{"id":"a8346596-3003-4e8a-9724-97054fca8feb","arxiv_id":"2607.19061","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"Adaptive multi-view template retrieval lifts hidden-hate detection on HatefulIllusion to 93.2% balanced accuracy, far above original-view filters and moderators.","lead":"Adaptive View Retrieval finds hidden hateful words and symbols in optical illusion images by transforming each image seven ways, matching the transforms against a library of known hate templates, and then judging whether the recovered message is harmful; it reaches 93.2% balanced accuracy where standard moderators stay near chance. It matters because today's content-moderation systems miss nearly all hidden hateful illusions, and this approach offers an interpretable, retriev","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Headline 93.2% is a closed-set result: every test message has a template in M. The paper admits performance drops on unseen symbol families but never reports the number, leaving real-world generalization unquantified.","rationale":"I read the paper in good faith and identify the same weakest assumption as the Reader: the central 93.2% balanced accuracy result depends on a template bank that contains every test-time message identity. This is not a hidden flaw — the method is explicitly designed as retrieval from a known library, and the Limitations passage acknowledges the drop on unseen symbol families — but the acknowledgment is qualitative. Without the target-holdout number, the practical scope of the claim is unquantified, and the title's promise ('Now You See the Hate') overreaches in a way that matters for deployment. The internal evidence for the closed-set result is otherwise strong: message-level splits, three seeds, ablations showing the view bank and adaptive gating contribute, and a hyperparameter sweep that shows robustness. The HC-Bench any-of-seven evaluation is a separate methodological issue, but it is not central to the HatefulIllusion headline and the Reader already conditioned on rescoring it. Therefore I do not think the verdict should change: the paper remains a conditional accept pending the unseen-template holdout number, code release with a hash, and the HC-Bench rescore. My concrete test directly measures the magnitude of the closed-set limitation and would settle whether the concern is merely a caveat or a fundamental bound on the method's utility.","tokens_in":12882,"tokens_out":8155,"duration_ms":93125,"concrete_test":"Run a strict target-family holdout on HatefulIllusion. Partition the message identities into seen and unseen sets, e.g., hold out all examples of one hate-symbol family and 20% of slang identities. At test time, remove the unseen templates from M, present their query images to the model, and measure (a) the accuracy of the retrieved identity and (b) balanced accuracy on those images, alongside the same metrics for the closed-set condition. If the unseen-target balanced accuracy remains above 85%, the closed-set caveat is minor; if it drops substantially (e.g., toward the 60% range of filter-only baselines), the 93.2% headline should be reported strictly as a known-template retrieval result, and the paper's contribution should be reframed as improving retrieval from a curated library rather than discovering novel hidden hate.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim — that Adaptive View Retrieval reaches 93.2% balanced accuracy on HatefulIllusion — is explicitly closed-set retrieval: the template bank M contains a reference rendering for every hidden-message identity that appears at test time (the message-level split reserves whole messages for test, but their templates remain in M). The method's decision rule is argmax over M, so it cannot recognize a message absent from the bank; it will return the closest known template and may mislabel the image. This is not merely an implementation detail: the paper's own Limitations section states 'not open-vocabulary discovery of unseen hate strings' and 'performance also drops under stricter target holdout on unseen symbol families,' but the magnitude of that drop is never reported. Since the practical motivation is moderating real-world hateful illusions, where new slangs and symbols emerge over time, the headline number is an upper bound for a fixed template library. Without a target-holdout experiment, we cannot distinguish between a method that degrades gracefully (nearest-neighbor errors on novel symbols) and one that collapses to chance on unseen families. This is the load-bearing uncertainty for the paper's central contribution. (Secondary: the HC-Bench result in Experiment 3 is scored as 'any of seven views yields a correct answer,' which is a best-of-seven oracle rather than a single adaptive decision; this inflates the reported 98.2% and makes the comparison to zoom-out unequal, but it does not affect the main HatefulIllusion claim.)","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Adaptive View Retrieval, a retrieve-and-calibrate framework for detecting hidden hateful messages in optical illusions. The method builds a seven-view perceptual bank (original, contrast, closure-edge, three figure-ground, low-pass), applies the same transforms to query images and to templates in a known-message library, embeds all views with a frozen CLIP encoder, uses an adaptive gate to weight views, retrieves the best-matching template, and calibrates a harmful/benign decision. On HatefulIllusion the authors report 93.2% balanced accuracy under a message-level held-out split, with ablations showing the view bank, adaptive gating, and joint retrieval/calibration training all contribute. The same view bank is transferred to IllusoryVQA (fine-tuned CLIP) and to HC-Bench (VLM multi-view questioning), where it outperforms single-view baselines. The paper includes component ablations, hyperparameter sensitivity, error analysis, and a public code release.","tokens_in":13270,"tokens_out":4503,"duration_ms":47417,"significance":"If the closed-set results are taken at face value, the paper demonstrates a substantial improvement over original-view classifiers and fixed-filter baselines on the HatefulIllusion benchmark, and the adaptive gate's dependence on target type and visibility is an interesting and interpretable finding. The component ablations (original view only 79.5%, uniform gate 89.1%, full model 93.2%) and the three-seed protocol support the central claim within the benchmark. The release of code and the explicit error analysis are also strengths. However, the practical significance is limited by the closed-set retrieval setting: the template bank contains a reference for every test message identity, and the paper acknowledges but does not quantify the drop under target holdout on unseen symbol families. The HC-Bench result is also scored as a best-of-seven oracle, which overstates the adaptive nature of the method. These concerns are addressable but are load-bearing for the generalization claims.","major_comments":[{"comment":"The method's decision rule is argmax over template bank M (Eq. 1), and the authors state that performance 'also drops under stricter target holdout on unseen symbol families' but never report the magnitude of that drop. Because the headline 93.2% is a closed-set retrieval result—every test message has a template in M—the practical benefit for real-world moderation, where new slangs and symbols emerge, is unquantified. I request a target-holdout experiment: train templates exclude an entire symbol family (or several), and report balanced accuracy on those unseen families. This is needed to distinguish graceful degradation from collapse and directly addresses the paper's stated limitation.","section":"Discussion, Implications and Limitations; Eq. (1)"},{"comment":"The HC-Bench result is scored as 'counted correct if any transformed view yields a valid answer under the official rules.' This is a best-of-seven oracle, not an adaptive decision, and the comparison to original image or zoom-out (single views) is therefore not apples-to-apples. The reported 98.2% is an upper bound. Please also report per-view accuracies, and ideally an adaptive view-selection accuracy using the gate or a similar mechanism. Otherwise the claim that 'Adaptive View Retrieval' outperforms zoom-out on HC-Bench is overstated.","section":"Experiment 3, Table 2"},{"comment":"The hyperparameter sweep in Supplementary Table 2 reports balanced accuracy on the test split. If the default hyperparameters were selected using test-split accuracy, the 93.2% is not a clean held-out estimate. Please clarify whether the sweep was conducted on the validation split or the test split. If the test split was used, rerun the sweep on the validation split (or report validation accuracy) and confirm the default remains the same.","section":"Training and inference; Supplementary Table 2"}],"minor_comments":[{"comment":"The temperature τ in Eq. (1) is not defined. Is it a learned scalar initialized to some value? Please specify; this matters for the scale of the retrieval scores.","section":"Method, Eq. (1)"},{"comment":"The IllusoryVQA results are reported as single point estimates without variance across seeds. Since Experiment 1 uses three seeds, please add mean±std for Table 1 as well, particularly because the method uses full fine-tuning there.","section":"Experiment 2, Table 1"},{"comment":"The main text references 'Supplementary Table 1' and 'Supplementary Figure 3,' but the supplementary file labels the relevant items as Table 3 and Figure 10. Please renumber consistently.","section":"Supplementary Material"},{"comment":"The HC-Bench experiment uses a fixed VLM and multi-view questioning, but does not use the gate or calibration head from Experiments 1–2. Please clarify in the text that this is a view-bank ablation under the SemVink protocol, not the full Adaptive View Retrieval architecture.","section":"Experiment 3"}],"recommendation":"major_revision","confidential_remarks":"The closed-set limitation is the key risk. The authors explicitly admit a drop under target holdout but never report the number, which is unusual and should be fixed. The HC-Bench best-of-seven oracle is also a significant overstatement. I would recommend the editor ask for a target-holdout experiment and a corrected HC-Bench analysis before publication. The core idea is sound and the HatefulIllusion experiments are well-structured."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the headline number is real for what it measures, but it measures a closed-set retrieval task. Every test message has a template in M, so 93.2% tells you the method can retrieve known messages if you point it at the right candidates. The authors admit in their Limitations section that performance drops on unseen symbol families and that this is 'not open-vocabulary discovery of unseen hate strings'—but they never report the magnitude. That's the number that matters for the stated motivation, and it's missing.\n\nWhat's genuinely new: the combination of adaptive gating over a deterministic perceptual view bank with CLIP template retrieval and a separate calibration head. Prior work on these benchmarks used fixed filters or zoom-out; nobody has shown learned view selection working this well on HatefulIllusion. The main experiment is solid: message-level split, three seeds, ablations, error analysis, and a hyperparameter sweep all back the 93.2% closed-set claim. Original-view retrieval sits at 79.5%, filter baselines near chance, so the adaptive mechanism is doing real work. I also credit the authors for showing the gate's learned preferences by target type and visibility—that's the kind of analysis that makes the result believable.\n\nThe soft spots are proportionate. First and most important: the missing target-holdout number. The paper's own Limitations section flags it, and the stress-test note is right that without it we can't tell graceful degradation from collapse on unseen symbols. The authors should report balanced accuracy when entire symbol families are held out both from training and from the template bank. Second, the HC-Bench result in Table 2 is scored as correct if any of seven views answers, which is a best-of-seven oracle. That inflates the 98.2% and makes the comparison to zoom-out unequal. It's a secondary benchmark, so not fatal, but they should re-score with the adaptive decision. Third minor: hyperparameters and the view bank are tuned on the same benchmark; the one-at-a-time sweep is a start, but it doesn't fix the closed-set issue. The code release promise also needs a hash to be checkable.\n\nNet: this is a useful, well-executed closed-set method with an unquantified generalization gap. It deserves a serious referee, but the referee's first request should be the unseen-template holdout. If that number is high, this is an important safety result. If it's near chance, the paper is still a reasonable demonstration of adaptive multi-view retrieval, just not a solution to the open-set problem it motivates.","headline":"Closed-set result is solid and well-analyzed, but the paper never quantifies the admitted drop on unseen symbol families, which is the number that matters.","tokens_in":13728,"tokens_out":2690,"would_cite":true,"duration_ms":28557,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Hate hidden inside optical illusions can be reliably detected by adaptively retrieving the concealed message from a bank of known templates, rather than by classifying the original view.","keywords":["hateful illusions","multimodal moderation","visual retrieval","adaptive view selection","template bank","CLIP","hidden content","optical illusions"],"falsifier":"Held-out discovery test: take the HatefulIllusion test set, remove all templates belonging to one hate-symbol family (e.g., all variants of one symbol) from the bank, and measure balanced accuracy on those images. If accuracy collapses or those images get mislabeled as a different known template, the closed-set dependence is confirmed; if the system flags them as uncertain or unknown, the retrieval can in principle support open-set moderation. A second observation: report the exact 'stricter target holdout' number the authors acknowledge but do not provide.","tokens_in":12807,"feed_emoji":"🕵️","tokens_out":6692,"duration_ms":69372,"temperature":0.7,"pith_summary":"This paper tries to establish that hidden hateful content in optical illusions is primarily an observation problem, not a classification problem: moderation systems fail because they never see the concealed message. Its proposed solution, Adaptive View Retrieval, applies the same set of seven perceptual transforms (contrast, edge closure, figure-ground separation, low-pass smoothing, plus the original) to both the query image and a bank of known message templates, lets a learned gate choose which view each image should be matched in, retrieves the best-matching template, and then calibrates a separate harmful/benign decision. On the HatefulIllusion benchmark with a frozen CLIP encoder, this reaches 93.2% balanced accuracy on the held-out test split, against roughly chance-level performance for original-view classifiers and VLMs. A sympathetic reader would care because the same adaptive view bank also transfers to hidden-digit, hidden-object, and hidden-text recognition on other benchmarks, suggesting a general recipe for recovering hidden meaning before moderation.","feed_headline":"Adaptive view retrieval catches hidden hate at 93.2%","feed_subtitle":"Classic perceptual transforms across image and templates recover slurs and symbols that beat current moderators.","key_machinery":"The load-bearing mechanism is Adaptive View Retrieval, a retrieve-and-calibrate architecture. Its core object is a complementary view bank: seven deterministic image operators (original, contrast-enhanced, closure-edge, three figure-ground variants, and low-pass) applied identically to the query and every template, so retrieval compares matched views in a shared embedding space. A frozen CLIP encoder produces view embeddings, branch MLPs project them, and a learned gate reallocates trust from view to view depending on target type and visibility. Template scoring is a temperature-scaled, gated sum of cosine similarities, and a separate calibration MLP reads the gated fusion to produce the har","core_discovery":"The paper's central claim is that hidden hateful illusions can be detected by reframing detection as perceptual retrieval. Instead of a K-way label head on the original image, the authors maintain a hidden-message template bank and retrieve the message identity through matched-view comparisons: the same set of seven classical perceptual views is generated for the input and for every template, a learned gate weights the views per image, and a frozen CLIP encoder embeds each view so retrieval can compare aligned evidence. The retrieved identity then feeds a calibration head that decides whether the evidence is harmful. The paper reports 93.2% balanced accuracy (mean ±3.1 over three seeds) on t","pith_inferences":["Editorial inference: Because retrieval is argmax over a fixed bank, the method's practical ceiling is template coverage; a natural extension is a rejection or 'unknown message' option based on retrieval confidence or a threshold on the top similarity score, which the paper does not implement.","Editorial inference: The gate's visibility-dependent reallocation (more low-pass weight when signals are faint) suggests visibility labels could be used as weak supervision or as a conditioning variable, potentially improving low-visibility recall further.","Editorial inference: The same matched-view bank could be tested on adversarial evasions—images crafted specifically to steer the gate toward a misleading view—since the failure analysis already shows deterministic figure-ground segmentation can break on textured carriers.","Editorial inference: The HC-Bench result with a small 2B VLM raises a testable hypothesis: multiplicative gains may come from giving VLMs multiple observation strategies rather than trading resolution for zoom; a direct comparison on a much larger VLM would clarify whether the view bank is a substitute for scale or only a fallback when scale is unavailable."],"forward_implications":["Platforms that maintain template libraries of known slurs and symbols could add new threats without retraining the detector, and could audit a decision by inspecting which view and which template drove it.","No single classical transform is a sufficient safety filter; only a complementary bank with learned gating keeps performance stable on hard low-visibility and benign look-alike cases.","Retrieval-only training collapses moderation to 47.8%, so any practical deployment needs joint identity-retrieval and harm-calibration training.","The same view bank transfers to non-hate hidden content (digits, fashion, animals, text), so the mechanism is a general perceptual-recovery module rather than a hate-specific classifier.","On HC-Bench, multi-view questioning recovers hidden text and objects where resolution-losing zoom-out fails (98.2% vs 2.7%), suggesting adaptive multi-view input can replace or supplement downsampling in VLM pipelines."],"fun_headline_variants":["Retrieval beats moderation: 93.2% on hidden hate illusions","Hidden hate? Adaptive view retrieval finds it at 93%","Perceptual retrieval cracks hateful illusions at 93%","Moderators miss hidden hate; retrieval catches 93.2%"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The load-bearing premise is that every hidden message at test time has a reference template in the bank: retrieval picks the best-scoring known template, so an unseen hate string or an unseen symbol family is at best labeled as its closest known neighbor, and the paper explicitly notes performance drops under stricter target holdout on unseen symbol families.","fun_headline_variants_meta":{"raw":{"variants":["Retrieval beats moderation: 93.2% on hidden hate illusions","Hidden hate? Adaptive view retrieval finds it at 93%","Perceptual retrieval cracks hateful illusions at 93%","Moderators miss hidden hate; retrieval catches 93.2%"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000677,"raw_usage":{"total_tokens":2924,"prompt_tokens":764,"completion_tokens":2160,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":508,"completion_tokens_details":{"reasoning_tokens":2085}},"tokens_in":508,"tokens_out":2160,"duration_ms":17063,"temperature":1.0,"reasoning_tokens":2085,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-01T13:33:07.115234+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Held-out discovery test: take the HatefulIllusion test set, remove all templates belonging to one hate-symbol family (e.g., all variants of one symbol) from the bank, and measure balanced accuracy on those images. If accuracy collapses or those images get mislabeled as a different known template, the closed-set dependence is confirmed; if the system flags them as uncertain or unknown, the retrieval can in principle support open-set moderation. A second observation: report the exact 'stricter target holdout' number the authors acknowledge but do not provide.","supporting_citations":[],"review_version":1}