SafeSMS: On-Device Threat Detection with Gemma 4 E4B, no internet required

This is a submission for the Gemma 4 Challenge: Build with Gemma 4

What I Built

SafeSMS is a privacy-first Android application designed to protect users from the rising threat of SMS-based scams, phishing, and spam.

Traditional SMS scanners and spam filters often send your private text messages to the cloud for analysis, creating severe privacy concerns. SafeSMS takes a completely different approach: it brings the intelligence directly to the device.

By running a powerful, on-device AI model, it performs real-time threat detection locally on your phone. It monitors incoming messages, categorizes them (SAFE, SUSPICIOUS, or SCAM), provides a confidence score, and explains why a message is dangerous.

The app features a sleek dark-mode UI built with Jetpack Compose, including:

• Live scanning “terminal” view
• Detailed history logs
• Visual analytics for inbox threat patterns

✨ Example Detection

Incoming SMS:

Your bank account will be blocked. Click immediately: http://bit.ly/xyz

SafeSMS Output:

• Category: SCAM
• Confidence: 92%
• Reason:
  • Urgent language ("immediately")
  • Suspicious shortened URL
  • Impersonation of financial institution

Demo

[https://youtu.be/2NhvyiARX1c]

Code

• GitHub Repo: https://github.com/parulmalhotraiitk/safesms
• Try APK: https://github.com/parulmalhotraiitk/safesms/blob/main/release/SafeSMS.apk

How I Used Gemma 4

To enable real-time, completely private SMS analysis, SafeSMS uses Gemma 4 via LiteRT for on-device inference.

Model Selection: Gemma 4 E4B

I selected the E4B model because it perfectly fits mobile and edge environments:

1. Absolute Privacy
   
   All SMS data stays on-device. No cloud calls, no data leakage.

2. Zero Latency & Offline Capability
   
   Messages are analyzed instantly without any network dependency.

3. Resource Efficiency
   
   The lightweight model runs efficiently inside a background Android service with minimal battery impact.

4. Strong Reasoning in a Small Model
   
   Despite its compact size, the model effectively detects:

   • Phishing attempts
   • Social engineering patterns
   • Urgency-based scams

🧠 Prompting Strategy

The model is prompted using a structured classification + reasoning format, enabling it to return:

• Label (SAFE / SUSPICIOUS / SCAM)
• Confidence score
• Explanation

This ensures both accuracy and transparency in predictions.

⚡ Performance

• Inference Time: ~50–150 ms per SMS
• Runs fully offline
• Optimized for low battery usage
• No network permissions required (privacy-first design)

🏗️ Architecture

SafeSMS follows a fully on-device architecture, ensuring privacy, speed, and reliability.

🔄 Flow Overview

1. Incoming SMS

   • Captured via Android Broadcast Receiver

2. Protection Service

   • Background service processes SMS in real time

3. SafeSMS Model Controller

   • Handles preprocessing, inference, and routing

4. On-Device AI Inference

   • Gemma 4 E4B via LiteRT
   • Classifies SMS into SAFE / SUSPICIOUS / SCAM

5. Result Handling

   • Stored in local SQLite database
   • Sent instantly to UI

6. User Interface (Jetpack Compose)

   • Live scan results
   • History and analytics dashboard

🧩 Architecture Components

• SMS Layer: Broadcast Receiver
• Processing Layer: Background Protection Service
• AI Layer: LiteRT + Gemma 4
• Data Layer: SQLite (local storage)
• UI Layer: Jetpack Compose

🚀 Why This Architecture?

• 🔒 Fully private (on-device processing only)
• ⚡ Real-time detection with minimal latency
• 📡 Works completely offline
• 📊 Local analytics and history tracking
• 🧠 Efficient AI optimized for mobile devices

🔮 Future Improvements

• Multi-language scam detection
• WhatsApp and email integration
• Personalized scam pattern learning
• Federated learning (privacy-preserving improvements)

🏁 Final Thoughts

SafeSMS demonstrates how powerful AI models like Gemma 4 can run entirely on-device, enabling real-world applications that are fast, private, and reliable.

It’s a step toward a future where user data never has to leave their device to stay safe.