → 6: score-combining functions in Sentinel version 2
• 0.894 → 0.996: Sentinel ROC-AUC, default settings versus best swept configuration
• 30: languages covered by voice safety classifier v3, at 61% recall and a 1% false-positive rate
• 94.6M → 320M: underlying parameter count in the voice classifier, offset by distillation
• 72,000+: downloads of the voice safety classifier since its 2024 open-source release

How Roblox’s Open-Source Safety Push Got Here

Roblox has been steadily releasing production safety models as open source — Sentinel in August 2025 and the original PII Classifier that November — and this release adds updated versions of both plus its voice safety classifier to the ROOST Model Community. Roblox announced its founding membership in the initiative in February 2025, arguing at the time that safety tooling should be shared infrastructure rather than a competitive advantage. Sentinel was open-sourced in August 2025, and the original PII Classifier followed that November. The voice safety classifier predates the ROOST arrangement, first released in 2024 and upgraded to its third version in June 2026.

Roblox says the incentive runs both directions: as of the 12 months ended August 7, 2026, nearly 70% of the child-endangerment cases it detected came through Sentinel’s early detection, and version 2 incorporates feedback from other ROOST members on evaluation and scoring. The contribution lands while the platform’s moderation practices face growing regulatory attention in Europe, where Roblox is moving closer to the EU’s strictest platform rules. All three models and the benchmark are available now on Hugging Face and GitHub under the Apache 2.0 license.