Social media platforms have experienced a significant rise in toxic content, including abusive language and discriminatory remarks, presenting growing challenges for content moderation. Some users evade censorship by deliberately disguising toxic words through homophonic cloak, which necessitates the task of unveiling cloaked toxicity. Existing methods are mostly designed for English texts, while Chinese cloaked toxicity unveiling has not been solved yet. To tackle the issue, we propose C2TU, a novel training-free and prompt-free method for Chinese cloaked toxic content unveiling. It first employs substring matching to identify candidate toxic words based on Chinese homophone graph and toxic lexicon. Then it filters those candidates that are non-toxic and corrects cloaks to be their corresponding toxicities. Specifically, we develop two model variants for filtering, which are based on BERT and LLMs, respectively. For LLMs, we address the auto-regressive limitation in computing word occurrence probability and utilize the full semantic contexts of a text sequence to reveal cloaked toxic words. Extensive experiments demonstrate that C2TU can achieve superior performance on two Chinese toxic datasets. In particular, our method outperforms the best competitor by up to 71% on the F1 score and 35% on accuracy, respectively. Our code and data are available at https://github.com/XDxc-cuber/C2TU-Chinese-cloaked-toxicity-unveiling.
Figures & tables
Figure 1: The main workflow of C 2 TU method. C 2 TU consists of two key stages: matching and filtering. In the matching stage, we identify candidate toxic terms in the input text by leveraging a homophone graph and a toxic lexicon. In the filtering stage, we use a language model (BERT model or LLM) to compute the probability gap for each (w,l) pair and iteratively replace the pair with the most significant gap. Once the iteration terminates, the unveiled sentence is returned.
Figure 2: Three candidate toxic words pairs are matched in the input text. Each pair is individually substituted to generate three new sentences. It is evident that the pair [“讲”, “贱”] is incorrect, as the resulting sentence is highly unnatural in meaning, leading to a significantly smaller probability. In contrast, the substitutions of [“穆人”, “母人”] and [“穆”, “母”] are correct, and their corresponding sentences yield higher probabilities.
Metric/%
Method
ToxicloakCN
COLDataset
Sentence
Character
Sentence
Character
Det.
Cor.
Det.
Cor.
Det.
Cor.
Det.
Cor.
F1 score
Naive
3.96
2.77
20.29
17.31
72.32
64.00
90.42
87.41
SCOPE
13.23
6.33
7.81
2.22
14.80
9.91
18.41
7.01
ft-SCOPE
35.79
26.99
17.48
11.73
62.66
59.15
41.21
35.83
Simple-CSC
47.81
41.28
50.18
43.77
59.60
57.36
71.60
69.28
Table 1: The main results of all baseline models and our method w.r.t. the F1 score/% and the accuracy/% metrics, where Det. and Cor. mean detection and correction. We highlight the best score in bold and underline the runner-up one.
Dataset
ToxicloakCN
Detection
Correction
Metrics/%
TP ↑
FP ↓
FN ↓
TN ↑
recall ↑
precision ↑
TP ↑
FP ↓
FN ↓
TN ↑
recall ↑
precision ↑
Naive
2.41
18.74
0.19
78.67
92.74
11.39
2.02
18.74
0.58
78.67
77.83
9.74
C 2 TU-BERT
1.55
0.29
1.05
97.11
59.54
84.25
1.42
0.29
1.18
97.11
54.50
83.04
C 2 TU-LLM
1.79
0.18
0.80
97.23
69.09
91.04
1.67
0.18
0.93
97.23
64.13
90.41
Dataset
COLDataset
Table 2: Character-level analysis between the Naive method with C 2 TU on ToxicloakCN and COLDataset . T/F means True/False. P/N means Positive/Negative. All results are normalized by dividing the raw values by the total number of sentences and characters in the dataset. We highlight the best score in bold.
Figure 3: Efficiency study on the sentence-level correction task.
Method
Sent-Det.
Sent-Cor.
Char-Det.
Char-Cor.
Simple-CSC
70.32
67.86
98.64
98.54
C 2 TU-BERT
89.97
89.97
99.42
99.42
C 2 TU-LLM
94.92
94.92
99.59
99.59
Table 3: Supplementary evaluation on ToxicloakCN with shape-similar cloaks. We extract the shape-similarity graph using SimilarCharacter and keep the rest of the framework unchanged.
Figure 4: Sentence level correction accuracy gap between C 2 TU , C 2 TU-WP and C 2 TU-SR on both datasets. The BERT-based model is employed on bert-chinese-base and the LLM-based model is employed on Baichuan2-7B-Base.
Appendix figures & tables12 assets
Supplementary material from the paper’s appendix.
Appendix
Dataset
Size
Lexicon size
ToxicloakCN
4,586
387
COLDataset
10,415
115
CHSD-subset
2,790
602
Appendix
Table 4: Dataset size and lexicon size of ToxicloakCN , COLDataset and CHSD-subset .
Dataset
Node size
Edge size
ToxicloakCN
3,613
141,683
COLDataset
3,879
163,969
Appendix
Table 5: Homo-graph size of ToxicloakCN and COLDataset .
w/ T.L
w/o T.L
w/ C.L
1,706
542
w/o C.L
542
0
Appendix
Table 6: The distribution of the CHSD-subset . T.L means ToxiCN ’s lexicon, while C.L means COLDataset ’s lexicon.
Quantity
Value
COLDataset graph nodes
3,879
ToxiCN graph nodes
3,613
Intersection
3,118
Union
4,374
COLDataset -only
761
ToxiCN -only
495
Appendix
Table 7: Overlap between the homophone graphs constructed from COLDataset and ToxiCN .
Method
Sent-Det.
Sent-Cor.
Char-Det.
Char-Cor.
w/ ToxiCN graph
74.67
70.01
78.56
75.04
w/ Joint graph
72.33
68.44
82.97
74.69
w/ General graph
72.33
68.44
82.97
74.69
Appendix
Table 8: Cross-resource evaluation on ToxicloakCN using the ToxiCN lexicon. We report F1 scores (%).
Dataset
Error type
Original Sentence
Cloaked Sentence
C 2 TU-BERT
C 2 TU-LLM
ToxicloakCN
Short-span phonetic confusion
连说说也不准？黑吹好猖獗
连说说也不准？嗨吹好猖獗
连说说也不准？嗨吹好猖獗
连说说也不准？黑吹好猖獗
COLDataset
Polyphonic ambiguity
冷暴力是不好，但是对男对女都是一样的啊，很多人强调用冷暴力对女生这个点，不理解
冷暴力是不好，但是对男对女都是一样的啊，很多人强调用冷暴力对女省这个点，不理解
冷暴力是不好，但是对男对女都是一样的啊，很多人强调用冷暴力对女性这个点，不理解
冷暴力是不好，但是对男对女都是一样的啊，很多人强调用冷暴力对女性这个点，不理解
ToxicloakCN
Dialectal overgeneralization
你这个喃蛮编的故事挺好的
你这个喃满编的故事挺好的
你这个南蛮编的故事挺好的
你这个南蛮编的故事挺好的
ToxicloakCN
Overlapping candidates
凭什么你觉得是女拳师你就用娘们侮辱人？[捂嘴]我还觉得你是男拳师呢，哪个词伺候？[捂嘴]
凭什么你觉得是女权师你就用娘们侮辱人？[捂嘴]我还觉得你是南犬师呢，哪个词伺候？[捂嘴]
凭什么你觉得是女权师你就用娘们侮辱人？[捂嘴]我还觉得你是男权师呢，哪个词伺候？[捂嘴]
凭什么你觉得是女权师你就用娘们侮辱人？[捂嘴]我还觉得你是男权师呢，哪个词伺候？[捂嘴]
Appendix
Table 9: Representative error cases of C 2 TU-BERT ( bert-chinese-base ) and C 2 TU-LLM ( Baichuan2-7B-Base ).
Table 10: Prompt template for prompt-based method.
Metric/%
Method
Model
ToxicloakCN
COLDataset
Sentence
Character
Sentence
Character
Det.
Cor.
Det.
Cor.
Det.
Cor.
Det.
Cor.
F1 score
Simple-CSC
Baichuan2-13B
47.81
41.28
50.18
43.77
59.60
57.36
71.60
69.28
Prompt-based
Deepseek-V3
28.66
20.21
17.15
8.56
40.89
31.99
40.15
26.84
C 2 TU-LLM
LLaMA3-8B
68.74
64.30
74.44
70.98
89.55
86.25
92.74
91.97
Qwen2.5-7B
67.20
63.52
73.46
70.19
89.37
86.30
92.41
91.73
Appendix
Table 11: The results of C 2 TU-LLM with different LLMs w.r.t. F1 score and accuracy metrics, where Det. and Cor. mean detection and correction. We highlight the best score in bold.
Model
Sent-Det.
Sent-Cor.
Char-Det.
Char-Cor.
Baichuan2-7B
74.67
70.01
78.56
75.04
Qwen3.5-4B
69.31
64.83
81.39
71.53
Qwen3.5-7B
71.01
66.65
81.82
72.52
Appendix
Table 12: Recent Qwen3.5 backbone comparison on ToxicloakCN . We report F1 scores (%).
Model
Correct
Incorrect
Accuracy (%)
95% CI (%)
Simple-CSC
154
46
77.00
[70.69, 82.29]
C 2 TU-BERT
168
32
84.00
[78.29, 88.43]
C 2 TU-LLM
178
22
89.00
[83.91, 92.62]
Appendix
Table 13: Human evaluation on 200 sampled examples from ToxicloakCN .
Model
Fleiss’ Kappa
Observed Agreement Pˉ
Chance Agreement Pe
C 2 TU-LLM
0.87
0.97
0.79
C 2 TU-BERT
0.88
0.97
0.72
Simple-CSC
0.94
0.98
0.64
Appendix
Table 14: Inter-annotator agreement for human evaluation.
Large language models (LLMs) require robust toxicity evaluation beyond explicit wording. This setting remains underexplored in Chinese, where toxicity may combine semantic indirectness with surface obfuscation. We introduce Chinese Implicit Toxicity Attack (CITA), a controlled red-team evaluation and defense-data generation framework, not a deployable evasion tool. CITA uses three stages: (i) Harmful Intent Learning, (ii) Implicit Toxicity Enhancement, and (iii) Obfuscation Variant Rewriting, to preserve harmful intent, increase implicitness, and add controlled surface variants. On CITA-generated evaluation samples, the seven tested detectors exhibit substantial missed-detection risks, reaching an average ASR of 69.48%; human evaluation further confirms preserved harmfulness and increased implicitness/evasiveness. As a downstream defense application, we fine-tune a Chinese Implicit Toxicity Defense model (CITD) with CITA-generated red-team data, showing that such data can improve robustness through additional training.
Jingyi Kang, Junyu Lu, Bo Xu +4
1Dalian University of Technology · 2The University of Tokyo · 3Singapore University of Technology and Design
Existing Chinese toxic content detection methods mainly target sentence-level classification but often fail to provide readable and contiguous toxic evidence spans. We propose ToxiTrace, an explainability-oriented method for BERT-style encoders with three components: (1) CuSA, which refines encoder-derived saliency cues into fine-grained toxic spans with lightweight LLM guidance; (2) GCLoss, a gradient-constrained objective that concentrates token-level saliency on toxic evidence while suppressing irrelevant activations; and (3) ARCL, which constructs sample-specific contrastive reasoning pairs to sharpen the semantic boundary between toxic and non-toxic content. Experiments show that ToxiTrace improves classification accuracy and toxic span extraction while preserving efficient encoder-based inference and producing more coherent, human-readable explanations. We have released the model at https://huggingface.co/ArdLi/ToxiTrace.
Boyang Li, Hongzhe Shou, Yuanyuan Liang +2
School of Data Science and Engineering, East China Normal University · School of International Chinese Studies, East China Normal University
Toxic content detection in online communication remains a significant challenge, with current solutions often inadvertently blocking valuable information, including medical terms and text related to minority groups. This paper presents a more nu-anced approach to identifying toxicity in Bulgarian text while preserving access to essential information. The research explores two distinct methodologies for detecting toxic content. The developed methodologies have po-tential applications across diverse online platforms and content moderation systems. First, we propose an ontology that models the potentially toxic words in Bulgarian language. Then, we compose a dataset that comprises 4,384 manually anno-tated sentences from Bulgarian online forums across four categories: toxic language, medical terminology, non-toxic lan-guage, and terms related to minority communities. We then train a BERT-based model for toxic language classification, which reaches a 0.89 F1 macro score. The trained model is directly applicable in a real environment and can be integrated as a com-ponent of toxic content detection systems.
Melania Berbatova, Tsvetoslav Vasev
Faculty of Mathematics and Informatics, Sofia University "St. Kliment Ohridski"