Pith. sign in

REVIEW 3 major objections 4 minor 8 cited by

Build it Break it Fix it for Dialogue Safety: Robustness from Adversarial Human Attack

T0 review · 3 major / 4 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read An iterative crowdworker attack-and-retrain loop yields substantially more robust offensive-language classifiers, and dialogue context is necessary to catch offensive replies.

desk verdict A useful adversarial dataset and a solid multi-turn context result, but the single-turn robustness claim rests on same-round test splits and is overstated as 'considerably more robust.' read the letter →

arxiv 1908.06083 v1 pith:2KW4N24B submitted 2019-08-17 cs.CL

Emily Dinan , Samuel Humeau , Bharath Chintagunta , Jason Weston This is my paper · ORCID
classification cs.CL
keywords dialoguesafetyoffensivelanguagedetectionadversarialhumanattackbuilditbreakfixcrowdsourcingBERTcontextrobustness
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

An iterative build-it-break-it-fix-it loop, with human crowdworkers as the breakers, can make dialogue-safety classifiers meaningfully more robust to adversarial offensive language. The paper starts from a BERT-based classifier (a large pre-trained transformer language model) trained on a public toxic-comments dataset, then asks crowdworkers to submit offensive messages the current model marks as safe; each round, the model is retrained on all prior broken examples. Across three single-turn rounds, the adversarially trained models $A_1$ through $A_3$ beat standard-data models $S_1$ through $S_3$ on every adversarial test set, with $A_3$ reaching 67.6 OFFENSIVE-class $F_1$ over all rounds. The paper further establishes that offense in dialogue is context-dependent: a reply can be innocuous alone but hurtful after certain history, and the best model, which feeds the dialogue history and the response as separate segments into BERT, reaches 66.4 OFFENSIVE-class $F_1$ on multi-turn attacks, well above models that ignore context. This matters because deployed conversational agents and forums are attacked by humans who actively seek the classifier's blind spots, while most benchmark datasets evaluate single sentences in isolation.

What carries the argument

Two mechanisms carry the argument. The first is the build-it-break-it-fix-it loop itself: human crowdworkers are asked to "beat the system" by producing messages the current model calls SAFE but the worker considers offensive, and every successfully breaking example is added to the next round's training data. The loop is parameter-free: no gradient-based adversary is needed, only human judgment. The second is the dialogue-segment input representation: a BERT-based classifier in which the conversation history and the final utterance are stored as two separate segments, each with its own segment embedding, so the transformer can condition the SAFE/OFFENSIVE decision on what was said before. The evaluation metric is OFFENSIVE-class $F_1$, the harmonic mean of precision and recall on the offensive class, because the dataset skews heavily SAFE.

What would settle it

Collect a fresh set of 1,000 offensive messages from crowdworkers who are never shown the classifier (or from a different crowd pool), withhold them, retrain $A_i$ and $S_i$ on their own rounds, and compare OFFENSIVE-class $F_1$ on that independent set. If $A_i$ does not beat $S_i$ there, the central robustness claim fails; the paper's Table 6 numbers are computed on test splits drawn from the same round's break-it collection, so the independent set is a direct check.

Watch

Extended reading notes

Core claim

The paper's central claim is that adversarial robustness in offensive-language detection can be learned by repeatedly exposing a classifier to human adversaries and retraining on what defeats it. Starting from $A_0$, a BERT-based binary classifier trained on a public toxic-comments corpus, the loop collects 1,000 crowdworker submissions per round that both $A_0$ and the previous round's model $A_{i-1}$ label SAFE but the worker judges OFFENSIVE. A new model $A_i$ is trained on all previous adversarial rounds plus the original corpus. The paper reports that on each adversarial round's test split the adversarial models outperform the standard models trained on non-adversarial offensive examples: $A_3$ scores 67.6 OFFENSIVE-class $F_1$ across rounds 1-3, versus 41.8 for $S_3$. The second claim is that dialogue context is not decorative but load-bearing: a BERT variant that encodes the conversation history and final response as separate segments reaches 66.4 OFFENSIVE-class $F_1$ with context versus 59.0 without, and the fastText baseline gets worse when context is added (23.6 with context, 37.1 without). The paper interprets this as evidence that context helps only when the architecture can represent it.

Load-bearing premise

The central robustness claim assumes that crowdworker attacks collected against the exact deployed model in the same round are a faithful proxy for the attacks the system will encounter in the real world, so beating those same-round test examples means the system is genuinely safer.

Editorial extensions

If this is right

  • Models trained on adversarial attacks generalize to previously unseen attacks collected in the same round: $A_3$ reaches 67.6 OFFENSIVE-class $F_1$ over all single-turn adversarial rounds, while the standard-data model $S_3$ reaches only 41.8.
  • The benefit compounds with iteration: scores on round 3 adversarial test move from 32.1 for $A_1$ to 59.9 for $A_3$, while the standard models stay near 14.
  • Dialogue context matters for offense detection: BERT with dialogue segments and context scores 66.4 OFFENSIVE-class $F_1$ on the multi-turn task, versus 59.0 for the same architecture without context; a fastText bag-of-embeddings model actually degrades when context is added.
  • Adversarial collection changes the data distribution: the share of profanity-laden examples drops from 18.2% in standard collection to 1.2% by adversarial round 3, while reliance on negation, figurative language, and world knowledge increases.
  • The iterative retraining maintains reasonable performance on the original benchmark: all adversarial models stay within a few points of the baseline on the toxic-comments test set, with only a small trade-off observed in round 3.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: because each round's test split is drawn from the same crowdworker attack distribution that produced the training examples, the reported $F_1$ numbers likely overstate robustness against an independent attacker who never saw the model; a cleaner test would collect a fresh round of attacks after training stops and evaluate all models on that held-out set.
  • Beyond the paper: the same loop could be applied to other dialogue-safety targets, such as detecting manipulation, harassment, or unsafe generative responses, and might be combined with algorithmic adversarial attacks to cover attack styles humans do not find.
  • Beyond the paper: if context is as load-bearing as the multi-turn results suggest, then single-sentence safety benchmarks underestimate real-world difficulty, and safety evaluation should adopt contextual test suites like this one.
  • Beyond the paper: the 0.0 scores of $A_0$ and $A_{i-1}$ on their own collected rounds do not mean these models forgotten offense; they mean the test examples were selected precisely because those models classified them as SAFE, so the comparison across models in the same round is a comparison on attack styles aimed at the previous models, not on a fixed difficulty scale.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes an iterative 'build it, break it, fix it' training scheme for offensive language detection in dialogue. Crowdworkers are asked to submit offensive utterances that a current classifier labels safe; the collected examples are added to the training data, and the process is repeated over several rounds. The authors collect three rounds of single-turn adversarial examples and one round of multi-turn adversarial examples, together with matched standard (non-adversarial) collections. Using BERT-based and fastText classifiers, they report that adversarially trained models outperform standard-trained models on the adversarial test sets, that later adversarial rounds contain less profanity and more negation and figurative language, and that for BERT-based models adding dialogue context improves multi-turn detection, with the best variant reaching 66.4 OFFENSIVE-class F1. Code, data, and trained models are promised for release.

Significance. If the central robustness claim holds, this is a useful empirical contribution to dialogue safety: it provides a practical human-in-the-loop data collection procedure, a new adversarial evaluation suite, and evidence that dialogue context matters for offensive language detection. The multi-turn experiments are run with five seeds and show consistent context gains for BERT-based models, and the distributional analysis of adversarial versus standard examples is informative. However, the paper's strongest claim—that the resulting models are 'considerably more robust than previous systems'—is broader than the evidence supports, because the evaluation protocol measures generalization to a random split of attacks collected against the deployed predecessor, not to a fresh, held-out attack round from an independent adversary.

major comments (3)
  1. [§5.2.2, Table 6] The central robustness comparison is measured on same-round random splits of adversarial examples, and the paper's own statement that 'all scores of 0 in Table 6 are by design' confirms the issue: for round i, the test examples were collected specifically to fool A0 and A_{i-1}, so A_{i-1} scores 0 by construction and A_i has trained on the other 90% of that same attack batch. This conflates supervised generalization to a held-out split of one attack distribution with robustness to unseen human attacks in deployment. To support the abstract's claim of being 'considerably more robust than previous systems,' the authors should either collect an additional attack round against the final deployed model (or use an independent adversary) and report performance on that held-out round, or substantially temper the robustness claim to 'robust to the specific attack distributions encountered during iterative collection.'
  2. [Abstract and §2] The abstract claims the approach is 'considerably more robust than previous systems,' but no comparison is made to any prior method beyond the WTC-trained baseline A0 and the standard-trained models Si. In particular, Mechanical Turker Descent (Yang et al., 2018) is cited in §2 as closely related, yet no comparison to that approach or any other adversarial-collection baseline is reported. The claim should be made relative to the actual baselines evaluated, or a comparison to a prior method should be added.
  3. [§5.2.2, Table 6] Single-turn results are reported without error bars or multiple seeds. Since BERT fine-tuning is stochastic and the adversarial test sets contain only 300 OFFENSIVE examples per round, the numerical gaps in Table 6 (e.g., round 2: S3 31.8 vs. A3 62.1) could be accompanied by variance estimates or significance tests. Without these, it is difficult to assess whether the round-by-round improvements are statistically reliable, even though the qualitative pattern is consistent.
minor comments (4)
  1. [Throughout] There are several typos and spacing errors, including 'Crowderworker' in §4.1, 'langauge' in §1, 'thestandard task' in the caption of Table 5, and 's single-turn' in §6.1.
  2. [§4.1 and Appendix B] The main text says the points 'have no other meaning (e.g. no monetary value),' but Appendix B states that users are 'provided with bonuses for good effort.' Please clarify whether and how effort was rewarded, since this affects the characterization of the gamification.
  3. [§5.1.2] The multitasking mixing parameter and the final classification bias are both tuned on the validation sets, but the paper does not report the chosen values or sensitivity to them. A sentence stating the selected values or noting that results were robust to their variation would improve reproducibility.
  4. [Table 7 and Table 11] Table 7 repeats the average score information also given in Table 11; consider merging or cross-referencing to avoid redundancy.

Circularity Check

1 steps flagged · score 4.0 of 10

Zero scores for A0 and A_{i-1} in Table 6 are guaranteed by the data-collection filter; the A_i-vs-S_i robustness comparison is not forced by construction.

  1. self definitional [Section 5.2.2 (Table 6), with the collection protocol in Section 4.1]
    "Finally, we remark that all scores of 0 in Table 6 are by design, as for round i of the adversarial task, both A0 and Ai−1 classified each example as SAFE during the “break it” data collection phase."

    The round-i adversarial test set is constructed only from messages that A0 and A_{i-1} both marked SAFE during collection; workers were required to produce messages that both models classify as SAFE. Therefore A0 and A_{i-1} have OFFENSIVE-class F1 of exactly 0 on that test set by selection, not by empirical measurement. These diagonal zeros are definitional consequences of the filtering rule, so citing them as evidence of vulnerability is a self-definitional step. The central A_i-vs-S_i comparison is not circular, because S_i played no role in the filter and its lower scores are empirically measured, but the zero entries are forced by construction.

full rationale

The central build-it-break-it-fix-it claim—that adversarially trained models A_i outperform standard models S_i on adversarial test rounds—is not circular: A_i and S_i differ only in training data, the adversarial test examples are held out within each round, and S_i was not used in the data-collection filter, so the gap is an empirical outcome with independent content. Additional grounding comes from the WTC baseline comparison (Table 2), the standard-task results (Table 6, Standard rows), and the multi-turn BERT segment experiments (Table 10), which do not depend on the adversarial filtering trick. There is no load-bearing self-citation chain or imported uniqueness theorem; citations to ConvAI2, Mechanical Turker Descent, and BERT are external or related-work context, not justification of the main result. The one genuine construction is the zero scores in Table 6: because round-i attacks are accepted only when A0 and A_{i-1} both output SAFE, those models are guaranteed a zero F1 on that round's test set. The paper discloses this "by design," and the main A_i-vs-S_i comparison does not rest on those zeros. A related scope limitation—the same-round split means the test set is in-distribution relative to that round's attack style rather than a fresh attack round—weakens the deployment inference but is a standard holdout procedure, not a by-construction equivalence. Overall, the circularity is partial, disclosed, and not central to the paper's main empirical comparison.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

All collected offensive labels rely on crowdworkers' subjective judgment with no reported inter-annotator agreement for the offensive examples; safe examples rely on two-worker review of ConvAI2 utterances. The 'break it' premise, that examples generated against the current model represent realistic attacks, is the load-bearing assumption for generalization. The listed free parameters are training choices tuned on validation sets, not reported numerically.

free parameters (2)
  • multitasking mixing parameter = not reported (tuned on validation)
    Used to weight Wikipedia Toxic Comments against the newly collected task during multi-task training (Section 5.1.2); value tuned on the validation sets and not stated.
  • final classification bias = not reported (adjusted on validation)
    Added after training to optimize OFFENSIVE-class F1 on the validation sets (Section 5.1.2).
assumptions (4)
  • domain assumption Crowdworkers' judgments that a message would not be ok to send in a friendly conversation are reliable ground truth for offensiveness.
    Used to label all collected adversarial examples (Section 4.1); no inter-annotator agreement is reported for the collected offensive examples.
  • domain assumption SAFE utterances from ConvAI2, reviewed by two workers, are genuinely safe.
    Used to construct the safe half of the binary tasks (Section 5.1.1).
  • domain assumption Examples that fool the current deployed model are representative of real-world adversarial attacks.
    The core 'break it' premise; its validity determines whether measured robustness transfers outside the crowdsourcing loop (Sections 4.1, 5.2.2).
  • domain assumption BERT pretrained representations transfer to offensive language detection.
    The paper adopts BERT-base as its main architecture (Section 3) and fine-tunes on WTC and the new tasks.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Build it Break it Fix it for Dialogue Safety: Robustness from Adversarial Human Attack." pith.science (2026). https://pith.science/paper/2KW4N24B

@misc{pith2026190806083,
  author       = {Pith},
  title        = {Pith review of: Build it Break it Fix it for Dialogue Safety: Robustness from Adversarial Human Attack},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2KW4N24B}},
  note         = {Machine review of arXiv:1908.06083}
}
read the original abstract

The detection of offensive language in the context of a dialogue has become an increasingly important application of natural language processing. The detection of trolls in public forums (Gal\'an-Garc\'ia et al., 2016), and the deployment of chatbots in the public domain (Wolf et al., 2017) are two examples that show the necessity of guarding against adversarially offensive behavior on the part of humans. In this work, we develop a training scheme for a model to become robust to such human attacks by an iterative build it, break it, fix it strategy with humans and models in the loop. In detailed experiments we show this approach is considerably more robust than previous systems. Further, we show that offensive language used within a conversation critically depends on the dialogue context, and cannot be viewed as a single sentence offensive detection task as in most previous work. Our newly collected tasks and methods will be made open source and publicly available.

Figures

Figures reproduced from arXiv: 1908.06083 by the authors.

Figure 1
Figure 1. The build it, break it, fix it algorithm we use [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. User interface for the single-turn adversarial collection [PITH_FULL_IMAGE:figures/full_fig_p012_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 8 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. CapTune: Adapting Non-Speech Captions With Anchored Generative Models

    cs.HC 2025-08 conditional novelty 6.0 of 10

    CapTune lets caption creators set bounds and viewers tune non-speech caption text; a 19-person qualitative evaluation reported greater engagement and retained creative control.

  2. Paper Summary Attack: Jailbreaking LLMs through LLM Safety Papers

    cs.CL 2025-07 conditional novelty 6.0 of 10

    Summaries of LLM safety papers, paired with a completion-style payload containing a harmful query, jailbreak aligned LLMs at high reported success rates and expose a defense paper versus attack paper bias.

  3. Quality-Diversity Red-Teaming: Automated Generation of High-Quality and Diverse Attackers for Large Language Models

    cs.LG 2025-06 conditional novelty 6.0 of 10

    QDRT combines behavior-conditioned RL, multiple specialized attackers, and a MAP-Elites replay buffer to generate LLM attacks that are more toxic and cover more risk-category/style combinations.

  4. Diverse and Effective Red Teaming with Auto-generated Rewards and Multi-step Reinforcement Learning

    cs.LG 2024-12 conditional novelty 6.0 of 10

    An automated red-teaming method that uses LLM-generated per-goal rewards and multi-step RL with a style-diversity reward to produce diverse and effective attacks on language models.

  5. InfoFlood: Jailbreaking Large Language Models with Information Overload

    cs.CR 2025-06 conditional novelty 5.0 of 10

    InfoFlood claims near-perfect jailbreak success on four frontier LLMs by rewriting harmful queries into verbose academic prose with fake citations, past-tense framing, and ethical disclaimers, without adversarial suffixes.

  6. LLM360 K2: Building a 65B 360-Open-Source Large Language Model from Scratch

    cs.LG 2025-01 conditional novelty 5.0 of 10

    K2 Diamond is a fully open 65B-parameter LLM that reaches Llama 2 70B-level performance on standard benchmarks.

  7. Generating Attacks for LLMs with GFlowNets

    cs.AI 2026-08 conditional novelty 3.0 of 10

    The authors apply GFlowNet-based reinforcement learning to train LLMs that generate English and Turkish adversarial prompts, reporting improved red-teaming success rates over a prior English-only method.

  8. Agentic Web: Weaving the Next Web with AI Agents

    cs.AI 2025-07 conditional novelty 3.0 of 10

    A position paper defines the Agentic Web as the next web era and proposes a three-dimensional conceptual framework for understanding and building it.

Reference graph

Works this paper leans on

36 extracted references · 21 canonical work pages · cited by 8 Pith papers

  1. [1]

    URL: " 'urlintro :=

    ENTRY address author booktitle chapter edition editor howpublished institution journal key month note number organization pages publisher school series title type volume year eprint doi pubmed url lastchecked label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block STRINGS urlintro eprinturl eprintpr...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    2018. https://openreview.net/group?id=ICLR.cc/2018/Conference 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings . OpenReview.net

    work page 2018

  4. [4]

    Yonatan Belinkov and Yonatan Bisk. 2018. https://openreview.net/forum?id=BJ8vJebC- Synthetic and natural noise both break neural machine translation . In DBLP:conf/iclr/2018

    work page 2018

  5. [5]

    Jonathan Bishop. 2014. Representations of ‘trolls’ in mass media communication: a review of media-texts and moral panics relating to ‘internet trolling’. International Journal of Web Based Communities, 10(1):7--24

    work page 2014

  6. [6]

    Andrew Brock, Jeff Donahue, and Karen Simonyan. 2018. Large scale gan training for high fidelity natural image synthesis. arXiv preprint arXiv:1809.11096

    arXiv 2018

  7. [7]

    Justin Cheng, Cristian Danescu-Niculescu-Mizil, Jure Leskovec, and Michael Bernstein. 2017. Anyone can become a troll: Causes of trolling behavior in online discussions. American Scientist, 105(3):152

    work page 2017

  8. [8]

    Thomas Davidson, Dana Warmsley, Michael Macy, and Ingmar Weber. 2017. Automated hate speech detection and the problem of offensive language. In Eleventh International AAAI Conference on Web and Social Media

    2017

Show all 36 references
  1. [9]

    Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2018. Bert: Pre-training of deep bidirectional transformers for language understanding. CoRR, abs/1810.04805

    2018 arXiv

  2. [10]

    Emily Dinan, Varvara Logacheva, Valentin Malykh, Alexander Miller, Kurt Shuster, Jack Urbanek, Douwe Kiela, Arthur Szlam, Iulian Serban, Ryan Lowe, et al. 2019. The second conversational intelligence challenge (convai2). arXiv preprint arXiv:1902.00098

    2019 arXiv

  3. [11]

    Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2018. https://aclanthology.info/papers/P18-2006/p18-2006 Hotflip: White-box adversarial examples for text classification . In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics, ACL 201...

    2018

  4. [12]

    Allyson Ettinger, Sudha Rao, Hal Daum \'e III, and Emily M Bender. 2017. Towards linguistically generalizable nlp systems: A workshop and shared task. arXiv preprint arXiv:1711.01505

    2017 arXiv

  5. [13]

    Patxi Gal \'a n-Garc \' a, Jos \'e Gaviria de la Puerta, Carlos Laorden G \'o mez, Igor Santos, and Pablo Garc \' a Bringas. 2016. Supervised machine learning for the detection of troll profiles in twitter social network: Application to a real case of cyberbullying. Logic Jour...

    2016

  6. [14]

    Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. 2014. Generative adversarial nets. In Advances in neural information processing systems, pages 2672--2680

    2014

  7. [15]

    Google. 2018. https://www.kaggle.com/c/jigsaw-toxic-comment-classification-challenge Toxic comment classification challenge

    2018

  8. [16]

    o ndahl, Luca Pajola, Mika Juuti, Mauro Conti, and N Asokan. 2018. All you need is

    Tommi Gr \"o ndahl, Luca Pajola, Mika Juuti, Mauro Conti, and N Asokan. 2018. All you need is" love": Evading hate-speech detection. arXiv preprint arXiv:1808.09115

    2018 arXiv

  9. [17]

    Peter Henderson, Koustuv Sinha, Nicolas Angelard-Gontier, Nan Rosemary Ke, Genevieve Fried, Ryan Lowe, and Joelle Pineau. 2018. https://doi.org/10.1145/3278721.3278777 Ethical challenges in data-driven dialogue systems . In Proceedings of the 2018 AAAI/ACM Conference on AI, Et...

    2018

  10. [18]

    trolling

    Susan Herring, Kirk Job-Sluder, Rebecca Scheckler, and Sasha Barab. 2002. Searching for safety online: Managing" trolling" in a feminist forum. The information society, 18(5):371--384

    2002

  11. [19]

    Hossein Hosseini, Sreeram Kannan, Baosen Zhang, and Radha Poovendran. 2017. Deceiving google's perspective api built for detecting toxic comments. arXiv preprint arXiv:1702.08138

    2017 arXiv

  12. [20]

    Robin Jia and Percy Liang. 2017. https://aclanthology.info/papers/D17-1215/d17-1215 Adversarial examples for evaluating reading comprehension systems . In DBLP:conf/emnlp/2017 , pages 2021--2031

    2017

  13. [21]

    Armand Joulin, Edouard Grave, Piotr Bojanowski, and Tomas Mikolov. 2017. Bag of tricks for efficient text classification. In Proceedings of the 15th Conference of the European Chapter of the Association for Computational Linguistics: Volume 2, Short Papers, pages 427--431. Ass...

    2017

  14. [22]

    Chandra Khatri, Behnam Hedayatnia, Rahul Goel, Anushree Venkatesh, Raefer Gabriel, and Arindam Mandal. 2018. http://arxiv.org/abs/1811.12900 Detecting offensive content in open-domain conversations using two stage semi-supervision . CoRR, abs/1811.12900

    2018 arXiv

  15. [23]

    Ojha, Shervin Malmasi, and Marcos Zampieri

    Ritesh Kumar, Atul Kr. Ojha, Shervin Malmasi, and Marcos Zampieri. 2018. https://www.aclweb.org/anthology/W18-4401 Benchmarking aggression identification in social media . In Proceedings of the First Workshop on Trolling, Aggression and Cyberbullying ( TRAC -2018) , pages 1--1...

    2018

  16. [24]

    Jiwei Li, Will Monroe, Tianlin Shi, S \' e bastien Jean, Alan Ritter, and Dan Jurafsky. 2017. https://aclanthology.info/papers/D17-1230/d17-1230 Adversarial learning for neural dialogue generation . In DBLP:conf/emnlp/2017 , pages 2157--2169

    2017

  17. [25]

    Aishan Liu, Xianglong Liu, Jiaxin Fan, Yuqing Ma, Anlan Zhang, Huiyuan Xie, and Dacheng Tao. 2019. Perceptual-sensitive gan for generating adversarial patches

    2019

  18. [26]

    David Noever. 2018. Machine learning suites for online toxicity detection. arXiv preprint arXiv:1810.01869

    2018 arXiv

  19. [27]

    Martha Palmer, Rebecca Hwa, and Sebastian Riedel, editors. 2017. https://aclanthology.info/volumes/proceedings-of-the-2017-conference-on-empirical-methods-in-natural-language-processing Proceedings of the 2017 Conference on Empirical Methods in Natural Language Processing, EMN...

    2017

  20. [28]

    Jeffrey Pennington, Richard Socher, and Christopher D. Manning. 2014. http://www.aclweb.org/anthology/D14-1162 Glove: Global vectors for word representation . In Empirical Methods in Natural Language Processing (EMNLP), pages 1532--1543

    2014

  21. [29]

    Andrew Ruef, Michael Hicks, James Parker, Dave Levin, Michelle L Mazurek, and Piotr Mardziel. 2016. Build it, break it, fix it: Contesting secure development. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pages 690--703. ACM

    2016

  22. [30]

    Pnina Shachaf and Noriko Hara. 2010. Beyond vandalism: Wikipedia trolls. Journal of Information Science, 36(3):357--370

    2010

  23. [31]

    Leandro Silva, Mainack Mondal, Denzil Correa, Fabr \' cio Benevenuto, and Ingmar Weber. 2016. Analyzing the targets of hate in online social media. In Tenth International AAAI Conference on Web and Social Media

    2016

  24. [32]

    Marty J Wolf, K Miller, and Frances S Grodzinsky. 2017. Why we should have seen that coming: comments on microsoft's tay experiment, and wider implications. ACM SIGCAS Computers and Society, 47(3):54--64

    2017

  25. [33]

    Ellery Wulczyn, Nithum Thain, and Lucas Dixon. 2017. https://doi.org/10.1145/3038912.3052591 Ex machina: Personal attacks seen at scale . In Proceedings of the 26th International Conference on World Wide Web, WWW 2017, Perth, Australia, April 3-7, 2017 , pages 1391--1399. ACM

    2017

  26. [34]

    Miller, Arthur Szlam, Douwe Kiela, and Jason Weston

    Zhilin Yang, Saizheng Zhang, Jack Urbanek, Will Feng, Alexander H. Miller, Arthur Szlam, Douwe Kiela, and Jason Weston. 2018. https://openreview.net/forum?id=SJ-C6JbRW Mastering the dungeon: Grounded language learning by mechanical turker descent . In DBLP:conf/iclr/2018

    2018

  27. [35]

    Marcos Zampieri, Shervin Malmasi, Preslav Nakov, Sara Rosenthal, Noura Farra, and Ritesh Kumar. 2019. Semeval-2019 task 6: Identifying and categorizing offensive language in social media (offenseval). arXiv preprint arXiv:1903.08983

    2019 arXiv

  28. [36]

    Saizheng Zhang, Emily Dinan, Jack Urbanek, Arthur Szlam, Douwe Kiela, and Jason Weston. 2018. https://aclanthology.info/papers/P18-1205/p18-1205 Personalizing dialogue agents: I have a dog, do you have pets too? In Proceedings of the 56th Annual Meeting of the Association for ...

    2018

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.