ACCD detects coordinated online harm campaigns by combining adaptive causal temporal scoring, semi-supervised account classification, and stability validation. On a filtered Twitter IRA task, it improves account-level coordination screening over correlation and fixed-parameter CCM baselines, while reducing manual labeling and runtime.

To efficiently combat the spread of LLM-generated misinformation in the news domain, we present RADAR, a Retrieval-Augmented Detector with Adversarial Refinement for adaptive LLM-generated fake news detection. Our approach employs a generator that rewrites real articles with factual perturbations, paired with a lightweight detector that verifies claims using dense passage retrieval. To enable effective co-evolution, we introduce Verbal Adversarial Feedback (VAF). Rather than relying on scalar rewards, VAF issues structured natural-language critiques; these guide the generator toward more sophisticated evasion attempts, compelling the detector to adapt and improve. Experiments on an LLM-generated fake news benchmark show that RADAR outperforms retrieval-augmented trainable baselines and general-purpose LLMs with retrieval. Further analysis shows that retrieval on both the generator and detector sides improves performance, while VAF and few-shot demonstrations offer complementary benefits. RADAR also transfers better to fake news generated by an unseen external attacker, suggesting improved generalization beyond the specific co-evolved generator used during training.

Fine-grained sexism classifiers are known to rely on surface gender terms, and explainability methods are increasingly proposed not merely to diagnose this reliance but to correct it during training. We test that proposition directly. Using LIME, we identify the tokens a DeBERTa-v3-large classifier relies on most when it misclassifies EDOS Task C development posts, and penalise those tokens’ hidden-state magnitudes during continued fine-tuning. Across three random seeds the method does not improve macro-F1: the best penalised setting reaches 0.477 against a 0.468 baseline (within seed variance), and continued training with the penalty disabled scores highest of all (0.483). A controlled ablation isolates why. Suppressing only the gendered subset of flagged tokens, only the function-word subset, and a random frequency-matched set all leave test macro-F1 statistically indistinguishable from the baseline (0.466, 0.467, and 0.461); critically, LIME-guided suppression performs no better than random suppression, indicating the attribution signal carries no usable corrective information. The flagged tokens are themselves predominantly gendered terms and slurs (65–80% of LIME’s top tokens across seeds) — that is, the genuine evidence for sexism rather than spurious cues. We further find that attribution methods disagree sharply on which tokens are most influential (LIME 65%, SHAP 30%, Integrated Gradients 35% gendered), cautioning against single-attributor conclusions. We conclude that attribution magnitude is an unreliable criterion for token suppression in abuse detection, and that explanation-guided correction cannot succeed where the most salient features are the task’s real signal.

Ten years of online-harms research have largely operationalized harm through abusive tone: slurs, hostility, and platform-visible toxicity. Yet some harms are carried by polite, institutional, role-mediated discourse that standard toxicity classifiers consistently miss. We study one such case through a corpus of 2,388 publicly available conversion therapy (CT) documents (119,976 sentences) compared with 26 APA-aligned affirmative-therapy controls (16,948 sentences). We test a semantic moralization hypothesis using contextual association tests; the signed statistic (d = -5.11, p = 0.0002) indicates that identity terms in CT are on average more similar to neutral-psychology attributes than to morality attributes, contradicting the hypothesis. A transparent rule set based on the BITE model of coercive control finds all four dimensions elevated in CT, with emotional control highest. We test two further alternative mechanisms—a staged emotional script and grammatical agency-deletion—and find neither at corpus scale. Three toxicity classifiers (Detoxify, ToxiGen-HateBERT, ToxiGen-RoBERTa) do not register the elevated coercion markers: Detoxify and RoBERTa flag ≤1.4% of CT sentences; HateBERT flags 11.5% but triggers on identity-group vocabulary rather than coercive structure. These findings argue for online-harms taxonomies that incorporate relational context and semantic constraint alongside surface abuse, and we release derived features and code.

This paper investigates the near-total absence of Urdu from mainstream LLM safety evaluation and nine years of WOAH proceedings. A complete enumeration of all 205 papers across nine ALW/WOAH editions confirms zero dedicated Urdu papers across the entire period. To assess whether this absence has measurable consequences, five large language models (GPT-4o, Claude Sonnet, Gemini 2.5 Flash, Llama-3.1, and Qwen-2.5) were evaluated across six datasets spanning Nastaliq Urdu, Roman Urdu, English, and code-switched Urdu-English, producing approximately 28,000 classifications. Label instability between original-script and English-translation classification ranged from 15.9% to 31.6%, and a missed-in-Urdu rate content flagged as harmful in English but passed as normal in Urdu ranged from 2.4% to 9.9%. Pairwise significance testing confirms that frontier closed models form a statistically indistinguishable cluster significantly outperforming smaller open-weight models on both metrics. The paper also identifies the absence of a dedicated Nastaliq Urdu with English code-switched hate speech dataset as a structural gap, and raises questions about annotation bias in existing Urdu corpora. The findings demonstrate that Urdu speakers are exposed to measurably weaker content moderation safety assurance, a gap that this paper documents, quantifies, and calls on the research community to address, considering that it is in the top 10 most spoken and used language in the world.

In this paper, I propose the RSD framework for computational detection of covert harmful online behaviors. The framework’s three dimensions of Repetition, Severity and Disregard are used together to assess the harmfulness of norm-violating behaviors. These are observable and operationalizable dimensions that aim to support computational detection, enabling evidence-based identification of harmful behavior in conjunction with community norms. While the computational detection of overt harmful behaviors like aggression and hate speech has received a lot of attention, covert harmful behaviors like trolling have been much more challenging to identify. I argue that covert behaviors can be traced by models that examine norm violations crossing the thresholds of the dimensions of RSD.

Multilingual moderation systems often need to account for the possibility that online incivility is expressed differently across languages, beyond differences in vocabulary or other surface-level linguistic features. To examine this issue, we analyze a manually annotated bilingual corpus of 800 YouTube comments (400 English and 400 Russian) labeled across four dimensions: incivility type, severity, target, and clarity of expression. While severity does not differ significantly between the two corpora (Cramér’s V = .06), significant differences emerge for type, target, and clarity (V = .13, .22, and .10, respectively). English comments contain more abusive and explicit forms of incivility, whereas Russian comments more frequently target individuals and employ implicit expression, including sarcasm and irony. User engagement analyzes further show that the forms of incivility associated with greater visibility differ across the two corpora. Together, these findings suggest that, within the corpora examined, severity is comparatively stable across languages, whereas communicative dimensions exhibit greater cross-linguistic variation. The results suggest that multilingual moderation may benefit from distinguishing comparatively stable dimensions from language-sensitive communicative dimensions when developing annotation guidelines and moderation resources.

Writing counterspeech that challenges online hate speech can be cognitively and emotionally demanding, whereas fully automated generation may weaken users’ sense of voice and responsibility. We present an in-browser AI-assisted co-writing tool that enables users to contribute their own ideas and offers three editable suggestions generated by a large language model using dynamically retrieved hate speech–counterspeech examples from the Multitarget CONAN dataset. We evaluated the tool in an exploratory within-subject study with ten participants, complemented by think-aloud observations and semi-structured interviews with half of the participants. Participants wrote responses to three self-selected hate speech instances without assistance and then repeated the task with the tool; final responses were subsequently peer-rated for empathy, non-toxicity, relevance, specificity, and persuasiveness. Participants evaluated the interface positively, and qualitative accounts linked user input, selection among alternatives, and small edits to perceived agency and responsibility. Assisted responses received higher descriptive mean ratings across all five proxies, with the largest difference for empathy. Mean composition time increased from 2.52 to 3.88 minutes. Qualitative findings further revealed a tension between empathy-oriented outputs and users’ desire to express legitimate anger or direct disagreement. We contribute exploratory design guidance for treating AI-assisted counterspeech as deliberative co-writing rather than automated text production.

Harmful-speech datasets drive moderation research but are risky to release as raw text. We ask how much source-text exposure curators can remove while preserving evidence for model comparison and error analysis. Releasing only classifier-important tokens corrupts the data: an independent, lexicon-free LLM judge recovers the targeted group from such excerpts only 36% of the time, and reads 53% of non-hateful excerpts as hateful. We introduce I-CEM, a deterministic evidence-minimization baseline that masks recorded synthetic identifiers, retains tokens whose removal lowers a frozen classifier’s harmful-speech score, and expands retained spans only when rules detect target, harm, negation, quotation, or counterspeech context. We evaluate on HateXplain, HateCheck, and Civil Comments with controlled synthetic PII injection. Our primary result is target recovery: I-CEM raises it from 58% to 67% over a token-matched fixed window (p.001), and the gain replicates against the dataset’s gold target labels (50% to 56%, p.001); I-CEM also more than halves the importance-only misreading (25%). Secondary gains are directional: hate-label fidelity improves modestly (90% vs. 88%, p=.04) but does not hold against gold labels, and the stance advantage over a matched window is not significant. On 5,000 HateXplain examples I-CEM retains about half of source tokens and stays within 0.02 positive-class F1 of a fixed importance window, but releases more text than that window when its context rules fire, a trade curators opt into. Masking every recorded injected identifier validates the masking pipeline; it is not evidence of real-world anonymization. I-CEM is a deterministic context-recovery baseline that measurably reduces label corruption from evidence-only release.

This paper investigates the use of an LLM to generate auxiliary background context for social media posts, and explores four methods to incorporate this context into the input of an SBERT-based Hate Speech Detection (HSD) classifier. These are: text concatenation, embedding concatenation, a hierarchical transformer-based fusion, and LLM-driven text enhancement. We evaluate the impact of our context generation and incorporation strategies in a textual setting on the Latent Hatred dataset of implicitly hateful tweets and a multimodal setting on the MAMI dataset of misogynous internet memes. Results are evaluated against a zero-context baseline, two previous approaches based on entity linking, and a zero-shot LLM classifier. Findings indicate that incorporating generated context improves HSD performance by up to 3 and 6 F1 points on textual and multimodal settings respectively, from a zero-context baseline to the highest-performing system, based on embedding concatenation.

This paper addresses a conceptual and a resource deficit in Hungarian toxicity detection, which to date has been limited to message-level, single-label classification. Conceptually, we introduce an operational framework grounded in Culpeper’s impoliteness theory that distinguishes three tests: face-aggression against the interlocutor (T1), antisocial perlocutionary effect (T2), and community norm violation (T3). Because T2 is already operationalised by prior Hungarian work, we focus on T1 and T3, and we motivate why these are the legally and platform-compliance relevant dimensions. As a resource, we release a silver-annotated corpus of 148,474 conversational comments across 35,431 threads, with a 500-thread human gold subset carrying binary T1/T3 labels plus secondary pragmatic layers, following a thread-level conversational design. As a model, we introduce ModernBERT-HU-4k, a 149M-parameter Hungarian encoder pretrained with a 4,096-token context window and a purpose-built low-fertility tokenizer (1.52), fine-tuned for thread-conditioned per-comment classification and trained on a single consumer GPU. Against a benchmark of eleven zero-shot LLMs on the gold set, the fine-tuned encoder is competitive with the strongest frontier systems, and an ablation shows that thread context helps face-aggression most, precisely where the relational framing predicts. We also document that decomposing the construct yields norm-violation agreement comparable to prior single-label work while revealing face-aggression as a harder, context-dependent sub-problem.

As large language models (LLMs) are increasingly deployed in real-world applications, ensuring their safety is a critical concern. Most safety evaluations focus on direct harmful requests, overlooking cases where the same harmful intent is disguised through indirect, polite, hypothetical, or contextually framed language. To address this limitation, we propose a pragmatics-based automated red-teaming framework that tests whether LLM safety behavior changes when malicious intent is repackaged through different pragmatic strategies. First, we develop a linguistically grounded taxonomy of seven pragmatic strategies—presupposition, implicature, indirect speech acts, denial disclaimers, politeness, hypothetical framing, and contextual framing—and use it to generate adversarial prompts across seven harm categories. Second, we evaluate these prompts on three Target Models (GPT-4o-mini, Qwen2.5-7B, Llama-3.3-70B), with Claude Haiku as judge and human validation. Our experiments show that pragmatically transformed prompts consistently yield higher Attack Success Rate (ASR) than original seed prompts, with contextual framing emerging as particularly effective. These results suggest LLM safety evaluation should account for pragmatic meaning and inferred intent, not just explicit harmful content.

This paper presents an analysis of ten years (2013–-2023) of magistrates’ court data on child sexual abuse (CSA) prosecutions in England and Wales. A dataset comprising 69,685 cases was examined to identify trends in prosecution volumes, offence classifications, defendant counts, and the geographical distribution of cases. Fourteen Home Office offence-group codes were mapped to the published Home Office/VKPP offence classification to ensure accurate interpretation of the legal offence categories.

The findings indicate that the number of prosecuted CSA cases increased steadily until reaching a peak in 2017, followed by a marked decline that began two years before the COVID-19 pandemic, suggesting that the decrease cannot be attributed solely to pandemic-related disruption. The analysis also identifies a notable geographical pattern: unlike crime in general, prosecuted CSA cases are relatively dispersed across neighbourhoods rather than concentrated within a small number of locations. This unexpected finding suggests that the spatial distribution of prosecuted CSA differs from that of many other offence types. Taken together, the temporal and geographical patterns highlight the value of magistrates’ court records as a source of evidence for understanding prosecuted CSA and contribute to ongoing discussions about the scale, distribution, and measurement of child sexual abuse in England and Wales.

Reducing toxicity is often framed as a global alignment problem, yet perceptions of harmful language are subjective and context-dependent. We present a comparative evaluation of training-free methods for aligning language generation to user-specific toxicity sensitivities across three inference-time intervention stages: pre-decoding (prompt conditioning and rewriting), in-decoding (token, logit, and representation steering), and post-decoding (candidate re-ranking). Evaluated against classifier-based toxicity targets derived from the PRISM dataset, all methods reduce alignment error by 28-47%. However, the results show trade-offs between alignment effectiveness, personalization, and general language quality.

The paper investigates to what extent linguistic features, primarily emotional and affective signals, serve as a common denominator in the online texts of various extremist groups. Examining social media data from multiple sources, this research focuses on ideologies such as far-right, jihadist, and various manosphere subgroups. Key results demonstrate distinct emotional profiles across ideologies, with "disgust" emerging as a dominant emotion in many extremist discourses, while "joy" is most prominent in the analyzed religious extremist content. Statistically significant dissimilarities in emotional expression patterns were confirmed, allowing for differentiation between ideological groups. Classifiers, particularly the DeBERTa model, demonstrated a strong capability to reliably distinguish between extremist groups based solely on linguistic characteristics.

Safety research often focuses on modelgenerated harms, but users may also direct hostility, coercion, and adversarial pressure at models. Understanding how and when that occurs is essential for accurately interpreting model behaviour, alignment drift, and real-world deployment risks. In this paper, we audit 777K English LMSYS-Chat-1M conversations with two independent detectors: an eight-category lexicon for hostility directed at the model, and the dataset’s moderation signal; and show that they capture different, weakly overlapping phenomena. The lexicon identifies insults, threats, and jailbreak coercion aimed at the assistant, while moderation flags are dominated by toxic-content solicitation rather than hostility at the model. Together, they mark about 5% of user turns; adjusting the narrower lexicon– harassment union (3.0% raw) for measured precision puts mistreatment aimed at the assistant at 0.90%. These absolute rates describe arenastyle evaluation traffic and should not be read as deployment-wide base rates. We find that user hostility varies 13× across models, driven largely by who each model attracts rather than by model behaviour: first-turn hostility spreads far wider than post-response hostility, and more than fifteenfold separates the extremes even after deduplicating opening prompts. Within conversations, assistant apologies are consistently associated with higher odds of next-turn hostility under both detectors; the effect survives restricting to non-refused prior turns and to jailbreak-free conversations, and is positive in 20 of 23 models. Yet across models, more apologetic (better-aligned) models receive less hostility overall. Finally, hostility also shows temporal structure, with coercive openings (jailbreaks) front-loading the first turn while affective hostility (insults, threats) accumulates over a session. We release the lexicon, the detector cross-validation pipeline, and all derived tables.

Large language models are entering classrooms and homes, yet the moderation tools that guard these interactions are aligned to adult users. We show that this produces a dangerous alignment gap: on our benchmark, general-purpose safeguards such as the OpenAI Moderation API and base Llama Guard 3 detect as little as 30–38% of child-directed harms—predatory grooming, emotional manipulation, encouragement of risky behaviour—because these harms carry no profanity and violate no adult-calibrated policy. Qualitatively, these tools pass textbook grooming as safe; we conclude that, in their current form, they are not on their own an adequate safeguard for children’s conversations with chatbots. To close the gap we (i) define a child-centric risk taxonomy of 27 categories across 7 domains, differentiated by developmental stage (ages 6–12 and 13–17); (ii) build a synthetic pipeline producing 83,338 single-message and multi-turn child–AI interactions, filtered to 79,193 by a reward-model quality mechanism; and (iii) fully fine-tune an encoder (ModernBERT-large) and LoRA-adapt generative safeguards (Llama Guard 3, Aegis-Defensive). Fine-tuned Llama Guard 3 8B reaches 0.996 macro-F1 and 0.994 harmful recall, cutting false negatives to near zero across all 27 categories. We give an honest account of the limits of fully synthetic evaluation—strong lexical baselines (BM25, 0.90 macro-F1) reveal distributional artefacts—and argue that generative safeguards remain the more robust choice for deployment. We release the taxonomy, dataset, and fine-tuned models, and outline planned validation of the safeguard inside a non-profit educational chatbot already used by tens of thousands of children, plus a free public moderation service for benchmarking child-safety.

Identity-related language occurs in both self-referential discussion and speech aboiut other groups, complicating toxicity detection. We ask whether an automatically inferred linguistic-perspective signal is useful as an auxiliary traiing objective. A regex and zero-shot NLI pipeline lables comments as SELF or OTHER; these are noisy linguistic proxies, not verified speak indetities. On Jigsaw Unintended Bias, we fine-tune a Toxic-BERT model with toxicity and proxy labels heads and compare it with a matched control whose perspective-loss weight is zero. The auxiliary objective gives a small descriptive mean ROC-AUC increase but lower mean accuracy. On decontaminated CivilComments-WILDS, ROC-AUC is 0.9346 while worst group accuracy is 0.5805. The main contribution is a leakage-controlled, matced evaluation showing that the full fine-tuning recipe improves toxic class F1 and ranking substantially, where as the automatic perspective proxy provides only limited additional benefit.

Deploying Large Language Models (LLMs) for content moderation on social media platforms introduces new challenges related to potential errors and biases, especially for speech-related policies. In this paper, we evaluate a diverse sample of 20 LLMs in zero-shot classification, for the specific case of sexist hate speech in French; a challenging task due to the scarcity of corpora in French and the English-centric research. We elaborate multiple protocols to explore the models’ understanding of the task and sensitivity to the language of the prompts and class labels. We show that small or medium size models can outperform much larger models, supporting the paradigm that scale is not the main driver of performance. We also demonstrate that models’ performance is not significantly altered when receiving specific guidelines about how to annotate potentially sexist content in French. Qualitative error analysis reveals that guidelines can help capture edge-cases (e.g. condemn sexism), but those are off-set by new misclassifications. This highlights a limitation of zero-shot prompting for content moderation, where specific instructions are crucial for adapting to different languages and cultures.

Conspiracy theories commonly attribute important events to the actions of powerful and secretive actors. While computational research has largely focused on document-level analyses of conspiracy theories, less attention has been paid to identifying the actors portrayed as responsible in such narratives. We develop detailed guidelines for the span-level annotation of conspiratorial actors and use them to create a corpus of German Telegram posts, before investigating automatic actor extraction using transformer-based models. We further apply the resulting model to the Schwurbelarchiv, a large-scale archive of German conspiracy-related Telegram channels. Our results demonstrate that conspiratorial actors can be annotated consistently and extracted with reasonable accuracy despite the linguistic complexity of conspiracy discourse, enabling large-scale analyses of actor representations in conspiracy narratives.

The growing volume of gender-based abusive content on social media platforms has increased the need for reliable automatic misogyny detection across languages. While multilingual language models achieve strong overall performance, less is known about how well they handle phenomena such as implicit hate, stereotypes, or humour. In this research, we present a multilingual study of misogyny detection in Dutch, English, and Spanish Twitter data using mmBERT. We introduce a newly collected and manually annotated Dutch dataset and re-annotate English and Spanish HatEval samples using a unified annotation framework. Beyond binary misogyny labels, tweets are annotated for implicitness, aggressiveness, stereotypes, humour, and target type, enabling a fine-grained analysis of model behaviour. Experimental results reveal substantial differences across languages, and show that overall classification performance masks important category-specific weaknesses. While aggressive content is generally detected reliably, implicit misogyny, stereotypes, and humour remain challenging across all three languages. Qualitative analysis further demonstrates that the model over-relies on lexical cues, and struggles with reported speech and stereotype-based misogyny expressed without overtly offensive language. These findings highlight the value of fine-grained multilingual analyses for understanding the limitations of contemporary misogyny-detection systems.

Classifiers for antisemitism detection inherit a shortcut from keyword-sampled training data: predictions flip when a Jewish identity term is rewritten to another religion, even though the gold label is preserved, conflating antisemitism with legitimate criticism of Israel. We audit this fragility jointly along three axes (positive-class performance, calibration, counterfactual stability) and report a previously unquantified tension. While four group-conditional post-hoc calibrators all improve global calibration (ECE), they inflate the soft counterfactual flip rate by 15–80%. A formal proposition shows intercept-free rescaling cannot change hard flips. Orbit-constrained calibration resolves it: it penalises calibrated probability differences on development-set identity-swap pairs, recovering the calibration gain (ECE −46%) with the hard rate unchanged; it is the only calibrator we test that lowers ECE without inflating soft flips. Separately, we attack invariance at training time: CCI (Counterfactual Consistency Invariance) adds a Jensen–Shannon consistency penalty between each tweet and its religiously rewritten counterfactuals. This cuts the hard flip rate by 49–73% across three encoder backbones and two model families, while preserving or improving F1+ (up to 0.72). Plain counterfactual augmentation reaches a lower flip rate at 3× the training-set size; raising CCI’s multiplier closes that gap at a matched predicted-positive rate. Three prompted 7–8B LLMs cap at F1+ 0.45 and flip an order of magnitude more often. Finally, Integrated Gradients show identity-token attribution nearly unchanged: the gain comes from coupling pair scores, not from suppressing identity salience.

This study examines how large language models annotate implicit extremist discourse in Brazilian Portuguese, and where their decisions diverge from human judgement. Using 1,843 risk-enriched segments, we compare three trained human annotators with GPT-4o, Gemini 2.5 Pro, and Claude 4 Sonnet under the same schema-constrained protocol. Each annotation includes a three-level severity label, an extractive evidence span, discourse-pragmatic metadata, and confidence, while human disagreements are adjudicated to produce a single adjudicated reference. We evaluate models against the adjudicated reference using accuracy, macro-F1, and Cohen’s κ, complement this with a multi-reference evaluation that preserves individual human variation, and additionally examine evidence-span overlap and whether shared evidence leads to the same severity judgement. LLMs agree with one another more than humans do, yet align only moderately with the adjudicated reference. They provide longer and cleaner evidence spans, but overlap with human rationales does not predict label correctness. Errors concentrate in the implicit class, where models often recognise similar cues but assign different severity levels. These findings identify agreement, confidence, and rationale overlap as unreliable proxies for annotation validity, and motivate evidence- and interpretation-level diagnostics for harmful-content annotation.

In this paper, we evaluate an LLM-assisted process for annotating persuasion intent in the context of online manipulation. We focus on the DIDECO taxonomy, a two-tier framework of explicit and implicit manipulation categories based on Speech Act Theory and Cialdini’s influence principles. Our question is not whether such annotations support a downstream classifier, but whether they are reliable enough to be used as labels in the first place. We measure reliability as Cohen’s $\kappa$ between a model and human gold labels, and between models, evaluating GPT-4o, Claude Sonnet 4.5, and Llama 3.3-70B on a synthetic corpus. On DIDECO, models agree more with one another than with human gold, suggesting shared annotation heuristics that diverge from human judgement. On an unlabeled real-world corpus, hierarchical prompting increases inter-model agreement for two of three model pairs, but this result establishes consistency rather than correctness. On a separate human-annotated real-world corpus, we evaluate Claude Sonnet 4.5, Gemma 3-27B, and Qwen 2.5-7B at both top-level and sub-label resolution. Claude and Gemma exceed human agreement at the top level, whereas Claude is the only model to exceed held-out human benchmarks across the full 23-label taxonomy; Gemma also does so when sparse sub-labels are excluded. These results tend to show that LLM annotation reliability depends on the corpus and label granularity, and that inter-model agreement cannot substitute for human validation. We release the prompts, code, and sub-label definitions.

A decade after the first Workshop on Online Abuse and Harms, abuse detection is evaluated on a sprawling collection of public datasets that are usually treated as independent and interchangeable. We audit five widely used English benchmarks (Davidson, DynaHate, HateXplain, TweetEval-Hate, and the Stormfront corpus; 109,698 posts) and, by measuring contamination, lexical shortcuts, label conflict, and transfer on one common scale, argue a single thesis: for these benchmarks the evidence points to a conceptual measurement bottleneck (what counts as abuse) more than to data hygiene (contamination or leakage), a reading we hold with the caution that the strict-cutoff conflict sample is small. Three findings carry this claim. (i) The data-hygiene worries are small here: cross-dataset duplication is negligible (only 17 near-duplicate pairs at Jaccard = 0.8 across 108,946 unique texts, 5 of them exact), and train/test near-duplicate leakage, though common (up to 9.8% of test items), barely changes macro-F1 for the pipeline we study, both for TF-IDF logistic regression and for a fine-tuned distilBERT on the two official-split corpora. (ii) The signal these benchmarks reward is concentrated in a few tokens: a TF-IDF model restricted to 50 tokens retains roughly 89 to 95% of full-model macro-F1 on every dataset, and, against the natural objection that this is a bag-of-words artifact, a fine-tuned distilBERT trained on only those 50 tokens per post still retains 81 to 92% across all five datasets (lowest on the adversarially debiased DynaHate). (iii) Where the same surface text recurs across corpora, its binary labels frequently flip, isolating definition from sampling: at a loose Jaccard = 0.5 near-duplicate cutoff the clean per-item conflict rate is 48.6% (103 of 212 shared texts, though many of these loose matches share a profanity skeleton rather than identical text); at the strict same-text Jaccard = 0.8 cutoff the clean shared set is small (n=18, 10 in conflict) and the disagreement is a Davidson-driven offensive-versus-hate split. Transfer is correspondingly poor (a 0.20 macro-F1 gap) but, given negligible contamination, reflects definitional and distributional divergence rather than leakage; we cannot separate those two, so the conceptual claim rests on the item-level comparison rather than on the transfer gap. Holding the near-duplicate graph fixed and sending both corpora’s offensive class to not-abuse moves the strict-cutoff conflict rate from 55.6% to 22.2%, so much of that disagreement is the offensive-versus-hate boundary rather than disagreement about hate itself. We release abuse-audit, a one-command tool that emits the same per-dataset report card for any new corpus, and recommend reporting a shortcut score and a cross-dataset transfer cell as standard practice.

Hate speech lacks a single agreed definition across legal, social, and benchmark contexts, yet instruction-tuned large language models (LLMs) are increasingly used for hate speech detection. These systems are usually prompted with generic task instructions, so their predictions may reflect built-in moderation priors rather than a different operational definition from a given policy, benchmark, or jurisdiction. We investigate the ability of LLMs to align with specific hate speech definitions through zero-shot and few-shot prompting, by including the hate speech definition in the prompt. We opt for three definitions from different sources: dataset (HateCheck), social media (Reddit), and law (Bulgaria). We use HateCheck, a template-based hate speech diagnostic test set, to verify this alignment by relabeling the same test cases. We compare three LLMs, two definition inclusion conditions, and four prompting strategies. Our findings suggest that regardless of the prompting strategy, LLMs are not reliable in aligning properly with non-HateCheck definitions.

Phonetic cloaking, the deliberate use of homophones, Pinyin, and numeric substitutions to disguise toxic content, poses a persistent challenge to Chinese toxic language detection. Existing work mainly relies on rule-based synthetic perturbations for benchmark evaluation, leaving uncertain how well such results transfer to naturally occurring cloaking. We present a controlled evaluation of fine-tuned encoders on PCR-ToxiCN, a dataset of naturally occurring, phonetically cloaked Chinese posts. Fine-tuning ChineseBERT and RoBERTa-wwm-ext on the CNTP synthetic perturbation dataset, we quantify synthetic-to-real performance gaps across four cloaking strategies. Synthetic perturbation training produces consistent but limited improvements, with diminishing returns as perturbation coverage expands. Hanzi (Chinese-character) replacement remains consistently difficult for both encoders, and few-shot fine-tuning on roughly 50 real examples provides only marginal improvement. The few-shot experiment, however, cannot distinguish representation limits from data scarcity or sampling effects. Overall, our findings caution against equating synthetic benchmark performance with real-world robustness.

Dehumanising language represents one of the most dangerous types of hate speech, that is known to hinder empathy, undermine prosocial behaviour, and contribute to between-group aggression. In wartime contexts, dehumanisation can escalate conflict by fostering support for war and enabling violence, extreme outgroup-targeted policies, and genocide. Yet, there is very limited data available to study online dehumanisation, and there are no respective datasets available in Russian and Ukrainian languages. We address this gap by introducing a novel dataset of dehumanising language from Telegram communication during Russia’s full-scale invasion of Ukraine. Using LLM-assisted annotation, we construct a corpus of 238,190 posts from leading Russian and Ukrainian news and political Telegram channels in 2022, classified as non-dehumanising, marginally dehumanising, or dehumanising. We additionally release a manually annotated evaluation set of 1,000 posts, labelled for six manifestations of dehumanisation, the targeted outgroup, and overall dehumanisation. Together, these resources provide a theory-informed foundation for computational research on dehumanisation in Russian- and Ukrainian-language wartime communication.

Hate speech is a real and timely threat that affects a large portion of online users, especially youth and minority groups. While building reliable and robust automatic hate speech detection (HSD) systems is paramount, we argue that this must also be balanced with the individual right to privacy. Exploring the intersection of HSD and privacy, we demonstrate that HSD systems might unintentionally achieve performance at the cost of encoding authorship, posing a threat to privacy. Building on these findings, we establish the notion of a privacy-HSD trade-off, which demands a careful balance. We benchmark a series of text privatization methods, as well as our newly proposed domain-specific AgnoSpeech technique, showing that balancing privacy and HSD is difficult but feasible. The findings make a strong case for more research on the trade-offs between privacy and HSD, both of which have tangible implications for the safeguarding of online participation.

Russian state propaganda spreads across many languages and online spaces. Yet, most computational work examines only one such space, usually social media, in one or two languages, and analyses sources rather than content. We introduce SWARM (Search-Web documents Annotated for Russian propaganda, Multilingual), a dataset of 2,183 search engine results across nine languages and diverse web domains (e.g., news, blogs, government sites), each annotated by trained coders for whether it supports a recurring Russian propaganda narrative. We benchmark a source-based blocklist, supervised classifiers, and zero-shot LLMs against these labels. The blocklist misses most propaganda-supporting documents, because such content is not confined to flagged "propaganda" outlets but also appears on mainstream ones. Content-level analysis helps, though how much depends on the model: the strongest LLM reaches a positive-class F1 of 0.73, whereas the supervised classifiers reach only about 0.5, with the smaller LLMs over-predicting support, mistaking topical relevance for endorsement. Detecting search-borne propaganda thus requires per-language, content-level evaluation, which we hope SWARM and our evaluation code enable.

Automated hate speech detection relies on benchmark datasets for both training and evaluation, making benchmark composition a fairness concern that precedes classifier behavior. We audit dogwhistle coverage in two widely-used benchmarks (HateXplain and Measuring Hate Speech) using an existing glossary of 340 dogwhistle entries mapped onto a four-level coding sophistication taxonomy, ranging from explicit slurs (L1) to opaque persona signals (L4). Across 59.6k posts in the benchmark union, annotation failure is the dominant failure mode: at the stereotype-based level (L2), every racial and religious group with stable match counts is labeled non-hateful at rates exceeding 60%. Collection failure, where entire dogwhistle categories are absent from the union, becomes co-dominant at higher coding levels, with twenty group x level cells showing categorical gaps that re-annotation cannot fix. These failures are unevenly distributed: race:black vs. race:middle_eastern fails the 4/5 rule on annotation DI at L2 (DI=0.661), and lgbtq:Trans/NB posts one of the highest annotator failure rates (81.2%, second only to origin:undocumented) and the lowest presence rate of any comparably-sized group at every level. We distinguish collection failure from annotation failure as mechanisms with different remediation implications, and release our mapped glossary and pipeline publicly.

Research on gender-related online content is often operationalized through harm-centered tasks that collapse non-harmful gender-related and unrelated content, while existing datasets remain concentrated in high-resource languages and Global North settings. To bridge these gaps, we introduce GENDIS, a dataset of 9,600 multilingual, human-annotated YouTube comments from India, Kenya, and Nigeria (3,200 per country), annotated using a two-level framework that first identifies whether gender is referenced and then classifies gender-related content as negative, positive, or neutral. This separation provides a denominator for gender-related discourse independent of harm, enabling both prevalence estimation and characterization of its evaluative range. In the uniform random stratum, 23.8-35.0% of comments are gender-related, and among those with a resolved stance, 82% are neutral or positive. Across models, gender-reference detection is substantially easier than stance classification, especially for positive and neutral speech. Lightly supervised classifiers match frontier zero-shot large language models at substantially lower cost and outperform generic toxicity detection, while cross-country transfer remains limited. GENDIS provides a locally grounded resource for measuring when gender is invoked online and how that reference is framed.

LLM safety evaluation remains largely English-centric and single-turn, despite real-world use in multilingual, multi-turn dialogue. We introduce MMJail, a controlled benchmark that embeds bias-eliciting prompts into controlled five-turn escalations while keeping the final prompt identical to the single-turn baseline. This design isolates the effect of conversational context across six languages: English, Vietnamese, Arabic, Thai, Bengali, and Swahili. Across Llama-3.1-8B, Qwen3.5-9B, and Gemma-3-12B, multi-turn escalation disproportionately increases attack success in lower-resource languages; for example, Qwen3.5-9B’s Bengali ASR rises from 17.6% to 66.7%. Turn-level analysis shows that escalation creates new jailbreaks and reveals distinct failure modes, including gradual drift, final-turn capitulation, and mid-conversation recovery. Along with behavioral analyses from multiple perspectives, we conduct a preliminary fine-tuning mitigation to reduce jailbreaking in several languages, suggesting that multilingual multi-turn safety can be improved through targeted supervision.

Online abuse research relies on a substantial measurement infrastructure comprising datasets, shared tasks, diagnostic suites, taxonomies, and evaluation practices that shape which harms become visible, comparable, and citable. We introduce Dataset Archaeology as a method for auditing that infrastructure and apply it to the first published decade of Abusive Language Online and Workshop on Online Abuse and Harms (ALW/WOAH) research. Our audit combines a reconciled corpus of 203 archival ALW/WOAH papers from 2017-2025 with a 60-resource registry of online-harm datasets and diagnostic benchmarks. The field has expanded beyond early hate-speech, offensive-language, and toxicity benchmarks toward diagnostic, perspectivist, multilingual, and multimodal resources. At the same time, much of the empirical record continues to be shaped by a narrower set of recurring design choices: short-form text, English, Twitter/X, coarse labels, thin context, and limited documentation of labeling authority. Across the dataset and diagnostic resources, documentation of annotation authority, annotator perspective, and disagreement remains uneven. Dataset influence also changes when mentions are separated from central use. Among 404 detected paper-dataset matches for the top reused resources, only 52 were verified as central experimental or analytical uses. We argue that progress in online-harm NLP should be evaluated as progress in measurement instruments, not only model performance, and we offer a next-decade agenda for contextual, cross-cultural, exposure-aware, and stakeholder-legitimate harm measurement.

Hate speech detection is inherently subjective because annotators routinely disagree on the same item, and collapsing their labels into a majority vote discards information about how contested the item actually is. Large language models exhibit variation by returning different labels for the same input across random seeds. We ask whether this variation empirically lines up with human disagreement. We operationalize annotator disagreement via entropy and the LLM instability via flip rate and model entropy across five seeds at fixed temperature, then measure their rank correlation on the full CREHate dataset using three models from both open- and closed-source families. The alignment with human disagreement is model dependent: Gemini 2.5 Flash and Llama 3.1 8B show significant positive correlations, while Mistral 7B shows only a marginal effect. The relationship is also modest in absolute scale: most items cluster at a flip rate of zero, and the signal is concentrated in a small fraction of high-disagreement items that also produce model instability. Qualitative analysis shows that culturally contested items, where human review is needed, sometimes produce zero model instability, as models classify them in opposite directions across cultural contexts. Our findings do not show evidence that seed-based instability is a reliable proxy for human disagreement for all LLMs.

We present the first survey study of German-language counterspeech in an Austrian context, where participants ranked LLM-generated responses to offensive comments involving xenophobia, sexual objectification, and political incivility. We compare generations from five state-of-the-art LLMs and additionally examine whether participants perceive them as human- or machine-written. Our results show substantial disagreement in rankings, indicating that counterspeech preferences are highly subjective. Although participants express a clear preference for human-written counterspeech in real-world settings, they fail to reliably identify LLM-generated responses as machine-written. These findings point to the need for personalized counterspeech systems that account for users’ diverse preferences, rather than assuming a single universally effective response. Such systems could combine LLMs’ capacity to generate high-quality counterspeech at scale with human involvement.

We present a forensic analysis of the generation pipeline behind a recent AI driven influence campaign. We introduce PROPAGIA, a corpus of 2,646 propagandist French articles from the Storm-1516/CopyCop campaign disclosed by VIGINUM and INSIKT GROUP in 2025. For comparison, we rely on SIPA, a corpus of human-written French mainstream press from the same period. Using topic modeling, vagueness and sentiment analysis, we first isolate persuasion techniques characteristic of propaganda, with PROPAGIA far exceeding SIPA in vagueness, subjectivity and negativity, and citing fewer sources. We then find prompt instruction leaks on 50 of the 84 PROPAGIA websites, including a verbatim ten-point editorial specification accounting for several of these differences, together with high cross-article redundancy. Finally, we show that rewriting-based detection supports INSIKT GROUP’s attribution to the Llama 3 family, but also suggests the involvement of Mistral-family models.

We study the problem of preserving offensive load in LLM-generated translations, focusing on how offensive words retain their load across languages. We draw on HurtNet, a novel language resource consisting of five multilingual (Arabic, French, Bulgarian, Greek, and Italian) dictionaries of hurtful terms, with multiple definitions and examples of usage. We draw on HurtNet to identify offensive senses shared by the 5 languages and the terms that denote them, and feed translations with this knowledge. We evaluate the approach through quantitative and qualitative analysis. A series of knowledge-injection zero-shot translation experiments were carried out with four different prompts that gradually increase injected linguistic knowledge, and three LLMs —an open use, a translation-dedicated, and a commercial one. Our results show that translations better preserving offensive load are produced when the prompt explicitly instructs the model about the translated offensive term and that the method is beneficial for those cases where the literal translation of the term does not preserve its offensive load.