{"id":"0a938473-3201-4e9c-8ecf-64739f499418","arxiv_id":"2412.15268","paper_version":4,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"MetaTox constructs a meta-toxic knowledge graph from toxic corpora and injects retrieved triplets into LLM prompts, improving toxicity detection and lowering false positives, especially out-of-domain.","lead":"The paper introduces MetaTox, a method that builds a knowledge graph of toxic speech patterns from public datasets and uses it to give large language models extra context when judging whether a post is hateful. The approach is designed to reduce both misses and false alarms, which matters for online moderation that must protect free speech while catching abuse.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"FPR gains may stem from the default-to-benign prompt instruction, not from KG retrieval: the query prompt in Appendix A.5 tells the model to default to non-toxic when no triplet matches, and no controlled baseline isolates the KG's contribution.","rationale":"The reader's weakest assumption concerned the reliability of the semantic-similarity threshold used for ranking and filtering. My concern is related but distinct and more load-bearing: even a perfectly ranked and filtered knowledge graph would not explain the reported FPR reduction if the prompt itself carries a strong default-to-benign prior. The MetaTox query prompt explicitly says that when no triplet matches, the text is 'more possible to be benign'; this instruction is part of the treatment but not, as far as the paper reports, part of the vanilla or RAG baselines. Consequently, the headline comparison does not isolate the contribution of the KG. The paper does have real strengths: the construction pipeline is clearly described, the manual evaluation of triplets is a good-faith quality check, and the case studies illustrate the intended mechanism. But the experimental design currently conflates two interventions: (1) adding retrieved toxic knowledge and (2) instructing the model to default to non-toxic when no evidence is present. A simple three-condition control experiment would settle whether the FPR reduction is attributable to the KG or to the prompt prior. Because the concern is addressable with additional experiments and does not require assuming any misconduct, I recommend keeping the conditional verdict rather than rejecting outright. The reader's threshold-tuning concern also deserves attention, but it is secondary: reporting the threshold and validating it on training data would strengthen the paper, but without the prompt-prior control the central claim remains unproven even if the threshold is perfectly chosen.","tokens_in":16095,"tokens_out":3971,"duration_ms":37027,"concrete_test":"Run a controlled experiment on the same test sets (HateXplain and IHC) with Qwen2.5-14B-Instruct using the identical query-prompt template from Appendix A.5 under three conditions: (A) no triplets inserted, (B) triplets sampled uniformly at random from the knowledge graph (same count and format as MetaTox), and (C) MetaTox's retrieved triplets. Compare FPR, F1, and AUC across the three conditions. If condition (A) or (B) produces an FPR close to MetaTox's (within a few points) while F1/AUC do not improve correspondingly, then the FPR reduction is a prompt-prior artifact rather than evidence for the knowledge graph. Additionally, report the percentage of toxic and non-toxic test inputs for which the ranking/filtering step returns zero triplets, and state whether the filtering threshold was fixed before seeing the test labels.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The MetaTox query prompt in Appendix A.5 instructs the model: 'If the context contains the same meaning with one of the triplets, it is hateful. Otherwise, it is more possible to be benign.' This is a strong prior toward the non-toxic class, and it appears in MetaTox but not, as reported, in the vanilla or naive-RAG baselines. The headline FPR reductions (e.g., 66.62 to 32.10 on HateXplain with Qwen, 48.42 to 11.64 on IHC with Qwen) could therefore be driven by the instruction alone: for ordinary benign speech, the retrieval/ranking step will often return no triplets, and the model is then explicitly told to lean benign. The paper never reports the filtering threshold, the fraction of test inputs that receive zero triplets, or a control condition with the identical prompt but without KG triplets (or with randomly sampled, irrelevant triplets). The ablation in Appendix B removes rank-and-filter but keeps the prompt instruction, so it cannot separate the effect of retrieved knowledge from the effect of the default-to-benign prior. As a result, the central causal claim that injecting curated toxic triplets reduces false positives is not yet established; the same FPR improvement might be achieved by editing the prompt alone.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes MetaTox, a training-free method for LLM-based hatred and toxicity detection. It constructs a meta-toxic knowledge graph from toxic training samples of HateXplain, ToxicSpans, and IHC using a three-step pipeline (rationale reasoning, triplet extraction, entity resolution). At inference, the method extracts entities from a given text, maps them to graph nodes, retrieves shortest paths, and injects ranked toxic triplets into the LLM prompt. Experiments compare MetaTox against vanilla LLM, naive RAG, and fine-tuned small models in both in-domain and cross-domain settings, reporting accuracy, F1, AUC, and false positive rate (FPR). The central claim is that MetaTox significantly reduces false positives while improving overall detection performance, especially out-of-domain.","tokens_in":16360,"tokens_out":4314,"duration_ms":38145,"significance":"If the causal claim holds, MetaTox offers a practical, training-free way to inject domain-specific toxicity knowledge into LLMs, with a novel domain-specific knowledge graph as a reusable artifact. The paper merits credit for releasing code, performing a manual annotation-quality check of the constructed graphs, including an ablation study, and evaluating cross-domain transfer, which is a meaningful step beyond in-domain-only comparisons. However, the current experimental design does not isolate the effect of the retrieved triplets from the effect of a strong prompt prior, and the absence of thresholds and statistical reporting leaves the headline FPR reductions unsubstantiated.","major_comments":[{"comment":"The query prompt in Appendix A.5 instructs the model: 'If the context contains the same meaning with one of the triplets, it is hateful. Otherwise, it is more possible to be benign, but you should leverage your knowledge to judge it.' This is a strong default-to-benign prior that is not present in the vanilla or naive-RAG baselines as described. Because the ablation in Appendix B only removes rank-and-filter while retaining this instruction, the reported FPR reductions (e.g., Table 2, HateXplain with Qwen: 66.62 to 32.10; Table 3, IHC with Qwen: 48.42 to 11.64) cannot be attributed to the injected knowledge graph triplets. The authors must report a controlled condition with the same prompt instruction but (a) no triplets, and (b) randomly sampled irrelevant triplets, to separate the prompt effect from the knowledge effect.","section":"Appendix A.5 / Section 3.3"},{"comment":"Several FPR values are exactly identical between the in-domain and cross-domain tables for the same backbone and test dataset: HateXplain with Qwen shows MetaTox FPR 32.10 in both Table 2 (KG from same dataset) and Table 3 (KG from ToxicSpans), and IHC with Llama shows 34.23 in both tables. Since the knowledge graph source differs across the two settings, exact duplication is implausible and suggests an experiment or reporting error. The authors must verify these numbers and explain the duplication or correct the tables.","section":"Tables 2 and 3"},{"comment":"The similarity threshold used in 'Ranking and Filtering' is never specified, and the entity-resolution clustering threshold is described only as 'relatively high' with no numerical value. These thresholds directly control how many triplets are injected into the prompt and hence how often the default-to-benign instruction applies. Without reporting the thresholds and a sensitivity analysis, the results are not reproducible and the contribution of the filtering step cannot be assessed.","section":"Section 3.3 and Section 3.2.3"},{"comment":"All experiments in Tables 2 and 3 report single runs with no error bars, confidence intervals, or significance tests. The abstract's claim that MetaTox 'significantly decreases the false positive rate' is therefore not statistically supported. At minimum, the authors should provide multiple seeds or bootstrap confidence intervals for the headline FPR and AUC differences.","section":"Section 4.2"}],"minor_comments":[{"comment":"The query prompt contains typos: 'aplphabet' should be 'alphabet' and 'Non-hatefule' should be 'Non-hateful'.","section":"Appendix A.5"},{"comment":"The appendix text for Section B and Section C appears duplicated in the manuscript, and the self-checking prompt in Section A.2 is printed twice; this likely stems from a formatting error and should be corrected.","section":"Appendix B / Appendix C"},{"comment":"The column header 'RAGMetaTox' is missing a space; it should read 'RAG MetaTox' to match the other method names.","section":"Table 2"},{"comment":"The knowledge graph is constructed from the same training corpora used by the naive-RAG baseline in the in-domain setting; while this is a fair comparison, the paper does not discuss the extent to which in-domain gains could reflect the LLM's familiarity with those exact training texts. A brief discussion of this circularity concern would strengthen the analysis.","section":"Section 3.1"}],"recommendation":"major_revision","confidential_remarks":"The duplicate FPR values across in-domain and cross-domain tables are a red flag for reporting accuracy, and the prompt-prior confound is a substantive threat to the central claim. If the authors can supply the controlled experiments and corrected tables, the paper may be publishable; in its current form, the evidence does not support the causal attribution to the knowledge graph."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"You should know two things before reading this paper. First, the meta-toxic knowledge graph and the shortest-path retrieval pipeline are a real contribution. Second, the central FPR claims are not yet cleanly separated from a prompt-level bias, and there is a duplicated number in the main tables that suggests sloppy reporting.\n\nWhat is actually new: the authors build a domain-specific knowledge graph for hate/toxic speech from existing toxic corpora, using a three-step LLM pipeline (rationale reasoning, triplet extraction, entity resolution), then query it via node mapping and shortest-path retrieval, rank the retrieved triplets, and inject them into an LLM prompt. That is a sensible and reasonably novel combination, and they are right that no prior work builds such a KG for this task. The manual annotation of 300 sampled triplets (82–89% accuracy) is a nice touch, and the case studies show the mechanism working in concrete examples. The ablation on HateXplain also suggests that the rank-and-filter step and shortest-path retrieval each contribute something on top of a 1-hop subgraph.\n\nThe soft spots are real. The most serious is the prompt confound. Appendix A.5 shows the MetaTox query prompt explicitly tells the model: \"If the context contains the same meaning with one of the triplets, it is hateful. Otherwise, it is more possible to be benign.\" That is a strong default-to-benign prior that appears in MetaTox but not in the vanilla or RAG baselines. For benign speech, the retrieval step often returns no triplets, and the model is then instructed to lean benign. A controlled condition with the same prompt but random or irrelevant triplets is missing, so we cannot tell how much of the FPR reduction comes from the KG content versus the instruction itself. The ablation in Appendix B removes rank-and-filter but keeps the instruction, so it does not isolate the KG's contribution.\n\nThere is also at least one improbable duplication: HateXplain FPR with Qwen is 32.10 in both the in-domain table and the cross-domain table, and IHC FPR with Llama is 34.23 in both. Exact matches to two decimals across different KG sources are not credible and suggest a copy/paste error. Finally, no error bars, no significance tests, and the similarity thresholds for entity resolution and filtering are undisclosed, so it is hard to judge robustness.\n\nWho is this for? People working on toxicity detection and retrieval-augmented prompting will find the pipeline idea worth knowing. But as evidence for the causal claim that KG triplets reduce false positives, the paper is not there yet. A serious referee should ask for a prompt-controlled ablation, corrected tables, released code and KG with configuration, and confidence intervals. I would not cite this as support for FPR improvement until the confound is resolved, but it is worth a reading-group discussion about evaluation design.\n\nRecommendation: yes, send to peer review with major revision. The core idea is solid and the presentation is honest; the experiments just need to be made trustworthy.","headline":"A genuinely new training-free KG-based toxicity detection method, but its headline FPR gains are confounded by a prompt bias and at least one suspicious duplicated table value.","tokens_in":16884,"tokens_out":2116,"would_cite":false,"duration_ms":21138,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Injecting toxic-knowledge triplets into LLM prompts reduces false positives in hate speech detection.","keywords":["hate speech detection","toxicity detection","knowledge graph","retrieval-augmented generation","false positives","large language models","graph retrieval","entity resolution"],"falsifier":"Run MetaTox on a held-out dataset while sweeping the ranking-and-filtering similarity threshold; if the optimal threshold changes across datasets or performance collapses when the threshold is fixed, the ranking mechanism is not stable. A simpler check is to have human annotators rate whether the retrieved triplets are actually relevant to the input speech and compare that rating with the cosine-similarity order.","tokens_in":15885,"feed_emoji":"🛡️","tokens_out":6050,"duration_ms":50260,"temperature":0.7,"pith_summary":"MetaTox proposes to reduce two failure modes of LLM-based toxicity detection: false negatives from missing domain-specific knowledge, and false positives from over-sensitivity to identity-related words. It builds a meta-toxic knowledge graph from toxic examples in three existing benchmarks, distilling the examples into Subject-Predicate-Object triplets such as \"white lives matter is against black lives matter.\" At detection time, the system extracts entities from the new text, maps them to graph nodes, retrieves shortest paths, ranks and filters the resulting triplets by similarity, and places the survivors in the LLM prompt. The paper reports consistently lower false positive rates and higher accuracy and F1 relative to vanilla prompting and naive RAG, with the largest gains in cross-domain evaluation. If correct, this gives a training-free route to updating and specializing toxicity detectors, while the in-domain results caution that fine-tuned small models remain strong competitors.","feed_headline":"Toxic triplets in prompts cut LLM false positives","feed_subtitle":"Retrieved toxic triplets injected into prompts reduce false positives and boost cross-domain detection, with no fine-tuning.","key_machinery":"The central object is the meta-toxic knowledge graph: a graph whose nodes are toxic entities and concepts and whose edges are relations such as \"demean,\" \"promote,\" and \"co-appear,\" with each path standing for a piece of concentrated toxicity knowledge. Its role in the argument is to turn fragmented toxic corpus text into concise, queryable triplets that can be ranked against an incoming speech and placed into the LLM prompt. Two later mechanisms carry much of the reported gain: shortest-path retrieval between mapped entities, and a ranking-and-filtering step that discards triplets with low BERT-embedding similarity to the input, which the ablation study says is essential.","core_discovery":"On its own terms, the paper claims that a knowledge graph of toxic triplets can carry the domain knowledge LLMs lack, and that retrieving from it makes the LLM's judgment both more sensitive to implicit hate and less allergic to benign mentions of sensitive groups. The construction pipeline treats LLMs as extractors rather than judges: given a known-toxic text, the LLM first writes a rationale, then extracts toxic triplets, then filters them with a self-checking step, and entity resolution merges near-duplicate nodes using BERT embeddings. At query time, entity extraction, node mapping, shortest-path retrieval, and similarity-based ranking filter the candidate triplets, and the prompt tells the model that a speech matching the triplets is hateful while a speech with no related triplets is likely benign. This design leads to the paper's headline results: false positive rate falls sharply on both HateXplain and IHC—for instance from 66.62% to 32.10% with Qwen on HateXplain—while accuracy and F1 rise, and cross-domain transfers from a ToxicSpans-built graph still beat both vanilla LLM prompting and naive RAG.","pith_inferences":["The ranking step's reliance on unspecified BERT-embedding similarity thresholds is the least controlled part of the pipeline; if the threshold was tuned separately per test set, the reported false-positive reductions may not transfer to new corpora.","The prompt instruction that no related triplets implies non-toxicity could bias the model toward benign predictions, so part of the false-positive reduction may come from instruction bias rather than knowledge quality.","Manual evaluation reports 82–89% triplet correctness, so the graph carries residual noise; measuring how detection performance changes as triplet accuracy is degraded artificially would test whether correctness is the active ingredient.","A natural extension is to build the graph from unlabeled social media streams rather than curated benchmarks and evaluate whether retrieval still improves detection, which would test the method's claim to be easily updateable."],"forward_implications":["On HateXplain and IHC, MetaTox raises accuracy, F1, and AUC relative to vanilla LLM prompting and naive RAG while cutting the false positive rate, for example from 66.62% to 32.10% with Qwen on HateXplain.","Because the method is training-free, the knowledge source can be expanded or edited without fine-tuning, which suits fast-evolving social media toxicity.","Using a graph built from ToxicSpans to test on HateXplain and IHC, MetaTox keeps much of its gain while naive RAG degrades, supporting cross-domain transfer of invariant toxic semantics.","In-domain results suggest fine-tuned small models such as HateBERT and BERT remain competitive or superior, so model choice depends on whether the deployment domain matches the training domain.","Ablation results show that both the ranking/filtering step and shortest-path retrieval, rather than 1-hop neighbor retrieval, contribute to the reported accuracy."],"supporting_citations":[{"why":"Supplies the HateXplain corpus used to build a meta-toxic knowledge graph and to evaluate in-domain detection.","marker":"Mathew et al., 2021"},{"why":"Supplies the ToxicSpans corpus used to build a cross-domain knowledge graph and to evaluate detection.","marker":"Pavlopoulos et al., 2021"},{"why":"Supplies the IHC implicit-hate corpus used for graph construction and in-domain and cross-domain evaluation.","marker":"ElSherief et al., 2021"},{"why":"Provides BERT embeddings used for entity resolution, node mapping, and ranking/filtering of retrieved triplets.","marker":"Devlin et al., 2019"},{"why":"Provides the Qwen2.5-14B-Instruct backbone used to construct the knowledge graphs and to generate toxicity predictions.","marker":"Qwen Team, 2024"},{"why":"Provides the Llama3.1-8B-Instruct backbone used as the second detection model.","marker":"AI@Meta, 2024"},{"why":"Defines the retrieval-augmented generation paradigm that serves as the naive RAG baseline.","marker":"Lewis et al., 2020"},{"why":"Provides the fine-tuned HateBERT model used as a small-model baseline.","marker":"Caselli et al., 2021"},{"why":"Documents the excessive sensitivity and calibration limitations of LLMs in implicit hate speech detection, motivating the false-positive problem.","marker":"Zhang et al., 2024b"}],"fun_headline_variants":["Toxic knowledge graph slashes LLM false positives","Graph-based toxic triplets sharpen LLM hate detection","MetaTox cuts false alarms in LLM toxicity checks","Retrieved toxic triplets reduce LLM over-sensitivity","Knowledge graph of toxic triplets lowers false positives"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method assumes that BERT-embedding cosine similarity between a candidate triplet and the incoming speech reliably indicates whether that toxic knowledge is relevant, and the paper does not specify or separately validate the similarity threshold used to filter triplets.","fun_headline_variants_meta":{"raw":{"variants":["Toxic knowledge graph slashes LLM false positives","Graph-based toxic triplets sharpen LLM hate detection","MetaTox cuts false alarms in LLM toxicity checks","Retrieved toxic triplets reduce LLM over-sensitivity","Knowledge graph of toxic triplets lowers false positives"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000213,"raw_usage":{"total_tokens":1428,"prompt_tokens":957,"completion_tokens":471,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":573,"completion_tokens_details":{"reasoning_tokens":404}},"tokens_in":573,"tokens_out":471,"duration_ms":4721,"temperature":1.0,"reasoning_tokens":404,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T13:55:34.483986+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run MetaTox on a held-out dataset while sweeping the ranking-and-filtering similarity threshold; if the optimal threshold changes across datasets or performance collapses when the threshold is fixed, the ranking mechanism is not stable. A simpler check is to have human annotators rate whether the retrieved triplets are actually relevant to the input speech and compare that rating with the cosine-similarity order.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the IHC implicit-hate corpus used for graph construction and in-domain and cross-domain evaluation."}],"review_version":1}