Paper deep dive
Calling the Bluff: Detecting Ever-Shifting Harmful Chat Dialogue via Ordered Reasoning Chain Regularization
Haojie Yu, Ziyou Jiang, Junjie Wang, Mingyang Li, Yuekai Huang, Jie Huang, Qing Wang
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 92%
Last extracted: 8/12/2026, 1:39:13 AM
Summary
The paper introduces BRACE (Blended Reasoning-chain Augmented Classification Engine), a novel framework for detecting ever-shifting harmful chat dialogues. BRACE utilizes an Ordered Reasoning Chain (ORC) that decomposes harm detection into four differentiable stages: Topic Profiling, Indicator Detection, Severity Assessment, and Type Classification. This structured regularizer is blended with direct classification heads and supported by a Prototype Memory Bank for feature augmentation. The model achieves high performance (Macro F1 0.934-0.949) across multiple domains and harm categories, effectively handling lexical evasion and semantic ambiguity.
Entities (12)
Relation Signals (9)
Ordered Reasoning Chain → consistsof → Type Classification
confidence 95% · Stage 4: Type Classification f4 (Type Classification)
Ordered Reasoning Chain → consistsof → Topic Profiling
confidence 95% · The Ordered Reasoning Chain instantiates C with differentiable modules... Stage 1: Topic Profiling
Ordered Reasoning Chain → consistsof → Indicator Detection
confidence 95% · Stage 2: Indicator Detection f2 (Indicator Detection)
Ordered Reasoning Chain → consistsof → Severity Assessment
confidence 95% · Stage 3: Severity Assessment f3 (Severity Assessment)
BRACE → uses → Ordered Reasoning Chain
confidence 95% · We propose BRACE, which encodes the ORC as four differentiable stages... serving as a structured regularizer
BRACE → uses → Prototype Memory Bank
confidence 95% · We then augment these encoder representations with a Prototype Memory Bank... producing category-aware representations
BRACE → achievesperformanceon → RoBERTa-wwm-ext
confidence 90% · BRACE achieves harm-type macro F1 of 0.934 (RoBERTa-wwm-ext, 3-seed mean)
BRACE → achievesperformanceon → Qwen3-1.7B
confidence 90% · with decoder backbones (Qwen3-1.7B LoRA) reaching 0.949
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Harmful chat dialogues are ever-shifting through type-shifting and lexical evasion, yet we find they share invariant principles, i.e., an Ordered Reasoning Chain (ORC) of recurring topics, harm language indicators, severity hierarchies, and type characteristics, which can help us capture the key information in the frequently changing lexical expressions. We propose BRACE, which encodes the ORC as four differentiable stages (Topic -> Indicator -> Severity -> Type) with intermediate supervision, serving as a structured regularizer blended with direct heads, and supported by prototype-based feature augmentation and feature path disentanglement. The evaluation results show that, across 4 domains and 5 harm categories, BRACE achieves harm-type macro F1 of 0.934 (RoBERTa-wwm-ext, 3-seed mean), with decoder backbones (Qwen3-1.7B LoRA) reaching 0.949. Ablation studies show that all components contribute to BRACE, and the structural decomposition of ORC enables BRACE to distinguish harmful types with semantic ambiguity. Disclaimer: This paper may contain content that is disturbing to some readers.
Tags
Links
- Source: https://arxiv.org/abs/2608.08451v1
- Canonical: https://arxiv.org/abs/2608.08451v1
Trouble viewing inline? Open PDF directly →
Full Text
47,164 characters extracted from source content.
Expand or collapse full text
Calling the Bluff: Detecting Ever-Shifting Harmful Chat Dialogue via Ordered Reasoning Chain Regularization Haojie Yu1,2,3, Ziyou Jiang1,2,3 , Junjie Wang1,2,3, Mingyang Li1,2,3, Yuekai Huang1,2,3, Jie Huang1,2,3, Qing Wang1,2,3 Abstract Harmful chat dialogues are ever-shifting through type-shifting and lexical evasion, yet we find they share invariant principles, i.e., an Ordered Reasoning Chain (ORC) of recurring topics, harm language indicators, severity hierarchies, and type characteristics, which can help us capture the key information in the frequently changing lexical expressions. We propose BRACE, which encodes the ORC as four differentiable stages (Topic → Indicator → Severity → Type) with intermediate supervision, serving as a structured regularizer blended with direct heads, and supported by prototype-based feature augmentation and feature path disentanglement. The evaluation results show that, across 4 domains and 5 harm categories, BRACE achieves harm-type macro F1 of 0.934 (RoBERTa-wwm-ext, 3-seed mean), with decoder backbones (Qwen3-1.7B LoRA) reaching 0.949. Ablation studies show that all components contribute to BRACE, and the structural decomposition of ORC enables BRACE to distinguish harmful types with semantic ambiguity. Disclaimer: This paper may contain content that is disturbing to some readers. Introduction The proliferation of online chat platforms, e.g., Slack, Freenode, and Telegram, poses a tremendous impact on the generation and dissemination of Internet public opinion. Due to malicious users freely expressing their opinions, these platforms host a wide spectrum of harmful types, including hate speech (Kiela et al. 2020), harassment, and illicit transaction discussions, which pose urgent risks to user safety and community well-being (Khapre et al. 2025). Over 40% of U.S. adults have experienced online harassment, and platform moderators face an ever-growing volume of harmful interactions, which require strict regulation and management. Some researchers propose automatic approaches (Huertas-García et al. 2023; Kang et al. 2025) that incorporate predefined malicious keywords into neural moderation systems to identify harmful dialogues statically. Figure 1: Motivation of ORC for harmful dialogue detection. Unlike static content, such as online posts or articles, chat dialogues are inherently conversational and ever-shifting: malicious users continuously transform harmful word expressions to preserve the harmful intent and bypass the content regulation of the Internet, a phenomenon known in content moderation research as lexical evasion (Huertas-García et al. 2023) (Figure 1). As shown in Figure 1, a drug addict discovers that an explicit Chinese term for “Drug” is blocked, so they evade the keyword through transformations—adopting the slang euphemism “Liu-Bing” (“ice skating”, a common street term for methamphetamine); when “Liu-Bing” is added to blocklists, they switch to its Latin pinyin spelling, phonetically identical to any Chinese reader. Some recent works have utilized chain‑of‑thought, retrieval, or concept reproduction (Li et al. 2025a, b; Mei et al. 2025; Jiang et al. 2026a) approaches to address this issue, but fail to identify these harmful dialogues because they cannot track frequently changing ways of expression, highlighting the challenge of ever-shifting harmful dialogue detection. To address this, we draw inspiration from the poker metaphor of calling the bluff: harmful users bet that detectors will be fooled by surface-level lexical tricks, yet their underlying communicative intent—the reasoning chain of what is discussed, where harmful signals appear, how severe, and which type—remains invariant. We therefore decompose harm detection into a four-stage ORC (Topic → Indicator → Severity → Type). Whether the harmful user writes the word “Liu-Bing”, Figure 1 shows the reasoning chain remains identical to the “Drug”: the topic is still Drug, because contextual cues, i.e.m “price,” quantity units, and transactional phrasing, lock the topic to Drug regardless of which surface term is used; “Liu-Bing” then activates as a methamphetamine euphemism under that topic but would be inert under Sports. In the previous cases, we can see that the ORC is useful. However, there is no such work that formally defines the structure of ORC and explains why it is helpful with experimental results. Therefore, we need to define ORC’s structure and derive the contents based on the user’s dialogue interaction mode. Moreover, we also need to illustrate how the ORC can accurately distinguish different harmful types when the dialogue’s semantics are ambiguous, especially for gambling (H2) and fraud-related illegal activity (H5) in Section 4. In this paper, we propose BRACE (Blended Reasoning-chain Augmented Classification Engine). Inspired by successive refinement in information theory (Equitz and Cover 1991), BRACE integrates three components. We first introduce an Ordered Reasoning Chain (ORC) that decomposes harm detection into four sequential steps (Topic → Indicator → Severity → Type) with intermediate supervision to regularize learning and resolve semantic ambiguity. We then augment these encoder representations with a Prototype Memory Bank, where learnable category prototypes enrich features via cross-attention, producing category-aware representations for fine-grained discrimination. Finally, direct heads with feature path disentanglement route harm type through these prototype-augmented features (70%) blended with chain reasoning (30%), while binary and severity read from the holistic CLS embedding, eliminating gradient competition between tasks. We evaluate BRACE across over 20 dialogue safety benchmarks and 3 additional domain-specific sources, covering diverse platforms, languages, and harm categories. With a RoBERTa-wwm-ext backbone, BRACE achieves a harm type macro F1 of 0.934 and severity accuracy of 0.818. Binary detection performance, per-category diagnostics, and cross-backbone statistical tests are reported in Table 2 and the Technical Supplement. Decoder backbones further improve performance, reaching a harm type macro F1 of 0.949. Comprehensive ablation studies confirm the ORC as the dominant mechanism and validate each component’s contribution. Interpretability analysis demonstrates that the ORC produces meaningful intermediate outputs, i.e., topic distributions, indicator heatmaps, and evidence spans, which provide auditability for moderation decisions. The paper makes the following contributions: • We propose BRACE, a harmful dialogue detector that utilizes ORC to distinguish the ambiguous boundaries between harmful types, thus improving the detection accuracy of ever-shifting harmful dialogues. • We evaluate BRACE across 11 diverse dialogue sources spanning Chinese and English platforms, achieving Macro-F1 of 0.934 and improving by +23.3% over frozen-encoder baselines. • We will release the code and dataset to facilitate BRACE’s reproducibility. Definition of ORC We define two architectural components that collectively specify the structural properties of harmful dialogue detection. Section 3 describes their concrete realization. Basic Structure of ORC Harmful dialogue analysis follows a natural sequential structure, i.e., identifying what topic is discussed, where harmful signals appear, how severe the harm is, and which type of harm it constitutes. This four-dimensional structure is formalized as the ORC’s basic structure =(f1,f2,f3,f4)C=(f_1,f_2,f_3,f_4), where each stage conditions on prior outputs f<if_<i: • f1f_1: Topic Profiling: cls↦∈Δ−1x_cls ∈ ^T-1, a distribution over T topics, answering what information the users discuss in the dialogue. • f2f_2: Indicator Detection: (,)↦∈[0,1]L×ℐ(X,z) ∈[0,1]^L×I, a token-level heatmap over ℐI harm language indicators with topic-conditioned activation, answering where harmful signals appear. • f3f_3: Severity Assessment: ↦^chain∈Δ4X v^chain∈ ^4, a distribution over five severity levels (L0: normal to L4: critical), answering how severe. • f4f_4: Type Classification: (¯,^chain)↦^chain∈[0,1]C( h, v^chain) y^chain∈[0,1]^C, combining mean-pooled indicator features with severity context to determine which type. The chain serves as a structured regularizer: each stage receives auxiliary supervision through ℒchainL_chain, constraining the shared encoder. Chain predictions blend with direct heads as ^=α^direct+(1−α)^chain y=α y^direct+(1-α) y^chain (α∈(0.5,1)α∈(0.5,1)), where α>0.5α>0.5 reflects direct heads as the primary inference path. Prototype Memory Bank: ORC’s Codebook Raw encoder features lack explicit category-level structure. We define a Prototype Memory Bank ∈ℝC×K×DP ^C× K× D, where each c,k∈ℝDp_c,k ^D is a learnable semantic anchor for category c. The Prototype Memory Bank includes three functions as follows: • Feature Augmentation. The Bank maps ↦augf ^aug by computing similarity scores between f and all prototypes, aggregating top-matching prototypes per category into context vectors, and fusing these with f via cross-attention. augf^aug encodes category-level semantics and serves as the feature source for harm type classification. • Adaptation. Prototypes evolve through momentum-based refinement for close-matching samples and explicit replacement of stale prototypes when no existing prototype adequately represents a sample, ensuring coverage of evolving expression patterns. • Diversity Preservation. A contrastive objective ℒprotoL_proto pulls each sample toward all K prototypes of its ground-truth category while pushing away from others; a diversity term ℒdivL_div penalizes high pairwise similarity among within-category prototypes. Figure 2: Overview of BRACE. Together, these two components, i.e., ORC and Prototype Memory Bank, constitute the BRACE architecture. Prediction heads route harm type classification through augf^aug and severity or binary detection through clsx_cls. Section 3 specifies their concrete realization. Methodology We now realize each architectural component defined above as a concrete module. The ordered reasoning chain provides structured regularization via intermediate supervision; direct heads serve as primary classifiers with a 70/30 blend; prototype memory produces category-aware features; and a lightweight MoE router handles binary detection. Figure 2 provides an overview. Embedding ORC with Stagewise Constraints The Ordered Reasoning Chain instantiates C with differentiable modules. As established, the chain serves as a structured regularizer, constraining the shared encoder through auxiliary supervision. Stage 1: Topic Profiling f1f_1 (Topic Profiling) maps the CLS representation cls∈ℝDx_cls ^D to a topic distribution over =20T=20 predefined conversational topics derived via LLM-assisted annotation with human review: =softmax(MLPtopic(cls)), =softmax (MLP_topic(x_cls) ), (1) MLPtopic _topic :ℝD→ℝD/2→ℝ :R^D ^D/2 ^T The topic distribution serves as contextual priors for downstream reasoning stages, enabling topic-conditioned disambiguation of ambiguous terms. Stage 2: Indicator Detection f2f_2 (Indicator Detection) takes the token-level sequence output ∈ℝL×DX ^L× D and the topic distribution z from f1f_1, producing a token-level heatmap ∈ℝL×ℐH ^L×I over ℐ=32I=32 harm language indicators (spanning slurs, threats, drug/gambling euphemisms, suicide risk signals, and identity-based hostility; derived via LLM-assisted annotation). Topic context is projected via Proj:ℝ→ℝDProj:R^T ^D and concatenated with each token’s hidden state before sigmoid activation: ℓ,: _ ,: =σ(MLPind([ℓ;Proj()])), =σ (MLP_ind([x_ ;Proj(z)]) ), (2) MLPind _ind :ℝ2D→ℝD→ℝℐ :R^2D ^D ^I Topic-conditioning enables disambiguation: the same token activates different indicators depending on topic context (e.g., drug euphemisms activate under Drugs but not under unrelated topics). Stage 3: Severity Assessment f3f_3 (Severity Assessment) evaluates the harm level on a five-point scale (L0: normal, L1: mild, L2: moderate, L3: severe, L4: critical). We employ attention pooling over token-level hidden states to produce a severity representation: αℓ=softmax(MLPpos(ℓ)),pool=∑ℓ=1Lαℓ⋅ℓ _ =softmax (MLP_pos(x_ ) ), _pool= _ =1^L _ ·x_ (3) The severity logits are ^chain=MLPsev(pool) v^chain=MLP_sev(v_pool), where MLPsev:ℝD→ℝD/2→ℝ5MLP_sev:R^D ^D/2 ^5. Stage 4: Type Classification f4f_4 (Type Classification) combines indicator features from f2f_2 with severity context from f3f_3: ^chain=MLPtype([Projind(¯);softmax(^chain)]) y^chain=MLP_type([Proj_ind( h);softmax( v^chain)]), where ¯=1L∑ℓ,: h= 1L _ H_ ,:, MLPtype:ℝD+5→ℝD→ℝCMLP_type:R^D+5 ^D ^C, and C=5C=5. Walkthrough: Why Sequential Reasoning is Necessary We illustrate the chain’s sequential dependency with a concrete example drawn from our corpus (Fig. 2, chain path)—a player coordinating a SWATting attack through gaming terminology (CS2 Discord): A: ‘this guy stream-sniped us, I pulled his info, got the full loadout’ B: ‘no way you got his addy already’ A: ‘parents’ house too, gonna send a wellness check since he’s been acting so erratic’ A: ‘prime time when he’s live, the viewers deserve to see the special delivery’ Stage 1—Topic (Fig. 2, Stage 1). f1f_1 anchors the dialogue to TGaming Conflict (0.623) rather than TGaming Social (0.148), fundamentally rewriting every ambiguous term: Phrase Under TConflict Under TSocial “wellness check” SWAT false report concern for friend “addy” home address (dox) game server IP “special delivery” police raid in-game gift Misclassifying Topic causes irrecoverable failure: every downstream stage reads through the wrong frame. Stage 2—Indicators. With TGaming Conflict as context, f2f_2 activates three harm indicators invisible under TGaming Social: Token Phrase Indicator Activated Activation “addy” IAddrDisclosure 0.94 “wellness check” IFalseEmergency 0.91 “special delivery” IViolentEuphemism 0.88 Without f1f_1’s topic context, these three indicators remain silent and f3f_3 receives no harm signal. Stage 3—Severity (Fig. 2, Stage 3). Attention pooling concentrates on “addy” (0.187), “parents’ house” (0.154), and “wellness check” (0.141); combined signals drive severity to L4 Critical (0.857). Without f2f_2, attention scatters uniformly and severity collapses to L0. Stage 4—Type (Fig. 2, Stage 4). f4f_4 combines indicator features with severity context; the same evidence maps to different types depending on severity: Severity Context Predicted Type Prob. L2 Moderate (hypothetical) H5 Criminal (doxxing) 0.67 L4 Critical (actual) H3 SWATting 0.94 Severity misestimation inverts the type prediction. Each stage thus provides the semantic frame for the next—not merely additional information, but a different interpretive lens—and any broken link propagates irrecoverable error. Evidence Span Extraction and Intermediate Supervision For interpretability, token-level BIO evidence spans are extracted to localize harmful text segments: ^ℓ=softmax(MLPev([ℓ;maxjℓ,j⋅D])) e_ =softmax(MLP_ev([x_ ; _jH_ ,j·1_D])), with MLPev:ℝ2D→ℝD→ℝ2MLP_ev:R^2D ^D ^2. The ordered reasoning chain applies auxiliary training objectives as structured regularization: ℒchain=ℒtypechain+0.5⋅ℒseveritychain+0.3⋅ℒtopicL_chain=L_type^chain+0.5·L_severity^chain+0.3·L_topic (4) using cross-entropy for topic and severity, and binary cross-entropy for multi-label type classification. Aggregating Direct Predictions BRACE employs a 70/30 blended prediction: direct MLP heads provide the primary classification signal (70%), while the ordered reasoning chain provides complementary regularization (30%). The chain alone introduces error cascading; direct heads alone lack inductive bias. Direct Harm Type Head The direct harm type head reads from augf^aug (prototype-augmented features capture category-level semantics): ^direct=MLPht(aug) y^direct=MLP_ht(f^aug) (MLPht:ℝD→ℝD→ℝCMLP_ht:R^D ^D ^C). Final logits blend as ^=0.7^direct+0.3^chain y=0.7 y^direct+0.3 y^chain. Direct Severity Head In contrast, severity assessment reads from the holistic CLS embedding: ^direct=MLPsevdirect(cls) v^direct=MLP_sev^direct(x_cls) (MLPsevdirect:ℝD→ℝD/2→ℝ5MLP_sev^direct:R^D ^D/2 ^5). Final severity logits blend as ^=0.7^direct+0.3^chain v=0.7 v^direct+0.3 v^chain. Augmenting ORC via Prototype Memory The Prototype Memory Bank instantiates ∈ℝC×K×DP ^C× K× D with K prototypes per harm category. Prototype Bank and Augmentation The Prototype Bank is initialized after the first training epoch: for each category c, c,0=cp_c,0= μ_c (class centroid), and c,k=c+0.5⋅c⊙ϵkp_c,k= μ_c+0.5· σ_c ε_k (k≥1k≥ 1) with ϵk∼(0,) ε_k (0,I) and orthogonalization (Saxe, McClelland, and Ganguli 2014) to maximize inter-prototype separation. Augmentation proceeds in three stages. Stage 1 — Similarity: cosine similarity to all prototypes: sc,k=⟨,c,k⟩‖⋅‖c,k‖,∀c∈[C],k∈[K]s_c,k= ,p_c,k \|f\|·\|p_c,k\|, ∀ c∈[C],k∈[K] (5) Stage 2 — Category Context: per category, the top-22 prototypes are softmax-weighted with learnable temperature τ, producing a category context vector c∈ℝDc_c ^D: c=∑r=12exp(sc,kr/τ)∑j=12exp(sc,kj/τ)⋅c,krc_c= _r=1^2 (s_c,k_r/τ) _j=1^2 (s_c,k_j/τ)·p_c,k_r (6) Stage 3 — Cross-Attention Fusion: the stacked category contexts ∈ℝC×DC ^C× D enrich the input feature through multi-head cross-attention with a residual connection: aug=LayerNorm(+MultiHeadAttn(,,))f^aug=LayerNorm (f+MultiHeadAttn(f,C,C) ) (7) augf^aug encodes category-level semantics for the direct harm type head. Prototype Bank Maintenance Prototypes adapt via EMA (m=0.99m=0.99 (He et al. 2020)) on the closest match: c,k∗←m⋅c,k∗+(1−m)⋅p_c,k^*← m·p_c,k^*+(1-m)·f. A graduated cosine threshold (0.3 → 0.7 over 80% training) avoids dead prototypes: when maxks(,c,k)<θreplace=0.5 _ks(f,p_c,k)< _replace=0.5, soft replacement activates (←0.9+0.1p← 0.9p+0.1f). The Bank is trained with multi-positive InfoNCE (Khosla et al. 2020), pulling samples toward all K prototypes of their category: ℒproto=−1B∑i=1Blog∑k=1Kexp(s(i,ci,k)/τ)∑c=1C∑k=1Kexp(s(i,c,k)/τ)L_proto=- 1B _i=1^B _k=1^K (s(f_i,p_c_i,k)/τ) _c=1^C _k=1^K (s(f_i,p_c,k)/τ) (8) Diversity regularization penalizes high pairwise cosine similarity within each category to prevent collapse: ℒdiv=1C∑c=1Cmax(0,1K(K−1)∑k≠k′⟨¯c,k,¯c,k′⟩−0.3)L_div= 1C _c=1^C (0, 1K(K-1) _k≠ k p_c,k, p_c,k -0.3 ) (9) where ¯ p denotes L2-normalized prototypes. MoE Router & Outputs Binary detection uses a lightweight Mixture-of-Experts (MoE) router with E=6E=6 experts (one per harm category plus a general expert). The gate produces soft routing weights =softmax(MLPgate(cls))∈ℝEg=softmax(MLP_gate(x_cls)) ^E, and the binary logit is y^bin=∑e=1Ege⋅Experte(cls) y_bin= _e=1^Eg_e·Expert_e(x_cls). Load balancing regularization (Fedus, Zoph, and Shazeer 2022) prevents expert collapse. Outputs. The framework produces three final predictions. For harm type, the 70/30 blend combines the direct head on augf^aug with the chain’s type prediction: ^=0.7^direct+0.3^chain y=0.7 y^direct+0.3 y^chain, yielding a distribution over H1–H5. For severity, the same 70/30 blend fuses the direct severity head on clsx_cls with the chain’s severity assessment: ^=0.7^direct+0.3^chain v=0.7 v^direct+0.3 v^chain, producing a distribution over L0–L4. For binary harmful/benign detection, the MoE router prediction is used directly (no blend). This three-output design routes each prediction target through its optimal feature path: prototype-augmented features for fine-grained type discrimination, the holistic CLS embedding for severity and binary judgments, and the chain as a shared regularizer across all targets. To train the BRACE, we optimize the model by combining a multi-task objective as follows: ℒtotal _total =ℒbin+0.5ℒtype+0.3ℒproto =L_bin+5L_type+3L_proto (10) +0.1ℒchain+0.1ℒsev+0.1ℒdiv+0.01ℒbal +1L_chain+1L_sev+1L_div+01L_bal where ℒbinL_bin is Focal Loss (α=0.25α=0.25, γ=2.0γ=2.0) (Lin et al. 2017), ℒtypeL_type is multi-label BCE, ℒprotoL_proto the contrastive loss, ℒchainL_chain chain intermediate supervision, ℒsevL_sev cross-entropy, ℒdivL_div diversity regularization, and ℒbalL_bal MoE load balancing (Fedus, Zoph, and Shazeer 2022). Although ℒchainL_chain has low explicit weight (0.1), its predictions participate in ℒtypeL_type and ℒsevL_sev through the 70/30 blend (≈0.7≈ 0.7 effective supervision). Full hyperparameters are provided in Experimental Design. Experimental Design To evaluate BRACE on a comprehensive benchmark spanning 4 domain groups and 5 harm categories. We structure our evaluation in two research questions: • RQ1 (Performance): How does BRACE compare across backbone architectures on harm type, severity, and binary detection vs. linear probe baselines? • RQ2 (Ablation Study): How does each component contribute to the BRACE? We aim to evaluate the contribution of ORC, blend ratio between direct heads, and chain prediction methods, as well as the contribution of the reasoning stage cumulatively. Some additional experimental results, e.g., per-category diagnostics, leave-one-type-out generalization, statistical validation, interpretability, and severity analysis, are provided in the Technical Supplement. Datasets and Data Preparation We construct a multi-source Chinese-English-Spanish dataset with 60,000 dialogues across 5 harm categories (12,000 per category), consolidating 25 public sources into 4 domain groups: (1) ECTC Chinese Platform (domain 0), comprising 22 safety benchmarks—BeaverTails (Ji et al. 2023), PKU-SafeRLHF (Ji et al. 2025), Safety-Prompts (Sun et al. 2023), ToxiCN (Lu et al. 2023), JADE (Zhang, Pan, and Yang 2023), DGHate (Vidgen et al. 2021), HateCheck (Röttger et al. 2021, 2022), Davidson (Davidson et al. 2017), LMSYS-Chat-1M (Zheng et al. 2024), the unalignment-toxic DPO corpus (Lee et al. 2024), Jigsaw (Wulczyn, Thain, and Dixon 2017), and community-sourced Chinese corpora; (2) Reddit (domain 1), English dialogues self-crawled via Pushshift API; (3) MentalRiskES (Mármol-Romero et al. 2024) (domain 2), Spanish mental health risk; and (4) PsySUICIDE (Qiu, Ma, and Lan 2024) (domain 3), Chinese suicide risk. The dataset is partitioned into 42,000/9,000/9,000 train/val/test with source-level stratification. Full details are in the Technical Supplement; the dataset will be released upon publication. Table 1 summarizes the scale. Table 1: Dataset scale. Source Group Sources ECTC Chinese Platform BeaverTails, PKU-SafeRLHF, Safety-Prompts, ToxiCN, JADE, DGHate, HateCheck, Davidson-offensive, LMSYS-Chat-1M, unalignment-toxic-dpo, Jigsaw, +11 community Chinese corpora Reddit Self-crawled English social media dialogues MentalRiskES Spanish mental health risk detection PsySUICIDE Chinese suicide risk assessment Total 60,000 dialogues (5 harm categories × 12,000) Train / Val / Test 42,000 / 9,000 / 9,000 (source-stratified) Table 2: Per-category and overall performance across backbones. LP = linear probe (frozen encoder + classifier). Δ % = relative Harm m-F1 gain of BRACE over LP. Best per metric in bold. Backbone Cond. H1 H2 H3 H4 H5 HarmType m-F1 Δ % Encoder Backbones RoBERTa-wwm (102M) LP 0.7132 0.7398 0.6441 0.7347 0.6757 0.7015 — BRACE 0.9725 0.9937 0.8578 0.9855 0.8620 0.9343 +33.2% ERNIE-Med (93M) LP 0.6425 0.6681 0.5773 0.6631 0.6215 0.6345 — BRACE 0.9699 0.9925 0.8525 0.9841 0.8576 0.9313 +46.8% ERNIE-Mini (27M) LP 0.6117 0.6356 0.5491 0.6305 0.5901 0.6034 — BRACE 0.9682 0.9917 0.8505 0.9833 0.8543 0.9296 +54.1% BERT-base (102M) LP 0.6945 0.7202 0.6272 0.7148 0.6583 0.6830 — BRACE 0.9590 0.9870 0.8405 0.9775 0.8485 0.9225 +35.1% Decoder Backbones ChineseGuard-1.5B BRACE 0.9780 0.9945 0.8820 0.9900 0.8955 0.9480 — Qwen3-1.7B BRACE 0.9785 0.9948 0.8825 0.9905 0.8962 0.9485 — Each dialogue is labeled with harm type (H1 Pornography, H2 Gambling, H3 Violence, H4 Suicide/Self-harm, H5 Other Illegal), severity (L0 normal–L4 critical), binary label, =20T=20 conversational topics, ℐ=32I=32 harm language indicators, and BIO-tagged evidence spans. DeepSeek-V4-Pro generates initial proposals via few-shot prompting; three trained annotators independently review each proposal with a third adjudicator resolving disagreements. We report Cohen’s κ on a dual-annotated calibration subset: LLM–Human agreement (proposals vs. final labels) and Human–Human agreement (pairwise among reviewers) as the upper bound. LLM proposals achieve substantial agreement with adjudicated labels, with Human–Human κ exceeding LLM–Human κ by a consistent margin. Baselines We compare BRACE against three categories. Linear probe: a linear classifier on frozen CLS embeddings from four pre-trained encoders (RoBERTa-wwm-ext, ERNIE-3.0-Medium, ERNIE-3.0-Mini, BERT-base-Chinese). Fine-tuned multi-task: the same encoders unfrozen with a 2-layer MLP head, jointly optimized on harm type, severity, and binary detection. LLM baselines: Qwen3-1.7B and ChineseGuard-1.5B under zero-shot prompting and LoRA fine-tuning (r=8r=8, α=16α=16). Evaluation Metrics For harm type classification, we use per-class and macro-averaged F1 (Harm m-F1) as the primary metric, with predicted probabilities binarized at a threshold of 0.5. Severity estimation is evaluated via overall accuracy and per-level F1 scores across five severity levels (L0–L4). Binary detection performance is measured by binary F1. All encoder-based results are reported as the mean over three random seeds (42, 123, 456), while decoder experiments use a single seed due to computational constraints. Implementation Details Our primary encoder is RoBERTa-wwm-ext (102M parameters, D=768D=768), selected based on backbone comparison results. Large language model baselines use Qwen3-1.7B and ChineseGuard-1.5B with LoRA fine-tuning (r=8r=8, α=16α=16). The Prototype Memory Bank maintains K=8K=8 learnable vectors per category with temperature τ=0.07τ=0.07 and exponential moving average momentum m=0.99m=0.99 for prototype updates. The ORC operates over =20T=20 conversational topics and ℐ=32I=32 harm language indicators across 5 severity levels (L0–L4). We optimize with AdamW, using a learning rate of 2×10−52×10^-5 for the encoder backbone and 1×10−41×10^-4 for newly initialized modules (prototype bank, reasoning chain, router, and task heads). Training uses a batch size of 16 with gradient accumulation steps of 2 (effective batch size 32) and a maximum sequence length of 512 tokens. All encoder experiments are reported as the mean over 3 random seeds (42, 123, 456); decoder experiments use a single seed due to computational constraints. Results Performance of BRACE (RQ1) To compare BRACE against baseline methods, we structure the experimental evaluation around three core research questions. All encoder-based backbones are reported as 3‑seed mean performance on a unified test set comprising 9,000 samples. For decoder‑only models, we adopt LoRA fine‑tuning, while linear probing is omitted as it yields near‑random zero‑shot m‑F1 on this fine‑grained five‑way harmful content classification task. Table 2 shows the comprehensive comparative results across all models and harm categories; we can see that three robust patterns emerge, which collectively underscore the cross‑category generalizability and practical deployability of our approach. First, per‑category intrinsic difficulty is structurally stratified—H2 (gambling) and H4 (suicide) approach ceiling performance (0.98–0.99), whereas H3 (violence, 0.84–0.88) and H5 (other‑illegal, 0.85–0.90) consistently remain the most challenging, reflecting their high intra‑class variance and semantic heterogeneity. Crucially, the relative improvement yielded by BRACE is inversely correlated with the linear‑probing baseline: on the lightweight ERNIE‑Mini (27M), it achieves a striking +54.1% gain, converging within 0.005 m‑F1 of much larger 100M‑parameter encoders (p=0.265p=0.265), which firmly confirms that our method is backbone‑agnostic and scales effectively across architectural scales. Moreover, for decoder‑based models, Qwen3‑1.7B further pushes the hardest categories, lifting H3 to 0.883 and H5 to 0.896—gains of +0.025 and +0.034 over the RoBERTa counterpart. These quantitative results demonstrate that BRACE delivers consistent improvements across diverse harmful content types. The case studies in Figure 3 further illustrate this qualitatively: across cross-lingual suicide risk (H4), religiously framed violence (H3), and culturally specific hate speech (H5), BRACE correctly resolves semantic ambiguity where flat classifiers misjudge, confirming that the ORC provides discriminative signals beyond surface-form correlations. Figure 3: Three representative boundary cases demonstrating ORC-based disambiguation of harmful types. Ablation Study (RQ2) Table 3: Component ablation and reasoning depth (ERNIE-3.0-Medium). Δ = Harm m-F1 change. Configuration Harm m-F1 (Δ ) Full BRACE 0.931 w/o Prototype Memory 0.867 (-0.064) w/o Ordered Reasoning Chain 0.830 (-0.101) w/o MoE Router 0.929 (-0.002) Chain Depth (cumulative, 70/30 blend) Depth 1 (Topic) 0.894 Depth 2 (w/ Indicators) 0.910 (+0.016) Depth 3 (w/ Severity) 0.924 (+0.014) Depth 4 (w/ Type) 0.931 (+0.007) “w/o” removes only the named component. See Technical Supplement for per-category ablation and Binary F1. Figure 4: The t-SNE results’ distribution of dimensionality reduction across different types of harmful dialogues. Table 3 shows the gain from ORC, which is cumulative across reasoning depths: indicator detection (+0.016) and severity assessment (+0.014) are the largest individual steps, each corresponding to further separation in the t‑SNE space—first distinguishing harmful cues, then grading severity levels. In contrast, the MoE router affects only Binary F1 (‑0.046, see Technical Supplement) and leaves inter‑class distances nearly unchanged, confirming its role as a binary‑only specialist with negligible influence on the multi‑class discriminative structure. Thus, ORC drives the global distance expansion and multi‑class performance, while the router plays a complementary but secondary part. The t‑SNE projection of prototype vectors (Fig. 4) confirms this: ORC markedly enlarges inter‑class distances among harmful categories, while its removal collapses these distances into overlapping clusters. Quantitatively, ORC removal induces the largest Harm m‑F1 drop (‑0.101), far exceeding prototype memory removal (‑0.064). This 1.6× gap confirms ORC as the primary mechanism for semantic separability. Related Works Harmful Content Detection Harmful content detection has progressed from binary toxic classification (Kiela et al. 2020) to fine-grained taxonomies (Mathew et al. 2021) and Chinese-specific benchmarks (Wang et al. 2026; Ma, Zhang, and Chen 2025; Zhang et al. 2025). For ever-shifting expressions, RepMD (Jiang et al. 2026a) and JADE (Jiang et al. 2026b) address lexical evasion; BRACE shares the invariant-principles insight but embeds it as architectural regularization. Reasoning-enhanced safety (Li et al. 2025a, b; Wei et al. 2022) uses intermediate reasoning as inference; BRACE employs the chain as a regularizer with direct heads delivering primary predictions. Prototype Learning and Expert Routing Prototype-based methods represent classes through exemplar vectors (Snell, Swersky, and Zemel 2017; Khosla et al. 2020; Ho et al. 2024); BRACE’s prototypes produce augmented representations via cross-attention rather than classifying directly. Mixture-of-Experts (Wu et al. 2024; Goyal et al. 2025) scales capacity through conditional computation; BRACE organizes experts around harm categories, isolating binary detection from harm type features. For multi-task learning, BRACE routes fine-grained classification through augf^aug and holistic judgments through clsx_cls, avoiding gradient competition from shared feature access. Conclusion In this paper, we propose BRACE, which encodes the ORC as four differentiable stages (Topic → Indicator → Severity → Type) with intermediate supervision, serving as a structured regularizer blended with direct heads, and supported by prototype-based feature augmentation and feature path disentanglement. Evaluation across over 20 dialogue safety benchmarks and 3 additional domain-specific sources shows that, with a RoBERTa-wwm-ext backbone, BRACE achieves a harm type macro F1 of 0.934 and severity accuracy of 0.818. Binary detection performance, per-category diagnostics, and cross-backbone statistical tests are reported in Table 2 and the Technical Supplement. Decoder backbones further improve performance, reaching a harm type macro F1 of 0.949. Ablation studies show that all components contribute to BRACE, and the structural decomposition of ORC enables BRACE to distinguish harmful types with semantic ambiguity, References Davidson et al. (2017) Davidson, T.; Warmsley, D.; Macy, M.; and Weber, I. 2017. Automated Hate Speech Detection and the Problem of Offensive Language. In Proceedings of the 11th International Conference on Web and Social Media (ICWSM), 512–515. Equitz and Cover (1991) Equitz, W. H. R.; and Cover, T. M. 1991. Successive Refinement of Information. IEEE Transactions on Information Theory, 37(2): 269–275. Fedus, Zoph, and Shazeer (2022) Fedus, W.; Zoph, B.; and Shazeer, N. 2022. Switch Transformers: Scaling to Trillion Parameter Models with Simple and Efficient Sparsity. Journal of Machine Learning Research, 23(120): 1–39. Goyal et al. (2025) Goyal, A.; Zhan, X.; Chen, Y.; Saha, K.; and Chandrasekharan, E. 2025. MoMoE: Mixture of Moderation Experts Framework for AI-Assisted Online Governance. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing (EMNLP). He et al. (2020) He, K.; Fan, H.; Wu, Y.; Xie, S.; and Girshick, R. 2020. Momentum Contrast for Unsupervised Visual Representation Learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 9726–9735. Ho et al. (2024) Ho, S.; Liu, M.; Du, L.; Gao, L.; and Long, G. 2024. Prototype-Guided Memory Replay for Continual Learning. IEEE Transactions on Neural Networks and Learning Systems. Huertas-García et al. (2023) Huertas-García, Á.; Martín, A.; Huertas-Tato, J.; and Camacho, D. 2023. Countering Malicious Content Moderation Evasion in Online Social Networks: Simulation and Detection of Word Camouflage. Applied Soft Computing, 145: 110574. Ji et al. (2025) Ji, J.; Hong, D.; Zhang, B.; Chen, B.; Dai, J.; Zheng, B.; Qiu, T.; Zhou, J.; Wang, K.; Li, B.; Han, S.; Guo, Y.; and Yang, Y. 2025. PKU-SafeRLHF: Towards Multi-Level Safety Alignment for LLMs with Human Preference. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (ACL), 31983–32016. Ji et al. (2023) Ji, J.; Liu, M.; Dai, J.; Pan, X.; Zhang, C.; Bian, C.; Chen, B.; Sun, R.; Wang, Y.; and Yang, Y. 2023. BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Dataset. In Advances in Neural Information Processing Systems (NeurIPS), volume 36. Datasets and Benchmarks Track. Jiang et al. (2026a) Jiang, Z.; Li, M.; Wang, J.; Huang, Y.; Huang, J.; Chang, Z.; Li, Z.; and Wang, Q. 2026a. All Changes May Have Invariant Principles: Improving Ever-Shifting Harmful Meme Detection via Design Concept Reproduction. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 17595–17613. Jiang et al. (2026b) Jiang, Z.; Liu, M.; Qin, Y.; and Liu, B. 2026b. Breaking Free from Ivory Tower: Evaluating and Enhancing Real-world Chinese Underground Adversarial Jargon Detection. In Proceedings of the 47th IEEE Symposium on Security and Privacy (S&P), 417–435. Kang et al. (2025) Kang, H.; Chen, J.; Li, Y.; Miao, X.; Xu, M.; Zhou, S.; Zhong, M.; Zhu, Y.; and Qian, T. 2025. Developing Continuous Toxicity Detection Against Increasing Types of Perturbed Toxic Text. Computers & Security. Khapre et al. (2025) Khapre, S.; Mersha, M. A.; Shakil, H.; Baruah, J.; and Kalita, J. 2025. Toxicity in Online Platforms and AI Systems: A Survey of Needs, Challenges, Mitigations, and Future Directions. Expert Systems with Applications. ArXiv:2509.25539. Khosla et al. (2020) Khosla, P.; Teterwak, P.; Wang, C.; Sarna, A.; Tian, Y.; Isola, P.; Maschinot, A.; Liu, C.; and Krishnan, D. 2020. Supervised Contrastive Learning. In Advances in Neural Information Processing Systems, volume 33, 18661–18673. Kiela et al. (2020) Kiela, D.; Firooz, H.; Mohan, A.; Goswami, V.; Singh, A.; Ringshia, P.; and Testuggine, D. 2020. The Hateful Memes Challenge: Detecting Hate Speech in Multimodal Memes. In Advances in Neural Information Processing Systems, volume 33, 2611–2624. Lee et al. (2024) Lee, A.; Bai, X.; Pres, I.; Wattenberg, M.; Kummerfeld, J. K.; and Mihalcea, R. 2024. A Mechanistic Understanding of Alignment Algorithms: A Case Study on DPO and Toxicity. arXiv:2401.01967. Li et al. (2025a) Li, C.; Wang, J.; Pan, X.; Hong, G.; and Yang, M. 2025a. ReasoningShield: Safety Detection over Reasoning Traces of Large Reasoning Models. arXiv:2505.17244. Li et al. (2025b) Li, J.-J.; Pyatkin, V.; Kleiman-Weiner, M.; Jiang, L.; Dziri, N.; Collins, A.; Schaich Borg, J.; Sap, M.; Choi, Y.; and Levine, S. 2025b. SafetyAnalyst: Interpretable, Transparent, and Steerable Safety Moderation for AI Behavior. In Proceedings of the 42nd International Conference on Machine Learning, volume 267 of Proceedings of Machine Learning Research, 35731–35752. Lin et al. (2017) Lin, T.-Y.; Goyal, P.; Girshick, R.; He, K.; and Dollár, P. 2017. Focal Loss for Dense Object Detection. In Proceedings of the IEEE International Conference on Computer Vision (ICCV), 2980–2988. Lu et al. (2023) Lu, J.; Xu, B.; Zhang, X.; Min, C.; Yang, L.; and Lin, H. 2023. Facilitating Fine-grained Detection of Chinese Toxic Language: Hierarchical Taxonomy, Resources, and Benchmarks. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (ACL), 16235–16250. Ma, Zhang, and Chen (2025) Ma, Y.; Zhang, N.; and Chen, H. 2025. ChineseHarm-Bench: A Chinese Harmful Content Detection Benchmark with Knowledge-Augmented Baselines. arXiv:2506.10960. Mármol-Romero et al. (2024) Mármol-Romero, A. M.; Moreno-Muñoz, A.; Plaza-del Arco, F. M.; Molina-González, M. D.; Martín-Valdivia, M. T.; Ureña-López, L. A.; and Montejo-Ráez, A. 2024. MentalRiskES: A New Corpus for Early Detection of Mental Disorders in Spanish. In Proceedings of the 2024 Joint International Conference on Computational Linguistics, Language Resources and Evaluation (LREC-COLING), 11204–11214. Mathew et al. (2021) Mathew, B.; Saha, P.; Yimam, S. M.; Biemann, C.; Goyal, P.; and Mukherjee, A. 2021. HateXplain: A Benchmark Dataset for Explainable Hate Speech Detection. In Proceedings of the Conference on Artificial Intelligence, volume 35, 14867–14875. Mei et al. (2025) Mei, J.; Chen, J.; Yang, G.; Lin, W.; and Byrne, B. 2025. Robust Adaptation of Large Multimodal Models for Retrieval Augmented Hateful Meme Detection. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, 23817–23839. Qiu, Ma, and Lan (2024) Qiu, H.; Ma, L.; and Lan, Z. 2024. PsyGUARD: An Automated System for Suicide Detection and Risk Assessment in Psychological Counseling. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing (EMNLP), 4581–4607. Röttger et al. (2022) Röttger, P.; Seelawi, H.; Nozza, D.; Talat, Z.; and Vidgen, B. 2022. Multilingual HateCheck: Functional Tests for Multilingual Hate Speech Detection Models. In Proceedings of the Sixth Workshop on Online Abuse and Harms (WOAH), 154–169. Röttger et al. (2021) Röttger, P.; Vidgen, B.; Nguyen, D.; Waseem, Z.; Margetts, H.; and Pierrehumbert, J. 2021. HateCheck: Functional Tests for Hate Speech Detection Models. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics (ACL), 41–58. Saxe, McClelland, and Ganguli (2014) Saxe, A. M.; McClelland, J. L.; and Ganguli, S. 2014. Exact Solutions to the Nonlinear Dynamics of Learning in Deep Linear Neural Networks. In International Conference on Learning Representations (ICLR). Snell, Swersky, and Zemel (2017) Snell, J.; Swersky, K.; and Zemel, R. 2017. Prototypical Networks for Few-shot Learning. In Advances in Neural Information Processing Systems, volume 30. Sun et al. (2023) Sun, H.; Zhang, Z.; Deng, J.; Cheng, J.; and Huang, M. 2023. Safety Assessment of Chinese Large Language Models. arXiv preprint arXiv:2304.10436. Vidgen et al. (2021) Vidgen, B.; Thrush, T.; Waseem, Z.; and Kiela, D. 2021. Learning from the Worst: Dynamically Generated Datasets to Improve Online Hate Detection. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics (ACL). Wang et al. (2026) Wang, Y.; Zhang, S.; Zhou, Z.; Zhang, L.; Bai, J.; Lu, J.; Fan, B.; and Bu, F. 2026. DiaCOLQ: A Benchmark for Chinese Offensive Language Quadruple Prediction in Multi-Turn Dialogues. Information Processing & Management, 63(7): 104805. Wei et al. (2022) Wei, J.; Wang, X.; Schuurmans, D.; Bosma, M.; Ichter, B.; Xia, F.; Chi, E.; Le, Q. V.; and Zhou, D. 2022. Chain-of-Thought Prompting Elicits Reasoning in Large Language Models. In Advances in Neural Information Processing Systems, volume 35, 24824–24837. Wu et al. (2024) Wu, H.; Qiu, Z.; Wang, Z.; Zhao, H.; and Fu, J. 2024. GW-MoE: Resolving Uncertainty in MoE Router with Global Workspace Theory. arXiv:2406.12375. Wulczyn, Thain, and Dixon (2017) Wulczyn, E.; Thain, N.; and Dixon, L. 2017. Ex Machina: Personal Attacks Seen at Scale. In Proceedings of the 26th International Conference on World Wide Web (W), 1391–1399. Zhang et al. (2025) Zhang, H.; Gao, H.; Hu, Q.; Chen, G.; Yang, L.; Jing, B.; Wei, H.; Wang, B.; Bai, H.; and Yang, L. 2025. ChineseSafe: A Chinese Benchmark for Evaluating Safety in Large Language Models. arXiv:2410.18491. Zhang, Pan, and Yang (2023) Zhang, M.; Pan, X.; and Yang, M. 2023. JADE: A Linguistics-based Safety Evaluation Platform for Large Language Models. arXiv:2311.00286. Zheng et al. (2024) Zheng, L.; Chiang, W.-L.; Sheng, Y.; Li, T.; Zhuang, S.; Wu, Z.; Zhuang, Y.; Li, Z.; Lin, Z.; Xing, E. P.; Gonzalez, J. E.; Stoica, I.; and Zhang, H. 2024. LMSYS-Chat-1M: A Large-Scale Real-World LLM Conversation Dataset. arXiv:2309.11998. Acknowledgement This work was supported by the National Key Research and Development Program of China (No.2024YFF0618800), National Natural Science Foundation of China Grant No.62402484, No.62232016, Postdoctoral Fellowship Program and China Postdoctoral Science Foundation under Grant Number GZC20260867, 2026M791714, Youth Innovation Promotion Association Chinese Academy of Sciences, and Basic Research Program of ISCAS Grant No.ISCAS-JCZD-202405.