Fraudulent messages sent via Short Message Service (SMS) are increasingly obfuscated to evade cost-conscious classifiers in production systems. In Chinese SMS, attackers can exploit a wide range of carefully crafted obfuscation strategies to hide risk-bearing phrases while preserving human readability, making direct classification brittle under real-world latency and throughput constraints. We propose ReCAST, a Restoration-aware Cascaded Stage-wise Training framework for robust obfuscated Chinese SMS classification. ReCAST distills a large teacher model's de-obfuscation ability into a smaller deployable student model by supervising obfuscated span detection, obfuscation type prediction, and text restoration, and then uses the restoration-aware student for downstream risk classification. Experiments on an internally constructed real-world Chinese SMS benchmark show that ReCAST substantially improves classification performance over directly trained baselines under obfuscation. The results suggest that restoration-aware distillation offers a practical path toward robust SMS risk classification with smaller deployable models under production-oriented constraints.
Figures & tables
Figure 1: Representative obfuscation strategies in Chinese SMS. Attackers hide risk-bearing phrases while preserving human readability with these strategies, making direct classification brittle.
Figure 2: ReCAST distills restoration-oriented supervision from a large teacher into a smaller deployable student, then further trains it for robust SMS risk classification.
Method
ACC
RR
Avg
P95
TT
(%)
(%)
(s)
(s)
(s)
Prompt-CLS
62.8
69.5
0.65
1.15
2.94
Direct-CLS
75.8 ± 0.30
79.2 ± 0.36
0.67
1.18
2.98
Aug-CLS
80.6 ± 0.28
85.1 ± 0.31
0.68
1.17
3.00
Pipeline-CLS
83.4 ± 0.53
86.2 ± 0.47
1.42
2.52
6.66
ReCAST
86.6 ± 0.17
89.5 ± 0.15
0.71
1.20
3.03
Table 1: Main results on internal real-world Chinese SMS test set. Trainable methods report mean ± std over 4 random seeds; Prompt-CLS uses deterministic constrained decoding and is a single value. Avg/P95/TT are average latency, P95 latency, and total test time under 256 concurrent requests with the same vLLM serving configuration and prefix caching.
Method
Backbone
Params
ACC
RR
(%)
(%)
RoCBert
RoCBert-base
≈ 0.1B
79.1
82.7
Adapted CA-CoT
Qwen3.5-9B
9B
81.5
84.3
ReCAST
Qwen3.5-9B
9B
86.6
89.5
DS-CLS
DeepSeek-V4-Pro
1.6T
92.2
94.1
Table 2: Comparison with published methods and the teacher. RoCBert ( Su et al., 2022 ) and CA-CoT ( Yang et al., 2025 ) are evaluated under the same SMS test protocol; ReCAST outperforms both, including the same-backbone CA-CoT. ReCAST values are the 4-seed mean from Table 1 (std omitted for compactness). DS-CLS is direct teacher inference, a non-deployable offline reference; ReCAST recovers about 94% of its accuracy.
Variant
ACC ↑
RR ↑
ReCAST full
86.4
89.7
Joint-Shuffled
84.1
86.8
w/o FULL replay in Stage 2
84.5
87.4
w/o CLS label in Stage 1
85.3
87.8
w/o Stage 2
82.9
85.6
- w/o span&type in Stage 1
73.8
72.1
Table 3: Ablation of ReCAST. The upper block evaluates variants with Stage 2 classification training. The lower block removes Stage 2 and uses the CLS label generated in Stage 1 for classification, where each indented variant further removes one Stage 1 restoration signal. span&type denotes joint supervision of obfuscated spans and their types. Ablations use a single representative checkpoint—the same one underlying the class-wise, restoration, and perturbation analyses—whose ACC/RR fall within 0.2pp of the 4-seed mean in Table 1 . Because the smallest ablation drop (1.1pp ACC / 1.9pp RR) exceeds the largest cross-seed std in Table 1 (0.53pp for ACC, 0.47pp for RR) by over 2 × , suggesting that the observed ablation effects are larger than the typical cross-seed variation.
Appendix figures & tables5 assets
Supplementary material from the paper’s appendix.
Appendix
Method
ACC ↑
RR ↑
Benign FPR ↓
DS-CLS
92.2
94.1
2.4
Prompt-CLS
62.8
69.5
16.0
Direct-CLS
75.7
79.6
6.8
Aug-CLS
80.3
85.5
6.4
Pipeline-CLS
82.9
86.2
2.8
ReCAST
86.4
89.7
2.8
Appendix
Table 4: Benign false positive analysis on the real-world Chinese SMS test set (representative ReCAST checkpoint). The benign subset contains 250 messages. Benign FPR measures the proportion of benign messages incorrectly classified as fraud, gambling, or pornography. DS-CLS directly applies DeepSeek-V4-Pro with the direct classification prompt and is included only as a non-deployable offline teacher reference.
Actual \ Pred.
Benign
Gambling
Porn.
Fraud
Benign
243
2
1
4
Gambling
22
201
5
15
Pornography
17
5
220
7
Fraud
38
12
8
200
Appendix
Table 5: Confusion matrix of the ReCAST checkpoint on the 1,000-message test set (rows: actual, columns: predicted).
Category
Precision (%)
Recall (%)
F1 (%)
Benign
75.9
97.2
85.3
Gambling
91.4
82.7
86.8
Pornography
94.0
88.4
91.1
Fraud
88.5
77.5
82.6
Appendix
Table 6: Class-wise precision, recall, and F1 of the ReCAST checkpoint. Pornography obtains the highest F1, while Fraud is the most challenging category.
Figure 4: Few-Shot examples.
Figure 5: This is an English translation of the direct classification prompt template for the Prompt - CLS, Direct - CLS, and Aug - CLS baselines; it is provided for readability only, while the original Chinese prompt is used in all experiments.
Department of Computer Science, University of Technology and Applied Sciences, Navrongo, Ghana · Department of Computer Science, University for Development Studies, Tamale, Ghana