{"id":"1a6fcb8c-d3eb-4a9a-9cd0-10c5e7772fe7","arxiv_id":"2607.26200","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"Under end-to-end usefulness and harmful-exposure metrics, response-only filtering beats input and input+response filtering in two chat settings, and selective rewriting recovers most blocked traffic without an observed exposure increase.","lead":"This paper compares four chatbot content-moderation setups—checking the user's input, the model's reply, or both—and finds that checking only the reply gives the most useful safe answers, while rewriting flagged replies recovers most blocked traffic. It offers an end-to-end way to choose moderation placement using usefulness and harmful-exposure limits instead of classifier accuracy alone.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Public corroboration relies on LLM harm/relevance graders that were validated only on prompts, not on long generated responses or optimized rewrites; if the grader misses harmful rewrites, the public 'same Harmful Exposure count' and placement ordering are unsupported.","rationale":"Good-faith reading: the paper is a careful empirical study with explicit scope limitations. I checked the internal arithmetic (Tables 2, 3, 6, 19), the decision logic (Appendix A), the statistical statements (paired bootstrap, McNemar), and the 'same exposure count' reasoning. The internal human-labelled comparison fully supports the directional claims: Response only highest filter-only Usefulness, Input+response lowest Harmful Exposure at the measured operating points, and Response+rewrite recovering 117/120 blocked turns with all shown rewrites human-labelled safe and relevant, leaving the same 30 exposed turns. The 'not an equivalence test' caveat is stated repeatedly and is not a hidden weakness.\n\nThe single load-bearing concern is the unvalidated transfer of the public LLM grader from ToxicChat prompts to GPT-5 responses and optimized rewrites. This matters because the internal labels are not released, making the public replay the only independently inspectable evidence. The paper itself flags this in Section 4 and Appendix C, and the reader correctly identifies it as the weakest assumption. I did not find an additional internal inconsistency or a more central flaw. The concern does not change the verdict: CONDITIONAL remains appropriate, since the internal evidence is human-labelled and credible, and the public flaw is disclosed and addressable. If the proposed human-label validation passes, confidence would rise; if it fails, the public corroboration would need to be revised.","tokens_in":24011,"tokens_out":12298,"duration_ms":121349,"concrete_test":"Sample ~300 public GPT-5 responses (oversampling T5-flagged rows) and all 202 public shown rewrites; have two trained annotators apply the same toxicity severity rubric used for ToxicChat prompts, with adjudication. Compute LLM-grader versus human agreement separately for original responses and rewrites (binary toxic F1 and false-negative rate). Then recompute public Usefulness and Harmful Exposure for Response only and Response+rewrite using human labels on the sample (or full relabeling if feasible). The concern lands if (a) the grader's false-negative rate on rewrites significantly exceeds its prompt-validation rate, or (b) relabeled Harmful Exposure for Response+rewrite rises above Response only's 35-count, or (c) the Usefulness ordering among placements changes.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing risk is that the public corroboration — the only independently inspectable evidence once the internal human labels are unavailable — computes all Harmful Exposure and Usefulness figures from LLM graders whose rubric (toxicity_v10) was validated only on ToxicChat prompts and is applied, by the authors' own statement, 'as an approximation' to GPT-5-generated responses and to optimized rewrites without human validation (Section 4, Automatic graders; Appendix C). The text-domain shift is large: public prompts average 199 chars, GPT-5 responses average 2,901 chars, and rewrites are substantially shorter and deliberately generalize triggering language. If this grader under-detects harm in long responses or in rewrites, the public half of the central claim is unsupported: the 'same observed Harmful Exposure count' (35 turns) between Response only and Response+rewrite could be an artifact of grading all 202 shown rewrites safe, and the placement ordering could shift. The paper flags the transfer explicitly and labels the public result 'corroboration,' so this is not a hidden flaw, but it is load-bearing because the internal human-labelled set is not released and the public replay is the only part an outsider can independently recompute. The internal human-labelled comparison (N=1,250) supports the same directional findings, so the concern narrows scope rather than falsifying the paper.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes an end-to-end evaluation framework for content-moderation deployment, replacing component-level classifier accuracy with two customer-outcome metrics: Usefulness (shown, non-harmful, relevant responses / N) and Harmful Exposure (shown harmful responses / N). Four configurations are compared on a human-labelled internal benchmark (N=1,250) and a public ToxicChat setting (N=5,654): Input only, Response only, Input+response hard blocking, and Response+rewrite. The main findings are that Response only achieves the highest filter-only Usefulness in both settings, Input+response achieves the lowest Harmful Exposure, and replacing Response-only blocking with Response+rewrite recovers most blocked traffic with the same observed Harmful Exposure count for the selected configuration (explicitly not an equivalence result). Probe routing reduces conditional rewrite-stage latency substantially relative to LLM routing. A focused qualitative audit shows both successful safe redirections and cases where sensitive-domain rewrites omit support information.","tokens_in":24223,"tokens_out":7305,"duration_ms":80772,"significance":"If the results hold, the paper makes a useful contribution by shifting moderation evaluation from isolated classifier metrics to deployment-relevant final outcomes. Its strengths include a fully human-labelled internal comparison for the headline placement and rewrite findings, paired bootstrap confidence intervals and exact McNemar tests for differences, explicit non-equivalence caveats, a test-split-only sensitivity analysis for the public filter, and release of code and public artifacts. The framework is practical and the main internal finding—that Response only dominates Input-only and Input+response on Usefulness at the chosen operating points—is credible. The public corroboration is more fragile because its response and rewrite grades come from LLM judges whose rubric was validated only on prompts, not on long generated responses or optimized rewrites. The internal evidence is not affected by this concern, so the central claim is defensible, but the 'both settings' formulation of the abstract is stronger than the public evidence currently supports.","major_comments":[{"comment":"The public ToxicChat results, including the Harmful Exposure counts and the zero-discordance equality between Response only and Response+rewrite, are computed with the toxicity_v10 LLM grader applied to GPT-5 responses (mean 2,901 characters) and to optimized rewrites. The paper states this rubric was validated only on ToxicChat prompts (mean 199 characters) and that the transfer to responses is an approximation. If the grader under-detects harm in long responses or in deliberately generalized rewrites, the public placement ordering and the 'same observed Harmful Exposure count' claim could shift. The internal human-labelled comparison is not affected, which protects the central finding, but the abstract's 'in both settings' and the public rewrite-safety equality currently rest on unvalidated transfer. Please either add a human-validated sample of public responses/rewrites and report gra","section":"Section 4, 'Automatic graders'; Table 3; Table 13; Appendix C"},{"comment":"The public E2E FP Rate—defined as safe-prompt turns that end in a hard block—uses the LLM-graded toxicity label for the prompt, not ToxicChat's human prompt labels, with a stabilized majority only for the doubly blocked subset. Since the LLM grader has F1 0.856 against human labels on prompts, roughly 14% of prompt-toxicity decisions differ from the human reference. These errors propagate directly into the FP counts used to support the claim that Response only has the lowest E2E FP Rate (1.43% vs. 1.95% for Input only in Table 3). Because E2E FP Rate is a diagnostic rather than a main outcome, this is not fatal, but the paper should either use the available human prompt labels for this metric or provide a sensitivity analysis showing the placement conclusion is unchanged when human labels are used.","section":"Section 4, 'Public corroboration' and 'Automatic graders'; Table 3; Appendix C, 'Prompt-label stabilization'"}],"minor_comments":[{"comment":"The abstract says 'yields the same observed Harmful Exposure count as Response only blocking for the selected configuration.' Since the internal count (30 turns) and public count (35 turns) are computed from different label sources, it would be clearer to state which setting is being referenced or to mention both explicitly.","section":"Abstract"},{"comment":"The footnote symbol on 'Response + rewrite†' is not defined in the caption. Please add a footnote defining the selected public configuration.","section":"Table 3"},{"comment":"The text refers to 'the authors' released fine-tuned T5' but does not give the model identifier or a HuggingFace revision in the body. Appendix O gives some details, but the model card should be cited or linked here for reproducibility.","section":"Section 4, 'Public corroboration'"},{"comment":"The phrasing 'Wildflare GuardRail ... already contributes' and 'Constitutional Classifiers ... already contributes' is repetitive. Consider rewording to avoid implying a comparison ranking.","section":"Section 2"},{"comment":"The configuration labels are placed close together, especially for Input only and Input+response. Direct labeling or a small legend would improve readability.","section":"Figure 2"},{"comment":"The column heading 'Route / classify' is not fully spaced and the note about LLM-intent template rows retaining an unused LLM-domain call is important; consider moving it to the table caption for visibility.","section":"Appendix G, Table 8"}],"recommendation":"major_revision","confidential_remarks":"The internal fully human-labelled comparison is the strongest part of the paper and likely supports the central directional claims. The main risk is that the public replay, which is the only independently inspectable evidence, relies on grader transfer that the authors themselves flag as unvalidated. I would not reject: the issue is addressable by adding a modest human-validation sample on public responses/rewrites or by softening the 'both settings' claim. The paper's scope is appropriate for a top NLP/ML venue; the release of code and artifacts is a plus."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe thing to know: this paper makes moderation placement and action the experimental variables, and it does so more carefully than most. On a fully human-labelled internal benchmark, response-only filtering beats input-side filtering on Usefulness, input+response lowers Harmful Exposure, and replacing response blocking with a re-screened rewrite recovers most blocked traffic with the same observed harmful-exposure count. The authors are explicit that the equality is not equivalence.\n\nWhat's actually new is the controlled comparison, not the pieces: input filtering, output filtering, repair pipelines, safe completion, and latency measurement all exist in cited work. The paper says so itself. The value is the end-to-end customer-outcome framework and the evidence that placement and action trade off.\n\nThe statistical reporting is a credit: paired bootstrap CIs, exact McNemar tests, test-split sensitivity for ToxicChat, threshold sweeps, and a fully human-labelled selected rewrite configuration (all 117 shown rewrites). The qualitative audit of what rewrites gain and lose is a useful addition.\n\nThe soft spot is the public corroboration. The LLM graders for harm and relevance were designed and validated on ToxicChat prompts, then applied to GPT-5 responses and optimized rewrites without human validation on those outputs. The authors flag this, but it means the public numbers—including the 'same 35 harmful responses' observation—rest on graders whose transfer is unmeasured. The internal human-labelled results support the same directional findings, so this narrows the scope of the public result rather than overturning the paper. Still, because the internal human labels are not released, the public replay is the only independent check an outsider can recompute, and that check is weaker than the headline suggests.\n\nThe other limitations are disclosed honestly: latency is component-level, not user-visible; the internal benchmark is hand-authored and harm-enriched; the exposure equality is not equivalence. No hidden flaws.\n\nWho is this for? People building or evaluating moderation stacks in chat products. It gives a decision framework and empirical evidence, not a universal rule.\n\nSend it to peer review. The main revision request I'd make is to either release the internal human labels (de-identified or a subset) or validate the public graders on responses and rewrites. That would firm up the aggregate numbers.","headline":"A careful, honest study of moderation placement and rewriting: the internal human-labelled results carry the paper, while the public LLM-graded corroboration is the main weak link.","tokens_in":24838,"tokens_out":3012,"would_cite":true,"duration_ms":28252,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper argues that content-moderation placement and action should be chosen against each deployment's own safety ceiling and latency budget, not by a universal rule, and it supports this with end-to-end metrics that measure final custome","keywords":["content moderation","filter placement","response rewriting","end-to-end evaluation","Usefulness","Harmful Exposure","guardrail trade-offs","LLM safety"],"falsifier":"Have human annotators label all rewrites that passed the public re-screening (202 shown outputs). If any is harmful or irrelevant under the same rubric, the reported equality of 35 harmful exposures between response-only blocking and response + rewrite would no longer hold. A second check: re-run the placement comparison with a different aligned generator; if response-only no longer gives the highest filter-only Usefulness, the ordering is not transferable.","tokens_in":23785,"feed_emoji":"🛡️","tokens_out":4634,"duration_ms":48593,"temperature":0.7,"pith_summary":"The paper argues that content-moderation classifiers should be judged by final outcomes—whether the user sees a safe, relevant answer—not by classifier accuracy. Using two metrics, Usefulness and Harmful Exposure, it compares placing the filter on the user input, on the model response, or on both. On its internal benchmark and a public chat benchmark, checking only the response was the most useful filter-only placement, while checking both input and response exposed harmful content least often. Replacing response-side blocking with one rewrite attempt recovered almost all blocked turns and produced the same observed number of harmful exposures as blocking alone, although the authors stress this equality is not an equivalence result. The paper concludes that moderation placement and action should be chosen against each deployment's safety ceiling and latency budget rather than by a universal rule.","feed_headline":"Response-side filters keep chats most useful; input checks are safest","feed_subtitle":"New end-to-end metrics let teams choose where to filter and whether to rewrite under their own safety ceiling.","key_machinery":"The central mechanism is the decision pipeline over final show-or-block outcomes, scored by Usefulness (shown safe relevant responses divided by total turns) and Harmful Exposure (shown harmful responses divided by total turns), with end-to-end Block Rate, end-to-end False Positive Rate, and latency as diagnostics. Rewriting is a one-shot recovery action: a flagged response is rewritten, re-screened by the same filter, and shown only if it passes; otherwise it is hard-blocked. A lightweight probe-based router selects rewrite-or-refuse and domain before regeneration, cutting conditional rewrite time from 13.8 seconds to 0.47 seconds on the internal stack while preserving comparable outcomes.","core_discovery":"The discovery is that filter placement and follow-up action jointly determine outcomes that component accuracy cannot express. Measured end-to-end, response-only filtering composed with an aligned generator blocks far fewer useful turns than input-side filtering, because the generator already handles many risky inputs safely; input+response filtering gives the lowest harmful exposure at the cost of roughly twice the blocking; and response-side rewriting converts most would-be blocks into shown safe answers with the same observed harmful-exposure count as blocking, for the tested operating points. The paper frames this as a constrained comparison, not a universal recipe.","pith_inferences":["Because the placement ordering is explained by the generator's own alignment, the same comparison with a weaker or unaligned generator could shift the frontier toward input-side checks.","The equal observed exposure count for rewrite versus blocking invites a formal equivalence test with a prespecified margin; the current sample cannot show that rewriting is as safe as blocking.","The public LLM-grader labels are the one transfer that was not human-validated on rewritten outputs; human-reviewing the released rewrites would settle whether the reported public Harmful Exposure and Usefulness figures hold.","The framework extends naturally to multi-turn or agentic systems, but response-side checks must then be supplemented by input- or action-side checks where side effects execute before a flag can block."],"forward_implications":["Response-side filtering is the highest-usefulness filter-only choice for aligned chat generators; input-side filtering over-blocks safe prompts in these settings.","Input + response filtering is the only placement that meets the tightest harmful-exposure ceilings, so deployments with strict safety budgets should accept its usefulness cost.","Selective rewriting can recover most blocked traffic: the selected rewrite configuration cut end-to-end Block Rate from 9.60% to 0.24% internally while showing the same 30 harmful turns as response-only blocking.","Probe-based routing makes rewriting latency-feasible (roughly 29x faster than LLM routing in the internal conditional timing), though user-visible latency must be re-measured on the target stack.","Rewrites should aim for calibrated specificity: generalizing trigger words preserves usefulness, but sensitive domains may lose safety-relevant support information."],"fun_headline_variants":["Response-side filters keep chats useful; input-side safest","Rewrite rescues blocked chats without raising harmful exposure","No one-size-fits-all moderation: choose by safety and latency","End-to-end metrics reveal where to filter and whether to rewrite"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The load-bearing premise is that the LLM grader's toxicity rubric, validated only on prompts, correctly labels generated responses and optimized rewrites in the public evaluation; if those labels misjudge harmful rewrites as safe, the public Harmful Exposure and Usefulness numbers for the rewrite configuration would change.","fun_headline_variants_meta":{"raw":{"variants":["Response-side filters keep chats useful; input-side safest","Rewrite rescues blocked chats without raising harmful exposure","No one-size-fits-all moderation: choose by safety and latency","End-to-end metrics reveal where to filter and whether to rewrite"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000919,"raw_usage":{"total_tokens":3782,"prompt_tokens":750,"completion_tokens":3032,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":494,"completion_tokens_details":{"reasoning_tokens":2965}},"tokens_in":494,"tokens_out":3032,"duration_ms":21828,"temperature":1.0,"reasoning_tokens":2965,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-01T00:29:28.811467+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Have human annotators label all rewrites that passed the public re-screening (202 shown outputs). If any is harmful or irrelevant under the same rubric, the reported equality of 35 harmful exposures between response-only blocking and response + rewrite would no longer hold. A second check: re-run the placement comparison with a different aligned generator; if response-only no longer gives the highest filter-only Usefulness, the ordering is not transferable.","supporting_citations":[],"review_version":1}