SafeSMS: On-Device Threat Detection with Gemma 4 E4B, no internet required

This is a submission for the Gemma 4 Challenge: Build with Gemma 4

What I Built

SafeSMS is a privacy-first Android application designed to protect users from the rising threat of SMS-based scams, phishing, and spam.

Traditional SMS scanners and spam filters often send your private text messages to the cloud for analysis, creating severe privacy concerns. SafeSMS takes a completely different approach: it brings the intelligence directly to the device.

By running a powerful, on-device AI model, it performs real-time threat detection locally on your phone. It monitors incoming messages, categorizes them (SAFE, SUSPICIOUS, or SCAM), provides a confidence score, and explains why a message is dangerous.

The app features a sleek dark-mode UI built with Jetpack Compose, including:

• Live scanning “terminal” view
  


• Detailed history logs
  


• Visual analytics for inbox threat patterns
  

✨ Example Detection

Incoming SMS:

Your bank account will be blocked. Click immediately: http://bit.ly/xyz

SafeSMS Output:

• 
  Category: SCAM
  


• 
  Confidence: 92%
  


• 
  Reason:
  
  
  
  
  • Urgent language ("immediately")
    
  
  
  • Suspicious shortened URL
    
  
  
  • Impersonation of financial institution
    
  
  
  
  
  
  

Demo

[https://youtu.be/2NhvyiARX1c]

Code

• GitHub Repo: https://github.com/parulmalhotraiitk/safesms
  


• Try APK: https://github.com/parulmalhotraiitk/safesms/blob/main/release/SafeSMS.apk
  

How I Used Gemma 4

To enable real-time, completely private SMS analysis, SafeSMS uses Gemma 4 via LiteRT for on-device inference.

Model Selection: Gemma 4 E4B

I selected the E4B model because it perfectly fits mobile and edge environments:

1. Absolute Privacy
   
   
   All SMS data stays on-device. No cloud calls, no data leakage.




2. Zero Latency & Offline Capability
   
   
   Messages are analyzed instantly without any network dependency.




3. Resource Efficiency
   
   
   The lightweight model runs efficiently inside a background Android service with minimal battery impact.



4. 
   

   Strong Reasoning in a Small Model
   
   
   Despite its compact size, the model effectively detects:

   
   
   
   
   
   • Phishing attempts
     
   
   
   • Social engineering patterns
     
   
   
   • Urgency-based scams
     
   
   
   
   

🧠 Prompting Strategy

The model is prompted using a structured classification + reasoning format, enabling it to return:

• Label (SAFE / SUSPICIOUS / SCAM)
  


• Confidence score
  


• Explanation
  

This ensures both accuracy and transparency in predictions.

⚡ Performance

• 
  Inference Time: ~50–150 ms per SMS
  


• 
  Runs fully offline
  


• 
  Optimized for low battery usage
  


• 
  No network permissions required (privacy-first design)
  

🏗️ Architecture

SafeSMS follows a fully on-device architecture, ensuring privacy, speed, and reliability.

🔄 Flow Overview

1. 
   

   Incoming SMS

   
   
   
   
   
   • Captured via Android Broadcast Receiver
     
   
   
   
   


2. 
   

   Protection Service

   
   
   
   
   
   • Background service processes SMS in real time
     
   
   
   
   


3. 
   

   SafeSMS Model Controller

   
   
   
   
   
   • Handles preprocessing, inference, and routing
     
   
   
   
   


4. 
   

   On-Device AI Inference

   
   
   
   
   
   • Gemma 4 E4B via LiteRT
     
   
   
   • Classifies SMS into SAFE / SUSPICIOUS / SCAM
     
   
   
   
   


5. 
   

   Result Handling

   
   
   
   
   
   • Stored in local SQLite database
     
   
   
   • Sent instantly to UI
     
   
   
   
   


6. 
   

   User Interface (Jetpack Compose)

   
   
   
   
   
   • Live scan results
     
   
   
   • History and analytics dashboard
     
   
   
   
   

🧩 Architecture Components

• 
  SMS Layer: Broadcast Receiver
  


• 
  Processing Layer: Background Protection Service
  


• 
  AI Layer: LiteRT + Gemma 4
  


• 
  Data Layer: SQLite (local storage)
  


• 
  UI Layer: Jetpack Compose
  

🚀 Why This Architecture?

• 🔒 Fully private (on-device processing only)
  


• ⚡ Real-time detection with minimal latency
  


• 📡 Works completely offline
  


• 📊 Local analytics and history tracking
  


• 🧠 Efficient AI optimized for mobile devices
  

🔮 Future Improvements

• Multi-language scam detection
  


• WhatsApp and email integration
  


• Personalized scam pattern learning
  


• Federated learning (privacy-preserving improvements)
  

🏁 Final Thoughts

SafeSMS demonstrates how powerful AI models like Gemma 4 can run entirely on-device, enabling real-world applications that are fast, private, and reliable.

It’s a step toward a future where user data never has to leave their device to stay safe.