{"id":"513d2b5e-a290-4354-8973-9b364a57016c","arxiv_id":"2510.10961","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A new Korean dataset with 6,882 paired toxic/neutral sentences and 17 rule-based obfuscation types improves LLMs' detection, deobfuscation, and sanitization of disguised toxic text.","lead":"KOTOX is a new Korean dataset of 6,882 toxic/neutral sentence pairs disguised with 17 obfuscation rules—spelling, look-alike symbols, transliteration, spacing, and emoji tricks. The paper shows that fine-tuning models on this data improves detection, deobfuscation, and sanitization of disguised Korean toxic text while keeping performance on ordinary text intact.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The central robustness claim is supported only by test data generated with the same 17-rule obfuscation framework used to build training data; no naturally obfuscated Korean corpus is evaluated, so the reported gains may reflect pattern-matching to KOTOX's own transformations rather than genuine rob","rationale":"The reader's weakest_assumption identifies exactly the concern I find most load-bearing: the absence of any naturally obfuscated Korean evaluation data. The paper's internal experiments are consistent with the narrow claim that KOTOX can train models to handle KOTOX-style obfuscation without hurting clean-text performance. Tables 4, 5, and 6 support that. However, the abstract's phrasing 'better handle obfuscated text' and the stated grounding in 'real-world examples' imply external robustness, and the only evidence for that is a synthetic test set produced by the same rules and rates as the training data. This is not an internal contradiction, so I do not think the paper should be rejected; it is a request for a direct external validation. I also note the appendix contains placeholder/unresolved entries (e.g., Table 25 is entirely zeros, Table 24 has discrepancies with Table 5 for chrF values), which the reader already flagged. Those issues are addressable and secondary. The concrete test I propose—crowdsourcing obfuscations from native speakers without exposing the rule set, or collecting naturally obfuscated online text—directly targets the gap between KOTOX's synthetic distribution and real-world obfuscation. If the test shows large degradation, the central claim should be weakened to 'models trained on KOTOX handle KOTOX-style obfuscation'; if it shows match, the claim stands. Therefore the reader's CONDITIONAL verdict remains appropriate.","tokens_in":22843,"tokens_out":3818,"duration_ms":37453,"concrete_test":"Build a held-out evaluation set of naturally obfuscated Korean toxic/neutral sentences: either (a) collect obfuscated comments from Korean online platforms (DC Inside, Naver cafes, YouTube comments) with human toxicity labels, or (b) ask native Korean speakers to obfuscate the 2,294 KOTOX source pairs without exposing the 17 rules. Then evaluate the best KOTOX-trained classifiers (e.g., toxicity-xlmr-v2 Ours FT) and SFT deobfuscation/sanitization models on this set, comparing F1, BERTScore, and chrF against the KOTOX test-set numbers in Tables 4–6. If performance drops by more than the standard deviations reported in Table 22, the rule distribution is not representative; if it matches, the external-validity concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim (Abstract; §6.1) is that models trained on KOTOX 'better handle obfuscated text without sacrificing performance on non-obfuscated text.' The non-obfuscated half of this claim is well supported internally: Table 4 shows Ours (FT) matches or exceeds w/o Obf (FT) on the No-Obf test set. The load-bearing weakness is the 'obfuscated text' half. Every obfuscated sentence in train, validation, and test is produced by Algorithm 1 using the same 17 rules and the same per-rule rewrite rates (Table 16, Fig. 3). The test split is a random 8:1:1 partition of this synthetic corpus; it is not an independent sample of real-world Korean obfuscation. Thus the evaluation measures how well models learn KOTOX's own transformation distribution, not how well they handle obfuscation as it occurs in the wild. The paper states the rules are 'derived from real-world examples' (Abstract) but provides no quantitative comparison between the induced rule/rate distribution and any naturally obfuscated Korean corpus. If real users favor different transformations—e.g., more emoji substitution, more cross-script mixing, or different phonological edits—the reported gains could collapse. This is an external-validity concern, not an internal inconsistency, but it is load-bearing because the paper's title and abstract promise detection/detoxification of real obfuscated Korean toxicity.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces KOTOX, a Korean dataset for obfuscated toxic-text research. Starting from 2,294 filtered neutral-toxic pairs in K/DA, the authors define 17 obfuscation rules organized into five linguistic categories and apply them with varying intensity (k=2,3,4) to create Easy, Normal, and Hard versions, yielding 6,882 neutral-toxic-obfuscated triples. They define three tasks: obfuscated toxic text classification, neutral text deobfuscation, and obfuscated toxic text sanitization. Experiments fine-tune three toxicity classifiers and four LLMs (three open-source, one closed-source) under zero-shot, few-shot, and SFT settings. The main finding is that models fine-tuned on KOTOX improve classification on obfuscated inputs while maintaining or improving performance on non-obfuscated inputs, and that SFT substantially improves deobfuscation and sanitization quality.","tokens_in":23265,"tokens_out":6202,"duration_ms":56311,"significance":"If the robustness claim holds, KOTOX would be the first Korean dataset jointly supporting obfuscation-robust toxicity detection, deobfuscation, and sanitization, and the authors release code and data. The linguistic taxonomy of Hangeul-specific obfuscation and the paired difficulty-level design are useful resources. The experimental protocol is also careful in several respects: three seeds are used, LoRA SFT is applied to generation models, and cross-evaluation between obfuscated and non-obfuscated sets is reported. However, the central claim—that trained models 'better handle obfuscated text'—is currently validated only on obfuscations generated by the same rule pipeline used for training. Without evaluation on naturally obfuscated Korean text or an independently generated obfuscation distribution, the external validity of the robustness conclusion is not established. A further internal-validity concern about possible train/test leakage across difficulty levels needs to be resolved before the non-obfuscated performance claim can be taken at face value.","major_comments":[{"comment":"The evaluation of obfuscation robustness is entirely on data produced by the same 17-rule sampler (Algorithm 1) with the same per-rule rewrite rates (Table 16) used to create the training data. No naturally obfuscated Korean corpus or independently generated obfuscations are used in Tables 4–6. The abstract's claim that models 'better handle obfuscated text' is therefore only demonstrated for the authors' own transformation distribution. Please add an out-of-distribution evaluation (e.g., human-written obfuscations, a different rule sampler, or naturally obfuscated social-media text) or qualify the claim accordingly.","section":"§4.2–§4.3, Algorithm 1, Table 16"},{"comment":"Each source pair is obfuscated three times (k=2,3,4), producing Easy/Normal/Hard variants. The 8:1:1 split is described only at the level of the 6,882 obfuscated samples; it is not stated that the same source pair is kept in the same split across difficulty levels or that the original (No-Obf) pairs of the test source pairs are excluded from training. If source-pair identity is not controlled, the cross-evaluation in Table 7 and the non-obfuscated performance claim in Table 4 are inflated by train/test leakage. Please clarify the split procedure and, if needed, re-run with a source-pair-level split.","section":"§4.2–§4.3, Table 7"},{"comment":"The appendix tables intended to provide full results contain 00.0 values that contradict the main-text Tables 5–6 (e.g., GPT-4.1 zero/five-shot rows and all sanitization rows). This makes the experimental results non-reproducible from the appendix. Please replace the placeholder values with actual numbers or remove the appendix tables and clearly state the discrepancy.","section":"Appendix E.1.1, Tables 24–25"}],"minor_comments":[{"comment":"The dataset size is reported as 'about 6.9K neutral-toxic pairs' in the introduction and 'approximately 15,000 samples' in the conclusion. These numbers are inconsistent; clarify what is being counted (pairs, sentences, or difficulty-level variants).","section":"Abstract/Conclusion"},{"comment":"The heading 'Obfuscated Toxic Text Obfuscation' should read 'Deobfuscation'; Section 6.3 refers to 'Fig. 6' where the results are in Table 6. Several cross-references (e.g., 'Figure7' in §7.1) should be corrected.","section":"§6.2–6.3"},{"comment":"The data-construction description mentions 'GPT-5 nano' but provides no public model identifier or version. Since this model is used to generate rules 13–14, please specify the exact model and access date, or state that the name is a typo and identify the actual model used.","section":"§B.3"},{"comment":"The model name is inconsistently spelled 'Bllosom' and 'Bllossom'; Table 24 also contains a duplicate '21.14' entry in the Bllossom five-shot row. These typos should be fixed.","section":"Tables 5, 6, 24"},{"comment":"There are several typos: 'real-word examples' in the abstract, 'syntatic' in §3.2, 'Rochy Linux' and 'unsing' in §D.4, and 'KoG2Padvaned' in §C.2. A careful proofread is needed.","section":"Throughout"}],"recommendation":"major_revision","confidential_remarks":"The strongest concern is external validity: the claimed robustness to obfuscation is measured on the authors' own transformation distribution. The fix is straightforward to state (add an OOD or human-obfuscation evaluation), but without it the paper's central contribution is not fully supported. The potential source-pair leakage is more serious internally and should be resolved before acceptance; if the current split already controls for it, the paper should say so explicitly."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"You should know two things about this one. First, KOTOX is genuinely new: it is the first Korean dataset pairing neutral and toxic sentences with obfuscated counterparts, and the 5-class/17-rule taxonomy is linguistically informed, with Hangeul-specific rules (rotation, sub-syllabic substitution, syllable anagrams) that go beyond the usual leetspeak/emoji tricks. The three tasks — classification, deobfuscation, sanitization — are well-defined, and the dataset construction is careful: filtering K/DA with a rubric, reporting inter-annotator agreement, and releasing the transformation package. The experiments are competently run: three seeds, LoRA fine-tuning, cross-evaluation across difficulty levels, and the internal story is consistent. Training on KOTOX clearly improves performance on KOTOX-generated obfuscated test data without hurting clean performance. That is a real, reproducible contribution and the community will want it. Credit where due: this is not a toy resource.\n\nThe soft spot is exactly the one the stress test flags. The train, validation, and test splits are all random partitions of the same corpus generated by Algorithm 1 with the same 17-rule sampler and the same per-rule rewrite rates. So the reported robustness numbers measure how well models learn KOTOX's own transformation distribution, not how they handle obfuscation as it actually occurs online. The abstract says the rules are \"derived from real-world examples,\" but there is no quantitative comparison against any naturally obfuscated Korean corpus. If real users favor different transformations, the gains could shrink or vanish. That is a load-bearing gap, not a nitpick — the title promises detection and detoxification of real obfuscated Korean toxicity.\n\nTwo smaller issues. The appendix has some numerical oddities: Table 24 lists Bllossom's five-shot chrF as 21.14 in both columns, and the GPT-4.1 rows in Tables 24–25 are all zeros, which looks like an artifact or missing evaluation rather than a result. More substantively, the sanitization experiments show Perspective toxicity scores increasing after fine-tuning (Table 6, from ~10 to ~33). The authors call this \"interesting,\" but it actually suggests their fine-tuned models are producing more toxic-looking outputs, which cuts against the detoxification claim. They should address that directly.\n\nWho is this for? Researchers working on Korean NLP safety, robustness, and detoxification. They will find the dataset and the taxonomy useful even if the robustness numbers need an asterisk. It deserves a serious referee. My recommendation: send it to peer review, but the reviewers should insist on either an external naturally-obfuscated test set or an explicit reframing of the claim as \"robustness to the KOTOX transformation family.\" With that fixed, this becomes a solid resource paper.","headline":"A solid, first-of-its-kind dataset for Korean obfuscated toxicity whose headline robustness claim is only demonstrated on its own synthetic transformations; worth peer review with a demand for external validation.","tokens_in":23736,"tokens_out":1452,"would_cite":true,"duration_ms":17157,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Korean toxicity can hide in plain sight through Hangeul's structure; a new dataset teaches models to see through the disguise.","keywords":["Korean toxicity","obfuscation","deobfuscation","detoxification","Hangeul","dataset","robustness","transformation rules"],"falsifier":"Collect a corpus of naturally obfuscated Korean toxic comments from online communities (with user consent and anonymization) and run the best KOTOX-trained classifier on it. If the accuracy drop is comparable to the drop seen on clean text, the simulated rules do not capture real-world obfuscation; a large gap would confirm the dataset's validity.","tokens_in":22781,"feed_emoji":"🛡️","tokens_out":1123,"duration_ms":12043,"temperature":0.7,"pith_summary":"This paper introduces KOTOX, the first Korean dataset that pairs neutral and toxic sentences with their obfuscated counterparts, covering 17 transformation rules across five linguistically grounded categories. The central claim is that models trained on this dataset handle obfuscated toxic text better without losing accuracy on normal text, shrinking the robustness gap by as much as 34.67 percentage points. The authors argue that Korean's agglutinative morphology and Hangeul's syllable-block composition make it uniquely rich for studying obfuscation, and that current LLMs remain highly vulnerable to such disguised abuse. If the claim holds, KOTOX becomes a practical resource for building Korean toxicity detectors and sanitizers that resist real-world evasion.","feed_headline":"New dataset teaches models to spot disguised Korean abuse","feed_subtitle":"17 Hangeul-based obfuscation rules train detectors that keep accuracy on clean text while cutting the robustness gap by up to 34 points.","key_machinery":"The central object is KOTOX, a dataset of 6,882 neutral-toxic pairs where both sides are obfuscated by an algorithmic pipeline (Algorithm 1) that samples rules, applies per-rule rewrite rates, and checks sanity to avoid trivial or overlapping edits. Each pair is generated at three difficulty levels (easy, normal, hard) by applying 2, 3, or 4 rules. The dataset is built on a filtered subset of K/DA (2,294 high-quality pairs after annotator filtering with Gwet's AC1 = 0.74), and the rules are derived from real-world obfuscation examples, grounded in Korean phonology and Hangeul's decomposable syllable blocks.","core_discovery":"The paper claims that a paired dataset of obfuscated Korean neutral and toxic sentences, built from 17 transformation rules in five classes (phonological, iconological, transliteration-based, syntactic, pragmatic), enables models to detect and detoxify obfuscated toxic text without sacrificing performance on clean text. The authors demonstrate this with three toxicity classifiers and four LLMs, showing that fine-tuning on KOTOX reduces the gap between obfuscated and non-obfuscated F1 scores from as high as 41.40 points to below 8 points, and that SFT models produce sanitized outputs with clearly improved chrF scores (roughly tripling zero-shot results). They also report that spacing perturba","pith_inferences":["Because the evaluations are based on self-generated obfuscations, the real-world benefit depends on whether these 17 rules match how Korean users actually disguise toxic text online; a natural-obfuscation corpus would be the decisive test.","The same taxonomy could be ported to other agglutinative or syllable-block scripts (e.g., Japanese kana, Thai) with analogous phonological and visual manipulations, though the specific rule dictionaries would need re-derivation.","The observed rise in Perspective API toxicity scores after fine-tuning suggests that current sanitization models may be learning to 'restore' toxicity while failing to remove it; a more reliable toxicity metric than a single API is worth exploring.","An LLM-assisted obfuscation step for transliteration rules hints that the framework could be extended to fully model-driven obfuscation, potentially generating harder and more diverse evasions."],"forward_implications":["Fine-tuned classifiers can close most of the accuracy gap between clean and obfuscated Korean toxic text, making robustness a trainable property rather than a fixed model trait.","Models trained on obfuscated data also generalize to non-obfuscated toxic text, suggesting obfuscation-aware training does not come at the cost of standard performance.","The three tasks (classification, deobfuscation, sanitization) give a unified benchmark for future Korean safety work, allowing direct comparison of robustness across models.","The rule-based difficulty levels (easy/normal/hard) enable controlled assessment of how much obfuscation a model can handle.","The error analysis pinpoints specific weak rules (e.g., spacing perturbation, emoji insertion) that should be prioritized in future adversarial defenses."],"fun_headline_variants":["17 rules help models unravel disguised Korean toxicity","KOTOX dataset outsmarts disguised Korean toxic speech","Fine-tuning on KOTOX cuts obfuscated toxicity gap by 34 points","First dataset to deobfuscate and detoxify Korean toxic text","KOTOX rules shrink the disguised toxicity gap to under 8 points"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The 17 rules and their application rates faithfully simulate real-world Korean obfuscation, so that performance on KOTOX's self-generated test set is evidence of robustness to genuine evasions.","fun_headline_variants_meta":{"raw":{"variants":["17 rules help models unravel disguised Korean toxicity","KOTOX dataset outsmarts disguised Korean toxic speech","Fine-tuning on KOTOX cuts obfuscated toxicity gap by 34 points","First dataset to deobfuscate and detoxify Korean toxic text","KOTOX rules shrink the disguised toxicity gap to under 8 points"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001365,"raw_usage":{"total_tokens":5382,"prompt_tokens":761,"completion_tokens":4621,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":505,"completion_tokens_details":{"reasoning_tokens":4531}},"tokens_in":505,"tokens_out":4621,"duration_ms":29105,"temperature":1.0,"reasoning_tokens":4531,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-04T10:12:18.883716+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Collect a corpus of naturally obfuscated Korean toxic comments from online communities (with user consent and anonymization) and run the best KOTOX-trained classifier on it. If the accuracy drop is comparable to the drop seen on clean text, the simulated rules do not capture real-world obfuscation; a large gap would confirm the dataset's validity.","supporting_citations":[],"review_version":1}