Breaking the Cloak! Unveiling Chinese Cloaked Toxicity with Homophone Graph and Toxic Lexicon

arXiv:2505.22184 · cs.CL, cs.AI · Submitted 2025-05-28 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: AI Radio. Generated commentary on the latest Artificial Intelligence papers.

Tom: Today's paper: "Breaking the Cloak! Unveiling Chinese Cloaked Toxicity with Homophone Graph and Toxic Lexicon".

Jane: The gist The C2TU method proposes a novel training-free and prompt-free approach for Chinese cloaked toxicity unveiling by employing substring matching with a homophone graph and filtering candidates using both…

Tom: First, who's behind it and why it matters.

Paper summary: Tom: So we’ve touched on what this paper is about, but let's dig into the specifics now about "Breaking the Cloak! Unveiling Chinese Cloaked Toxicity with Homophone Graph and Toxic Lexicon." The authors are trying to solve the problem of toxic content evasion through homophonic cloaks in Chinese, which they say existing tools designed for English just don't work.

Jane: They propose C squared TU, which is training-free and prompt-free <ref:2505.22184#pg1,training-free and prompt-free>. They start by using substring matching against a Chinese homophone graph and a toxic lexicon to identify candidate toxic words that match the length of known toxic words.

Lu: The matching stage generates these candidate pairs denoted as Wp equals w(i), l(i), where l(i) is a probable toxic unveiling of w(i) based on the homophone graph and lexicon, as described in Algorithm one on page sixteen.

Meng: Then they move to filtering those candidates, refining them by calculating the probability difference between the word and its potential replacement using either BERT or LLMs, which is defined by ProbDiff Pw l equals log Pw minus log Pl equals log Pw/Pl, as detailed in Section three point four on page five.

Lalam: For BERT filtering, they use a Masked Language Modeling task where they compute the probability difference using Equation three on page five to reveal cloaked toxic words based on larger probabilities and for LLMs, they handle the auto-regressive limitation by reformulating word-level probability differences into sentence-level ones using Bayes’ theorem as shown in Theorem one and Equation nine on page thirteen.

Tom: So, essentially, it’s a two-stage process: first identifying potential matches through matching, and then filtering those candidates iteratively by finding the most significant probability gap using either BERT or LLMs to correct the cloaks into their proto toxic words.

Jane: The authors specifically construct a homophone graph G equals (N, E) involving extracting all Chinese characters and connecting them with identical pinyin or phonetically similar pronunciations, including dialectal relationships like “n” ↔ “l” or “zh” ↔ “z”, as described in Section three point one.one on page three.

Lu: They also build a toxic lexicon L equals (l1, · · ·, lm) which is designed to be simple and clean by retaining only the proto words, like keeping “垃圾” la j¯ı while using “辣鸡” là j¯ı as a cloaked substitution, according to Section three point one.two on page three.

Meng: The filtering step itself involves iteratively replacing the pair with the most significant gap where di equals ProbDiff Pw i Pl i is calculated, and then selecting the index k equals argmin i di in Algorithm two on page sixteen which basically finds the largest difference.

Lalam: And their experimental results are pretty strong. They showed C2TU-LLM achieving an F1 score of seventy-four point six seven percent on the ToxicloakCN dataset and ninety point five two percent on COLDataset, outperforming the best competitor by up to seventy-one percent on the F1 score as shown in Table one on page seven.

Tom: That’s a substantial gap, nearly three times better than the top baselines they compared it against, which really shows how this method handles Chinese cloaked toxicity effectively.

Conclusion: Jane: So we’ve gone through the paper "Breaking the Cloak! Unveiling Chinese Cloaked Toxicity with Homophone Graph and Toxic Lexicon," and what it means for the world is that we finally have a tool specifically built for Chinese language toxicity that doesn't require extensive training or complex prompting.

Lu: The C squared TU method successfully combines substring matching with iterative filtering using either BERT or LLMs to correct cloaks into their proto toxic words, and they demonstrate superior performance on the ToxicloakCN and COLDataset datasets <ref:2505.22184#pg1>.

Meng: For people building moderation tools, this means they can expect a system that is not just good at spotting toxicity but also actually correcting the deceptive language users employ to bypass filters.

Lalam: It shows that leveraging full semantic context through those sentence probability differences allows this method to outperform existing techniques by up to seventy-one percent on the F1 score and thirty-five percent on accuracy, which is a big jump.

Tom: The title itself, "Breaking the Cloak!", captures the essence of what they did—they managed to peel back that deliberate disguise using linguistic structure and probability calculations specific to Chinese.

Jane: The authors are Xuchen Ma, Jianxiang Yu, Wenming Shao, Bo Pang, and Xiang Li at East China Normal University. Their work moves us closer to creating more robust safety measures for online Chinese platforms by tackling the unique challenges of homophonic cloaking.

School of Data Science and Engineering, East China Normal University

cs.CL, cs.AI

Submitted: 2025-05-28

Updated: 2026-10-09

Comments: 17 pages, 5 figures, 14 tables

Code: https://github.com/XDxc-cuber/C2TU-Chinese-cloaked-toxicity-unveiling

License: http://creativecommons.org/licenses/by/4.0/

Importance score: 92/100

The gist: The gist The C2TU method proposes a novel training-free and prompt-free approach for Chinese cloaked toxicity unveiling by employing substring matching with a homophone graph and filtering candidates

Key concepts

Homophone Graph: This is a map created by connecting all Chinese characters that sound alike or share phonetic similarities, including dialectal relationships like 'n' and 'l'. This graph helps the method find potential toxic words that are written using different characters but pronounced similarly, which is a common way users hide toxicity.
Toxic Lexicon: This is a curated list of actual toxic words. The method uses this list to identify the 'proto' or true form of a word, such as '垃圾', and then looks for cloaked versions like '辣鸡' that might be used instead. This external knowledge helps narrow down the search space for toxic content.
ProbDiff (Probability Difference): This is a mathematical measure calculated between the probability of the cloaked word ($P_w$) and its potential true word ($P_l$). A larger difference indicates a stronger likelihood that the cloaked word is actually a toxic term. This difference is used iteratively to select the most likely correct replacement for each candidate.
BERT/LLM Filtering Variants: The method uses two different models—BERT and Large Language Models (LLMs)—to filter candidates. BERT uses its Masked Language Modeling task to calculate word-level probability differences. LLMs are used by reformulating these differences into sentence-level probabilities, allowing them to capture the full context of the text for better unveiling.

Terminology

Accuracy — 1× in this paper · explained in 1 episode
F1 Score — 1× in this paper · explained in 3 episodes

Summary

The gist The C2TU method proposes a novel training-free and prompt-free approach for Chinese cloaked toxicity unveiling by employing substring matching with a homophone graph and filtering candidates using both BERT and LLMs to correct cloaks into their corresponding proto toxic words.

How it works

The process begins with identifying candidate toxic words by leveraging a homo-graph and a toxic lexicon to find substrings that match the length of known toxic words, as described in Algorithm 1 on page 16.
This matching stage generates a set of candidate pairs denoted as Wp = (w(i), l(i)) for i = 1, · · ·, M, where l(i) is a probable toxic unveiling of w(i), as summarized in Algorithm 1 on page 16.
The filtering stage then refines these candidates by calculating the probability difference between the word and its potential replacement using BERT or LLMs, as detailed in Section 3.4 and Equation (1) on page 5, which defines ProbDiff(Pw, Pl) = log Pw − log Pl = log Pw/Pl.
For BERT-based filtering, the method utilizes a Masked Language Modeling (MLM) task where it computes the probability difference using Equation (3) on page 5 to unveil cloaked toxic words based on larger probabilities.
For LLM-based filtering, the method addresses the auto-regressive limitation by reformulating word-level probability differences into sentence-level ones using Bayes’ theorem, as shown in Theorem 1 and Equation (9) on page 13.

Key Components and Methodology

The paper introduces two primary model variants for filtering candidate toxic words: BERT and LLMs, which are employed to compute the occurrence probability of words for filtering candidate toxic words, respectively, as stated in the abstract on page 1.

The construction of the homophone graph G = (N, E) involves extracting all Chinese characters and connecting those with identical pinyin or phonetically similar pronunciations, including dialectal relationships such as “n” ↔ “l”, “zh” ↔ “z”, etc., as described in Section 3.1.1 on page 3.

The toxic lexicon L = (l1, · · ·, lm) is constructed to introduce external knowledge about toxicity, retaining only the protowords to maintain a simple and clean toxic lexicon, such as keeping “垃圾” (la j ¯ ¯ı) as the proto word while using “辣鸡” (là j¯ı) as a cloaked substitution, according to Section 3.1.2 on page 3.

The filtering step iteratively replaces the pair with the most significant gap, where di ← ProbDiff(Pw(i), Pl(i)) is calculated, and the index with the most significant difference is selected as k ← argmin i di in Algorithm 2 on page 16.

Experimental Results

Extensive experiments were conducted on two Chinese toxic datasets, ToxicloakCN [24] and COLDataset [7], demonstrating superior performance compared to baselines, with C2TU-LLM achieving an F1 score of 74.67% on ToxicloakCN and 90.52% on COLDataset, outperforming the best competitor by up to 71% on the F1 score as shown in Table 1 on page 7.

The C2TU-LLM model exhibits high effectiveness across different LLMs, consistently taking the first two ranks in all contests when compared against baselines like Simple-CSC and Baichuan2-7B-Base, with its performance being better than models like Deepseek-V3 on both F1 score and accuracy metrics as seen in Table 3 on page 9.

The analysis of candidate toxic word filtering confirms that the Naive method suffers from high false positive rates, whereas our methods further filter out non-toxic words to achieve better FP and TN rates, with C2TU-LLM achieving a precision of 90.41% on the ToxicloakCN dataset in the correction task compared to 9.74% for Naive as shown in Table 2 on page 8.

The efficiency study indicates that C2TU-LLM is significantly more efficient than Simple-CSC and Baichuan2-7B-Base because it only uses LLM to output sentence probability difference, while the other two methods perform token generation, as observed in Figure 3 on page 8.

Conclusion

C2TU successfully proposes a training-free and prompt-free method for Chinese cloaked toxicity unveiling by combining homophone graph matching with iterative filtering using BERT or LLMs to achieve superior performance on Chinese toxic datasets. The method's ability to leverage full semantic context through the sentence probability difference calculation allows it to outperform existing methods by up to 71% on the F1 score and 35% on accuracy, as demonstrated in extensive experiments.

Improvements for AI systems

Bold Header: Training-free and prompt-free C2TU Model

This method can be applied to Chinese text to unveil cloaked toxic content, specifically by utilizing a homo-graph and a toxic lexicon to identify candidate toxic words followed by filtering them using BERT or LLMs.

Bold Header: BERT-based Filtering Enhancement

The BERT model can be adapted to compute the probability difference between raw and toxic words, as described in the paper, allowing for unveiling where toxic tokens have larger probabilities.

Bold Header: LLM Contextual Filtering via Bayes' Theorem

LLMs can be leveraged to address auto-regressive limitations by reformulating word-level differences into sentence-level ones using Bayes’ theorem, thus allowing them to compute the word probability differences based on the full semantic contexts of a sentence.

Bold Header: Optimized Matching Mechanism

The system uses a specific matching logic where a substring is considered a candidate toxic word if ∃l ∈ L, len(w) = len(l) and ∀k ∈ [1, 2, · · ·, N], G.HasEdge(wk, lk) = 1, ensuring only homophonic matches against the lexicon are considered.

Bold Header: Iterative Cloak Correction

The filtering stage employs an iterative process where the system replace[s] w˜ with ˜l based on the most significant difference in probability, ensuring that each replacement is guided by maximizing the log probability difference to refine the sentence correction.

Abstract

Social media platforms have experienced a significant rise in toxic content, including abusive language and discriminatory remarks, presenting growing challenges for content moderation. Some users evade censorship by deliberately disguising toxic words through homophonic cloak, which necessitates the task of unveiling cloaked toxicity. Existing methods are mostly designed for English texts, while Chinese cloaked toxicity unveiling has not been solved yet. To tackle the issue, we propose C squared TU, a novel training-free and prompt-free method for Chinese cloaked toxic content unveiling. It first employs substring matching to identify candidate toxic words based on Chinese homophone graph and toxic lexicon. Then it filters those candidates that are non-toxic and corrects cloaks to be their corresponding toxicities. Specifically, we develop two model variants for filtering, which are based on BERT and LLMs, respectively. For LLMs, we address the auto-regressive limitation in computing word occurrence probability and utilize the full semantic contexts of a text sequence to reveal cloaked toxic words. Extensive experiments demonstrate that C squared TU can achieve superior performance on two Chinese toxic datasets. In particular, our method outperforms the best competitor by up to 71% on the F1 score and 35% on accuracy, respectively. Our code and data are available at https://github.com/XDxc-cuber/C2TU-Chinese-cloaked-toxicity-unveiling.