Restoring hidden toxic words, not just flagging them
Most toxicity detectors output a binary label: toxic or not. This paper targets a different output. Chinese users often swap a toxic character for a homophone — the paper's example replaces “操” (cào, a profanity) with “草” (cǎo, meaning grass), or “垃圾” (lājī, rubbish) with “辣鸡” (làjī, spicy chicken). The task the authors call unveiling cloaked toxicity is to restore the cloaked word to its original proto-toxic word, so a moderator sees what was actually meant rather than only a score.
That distinction matters for the paper's claims. The reported gains are on unveiling, meaning the method is judged on whether it recovers the correct original toxic expression, not merely on whether it labels a post toxic. The authors also note that existing methods are mostly built for English, and that Chinese cloaked toxicity unveiling had not been solved in their framing.
Matching candidates through a homophone graph
C2TU builds a graph whose nodes are Chinese characters and whose edges connect characters that sound alike. Pinyin is taken from the open-source pypinyin library with tones ignored, so characters sharing a pinyin are linked; each character also gets a self-loop. The graph adds polyphonic characters, where a character with at least one shared pronunciation is linked to its match, and dialect-driven confusions: retroflex versus non-retroflex sounds, front versus back nasals, and “n” versus “l”. The authors encode five extra relation types — “n”↔“l”, “zh”↔“z”, “ch”↔“c”, “sh”↔“s” and “*ng”↔“*n”.
Matching then enumerates substrings of the input text and checks each against the toxic lexicon. A substring counts as a candidate only if it has the same length as a lexicon entry and every character pair is connected in the graph. The lexicon is deliberately cleaned: the authors keep only proto-toxic words and strip cloaked substitutes such as “辣鸡”, because those substitutes are common enough on social media to be treated as toxic knowledge in their own right.
This stage is designed to have a low false-negative rate: with a comprehensive graph and lexicon, a homophonic substitution should be caught. The cost is a high false-positive rate. The paper's own example is “干净” (gānjìng, clean) being matched to “杠精” (gàngjǐng, troll), and it notes the problem is especially severe for single-character toxic words, since every homophone of that character gets matched.
Filtering false matches with context probabilities
The second stage decides which candidates are real cloaks. For each candidate pair (w, l) — the matched substring and its probable toxic original — the method computes the probability of w and of l given the surrounding prefix and suffix text, written Pw and Pl. Pairs where Pw < Pl are candidates for replacement; the method picks the pair with the largest log-ratio log(Pw/Pl), replaces w with l, removes that pair, and repeats. Because each replacement changes the surrounding context for the remaining pairs, probabilities are recomputed every iteration. The loop stops when no pairs remain or every remaining pair has Pw ≥ Pl.
Two variants compute these probabilities. The BERT variant uses a masked language model over the masked sentence. The LLM variant uses sentence-level probability, and the authors say it addresses an auto-regressive limitation in computing word occurrence probability by using the full semantic context of the sequence. The paper reports both variants, so the filtering step is a design choice with two implementations rather than a single fixed component.
Reported gains over the strongest competitor
The abstract states that C2TU achieves superior performance on two Chinese toxic datasets and outperforms the best competitor by up to 71% on F1 score and 35% on accuracy. Those figures are stated as up-to values, so they mark the largest observed margin rather than an average across datasets or settings. The evidence packet does not give the per-dataset breakdown behind those maxima, so the size of the typical gain cannot be read from it.
A separate human evaluation reported in the results ranks the variants consistently: C2TU-LLM performs best, followed by C2TU-BERT, then Simple-CSC. Inter-annotator agreement for that evaluation is reported as Fleiss' kappa of 0.87 for C2TU-LLM, 0.88 for C2TU-BERT and 0.94 for Simple-CSC, with observed agreement of 0.97, 0.97 and 0.98 respectively. The authors note that a larger sample reduced variance while preserving the same ranking. These agreement numbers describe how consistently annotators judged outputs; they are not detection accuracy.
The deliberate trade-off against false positives
The authors are explicit that stage-one candidates, while comprehensive, inevitably include many false positives, because simple homophonic matching misclassifies a substantial number of normal expressions as toxic. Stage two exists to remove those normal expressions. The paper states that filtering significantly reduces the false positive rate, albeit at some cost to the true positive rate, and frames this as prioritizing users' right to express legitimate content while maintaining detection efficacy.
That framing is the paper's own interpretation of a measured trade-off, and it sets the practical reading of the results: the method is tuned toward not over-flagging ordinary speech, and the reported F1 and accuracy gains should be read alongside that stated cost in true positives. The authors also argue that human review remains indispensable in moderation systems, with the method identifying the vast majority of cloaked toxicity cases for human verification.
Where the unveiling stops
The limitations section narrows the claim considerably. The method restores cloaked variants of known toxic terms; it does not discover entirely new toxic expressions or rapidly evolving slang. It mainly targets character-substitution cloaks, and other cloak types — character-splitting, cross-lingual homophones and emoji replacements — remain outside the current framework and are listed for future work.
So the answer to the title question is conditional. A homophone graph plus lexicon can unveil Chinese cloaked toxicity without training, but only within the space of lexicon-known toxic words disguised by character substitution. A deployment facing novel slang, split characters or emoji substitution is outside what the reported experiments cover, and the paper does not claim otherwise.
What decides whether this is useful
The most decision-relevant comparison in this paper is not C2TU versus a binary detector; it is C2TU-LLM versus C2TU-BERT versus Simple-CSC on the unveiling task, where the LLM variant ranks first and the BERT variant second in the reported human evaluation. The second decisive factor is the lexicon: because only proto-toxic words are retained and matching depends on graph coverage, the method's reach is bounded by how well that lexicon and graph cover the cloaks actually used.
For a reader weighing this approach, the paper's own priority is clear: it chooses fewer false positives over a higher true-positive rate, and it treats human review as the final step. The gains of up to 71% F1 and 35% accuracy apply to unveiling known toxic terms under character-substitution cloaks on the two evaluated Chinese datasets — that is the scenario the evidence supports, and the boundary the authors themselves draw.
Sources used in this answer
Breaking the Cloak! Unveiling Chinese Cloaked Toxicity with Homophone Graph and Toxic Lexicon
C2TU, a training-free and prompt-free method combining a Chinese homophone graph, a proto-toxic lexicon and BERT- or LLM-based filtering, outperforms the best competitor by up to 71% on F1 and 35% on accuracy on two Chinese toxic datasets, while restoring cloaked words to their original toxic forms.