💻 computer science

All Changes May Have Invariant Principles: Improving Ever-Shifting Harmful Meme Detection via Design Concept Reproduction

This paper proposes RepMD, a novel method that improves the detection of ever-shifting harmful memes by constructing a Design Concept Graph to reproduce underlying malicious design principles and guide a Multimodal Large Language Model, achieving high accuracy and efficiency even when memes evolve over time.

Original authors: Ziyou Jiang, Mingyang Li, Junjie Wang, Yuekai Huang, Jie Huang, Zhiyuan Chang, Zhaoyang Li, Qing Wang

Published 2026-04-17

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Ziyou Jiang, Mingyang Li, Junjie Wang, Yuekai Huang, Jie Huang, Zhiyuan Chang, Zhaoyang Li, Qing Wang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Problem: The "Chameleon" of the Internet

Imagine the internet is a giant, chaotic playground. In this playground, people share memes (funny or relatable images with text). Most memes are harmless fun. But some are harmful memes—they are like digital weapons designed to bully, hate, or spread misinformation.

The problem is that these harmful memes are chameleons.

They change shape (Type Shifting): One day they are racist jokes, the next they are sexist cartoons, then they become political satire.
They change with time (Temporal Evolving): They use new slang, reference current news events, or hide their bad meaning behind inside jokes that only a specific group understands.

The Old Way: Previous AI detectors were like security guards who memorized a "Wanted" poster. If a criminal looked exactly like the photo on the poster, the guard caught them. But if the criminal put on a disguise, wore a hat, or changed their hair color, the guard said, "That's not the guy I'm looking for," and let them pass.

The New Idea: The "Master Blueprint"

The researchers behind this paper (REPMD) realized something brilliant: Even though the costumes change, the plan to commit the crime often stays the same.

Think of a master criminal. They might wear a mask today and a wig tomorrow, but their method (e.g., "sneak in through the back door," "distract the guard," "steal the jewels") remains consistent.

The paper argues that harmful memes have "Invariant Principles" (unchanging rules). Instead of just looking at the picture, we need to understand the Design Concept—the step-by-step recipe the bad user used to create the hate.

How REPMD Works: The Three-Step Detective Process

The researchers built a system called REPMD (Reproduction-based Ever-shifting Harmful Meme Detection). Here is how it works, step-by-step:

1. The "Autopsy" (Fail Reason Tree)

First, the system looks at all the harmful memes that the AI missed in the past. It asks: "Why did we fail to catch this?"

Analogy: Imagine a detective reviewing cases where a thief got away. They write down the reasons: "The thief wore a disguise," or "The thief used a new code word."
Result: This creates a "Fail Reason Tree," a map of all the tricks bad users use to hide their hate.

2. The "Blueprint" (Design Concept Graph - DCG)

Next, the system takes those tricks and turns them into a Design Concept Graph (DCG). This is the core innovation.

Analogy: Instead of just listing "Thief wore a mask," the system draws a blueprint of the heist.
- Step 1: Pick a target (e.g., a specific group of people).
- Step 2: Pick a "fact" (e.g., "They are crazy").
- Step 3: Combine them to create an attack.
The system builds a library of these blueprints. Even if a new meme uses a totally different image (like a Minecraft character instead of a real person), if the blueprint is "Pick a target + Assign a negative trait," the system recognizes the pattern.
Pruning: The system is smart enough to clean up this library, removing duplicate blueprints so it doesn't get confused by too much information (using a math trick called SVD).

3. The "Guide" (Detecting New Memes)

Finally, when a new, weird meme appears, the system doesn't just look at the picture. It asks the AI: "Hey, does this meme follow any of the blueprints in our library?"

Analogy: The AI gets a cheat sheet. Instead of guessing, it says: "Ah, this meme is using the 'Stereotype Attack' blueprint. It's taking a harmless fact and attaching it to a specific group to make them look bad. This is harmful."

Why This is a Game Changer

It Catches the "Invisible" Attacks:
Some memes are subtle. For example, a meme might not say "I hate Black people." Instead, it might highlight a nose stud on a Black person and circle it in red, implying a stereotype. Old AI might see a nose stud and say, "Safe." REPMD sees the blueprint ("Highlighting a feature to stereotype") and says, "Danger!"
It Adapts to Time:
Because it learns the method rather than the image, it works even when memes evolve. If a new slang word appears, the system doesn't need to be retrained; it just needs to see that the slang is being used in a "harmful blueprint."
It Helps Humans Too:
The researchers tested this with human moderators. When the AI gave them the "Blueprint" explanation, humans could spot the harmful memes 15 to 30 seconds faster. It's like giving a detective a magnifying glass that highlights exactly where the clue is hidden.

The Results

Accuracy: The system achieved 81.1% accuracy, beating all previous methods.
Speed: It helps humans work faster.
Robustness: It works even when the memes change types (from racism to sexism) or time (new events).

Summary

REPMD is like upgrading from a security guard who memorizes faces to a security guard who understands criminal psychology. It knows that while the criminal's outfit changes, their plan to cause trouble usually follows the same old steps. By teaching the AI to recognize the plan (the Design Concept), we can catch the bad memes no matter how they try to disguise themselves.

1. Problem Statement

Harmful memes on the internet are characterized by an "ever-shifting" nature, making them difficult to detect using traditional methods. This shifting nature manifests in two ways:

Type-Shifting: Memes attack different targets and utilize diverse forms (e.g., racism, misogyny, sarcasm) that evolve rapidly.
Temporal-Evolving: Memes are tightly coupled with current events and slang, causing their visual and textual expressions to change quickly over time.

Existing detection methods (often relying on multimodal feature fusion or few-shot learning) struggle because they learn specific combinations of harmful elements rather than the underlying logic of the attack. Consequently, they fail to detect implicit expressions (e.g., using a nose stud to imply racism) or new slang abbreviations. The core challenge is to identify the invariant principles (the malicious user's design concept) that persist despite surface-level changes.

2. Methodology: REPMD

The authors propose REPMD (Reproduction-based Ever-shifting Harmful Meme Detection), a framework that reproduces the malicious user's design process to guide Multimodal Large Language Models (MLLMs). The methodology consists of three main stages:

A. Fail Reason Tree Construction ( $G_F$ )

Before building the solution, the system analyzes why current MLLMs fail to detect specific memes.

Process: Historical memes are tested against multiple state-of-the-art MLLMs (e.g., GPT-4o, Qwen3VL). Cases where $\ge$ 3 models fail are selected.
Structure: A Fail Reason Tree is generated using a large MLLM (Qwen3VL-235B). It contains:
- Type Nodes ( $N_T$ ): Macro and sub-types of the harm (e.g., Gender $\to$ Misogyny).
- Fail Reason Nodes ( $N_F$ ): Explanations of why the detection failed (e.g., "implicit expression," "cultural nuance").
Optimization: The insights from these trees are used to optimize the detection prompts for future tasks.

B. Design Concept Graph (DCG) Construction

The core innovation is the Design Concept Graph (DCG), inspired by Attack Trees used in cybersecurity. It formalizes the "reproduction steps" a malicious user takes.

Node Derivation: The system converts "Fail Reasons" into "Reproduction Steps" by asking the MLLM:
1. What are the surface elements?
2. What is the logic gate (AND/OR/NOT) combining them?
3. What is the Reproduction Goal (e.g., "Specify a fact to a specific group to attack them")?
4. Are there alternative elements? (To identify invariant principles).
Graph Structure: The DCG is a heterogeneous graph containing Type Nodes, Reproduction Method Nodes ( $N_M$ ), Logic Gates ( $N_\sigma$ ), and Reproduction Goals ( $N_G$ ).
SVD-Based Pruning: Since the raw DCG contains redundant nodes from similar memes, the authors propose a Singular Value Decomposition (SVD) based pruning algorithm.
- It constructs an adjacency matrix representing node correlations.
- It uses a logarithmic cut-off on singular values to retain the most significant nodes (the "head" of the distribution) while pruning redundant edges, ensuring the graph remains compact and computationally efficient.

C. DCG-Guided Detection

For a new target meme:

Retrieval: The system retrieves relevant reproduction steps from the pruned DCG that match the target meme's context.
Guidance Generation: These steps are converted into a step-by-step logical guide (e.g., "Step 1: Identify the target group; Step 2: Note the specific fact specified to them...").
Detection: The target meme and the generated guidance are fed into the test MLLM with an optimized prompt, enabling the model to reason through the design concept rather than just pattern matching.

3. Key Contributions

Invariant Principle Discovery: The paper introduces the concept that while meme surfaces shift, the design concepts (the logic of how an attack is constructed) remain invariant.
Design Concept Graph (DCG): A novel, explainable graph structure derived from attack trees that formally describes the steps of designing a harmful meme.
SVD-Based Graph Pruning: An efficient algorithm to reduce the complexity of the DCG, balancing performance and computational cost.
Framework for Ever-Shifting Detection: A complete pipeline (Fail Reason Tree $\to$ DCG $\to$ Guided Detection) that generalizes well to unseen meme types and temporal shifts.
Human Efficiency: The framework not only automates detection but also aids human moderators by providing explainable reasoning steps.

4. Experimental Results

The authors evaluated REPMD on a dataset of 58,192 memes (from GOAT-Bench and Twitter) across two scenarios:

Type-Shifting (Cross-Domain):
- REPMD achieved 81.1% accuracy, outperforming all baselines (including few-shot SFT and RAG methods).
- It showed high robustness in Out-of-Domain (OOD) evaluation, with only a 2.1% accuracy drop compared to In-Domain performance, whereas baselines dropped by ~19%.
Temporal-Evolving:
- Tested on memes from different quarters of 2025. REPMD improved upon vanilla MLLMs by +14.3% accuracy on average.
- It successfully detected memes using subcultural metaphors (e.g., Minecraft "Creeper" explosions representing violence) that standard models missed.
Ablation Studies:
- Removing the DCG or the SVD pruning caused significant performance drops (up to -9.2%), confirming the necessity of the design concept reproduction and pruning.
Human Evaluation:
- Human evaluators could identify harmful memes 15–30 seconds faster when assisted by DCG guidance.
- The DCG scored significantly higher (4.4/5) than raw fail trees in Explainability, making it easier for humans to understand why a meme is harmful.
Safeguarding:
- The DCG was also used to "guard" text-to-image models, reducing the success rate of generating harmful memes by over 50% by identifying and blocking the underlying design concepts.

5. Significance

Paradigm Shift: Moves harmful content detection from feature-based (what does the image look like?) to logic-based (how was this attack designed?).
Explainability: Unlike black-box deep learning models, REPMD provides a structured, step-by-step rationale for its decisions, which is crucial for trust and human-in-the-loop moderation.
Generalizability: The approach addresses the "cold start" problem for new meme types by leveraging the invariant design logic rather than requiring massive retraining on new data.
Security Application: The methodology bridges the gap between offensive security (attack trees) and content moderation, offering a robust framework for detecting evolving digital threats.