Pith. sign in

REVIEW 3 major objections 6 minor 1 cited by

Exploring Multimodal Challenges in Toxic Chinese Detection: Taxonomy, Benchmark, and Findings

T0 review · 3 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read LLMs cannot reliably detect perturbed toxic Chinese, and small-sample adaptation makes them overcorrect.

desk verdict A useful benchmark and a genuinely cautionary overcorrection result, but the positive labels in the dataset are not validated for toxicity preservation, which puts the central numbers at risk. read the letter →

arxiv 2505.24341 v1 pith:SRNQ3BRD submitted 2025-05-30 cs.CL cs.AIcs.CY

Shujian Yang , Shiyao Cui , Chuanrui Hu , Haicheng Wang , Tianwei Zhang , Minlie Huang , Jialiang Lu , Han Qiu This is my paper
classification cs.CLcs.AIcs.CY
keywords toxiccontentdetectionChineselanguagemultimodalperturbationLLMrobustnessovercorrectionin-contextlearningsupervisedfine-tuningCNTPbenchmark
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that the multimodal structure of Chinese—glyph, phonetic, and semantic variants of the same characters—forms a practical blind spot for state-of-the-art LLMs doing toxicity detection. To show this, it proposes a taxonomy of three perturbation strategies and eight concrete rewriting methods, builds a validated dataset of about 20,000 perturbed toxic Chinese sentences, and benchmarks nine LLMs from US and Chinese developers. The benchmark shows large detection drops for homophone, pinyin-initial, and character-splitting perturbations, with Chinese-developed models holding no clear edge. The second central finding is that lightweight adaptation backfires: fine-tuning GPT-4o-mini on ten perturbed examples raises detection above 98 percent but pushes the false-positive rate on ordinary Chinese from about 2.7 percent to over 30 percent. A careful reader would care because the result separates "the model detects toxicity" from "the model has learned a brittle heuristic," with direct stakes for content moderation.

What carries the argument

The load-bearing object is the perturbation taxonomy plus the generation-validation pipeline that turns it into a benchmark. The taxonomy defines three strategies—glyph, phonetic, and semantic—and eight named perturbations: visual similarity, character splitting, traditional Chinese substitution, pinyin initials, full pinyin, homophone replacement, shuffling, and emoji replacement. The pipeline samples toxic and non-toxic sentences from Toxi_CN, uses GPT-4o-mini to extract toxic entities, applies each perturbation with a controlled perturbation rate below 30 percent, and keeps only sentences rated readable by four native-speaker annotators, yielding the CNTP dataset of 20,087 perturbed toxic texts. The paper then measures LLMs with three indicators—detection rate on toxic content, error rate on non-toxic content, and misinterpretation rate—so that "correct" classifications achieved by over-triggering can be distinguished from genuine understanding. This combination is what lets the paper attribute drops in performance to the Chinese multimodal character system rather than to mere prompt sensitivity.

What would settle it

Conduct a human rating study in which native Chinese speakers see each perturbed sentence without the original and independently label whether it is toxic; then recompute detection rates only on sentences the humans agree are toxic and readable. If detection rates on that confirmed subset are high, the paper's central failure claim would be weakened, while if the fine-tuned model still over-flags confirmed-benign sentences, the overcorrection finding would be strengthened.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that current LLMs do not understand perturbed toxic Chinese; they pattern-match. The authors construct a taxonomy of Chinese-specific perturbations grounded in the language's logographic nature: glyph-based (visually similar characters, character splitting, traditional-script substitution), phonetic-based (pinyin initials, full pinyin, homophones), and semantic-based (character shuffling and emoji replacement). Across nine LLMs, homophone and pinyin-initial perturbations consistently push detection rates below 60 percent, and even the strongest models lose more than 20 points on average. When the authors try to patch the weakness with in-context learning or fine-tuning on 10–40 examples, detection rates rise but the misinterpretation rate stays high, and fine-tuned GPT-4o-mini flags more than 30 percent of benign Chinese sentences as toxic; human checks confirm the model is not recovering the intended meaning. The paper's claim is that this overcorrection is not a prompt artifact but a sign that the model acquired a shallow trigger heuristic rather than semantic understanding.

Load-bearing premise

The load-bearing assumption is that the automatically generated perturbations preserve the original sentence's toxicity and are readable to native speakers; if a perturbation changes the meaning or becomes incoherent, the detection rates measure something other than toxicity detection.

Editorial extensions

If this is right

  • If the benchmark reflects real-world Chinese social media, current LLM-based Chinese toxicity detectors are evadable by simple, human-readable rewrites that require no model knowledge.
  • Detection gains from ICL or SFT with small numbers of perturbed examples do not imply understanding; the same adaptation increases false positives on ordinary Chinese, so deployment needs precision monitoring.
  • Language alignment matters: Chinese prompts consistently outperform English prompts for the same model, so detection quality depends on prompt language as much as model capability.
  • Chinese-developed LLMs do not automatically outperform US-developed models on perturbed Chinese content, so claims of native-language advantage need robustness testing.
  • A prompt that explicitly asks the model to recover perturbations (CA-CoT) improves detection while keeping error rate low, suggesting that decoding the perturbation is a separable skill from judging toxicity.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A likely extension beyond the paper: the overcorrection failure mode is a precision problem, not a recall problem, so any deployment that fine-tunes on small adversarial sets should gate on non-toxic error rate to avoid censoring benign speech.
  • The taxonomy logic may transfer to other logographic and script-mixing languages, such as Japanese kanji variants or Arabic script manipulations, so the benchmark design could serve as a template for robustness tests beyond Chinese.
  • The high misinterpretation rate suggests a testable route the paper does not fully pursue: instead of fine-tuning on labeled perturbed examples, models could be trained or prompted to reconstruct the original string before judging; the paper's CA-CoT result is preliminary evidence for this direction.
  • The 30-percent false-positive jump under tiny fine-tuning implies that benchmark evaluations reporting only detection rate on adversarial sets can badly overstate real-world safety; error rates on clean text should be reported alongside every detection gain.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper introduces a taxonomy of 3 perturbation strategies and 8 methods for obfuscating toxic Chinese text (glyph, phonetic, and semantic), constructs a large benchmark dataset (CNTP) of 20,087 perturbed toxic texts, and evaluates 9 state-of-the-art LLMs from the US and China on their ability to detect these perturbed examples. It further studies cost-effective enhancement via in-context learning (ICL) and supervised fine-tuning (SFT), reporting that these small-sample methods improve detection rates but cause severe overcorrection, i.e., misclassifying many non-toxic Chinese sentences as toxic. The central claims are that SOTA LLMs are less capable of detecting perturbed multimodal Chinese toxic contents, and that ICL/SFT with a small number of perturbed examples leads to overcorrection.

Significance. If the findings hold, the paper makes a useful contribution: the taxonomy is systematic, the dataset is a potentially valuable resource for the Chinese toxicity detection community, and the overcorrection finding is practically important for deploying LLM-based moderation systems. The authors provide a public repository, include an ethics statement, and their prompt-ablation study shows that results are sensitive to prompt wording, which is a useful robustness analysis. However, the central claims depend on an unvalidated assumption that every perturbed example remains toxic, and the Misinterpretation Rate used to support the overcorrection conclusion is not formally defined. These issues need to be addressed before the empirical conclusions can be trusted.

major comments (3)
  1. [§4.4] The human validation protocol covers extraction accuracy and readability, but it never verifies that a perturbed sentence remains toxic. The paper's own Section 3.2 notes that full Pinyin can produce neutral homophones ('da ren' can mean 'adult' rather than 'hit person'), and Section 3.3 notes that shuffling can change meaning entirely ('海上' to '上海'). Because every one of the 20,087 CNTP examples is treated as a positive toxic sample in Tables 3, 5, and 6, any perturbed example that is actually non-toxic or incoherent is counted as a detection miss, and a fine-tuned model trained on such labels would learn to call benign text toxic, inflating the apparent overcorrection. The authors should add a human toxicity-preservation check (e.g., annotate a sample of perturbed sentences for whether the intended toxic meaning is retained) and report the agreement rate; without this, the detection-rate numbers and the overcorrection finding are not established.
  2. [§6.1] The Misinterpretation Rate (MR) is never defined. The text says it 'evaluates whether the LLM truly understands and identifies perturbed contexts' and that the authors 'select one perturbation from them,' but no formula, annotation protocol, or denominator is given. Tables 5, 6, and 9 report MR values, and the paper uses high MR to conclude that ICL/SFT improvements come from overcorrection rather than genuine understanding. Without an operational definition, these results cannot be interpreted or reproduced.
  3. [§5.1 / Table 3] The benchmark reports single-run detection rates with no error bars, confidence intervals, or significance tests. The prompt-ablation tables in Appendix C show that detection rates can swing by dozens of points with prompt wording (e.g., Qwen-turbo on VSim: 85.86% with CN vs. 46.85% with CN_Concise), so the reported cross-model and cross-perturbation differences in Table 3 should be accompanied by variance estimates or repeated trials. This is particularly important for the first claim that SOTA LLMs are less capable on certain perturbation types, since the gaps for some models are comparatively small.
minor comments (6)
  1. [Appendix C] The heading 'Abalation' should be corrected to 'Ablation'.
  2. [Table 3] Several cells contain merged numeric strings without separators (e.g., the GLM-4-Air row: '92.4657.7482.6051.8980.8477.08'); these should be separated into distinct values.
  3. [§4.3] The text cites 'RoCBert, ToxiCloakCN, and Adversarial GLUE' without full citations; the corresponding references should be added.
  4. [§5.1] For API-based models, the access dates or model version identifiers should be specified to improve reproducibility.
  5. [§6.1] The footnote about OpenAI fine-tuning requiring at least 10 samples is placed after the mention of 10 samples, but the paper also uses 20 and 40; the relationship between the minimum sample size and the chosen sizes should be clarified.
  6. [Limitations] The limitation about small sample sizes in the mitigation experiments is mentioned only at the end; moving this caveat into the experimental setup in Section 6 would better frame the ICL/SFT results.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the benchmark results are empirical measurements against external models and human-validated labels, not derivations from the paper's own inputs.

full rationale

This paper is an empirical benchmark study rather than a derivation, and its claims do not reduce to its own inputs by construction. The taxonomy in Section 3 is a classification scheme, not a theorem, and the CNTP dataset is generated from the external Toxi_CN base dataset with human validation (Section 4.4). Detection rates are obtained by prompting nine external LLMs with fixed prompts (Section 5.1), so the reported performance is not fitted to the benchmark labels. The use of GPT-4o-mini for toxic entity extraction in Section 4.2 is not circular because extraction accuracy is independently human-verified at 98.6% and extraction is distinct from the toxicity classification being benchmarked. The overcorrection finding is measured via error rates on originally non-toxic samples and human reinterpretation, so it is not an artifact of the construction labels. The only caveat is that Section 4.4 validates readability rather than directly confirming toxicity preservation, which is a benchmark-validity concern, not a circularity one. Overall, the central findings are self-contained empirical results with no load-bearing self-citation or definitional equivalence.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central claims rest on the validity of the base dataset labels, the preservation of toxicity after perturbation, the accuracy of LLM extraction, and the completeness of the proposed taxonomy. No new physical or conceptual entities are introduced.

free parameters (4)
  • perturbation_rate = 0.28 average (below 30%)
    Chosen by hand following prior work; controls how strongly each sentence is perturbed, directly affecting detection difficulty.
  • readability_threshold = 3 on a 1-5 scale
    Sentences rated below 3 are discarded, changing the composition of the dataset and the pool of evaluation examples.
  • few_shot_sample_size = 10 (ICL), 10/20/40 (SFT)
    The overcorrection result depends on these specific small sample sizes; no sweep or randomization is reported.
  • fine_tuning_hyperparameters = batch_size=16, epochs=3, lr_multiplier=0.1
    Standard settings, not tuned per task, but they influence the measured overcorrection effect.
assumptions (4)
  • domain assumption Toxi_CN base dataset labels are correct for toxicity.
    The 2,533 toxic and 2,696 non-toxic base sentences are taken from Toxi_CN without independent re-labeling.
  • domain assumption Human readability scores imply semantic (toxicity) preservation.
    Section 4.4: only readability is rated; toxicity preservation is assumed from readability scores above 3.
  • domain assumption GPT-4o-mini toxic entity extraction is sufficiently accurate.
    Extraction accuracy is reported as 98.6% by four annotators, but the extraction itself is used to build the evaluation data.
  • ad hoc to paper The 3-strategy, 8-method taxonomy covers the relevant Chinese perturbation space.
    The taxonomy is proposed by the authors in Section 3 and is not derived from an external theory; the authors note in Limitations that it may not capture future perturbations.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Exploring Multimodal Challenges in Toxic Chinese Detection: Taxonomy, Benchmark, and Findings." pith.science (2026). https://pith.science/paper/SRNQ3BRD

@misc{pith2026250524341,
  author       = {Pith},
  title        = {Pith review of: Exploring Multimodal Challenges in Toxic Chinese Detection: Taxonomy, Benchmark, and Findings},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SRNQ3BRD}},
  note         = {Machine review of arXiv:2505.24341}
}
read the original abstract

Detecting toxic content using language models is important but challenging. While large language models (LLMs) have demonstrated strong performance in understanding Chinese, recent studies show that simple character substitutions in toxic Chinese text can easily confuse the state-of-the-art (SOTA) LLMs. In this paper, we highlight the multimodal nature of Chinese language as a key challenge for deploying LLMs in toxic Chinese detection. First, we propose a taxonomy of 3 perturbation strategies and 8 specific approaches in toxic Chinese content. Then, we curate a dataset based on this taxonomy, and benchmark 9 SOTA LLMs (from both the US and China) to assess if they can detect perturbed toxic Chinese text. Additionally, we explore cost-effective enhancement solutions like in-context learning (ICL) and supervised fine-tuning (SFT). Our results reveal two important findings. (1) LLMs are less capable of detecting perturbed multimodal Chinese toxic contents. (2) ICL or SFT with a small number of perturbed examples may cause the LLMs "overcorrect'': misidentify many normal Chinese contents as toxic.

Figures

Figures reproduced from arXiv: 2505.24341 by the authors.

Figure 1
Figure 1. An example of one toxic Chinese con [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Illustration of three main categories of the [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. The construction pipeline of the CNTP dataset. be removed. This process is effective, but labor￾intensive and time-consuming. With the develop￾ment of language models, researchers have proven that LLMs have the capability to efficiently extract specific data in context through prompt engineering. In this case, we use the SOTA LLM GPT-4o-mini to directly extract toxic terms through a few-shot prompt that guides the m… view at source ↗

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Lost in Pronunciation: Detecting Chinese Offensive Language Disguised by Phonetic Cloaking Replacement

    cs.CL 2025-07 conditional novelty 6.0 of 10

    A new 500-post benchmark of naturally occurring phonetic cloaking shows LLMs detect such Chinese offensive language with F1 at most 0.672, and Pinyin-augmented prompting partially repairs the gap.

Reference graph

Works this paper leans on

47 extracted references · 28 canonical work pages · cited by 1 Pith paper

  1. [1]

    Ahmed Abbasi, Abdul Rehman Javed, Farkhund Iqbal, Natalia Kryvinska, and Zunera Jalil. 2022. Deep learning for religious and continent-based toxic content detection and classification. Scientific Reports, 12(1):17478

    work page 2022

  2. [2]

    Delphine Battistelli, Cyril Bruneau, and Valentina Dragos. 2020. Building a formal model for hate detection in french corpora. Procedia Computer Science, 176:2358--2365

    work page 2020

  3. [3]

    Fatih Beyhan, Buse C ar k, Inan c Ar n, Ay s ecan Terzio g lu, Berrin Yan ko g lu, and Reyyan Yeniterzi. 2022. A turkish hate speech dataset and detection system. In Proceedings of the thirteenth language resources and evaluation conference, pages 4177--4185

    work page 2022

  4. [4]

    Meghana Moorthy Bhat, Saghar Hosseini, Ahmed Hassan, Paul Bennett, and Weisheng Li. 2021. Say ` YES ' to positivity: Detecting toxic language in workplace communications. In Findings of the Association for Computational Linguistics: EMNLP 2021, pages 2017--2029

    work page 2021

  5. [5]

    Darya Bogoradnikova, Olesia Makhnytkina, Anton Matveev, Anastasia Zakharova, and Artem Akulov. 2021. Multilingual sentiment analysis and toxicity detection for text messages in russian. In 2021 29th Conference of Open Innovations Association (FRUCT), pages 55--64. IEEE

    work page 2021

  6. [6]

    Kai-Wei Chang, He He, Robin Jia, and Sameer Singh. 2021. Robustness and adversarial examples in natural language processing. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing: Tutorial Abstracts, pages 22--26

    work page 2021

  7. [7]

    Lijun Chi, Mounira Msahli, Qingjie Zhang, Han Qiu, Tianwei Zhang, Gerard Memmi, and Meikang Qiu. 2024 a . Adversarial attacks on autonomous driving systems in the physical world: a survey. IEEE Transactions on Intelligent Vehicles

    work page 2024

  8. [8]

    Yang Chi, Fausto Giunchiglia, Chuntao Li, and Hao Xu. 2024 b . Ancient chinese glyph identification powered by radical semantics. In Findings of the Association for Computational Linguistics ACL 2024, pages 12065--12074

    work page 2024

Show all 47 references
  1. [9]

    Jiawen Deng, Jingyan Zhou, Hao Sun, Chujie Zheng, Fei Mi, Helen Meng, and Minlie Huang. 2022. Cold: A benchmark for chinese offensive language detection. arXiv preprint arXiv:2201.06025

    2022 arXiv

  2. [10]

    Jianshuo Dong, Ziyuan Zhang, Qingjie Zhang, Tianwei Zhang, Hao Wang, Hewu Li, Qi Li, Chao Zhang, Ke Xu, and Han Qiu. 2024. An engorgio prompt makes large language model babble on. arXiv preprint arXiv:2412.19394

    2024 arXiv

  3. [11]

    Tanmay Garg, Sarah Masud, Tharun Suresh, and Tanmoy Chakraborty. 2023. Handling bias in toxic speech detection: A survey. ACM Computing Surveys, 55(13s):1--32

    2023

  4. [12]

    Ine Gevers, Ilia Markov, and Walter Daelemans. 2022. Linguistic analysis of toxic language on social media. In Computational Linguistics in the Netherlands, volume 12, pages 33--48

    2022

  5. [13]

    Team GLM, Aohan Zeng, Bin Xu, Bowen Wang, Chenhui Zhang, Da Yin, Dan Zhang, Diego Rojas, Guanyu Feng, Hanlin Zhao, et al. 2024. Chatglm: A family of large language models from glm-130b to glm-4 all tools. arXiv preprint arXiv:2406.12793

    2024 arXiv

  6. [14]

    Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, et al. 2025. Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning. arXiv preprint arXiv:2501.12948

    2025 arXiv

  7. [15]

    Zhanhao Hu, Julien Piet, Geng Zhao, Jiantao Jiao, and David Wagner. 2024. Toxicity detection for free. arXiv preprint arXiv:2405.18822

    2024 arXiv

  8. [16]

    Fatemah Husain and Ozlem Uzuner. 2021. A survey of offensive language detection for the arabic language. ACM Transactions on Asian and Low-Resource Language Information Processing (TALLIP), 20(1):1--44

    2021

  9. [17]

    Lai Jiang, Hongqiu Wu, Hai Zhao, and Min Zhang. 2024. Chinese spelling corrector is just a language learner. In Findings of the Association for Computational Linguistics ACL 2024, pages 6933--6943

    2024

  10. [18]

    Deepak Kumar, Patrick Gage Kelley, Sunny Consolvo, Joshua Mason, Elie Bursztein, Zakir Durumeric, Kurt Thomas, and Michael Bailey. 2021. Designing toxic content classification for a diversity of perspectives. In Seventeenth Symposium on Usable Privacy and Security (SOUPS 2021)...

    2021

  11. [19]

    Jinfeng Li, Shouling Ji, Tianyu Du, Bo Li, and Ting Wang. 2019. Textbugger: Generating adversarial text against real-world applications. In Proceedings of the 26th Annual Network and Distributed System Security Symposium (NDSS)

    2019

  12. [20]

    Aixin Liu, Bei Feng, Bing Xue, Bingxuan Wang, Bochao Wu, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, et al. 2024. Deepseek-v3 technical report. arXiv preprint arXiv:2412.19437

    2024 arXiv

  13. [21]

    Junyu Lu, Bo Xu, Xiaokun Zhang, Changrong Min, Liang Yang, and Hongfei Lin. 2023. Facilitating fine-grained detection of chinese toxic language: Hierarchical taxonomy, resources, and benchmarks. arXiv preprint arXiv:2305.04446

    2023 arXiv

  14. [22]

    John X Morris, Eli Lifland, Jin Yong Yoo, Jake Grigsby, Di Jin, and Yanjun Qi. 2020. Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in nlp. arXiv preprint arXiv:2005.05909

    2020 arXiv

  15. [23]

    John Pavlopoulos, Jeffrey Sorensen, Lucas Dixon, Nithum Thain, and Ion Androutsopoulos. 2020. Toxicity detection: Does context really matter? arXiv preprint arXiv:2006.00998

    2020 arXiv

  16. [24]

    John Pavlopoulos, Jeffrey Sorensen, L \'e o Laugier, and Ion Androutsopoulos. 2021. Semeval-2021 task 5: Toxic spans detection. In Proceedings of the 15th international workshop on semantic evaluation (SemEval-2021), pages 59--69

    2021

  17. [25]

    Wei Ren and Yaping Guo. 2024. Translanguaging in self-praise on chinese social media. Applied Linguistics Review, 15(1):355--376

    2024

  18. [26]

    Maximilian Schmidhuber and Udo Kruschwitz. 2024. LLM -based synthetic datasets: Applications and limitations in toxicity detection. LREC-COLING 2024, page 37

    2024

  19. [27]

    Xinlei Shi, Junjie Zhai, Xudong Yang, Zehua Xie, and Chao Liu. 2015. Radical embedding: Delving deeper to chinese radicals. In Proceedings of the 53rd Annual Meeting of the Association for Computational Linguistics, pages 594--598

    2015

  20. [28]

    Hui Su, Weiwei Shi, Xiaoyu Shen, Zhou Xiao, Tuo Ji, Jiarui Fang, and Jie Zhou. 2022. Rocbert: Robust chinese bert with multimodal contrastive pretraining. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 921--931

    2022

  21. [29]

    Tzu-Ray Su and Hung-Yi Lee. 2017. Learning chinese word representations from glyphs of characters. arXiv preprint arXiv:1708.04755

    2017 arXiv

  22. [30]

    Ao Wang, Xinghao Yang, Chen Li, Weifeng Liu, et al. 2024. Adaptive immune-based sound-shape code substitution for adversarial chinese text attacks. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 4553--4565

    2024

  23. [31]

    Boxin Wang, Chejian Xu, Xiangyu Liu, Yu Cheng, and Bo Li. 2022. Semattack: Natural textual attacks via different semantic spaces. arXiv preprint arXiv:2205.01287

    2022 arXiv

  24. [32]

    Yuan Wang, Yukun Li, Xinning Gui, Yubo Kou, and Fenglian Liu. 2019. Culturally-embedded visual literacy: A study of impression management via emoticon, emoji, sticker, and meme on social media in china. Proceedings of the ACM on Human-Computer Interaction, 3(CSCW):1--24

    2019

  25. [33]

    Yunze Xiao, Yujia Hu, Kenny Tsu Wei Choo, and Roy Ka-wei Lee. 2024. ToxiCloakCN : Evaluating robustness of offensive language detection in chinese with cloaking perturbations. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing

    2024

  26. [34]

    Rongwu Xu, Yishuo Cai, Zhenhong Zhou, Renjie Gu, Haiqin Weng, Yan Liu, Tianwei Zhang, Wei Xu, and Han Qiu. 2024 a . Course-correction: Safety alignment using synthetic preferences. arXiv preprint arXiv:2407.16637

    2024 arXiv

  27. [35]

    Rongwu Xu, Brian S Lin, Shujian Yang, Tianqi Zhang, Weiyan Shi, Tianwei Zhang, Zhixuan Fang, Wei Xu, and Han Qiu. 2023. The earth is flat because...: Investigating llms' belief towards misinformation via persuasive conversation. arXiv preprint arXiv:2312.09085

    2023 arXiv

  28. [36]

    Rongwu Xu, Zi'an Zhou, Tianwei Zhang, Zehan Qi, Su Yao, Ke Xu, Wei Xu, and Han Qiu. 2024 b . Walking in others' shoes: How perspective-taking guides large language models in reducing toxicity and bias. arXiv preprint arXiv:2407.15366

    2024 arXiv

  29. [37]

    An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, et al. 2024. Qwen2. 5 technical report. arXiv preprint arXiv:2412.15115

    2024 arXiv

  30. [38]

    Xiran Yang and Meichun Liu. 2021. The pragmatics of text-emoji co-occurrences on chinese social media. Pragmatics, 31(1):144--172

    2021

  31. [39]

    Alex Young, Bei Chen, Chao Li, Chengen Huang, Ge Zhang, Guanwei Zhang, Guoyin Wang, Heng Li, Jiangcheng Zhu, Jianqun Chen, et al. 2024. Yi: Open foundation models by 01. ai. arXiv preprint arXiv:2403.04652

    2024 arXiv

  32. [40]

    Hongchuan Zeng, Senyu Han, Lu Chen, and Kai Yu. 2024. Converging to a lingua franca: Evolution of linguistic regions and semantics alignment in multilingual large language models. arXiv preprint arXiv:2410.11718

    2024 arXiv

  33. [41]

    Jiang Zhang, Qiong Wu, Yiming Xu, Cheng Cao, Zheng Du, and Konstantinos Psounis. 2024 a . Efficient toxic content detection by bootstrapping and distilling large language models. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 21779--21787

    2024

  34. [42]

    Qingjie Zhang, Han Qiu, Di Wang, Yiming Li, Tianwei Zhang, Wenyu Zhu, Haiqin Weng, Liu Yan, and Chao Zhang. 2025. A benchmark for semantic sensitive information in llms outputs. In The Thirteenth International Conference on Learning Representations

    2025

  35. [43]

    Qingjie Zhang, Han Qiu, Di Wang, Haoting Qian, Yiming Li, Tianwei Zhang, and Minlie Huang. 2024 b . Understanding the dark side of llms' intrinsic self-correction. arXiv preprint arXiv:2412.14959

    2024 arXiv

  36. [44]

    Zihan Zhang, Mingxuan Liu, Chao Zhang, Yiming Zhang, Zhou Li, Qi Li, Haixin Duan, and Donghong Sun. 2021. Argot: Generating adversarial readable chinese texts. In Proceedings of the Twenty-Ninth International Conference on International Joint Conferences on Artificial Intellig...

    2021

  37. [45]

    Li Zhou, Laura Cabello, Yong Cao, and Daniel Hershcovich. 2023. Cross-cultural transfer learning for chinese offensive language detection. arXiv preprint arXiv:2303.17927

    2023 arXiv

  38. [46]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list...

  39. [47]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.