A Holistic Approach to Undesired Content Detection in the Real World
Open accessAbstract
We present a holistic approach to building a robust and useful natural language classification system for real-world content moderation. The success of such a system relies on a chain of carefully designed and executed steps, including the design of content taxonomies and labeling instructions, data quality control, an active learning pipeline to capture rare events, and a variety of methods to make the model robust and to avoid overfitting. Our moderation system is trained to detect a broad set of categories of undesired content, including sexual content, hateful content, violence, self-harm, and harassment. This approach generalizes to a wide range of different content taxonomies and can be used to create high-quality content classifiers that outperform off-the-shelf models.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Existing LLM defenses typically analyze either user prompts or generated outputs, but not both.
“Existing defenses typically analyze either user prompts or generated outputs, but not both.”
From Verifying Intent and Harm: A Unified Defense Against LLM-Generated Threats (2026) · cites this paper as [13]
LLMs can be prompted to generate harmful or toxic content across adversarial contexts.
“LLMs can be prompted to generate harmful or toxic content across adversarial contexts.”
From Verifying Intent and Harm: A Unified Defense Against LLM-Generated Threats (2026) · cites this paper as [13]
Cited by
Sorted by citations
ChatGPT and the rise of large language models: the new AI-driven infodemic threat in public health
De Angelis, L., Baglivo, F., Arzilli, G., Privitera, G. P., Ferragina, P., Tozzi, A. E., & Rizzo, C. (2023) · Frontiers in Public Health · doi:10.3389/fpubh.2023.1166120 · Cited by 708 · see citing works
Chatbots and mental health: Insights into the safety of generative <scp>AI</scp>
De Freitas, J., Uğuralp, A. K., Oğuz‐Uğuralp, Z., & Puntoni, S. (2024) · Journal of Consumer Psychology · doi:10.1002/jcpy.1393 · Cited by 211 · see citing works
Larger and more instructable language models become less reliable
Zhou, L., Schellaert, W., Martínez-Plumed, F., Moros-Daval, Y., Ferri, C., & Hernández-Orallo, J. (2024) · Nature · doi:10.1038/s41586-024-07930-y · Cited by 203 · see citing works
Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attacks
Kang, D., Li, X., Stoica, I., Guestrin, C., Zaharia, M., & Hashimoto, T. (2024) · 2024 IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw63631.2024.00018 · Cited by 114 · see citing works
Hey ChatGPT, Let’s Talk About Sexual Consent
Marcantonio, T. L., Nielsen, K. E., Haikalis, M., Leone, R. M., Woerner, J., Neilson, E. C., & Schipani-McLaughlin, A. M. (2025) · The Journal of Sex Research · doi:10.1080/00224499.2023.2254772 · Cited by 21 · see citing works
Data-Efficient Strategies for Expanding Hate Speech Detection into Under-Resourced Languages
Röttger, P., Nozza, D., Bianchi, F., & Hovy, D. (2022) · Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing · doi:10.18653/v1/2022.emnlp-main.383 · Cited by 18 · see citing works
Malla: Demystifying Real-world Large Language Model Integrated Malicious Services
Lin, Z., Cui, J., Liao, X., & Wang, X. (2024) · arXiv · doi:10.48550/arxiv.2401.03315 · Cited by 13 · see citing works
“…of guardrails, which are designed to monitor and control LLM inputs and outputs and deployed by LLM providers (e.g., the OpenAI Moderation Endpoint [106,111] and Llama Guard [100]) or third parties (e.g., NeMo Guardrails [120], the OpenChatKit Moderation Model [71], and Guardrails AI [37]).”
MethodAI Companions Reduce Loneliness
De Freitas, J., Uguralp, A. K., Uguralp, Z. O., & Stefano, P. (2024) · arXiv · doi:10.48550/arxiv.2407.19096 · Cited by 12 · see citing works
R-Judge: Benchmarking Safety Risk Awareness for LLM Agents
Yuan, T., He, Z., Dong, L., Wang, Y., Zhao, R., Xia, T., Xu, L., Zhou, B., Li, F., Zhang, Z., et al. (2024) · arXiv · doi:10.48550/arxiv.2401.10019 · Cited by 2 · see citing works
“Llama Guard presents superior performance in content moderation, with 91.50% of F1 in its internal test set, and approaches GPT-4 in public datasets such as Ope-nAI Mod (Markov et al., 2023) and BeaverTails-30k (Ji et al., 2024).”
BackgroundInfluentialVerifying Intent and Harm: A Unified Defense Against LLM-Generated Threats
Thota, P., Lei, Y., Thangaraj, S., Jonnalagadda, S. R., & Nilizadeh, S. (2026) · arXiv · doi:10.48550/arxiv.2606.26377
“General-purpose moderators such as LlamaGuard [10], ShieldGemma [11], WildGuard [12], and the OpenAI Mod-eration API [13] provide broad coverage across harmful content categories.”
Influential
- Authors
- Markov, T., Zhang, C., Agarwal, S., Eloundou, T., Lee, T., Adler, S., Jiang, A., & Weng, L.
- Affiliations
- OpenAI (United States) (US)
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2022
- Volume
- 37
- Issue
- 12
- Pages
- 15009-15018
- ISSN
- 2159-5399 (ISSN-L)
- arXiv
- 2208.03274
- OpenAlex
- W4382318449
- Cited by
- 129
- References
- 0
- Citations by year
- 2026: 31 · 2025: 42 · 2024: 35 · 2023: 20 · 2022: 1
- FWCI
- 22.66
- Type
- conference paper
- Language
- en
- Open access
- diamond
- doi.org
- Locations
- Proceedings of the AAAI Conference on Artificial Intelligence (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- AAAI Publications (The Association for the Advancement of Artificial Intelligence (AAAI)) (submittedVersion)
- arXiv (Cornell University) (cc-by)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Hate Speech and Cyberbullying Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Text and Document Classification Technologies
- Physical Sciences › Computer Science › Artificial Intelligence › Sentiment Analysis and Opinion Mining
- Keywords
- content moderation, natural language classification, data quality control, active learning (machine learning), rare event detection, model robustness, overfitting, hate speech, violence detection, self-harm detection, harassment detection
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
