Obfuscation Rules for Detecting and Detoxifying Korean Toxicity

Dayoung Kim; Hyundong Jin; Su-Hyeon Kim; Yejin Lee; Yeonsoo Kim; Yo-Sub Han

Obfuscation Rules for Detecting and Detoxifying Korean Toxicity

T0 review · 3 major / 5 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Korean toxicity can hide in plain sight through Hangeul's structure; a new dataset teaches models to see through the disguise.

desk verdict A solid, first-of-its-kind dataset for Korean obfuscated toxicity whose headline robustness claim is only demonstrated on its own synthetic transformations; worth peer review with a demand for external validation. read the letter →

arxiv 2510.10961 v4 pith:FNANIQ7Z submitted 2025-10-13 cs.CL cs.AI

Yejin Lee , Su-Hyeon Kim , Hyundong Jin , Dayoung Kim , Yeonsoo Kim , Yo-Sub Han This is my paper · ORCID

classification cs.CLcs.AI

keywords KoreantoxicityobfuscationdeobfuscationdetoxificationHangeuldatasetrobustnesstransformationrules

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper introduces KOTOX, the first Korean dataset that pairs neutral and toxic sentences with their obfuscated counterparts, covering 17 transformation rules across five linguistically grounded categories. The central claim is that models trained on this dataset handle obfuscated toxic text better without losing accuracy on normal text, shrinking the robustness gap by as much as 34.67 percentage points. The authors argue that Korean's agglutinative morphology and Hangeul's syllable-block composition make it uniquely rich for studying obfuscation, and that current LLMs remain highly vulnerable to such disguised abuse. If the claim holds, KOTOX becomes a practical resource for building Korean toxicity detectors and sanitizers that resist real-world evasion.

What carries the argument

The central object is KOTOX, a dataset of 6,882 neutral-toxic pairs where both sides are obfuscated by an algorithmic pipeline (Algorithm 1) that samples rules, applies per-rule rewrite rates, and checks sanity to avoid trivial or overlapping edits. Each pair is generated at three difficulty levels (easy, normal, hard) by applying 2, 3, or 4 rules. The dataset is built on a filtered subset of K/DA (2,294 high-quality pairs after annotator filtering with Gwet's AC1 = 0.74), and the rules are derived from real-world obfuscation examples, grounded in Korean phonology and Hangeul's decomposable syllable blocks.

What would settle it

Collect a corpus of naturally obfuscated Korean toxic comments from online communities (with user consent and anonymization) and run the best KOTOX-trained classifier on it. If the accuracy drop is comparable to the drop seen on clean text, the simulated rules do not capture real-world obfuscation; a large gap would confirm the dataset's validity.

Watch

Extended reading notes

Core claim

The paper claims that a paired dataset of obfuscated Korean neutral and toxic sentences, built from 17 transformation rules in five classes (phonological, iconological, transliteration-based, syntactic, pragmatic), enables models to detect and detoxify obfuscated toxic text without sacrificing performance on clean text. The authors demonstrate this with three toxicity classifiers and four LLMs, showing that fine-tuning on KOTOX reduces the gap between obfuscated and non-obfuscated F1 scores from as high as 41.40 points to below 8 points, and that SFT models produce sanitized outputs with clearly improved chrF scores (roughly tripling zero-shot results). They also report that spacing perturba

Load-bearing premise

The 17 rules and their application rates faithfully simulate real-world Korean obfuscation, so that performance on KOTOX's self-generated test set is evidence of robustness to genuine evasions.

Editorial extensions

If this is right

Fine-tuned classifiers can close most of the accuracy gap between clean and obfuscated Korean toxic text, making robustness a trainable property rather than a fixed model trait.
Models trained on obfuscated data also generalize to non-obfuscated toxic text, suggesting obfuscation-aware training does not come at the cost of standard performance.
The three tasks (classification, deobfuscation, sanitization) give a unified benchmark for future Korean safety work, allowing direct comparison of robustness across models.
The rule-based difficulty levels (easy/normal/hard) enable controlled assessment of how much obfuscation a model can handle.
The error analysis pinpoints specific weak rules (e.g., spacing perturbation, emoji insertion) that should be prioritized in future adversarial defenses.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Because the evaluations are based on self-generated obfuscations, the real-world benefit depends on whether these 17 rules match how Korean users actually disguise toxic text online; a natural-obfuscation corpus would be the decisive test.
The same taxonomy could be ported to other agglutinative or syllable-block scripts (e.g., Japanese kana, Thai) with analogous phonological and visual manipulations, though the specific rule dictionaries would need re-derivation.
The observed rise in Perspective API toxicity scores after fine-tuning suggests that current sanitization models may be learning to 'restore' toxicity while failing to remove it; a more reliable toxicity metric than a single API is worth exploring.
An LLM-assisted obfuscation step for transliteration rules hints that the framework could be extended to fully model-driven obfuscation, potentially generating harder and more diverse evasions.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

You should know two things about this one. First, KOTOX is genuinely new: it is the first Korean dataset pairing neutral and toxic sentences with obfuscated counterparts, and the 5-class/17-rule taxonomy is linguistically informed, with Hangeul-specific rules (rotation, sub-syllabic substitution, syllable anagrams) that go beyond the usual leetspeak/emoji tricks. The three tasks — classification, deobfuscation, sanitization — are well-defined, and the dataset construction is careful: filtering K/DA with a rubric, reporting inter-annotator agreement, and releasing the transformation package. The experiments are competently run: three seeds, LoRA fine-tuning, cross-evaluation across difficulty levels, and the internal story is consistent. Training on KOTOX clearly improves performance on KOTOX-generated obfuscated test data without hurting clean performance. That is a real, reproducible contribution and the community will want it. Credit where due: this is not a toy resource.

The soft spot is exactly the one the stress test flags. The train, validation, and test splits are all random partitions of the same corpus generated by Algorithm 1 with the same 17-rule sampler and the same per-rule rewrite rates. So the reported robustness numbers measure how well models learn KOTOX's own transformation distribution, not how they handle obfuscation as it actually occurs online. The abstract says the rules are "derived from real-world examples," but there is no quantitative comparison against any naturally obfuscated Korean corpus. If real users favor different transformations, the gains could shrink or vanish. That is a load-bearing gap, not a nitpick — the title promises detection and detoxification of real obfuscated Korean toxicity.

Two smaller issues. The appendix has some numerical oddities: Table 24 lists Bllossom's five-shot chrF as 21.14 in both columns, and the GPT-4.1 rows in Tables 24–25 are all zeros, which looks like an artifact or missing evaluation rather than a result. More substantively, the sanitization experiments show Perspective toxicity scores increasing after fine-tuning (Table 6, from ~10 to ~33). The authors call this "interesting," but it actually suggests their fine-tuned models are producing more toxic-looking outputs, which cuts against the detoxification claim. They should address that directly.

Who is this for? Researchers working on Korean NLP safety, robustness, and detoxification. They will find the dataset and the taxonomy useful even if the robustness numbers need an asterisk. It deserves a serious referee. My recommendation: send it to peer review, but the reviewers should insist on either an external naturally-obfuscated test set or an explicit reframing of the claim as "robustness to the KOTOX transformation family." With that fixed, this becomes a solid resource paper.

Referee Report

3 major / 5 minor

Summary. The paper introduces KOTOX, a Korean dataset for obfuscated toxic-text research. Starting from 2,294 filtered neutral-toxic pairs in K/DA, the authors define 17 obfuscation rules organized into five linguistic categories and apply them with varying intensity (k=2,3,4) to create Easy, Normal, and Hard versions, yielding 6,882 neutral-toxic-obfuscated triples. They define three tasks: obfuscated toxic text classification, neutral text deobfuscation, and obfuscated toxic text sanitization. Experiments fine-tune three toxicity classifiers and four LLMs (three open-source, one closed-source) under zero-shot, few-shot, and SFT settings. The main finding is that models fine-tuned on KOTOX improve classification on obfuscated inputs while maintaining or improving performance on non-obfuscated inputs, and that SFT substantially improves deobfuscation and sanitization quality.

Significance. If the robustness claim holds, KOTOX would be the first Korean dataset jointly supporting obfuscation-robust toxicity detection, deobfuscation, and sanitization, and the authors release code and data. The linguistic taxonomy of Hangeul-specific obfuscation and the paired difficulty-level design are useful resources. The experimental protocol is also careful in several respects: three seeds are used, LoRA SFT is applied to generation models, and cross-evaluation between obfuscated and non-obfuscated sets is reported. However, the central claim—that trained models 'better handle obfuscated text'—is currently validated only on obfuscations generated by the same rule pipeline used for training. Without evaluation on naturally obfuscated Korean text or an independently generated obfuscation distribution, the external validity of the robustness conclusion is not established. A further internal-validity concern about possible train/test leakage across difficulty levels needs to be resolved before the non-obfuscated performance claim can be taken at face value.

major comments (3)

[§4.2–§4.3, Algorithm 1, Table 16] The evaluation of obfuscation robustness is entirely on data produced by the same 17-rule sampler (Algorithm 1) with the same per-rule rewrite rates (Table 16) used to create the training data. No naturally obfuscated Korean corpus or independently generated obfuscations are used in Tables 4–6. The abstract's claim that models 'better handle obfuscated text' is therefore only demonstrated for the authors' own transformation distribution. Please add an out-of-distribution evaluation (e.g., human-written obfuscations, a different rule sampler, or naturally obfuscated social-media text) or qualify the claim accordingly.
[§4.2–§4.3, Table 7] Each source pair is obfuscated three times (k=2,3,4), producing Easy/Normal/Hard variants. The 8:1:1 split is described only at the level of the 6,882 obfuscated samples; it is not stated that the same source pair is kept in the same split across difficulty levels or that the original (No-Obf) pairs of the test source pairs are excluded from training. If source-pair identity is not controlled, the cross-evaluation in Table 7 and the non-obfuscated performance claim in Table 4 are inflated by train/test leakage. Please clarify the split procedure and, if needed, re-run with a source-pair-level split.
[Appendix E.1.1, Tables 24–25] The appendix tables intended to provide full results contain 00.0 values that contradict the main-text Tables 5–6 (e.g., GPT-4.1 zero/five-shot rows and all sanitization rows). This makes the experimental results non-reproducible from the appendix. Please replace the placeholder values with actual numbers or remove the appendix tables and clearly state the discrepancy.

minor comments (5)

[Abstract/Conclusion] The dataset size is reported as 'about 6.9K neutral-toxic pairs' in the introduction and 'approximately 15,000 samples' in the conclusion. These numbers are inconsistent; clarify what is being counted (pairs, sentences, or difficulty-level variants).
[§6.2–6.3] The heading 'Obfuscated Toxic Text Obfuscation' should read 'Deobfuscation'; Section 6.3 refers to 'Fig. 6' where the results are in Table 6. Several cross-references (e.g., 'Figure7' in §7.1) should be corrected.
[§B.3] The data-construction description mentions 'GPT-5 nano' but provides no public model identifier or version. Since this model is used to generate rules 13–14, please specify the exact model and access date, or state that the name is a typo and identify the actual model used.
[Tables 5, 6, 24] The model name is inconsistently spelled 'Bllosom' and 'Bllossom'; Table 24 also contains a duplicate '21.14' entry in the Bllossom five-shot row. These typos should be fixed.
[Throughout] There are several typos: 'real-word examples' in the abstract, 'syntatic' in §3.2, 'Rochy Linux' and 'unsing' in §D.4, and 'KoG2Padvaned' in §C.2. A careful proofread is needed.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity; KOTOX is a held-out benchmark built from its own obfuscation rules, which is standard dataset evaluation rather than a derivation that reduces to its inputs.

full rationale

The paper's central claim is that models trained on KOTOX 'better handle obfuscated text without sacrificing performance on non-obfuscated text' (Abstract). This is supported by held-out evaluation: the dataset is 'divided into train, validation, and test sets in an 8:1:1 ratio' (Section 4.3), and models are fine-tuned on the training split and evaluated on the held-out test split. Although the test obfuscations are generated by the same Algorithm 1 and 17-rule framework used for training, this is a standard i.i.d. benchmark construction: the model must generalize to unseen sentence/rule combinations, and the paper shows that models trained without obfuscation perform substantially worse on the obfuscated test set, demonstrating that the result is not trivially entailed by the data construction. The non-obfuscated half of the claim is evaluated on original K/DA-derived pairs, which are external to the obfuscation transformation. The concern that the rule distribution may not match real-world Korean obfuscation is an external-validity limitation, not a circularity; the authors acknowledge the scope limitation in the Limitations section. There are no load-bearing self-citations, no fitted parameters renamed as predictions, and no uniqueness or ansatz imported from prior work. The derivation chain is therefore self-contained with respect to circularity, even though its real-world generalizability is open to question.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The paper's central contribution is a synthetic dataset; the main cost is the assumption that its rule-generated obfuscations stand in for real-world Korean obfuscation, plus several hand-set construction parameters. No new physical or theoretical entities are postulated.

free parameters (4)

Per-rule rewrite rates = 0.3 or 0.5 (Table 16)
Chosen by hand per rule to control fraction of tokens modified; no empirical basis; strongly shapes rule frequency and difficulty.
Number of applied rules per pair k = 2, 3, 4 for easy/normal/hard
Arbitrary definition of difficulty levels; k determines the obfuscation intensity and the train/test distribution.
Rule sampling order/random seed = not specified
Algorithm 1 samples rules randomly; without a seed or released generation script, exact dataset replication is not guaranteed.
GPT-5 nano prompts/parameters for rules 13-14 = not specified
Latin and semantic transliteration rely on LLM generation with Korean prompts; stochasticity and version dependence affect dataset content.

assumptions (5)

domain assumption Hangeul's decomposable syllabic blocks and Korean agglutinative morphology make the 17 obfuscation types human-recoverable and therefore valid proxies for real obfuscation.
Used throughout §A-B; if human recoverability fails, the 'obfuscation' may just be corruption, undermining the dataset's purpose.
domain assumption The 17 rules and their application rates represent the real-world distribution of Korean obfuscation.
No naturally obfuscated Korean corpus is used to validate this; the entire benchmark is generated by these rules (§4.2, Table 16).
domain assumption The filtered K/DA pairs are correctly labeled neutral/toxic after manual screening.
Gwet's AC1=0.7408 is reported (§C.1), but residual mislabels or subtle toxicity in 'neutral' sentences would contaminate all supervised experiments.
domain assumption Perspective API scores are a valid toxicity measure for Korean generated sentences.
Used as sanitization metric (§5.2, Table 6); its Korean reliability is not established in the paper.
domain assumption Held-out test items generated by the same rules measure generalization to real obfuscated text.
This underlies the claim of 'robustness' — if rule-pattern memorization suffices, the external validity is weak.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Obfuscation Rules for Detecting and Detoxifying Korean Toxicity." pith.science (2026). https://pith.science/paper/FNANIQ7Z

@misc{pith2026251010961,
  author       = {Pith},
  title        = {Pith review of: Obfuscation Rules for Detecting and Detoxifying Korean Toxicity},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FNANIQ7Z}},
  note         = {Machine review of arXiv:2510.10961}
}

read the original abstract

As language models become increasingly deployed in online environments, toxicity detection and detoxification have received growing attention. Existing studies primarily focus on non-obfuscated text, which limits robustness when users intentionally disguise toxic expressions. In particular, Korean toxic expressions can be easily disguised through agglutinative morphology and Hangeul-specific orthographic variation. However, obfuscation in Korean remains largely unexplored, which motivates us to introduce a KOTOX: Korean toxic dataset for deobfuscation and detoxification. We categorize Korean obfuscation patterns into linguistically grounded classes, define transformation rules derived from real-world examples, and provide the resulting obfuscation framework as an open transformation package. Using these rules, we provide paired neutral and toxic sentences alongside their obfuscated counterparts. Models trained on our dataset better handle obfuscated text without sacrificing performance on non-obfuscated text. This is the first dataset that simultaneously supports deobfuscation and detoxification for the Korean language. We expect the dataset to facilitate better understanding and mitigation of obfuscated toxic content in LLM for Korean. Our code and data are available at https://github.com/leeyejin1231/KOTOX.