Technical Summary: KOTOX – A Korean Toxic Dataset for Deobfuscation and Detoxification

Problem Statement

As Large Language Models (LLMs) are increasingly deployed in online environments, the detection and removal (detoxification) of toxic content have become critical. However, existing research and datasets primarily focus on non-obfuscated text. This limitation reduces the robustness of models when users intentionally disguise toxic expressions to evade automated moderation.

The challenge is particularly acute in the Korean language due to its agglutinative morphology and the specific properties of the Hangeul writing system. These linguistic features allow for diverse surface-level variations—such as phonological shifts, visual substitutions, and spacing perturbations—that preserve the original toxic intent while altering the text's appearance. Current obfuscation approaches often rely on simple techniques (e.g., homophone replacement or emoji insertion) and lack linguistically grounded taxonomies specific to Korean. Furthermore, existing resources do not provide jointly aligned neutral and toxic content with their corresponding obfuscated variants, hindering unified experimentation for both deobfuscation and detoxification.

Methodology

1. Obfuscation Rule Construction

The authors constructed a linguistically grounded taxonomy of Korean obfuscation patterns based on real-world instances collected from online platforms (e.g., Agoda, Google Maps). They defined five categories of transformation rules:

• Phonological: Modifies text while preserving pronunciation (e.g., replacing consonants/vowels with phonetically similar units, resyllabification, liaison).
• Iconological: Generates obfuscation through visual similarity, substituting characters with visually analogous symbols, numbers, or scripts (e.g., Hangeul to CJK or Latin characters, rotation of glyphs).
• Transliteration: Cross-script transformations preserving pronunciation or meaning. This includes substituting Korean expressions with phonetically equivalent foreign scripts (Latin/CJK) or translating words into foreign languages and re-transcribing them into Hangeul.
• Syntactic: Perturbs sentence structure rather than character forms, specifically through spacing variations and syllable-level reordering (anagrams).
• Pragmatic: Inserts symbols or emojis to alter perceived tone and distract automatic interpretation without changing semantic content.

2. Dataset Construction (KOTOX)

The authors introduced KOTOX, the first high-quality paired dataset for Korean obfuscated toxic text. The construction pipeline involved:

• Source Data: Utilizing the K/DA dataset (Korean neutral-toxic pairs) as the foundation.
• Filtering: A rigorous manual filtering process by Korean linguistics experts removed 7,555 pairs down to 2,294 high-quality pairs, addressing issues like mislabeling, semantic ill-formedness, and personally identifiable information (PII).
• Transformation: Applying the defined transformation rules to generate obfuscated counterparts. For each source pair $(x_n, x_t)$, the dataset provides a four-way aligned tuple $(x_n, x_t, \tilde{x}_n, \tilde{x}_t)$, where $\tilde{x}$ denotes the obfuscated version.
• Augmentation: The process generates three augmented pairs per source by applying $k \in \{2, 3, 4\}$ transformation categories, creating "Easy," "Normal," and "Hard" difficulty levels.
• Validation: A sanity check mechanism ensures generated text maintains readability and semantic consistency, discarding invalid transformations.

The final dataset contains 6,882 samples (5,505 training, 687 validation, 690 test) split into neutral-toxic and their obfuscated variants.

3. Evaluation Tasks

The paper defines three evaluation tasks to test model robustness:

1. Obfuscated Toxic Text Classification: Classifying whether an obfuscated text is toxic.
2. Neutral Text Deobfuscation: Recovering the original neutral text from an obfuscated neutral input.
3. Obfuscated Toxic Text Sanitization: Generating a deobfuscated, non-toxic version from an obfuscated toxic input (combining deobfuscation and detoxification).

Experiments were conducted using multiple toxicity classifiers (HateBERT, offensiveRoBERTa, toxicity-xlmr-v2) and instruction-tuned LLMs (Qwen2.5, EXAONE 3.5, Bllossom, GPT-4.1) under zero-shot, few-shot, and supervised fine-tuning (SFT) settings.

Key Results

Classification Robustness

• Baseline Vulnerability: Models trained on original (non-obfuscated) data showed significant performance degradation when evaluated on obfuscated text. For instance, the XLM-R model's F1-score dropped from 95.06 (on original data) to 53.66 (on obfuscated data).
• KOTOX Efficacy: Models fine-tuned on KOTOX demonstrated consistent improvements. SFT on KOTOX achieved the highest performance on obfuscated settings for HateBERT (71.65 F1) and XLM-R (89.57 F1).
• Generalization: Training on KOTOX improved performance on non-obfuscated inputs as well, suggesting that learning obfuscation patterns enhances general robustness. Small encoder-based models fine-tuned on KOTOX approached or surpassed the performance of GPT-4.1 in zero-shot settings.

Deobfuscation and Sanitization

• Zero/Few-Shot Limitations: Pre-trained LLMs showed limited capability in deobfuscating or sanitizing obfuscated text in zero-shot and five-shot settings. While five-shot prompting improved metrics slightly, models often failed to mitigate toxic content while recovering the text form.
• Fine-Tuning Success: Supervised fine-tuning on KOTOX yielded the best results for both deobfuscation and sanitization. Fine-tuned models showed significant gains in semantic reconstruction (BERTScore) and surface-level recovery (chrF).
• Sanitization Challenge: The sanitization task proved most difficult; models frequently succeeded in deobfuscation but retained toxic meaning in few-shot settings. SFT was essential for generating non-toxic outputs.

Rule Analysis

• Error Rates: Phonological transformations were the easiest for models to handle (lowest error ratio: 0.27). Syntactic and pragmatic transformations yielded the highest error ratios (0.35 and 0.36), indicating that structural perturbations and discourse-level signal disruptions are more challenging for current models than surface-level variations.
• Human vs. Model: Human evaluators achieved significantly higher deobfuscation scores (BERTScore ~95.64) compared to fine-tuned Qwen2.5 (77.90), confirming that while the rules preserve human interpretability, they remain difficult for current LLMs.

Significance and Claims

The authors claim that KOTOX is the first dataset to simultaneously support deobfuscation and detoxification for the Korean language, providing paired neutral, toxic, and their obfuscated counterparts.

• Linguistic Grounding: Unlike previous works relying on simple perturbation, KOTOX is built on a taxonomy derived from the specific agglutinative and orthographic properties of Korean and Hangeul.
• Robustness: The dataset enables the training of models that are robust to obfuscated toxic content without sacrificing performance on clean inputs.
• Resource Availability: The authors provide the obfuscation transformation package as an open-source tool, facilitating reproducible generation of obfuscated text for future research.
• Limitations: The study is explicitly limited to the Korean language and Hangeul. The authors acknowledge that the specific rules may not directly generalize to other linguistic contexts, though the framework could be extended.

In conclusion, the paper demonstrates that current LLMs are highly vulnerable to Korean-specific obfuscation patterns and that training on linguistically grounded, paired obfuscated datasets is essential for building safer and more robust language technologies for Korean online environments.