Calling the Bluff: Detecting Ever-Shifting Harmful Chat Dialogue via Ordered Reasoning Chain Regularization

# Calling the Bluff: Detecting Ever-Shifting Harmful Chat Dialogue via Ordered Reasoning Chain Regularization
Source: [https://arxiv.org/html/2608.08451](https://arxiv.org/html/2608.08451)
Haojie Yu1,2,3, Ziyou Jiang1,2,3\\corresponding, Junjie Wang1,2,3, Mingyang Li1,2,3, Yuekai Huang1,2,3, Jie Huang1,2,3, Qing Wang1,2,3

###### Abstract

Harmful chat dialogues are ever\-shifting through type\-shifting and lexical evasion, yet we find they share invariant principles, i\.e\., anOrdered Reasoning Chain \(ORC\)of recurring topics, harm language indicators, severity hierarchies, and type characteristics, which can help us capture the key information in the frequently changing lexical expressions\. We proposeBRACE, which encodes the ORC as four differentiable stages \(Topic→\\rightarrowIndicator→\\rightarrowSeverity→\\rightarrowType\) with intermediate supervision, serving as a structured regularizer blended with direct heads, and supported by prototype\-based feature augmentation and feature path disentanglement\. The evaluation results show that, across 4 domains and 5 harm categories,BRACEachieves harm\-type macro F1 of 0\.934 \(RoBERTa\-wwm\-ext, 3\-seed mean\), with decoder backbones \(Qwen3\-1\.7B LoRA\) reaching 0\.949\. Ablation studies show that all components contribute to BRACE, and the structural decomposition of ORC enables BRACE to distinguish harmful types with semantic ambiguity\.

Disclaimer:This paper may contain content that is disturbing to some readers\.

## Introduction

The proliferation of online chat platforms, e\.g\., Slack, Freenode, and Telegram, poses a tremendous impact on the generation and dissemination of Internet public opinion\. Due to malicious users freely expressing their opinions, these platforms host a wide spectrum of harmful types, including hate speech\(Kiela et al\.[2020](https://arxiv.org/html/2608.08451#bib.bib15)\), harassment, and illicit transaction discussions, which pose urgent risks to user safety and community well\-being\(Khapre et al\.[2025](https://arxiv.org/html/2608.08451#bib.bib13)\)\. Over 40% of U\.S\. adults have experienced online harassment, and platform moderators face an ever\-growing volume of harmful interactions, which require strict regulation and management\. Some researchers propose automatic approaches\(Huertas\-García et al\.[2023](https://arxiv.org/html/2608.08451#bib.bib7); Kang et al\.[2025](https://arxiv.org/html/2608.08451#bib.bib12)\)that incorporate predefined malicious keywords into neural moderation systems to identify harmful dialogues statically\.

![Refer to caption](https://arxiv.org/html/2608.08451v1/Figures/fig1.jpg)Figure 1:Motivation of ORC for harmful dialogue detection\.Unlike static content, such as online posts or articles, chat dialogues are inherently conversational andever\-shifting: malicious users continuously transform harmful word expressions to preserve the harmful intent and bypass the content regulation of the Internet, a phenomenon known in content moderation research aslexical evasion\(Huertas\-García et al\.[2023](https://arxiv.org/html/2608.08451#bib.bib7)\)\(Figure[1](https://arxiv.org/html/2608.08451#Sx1.F1)\)\. As shown in Figure[1](https://arxiv.org/html/2608.08451#Sx1.F1), a drug addict discovers that an explicit Chinese term for “Drug” is blocked, so they evade the keyword through transformations—adopting the slang euphemism “Liu\-Bing” \(“ice skating”, a common street term for methamphetamine\); when “Liu\-Bing” is added to blocklists, they switch to its Latin pinyin spelling, phonetically identical to any Chinese reader\. Some recent works have utilized chain‑of‑thought, retrieval, or concept reproduction\(Li et al\.[2025a](https://arxiv.org/html/2608.08451#bib.bib17),[b](https://arxiv.org/html/2608.08451#bib.bib18); Mei et al\.[2025](https://arxiv.org/html/2608.08451#bib.bib24); Jiang et al\.[2026a](https://arxiv.org/html/2608.08451#bib.bib10)\)approaches to address this issue, but fail to identify these harmful dialogues because they cannot track frequently changing ways of expression, highlighting the challenge of ever\-shifting harmful dialogue detection\.

To address this, we draw inspiration from the poker metaphor ofcalling the bluff: harmful users bet that detectors will be fooled by surface\-level lexical tricks, yet their underlying communicative intent—the reasoning chain of what is discussed, where harmful signals appear, how severe, and which type—remains invariant\. We therefore decompose harm detection into a four\-stage ORC \(Topic→\\rightarrowIndicator→\\rightarrowSeverity→\\rightarrowType\)\. Whether the harmful user writes the word “Liu\-Bing”, Figure[1](https://arxiv.org/html/2608.08451#Sx1.F1)shows the reasoning chain remains identical to the “Drug”: the topic is still Drug, because contextual cues, i\.e\.m “price,” quantity units, and transactional phrasing, lock the topic to Drug regardless of which surface term is used; “Liu\-Bing” then activates as a methamphetamine euphemism under that topic but would be inert under Sports\.

In the previous cases, we can see that the ORC is useful\. However, there is no such work that formally defines the structure of ORC and explains why it is helpful with experimental results\. Therefore, we need to define ORC’s structure and derive the contents based on the user’s dialogue interaction mode\. Moreover, we also need to illustrate how the ORC can accurately distinguish different harmful types when the dialogue’s semantics are ambiguous, especially for gambling \(H2\) and fraud\-related illegal activity \(H5\) in Section 4\.

In this paper, we proposeBRACE\(BlendedReasoning\-chainAugmentedClassificationEngine\)\. Inspired by successive refinement in information theory\(Equitz and Cover[1991](https://arxiv.org/html/2608.08451#bib.bib2)\), BRACE integrates three components\. We first introduce anOrdered Reasoning Chain\(ORC\) that decomposes harm detection into four sequential steps \(Topic→\\rightarrowIndicator→\\rightarrowSeverity→\\rightarrowType\) with intermediate supervision to regularize learning and resolve semantic ambiguity\. We then augment these encoder representations with aPrototype Memory Bank, where learnable category prototypes enrich features via cross\-attention, producing category\-aware representations for fine\-grained discrimination\. Finally,direct heads with feature path disentanglementroute harm type through these prototype\-augmented features \(70%\) blended with chain reasoning \(30%\), while binary and severity read from the holistic CLS embedding, eliminating gradient competition between tasks\.

We evaluateBRACEacross over 20 dialogue safety benchmarks and 3 additional domain\-specific sources, covering diverse platforms, languages, and harm categories\. With a RoBERTa\-wwm\-ext backbone,BRACEachieves a harm type macro F1 of0\.934and severity accuracy of0\.818\. Binary detection performance, per\-category diagnostics, and cross\-backbone statistical tests are reported in Table[2](https://arxiv.org/html/2608.08451#Sx4.T2)and the Technical Supplement\. Decoder backbones further improve performance, reaching a harm type macro F1 of0\.949\. Comprehensive ablation studies confirm the ORC as the dominant mechanism and validate each component’s contribution\. Interpretability analysis demonstrates that the ORC produces meaningful intermediate outputs, i\.e\., topic distributions, indicator heatmaps, and evidence spans, which provide auditability for moderation decisions\.

The paper makes the following contributions:

- •We propose BRACE, a harmful dialogue detector that utilizes ORC to distinguish the ambiguous boundaries between harmful types, thus improving the detection accuracy of ever\-shifting harmful dialogues\.
- •We evaluateBRACEacross 11 diverse dialogue sources spanning Chinese and English platforms, achieving Macro\-F1 of0\.934and improving by \+23\.3% over frozen\-encoder baselines\.
- •We will release the code and dataset to facilitate BRACE’s reproducibility\.

## Definition of ORC

We define two architectural components that collectively specify the structural properties of harmful dialogue detection\. Section 3 describes their concrete realization\.

### Basic Structure of ORC

Harmful dialogue analysis follows a natural sequential structure, i\.e\., identifyingwhattopic is discussed,whereharmful signals appear,how severethe harm is, andwhich typeof harm it constitutes\. This four\-dimensional structure is formalized as theORC’s basic structure𝒞=\(f1,f2,f3,f4\)\\mathcal\{C\}=\(f\_\{1\},f\_\{2\},f\_\{3\},f\_\{4\}\), where each stage conditions on prior outputsf<if\_\{<i\}:

- •f1f\_\{1\}: Topic Profiling:𝐱cls↦𝐳∈Δ𝒯−1\\mathbf\{x\}\_\{\\text\{cls\}\}\\mapsto\\mathbf\{z\}\\in\\Delta^\{\\mathcal\{T\}\-1\}, a distribution over𝒯\\mathcal\{T\}topics, answeringwhat informationthe users discuss in the dialogue\.
- •f2f\_\{2\}: Indicator Detection:\(𝐗,𝐳\)↦𝐇∈\[0,1\]L×ℐ\(\\mathbf\{X\},\\mathbf\{z\}\)\\mapsto\\mathbf\{H\}\\in\[0,1\]^\{L\\times\\mathcal\{I\}\}, a token\-level heatmap overℐ\\mathcal\{I\}harm language indicators with topic\-conditioned activation, answeringwhereharmful signals appear\.
- •f3f\_\{3\}: Severity Assessment:𝐗↦𝐯^chain∈Δ4\\mathbf\{X\}\\mapsto\\hat\{\\mathbf\{v\}\}^\{\\text\{chain\}\}\\in\\Delta^\{4\}, a distribution over five severity levels \(L0: normal to L4: critical\), answeringhow severe\.
- •f4f\_\{4\}: Type Classification:\(𝐡¯,𝐯^chain\)↦𝐲^chain∈\[0,1\]C\(\\bar\{\\mathbf\{h\}\},\\hat\{\\mathbf\{v\}\}^\{\\text\{chain\}\}\)\\mapsto\\hat\{\\mathbf\{y\}\}^\{\\text\{chain\}\}\\in\[0,1\]^\{C\}, combining mean\-pooled indicator features with severity context to determinewhich type\.

The chain serves as astructured regularizer: each stage receives auxiliary supervision throughℒchain\\mathcal\{L\}\_\{\\text\{chain\}\}, constraining the shared encoder\. Chain predictions blend with direct heads as𝐲^=α​𝐲^direct\+\(1−α\)​𝐲^chain\\hat\{\\mathbf\{y\}\}=\\alpha\\hat\{\\mathbf\{y\}\}^\{\\text\{direct\}\}\+\(1\-\\alpha\)\\hat\{\\mathbf\{y\}\}^\{\\text\{chain\}\}\(α∈\(0\.5,1\)\\alpha\\in\(0\.5,1\)\), whereα\>0\.5\\alpha\>0\.5reflects direct heads as the primary inference path\.

### Prototype Memory Bank: ORC’s Codebook

Raw encoder features lack explicit category\-level structure\. We define aPrototype Memory Bank𝐏∈ℝC×K×D\\mathbf\{P\}\\in\\mathbb\{R\}^\{C\\times K\\times D\}, where each𝐩c,k∈ℝD\\mathbf\{p\}\_\{c,k\}\\in\\mathbb\{R\}^\{D\}is a learnable semantic anchor for categorycc\. The Prototype Memory Bank includes three functions as follows:

- •Feature Augmentation\.The Bank maps𝐟↦𝐟aug\\mathbf\{f\}\\mapsto\\mathbf\{f\}^\{\\text\{aug\}\}by computing similarity scores between𝐟\\mathbf\{f\}and all prototypes, aggregating top\-matching prototypes per category into context vectors, and fusing these with𝐟\\mathbf\{f\}via cross\-attention\.𝐟aug\\mathbf\{f\}^\{\\text\{aug\}\}encodes category\-level semantics and serves as the feature source for harm type classification\.
- •Adaptation\.Prototypes evolve through momentum\-based refinement for close\-matching samples and explicit replacement of stale prototypes when no existing prototype adequately represents a sample, ensuring coverage of evolving expression patterns\.
- •Diversity Preservation\.A contrastive objectiveℒproto\\mathcal\{L\}\_\{\\text\{proto\}\}pulls each sample toward allKKprototypes of its ground\-truth category while pushing away from others; a diversity termℒdiv\\mathcal\{L\}\_\{\\text\{div\}\}penalizes high pairwise similarity among within\-category prototypes\.

![Refer to caption](https://arxiv.org/html/2608.08451v1/Figures/fig2.jpg)Figure 2:Overview ofBRACE\.Together, these two components, i\.e\., ORC and Prototype Memory Bank, constitute theBRACEarchitecture\. Prediction heads route harm type classification through𝐟aug\\mathbf\{f\}^\{\\text\{aug\}\}and severity or binary detection through𝐱cls\\mathbf\{x\}\_\{\\text\{cls\}\}\. Section 3 specifies their concrete realization\.

## Methodology

We now realize each architectural component defined above as a concrete module\. The ordered reasoning chain provides structured regularization via intermediate supervision; direct heads serve as primary classifiers with a 70/30 blend; prototype memory produces category\-aware features; and a lightweight MoE router handles binary detection\. Figure[2](https://arxiv.org/html/2608.08451#Sx2.F2)provides an overview\.

### Embedding ORC with Stagewise Constraints

The Ordered Reasoning Chain instantiates𝒞\\mathcal\{C\}with differentiable modules\. As established, the chain serves as astructured regularizer, constraining the shared encoder through auxiliary supervision\.

#### Stage 1: Topic Profiling

f1f\_\{1\}\(Topic Profiling\) maps the CLS representation𝐱cls∈ℝD\\mathbf\{x\}\_\{\\text\{cls\}\}\\in\\mathbb\{R\}^\{D\}to a topic distribution over𝒯=20\\mathcal\{T\}=20predefined conversational topics derived via LLM\-assisted annotation with human review:

𝐳\\displaystyle\\mathbf\{z\}=softmax​\(MLPtopic​\(𝐱cls\)\),\\displaystyle=\\text\{softmax\}\\bigl\(\\text\{MLP\}\_\{\\text\{topic\}\}\(\\mathbf\{x\}\_\{\\text\{cls\}\}\)\\bigr\),\(1\)MLPtopic\\displaystyle\\text\{MLP\}\_\{\\text\{topic\}\}:ℝD→ℝD/2→ℝ𝒯\\displaystyle:\\mathbb\{R\}^\{D\}\\rightarrow\\mathbb\{R\}^\{D/2\}\\rightarrow\\mathbb\{R\}^\{\\mathcal\{T\}\}The topic distribution serves as contextual priors for downstream reasoning stages, enabling topic\-conditioned disambiguation of ambiguous terms\.

#### Stage 2: Indicator Detection

f2f\_\{2\}\(Indicator Detection\) takes the token\-level sequence output𝐗∈ℝL×D\\mathbf\{X\}\\in\\mathbb\{R\}^\{L\\times D\}and the topic distribution𝐳\\mathbf\{z\}fromf1f\_\{1\}, producing a token\-level heatmap𝐇∈ℝL×ℐ\\mathbf\{H\}\\in\\mathbb\{R\}^\{L\\times\\mathcal\{I\}\}overℐ=32\\mathcal\{I\}=32harm language indicators \(spanning slurs, threats, drug/gambling euphemisms, suicide risk signals, and identity\-based hostility; derived via LLM\-assisted annotation\)\. Topic context is projected viaProj:ℝ𝒯→ℝD\\text\{Proj\}:\\mathbb\{R\}^\{\\mathcal\{T\}\}\\rightarrow\\mathbb\{R\}^\{D\}and concatenated with each token’s hidden state before sigmoid activation:

𝐇ℓ,:\\displaystyle\\mathbf\{H\}\_\{\\ell,:\}=σ​\(MLPind​\(\[𝐱ℓ;Proj​\(𝐳\)\]\)\),\\displaystyle=\\sigma\\bigl\(\\text\{MLP\}\_\{\\text\{ind\}\}\(\[\\mathbf\{x\}\_\{\\ell\};\\text\{Proj\}\(\\mathbf\{z\}\)\]\)\\bigr\),\(2\)MLPind\\displaystyle\\text\{MLP\}\_\{\\text\{ind\}\}:ℝ2​D→ℝD→ℝℐ\\displaystyle:\\mathbb\{R\}^\{2D\}\\rightarrow\\mathbb\{R\}^\{D\}\\rightarrow\\mathbb\{R\}^\{\\mathcal\{I\}\}Topic\-conditioning enables disambiguation: the same token activates different indicators depending on topic context \(e\.g\., drug euphemisms activate under Drugs but not under unrelated topics\)\.

#### Stage 3: Severity Assessment

f3f\_\{3\}\(Severity Assessment\) evaluates the harm level on a five\-point scale \(L0: normal, L1: mild, L2: moderate, L3: severe, L4: critical\)\. We employattention poolingover token\-level hidden states to produce a severity representation:

αℓ=softmax​\(MLPpos​\(𝐱ℓ\)\),𝐯pool=∑ℓ=1Lαℓ⋅𝐱ℓ\\alpha\_\{\\ell\}=\\text\{softmax\}\\bigl\(\\text\{MLP\}\_\{\\text\{pos\}\}\(\\mathbf\{x\}\_\{\\ell\}\)\\bigr\),\\quad\\mathbf\{v\}\_\{\\text\{pool\}\}=\\sum\_\{\\ell=1\}^\{L\}\\alpha\_\{\\ell\}\\cdot\\mathbf\{x\}\_\{\\ell\}\(3\)The severity logits are𝐯^chain=MLPsev​\(𝐯pool\)\\hat\{\\mathbf\{v\}\}^\{\\text\{chain\}\}=\\text\{MLP\}\_\{\\text\{sev\}\}\(\\mathbf\{v\}\_\{\\text\{pool\}\}\), whereMLPsev:ℝD→ℝD/2→ℝ5\\text\{MLP\}\_\{\\text\{sev\}\}:\\mathbb\{R\}^\{D\}\\rightarrow\\mathbb\{R\}^\{D/2\}\\rightarrow\\mathbb\{R\}^\{5\}\.

#### Stage 4: Type Classification

f4f\_\{4\}\(Type Classification\) combines indicator features fromf2f\_\{2\}with severity context fromf3f\_\{3\}:𝐲^chain=MLPtype​\(\[Projind​\(𝐡¯\);softmax​\(𝐯^chain\)\]\)\\hat\{\\mathbf\{y\}\}^\{\\text\{chain\}\}=\\text\{MLP\}\_\{\\text\{type\}\}\(\[\\text\{Proj\}\_\{\\text\{ind\}\}\(\\bar\{\\mathbf\{h\}\}\);\\text\{softmax\}\(\\hat\{\\mathbf\{v\}\}^\{\\text\{chain\}\}\)\]\), where𝐡¯=1L​∑ℓ𝐇ℓ,:\\bar\{\\mathbf\{h\}\}=\\frac\{1\}\{L\}\\sum\_\{\\ell\}\\mathbf\{H\}\_\{\\ell,:\},MLPtype:ℝD\+5→ℝD→ℝC\\text\{MLP\}\_\{\\text\{type\}\}:\\mathbb\{R\}^\{D\+5\}\\rightarrow\\mathbb\{R\}^\{D\}\\rightarrow\\mathbb\{R\}^\{C\}, andC=5C=5\.

#### Walkthrough: Why Sequential Reasoning is Necessary

We illustrate the chain’s sequential dependency with a concrete example drawn from our corpus \(Fig\.[2](https://arxiv.org/html/2608.08451#Sx2.F2), chain path\)—a player coordinating a SWATting attack through gaming terminology \(CS2 Discord\):

> A: ‘‘this guy stream\-sniped us, I pulled his info, got the full loadout’’ B: ‘‘no way you got his addy already’’ A: ‘‘parents’ house too, gonna send a wellness check since he’s been acting so erratic’’ A: ‘‘prime time when he’s live, the viewers deserve to see the special delivery’’

Stage 1—Topic\(Fig\.[2](https://arxiv.org/html/2608.08451#Sx2.F2), Stage 1\)\.f1f\_\{1\}anchors the dialogue to TGaming Conflict\(0\.623\) rather than TGaming Social\(0\.148\), fundamentally rewriting every ambiguous term:

Misclassifying Topic causes irrecoverable failure: every downstream stage reads through the wrong frame\.

Stage 2—Indicators\.With TGaming Conflictas context,f2f\_\{2\}activates three harm indicators invisible under TGaming Social:

Withoutf1f\_\{1\}’s topic context, these three indicators remain silent andf3f\_\{3\}receives no harm signal\.

Stage 3—Severity\(Fig\.[2](https://arxiv.org/html/2608.08451#Sx2.F2), Stage 3\)\. Attention pooling concentrates on “addy” \(0\.187\), “parents’ house” \(0\.154\), and “wellness check” \(0\.141\); combined signals drive severity to L4 Critical \(0\.857\)\. Withoutf2f\_\{2\}, attention scatters uniformly and severity collapses to L0\.

Stage 4—Type\(Fig\.[2](https://arxiv.org/html/2608.08451#Sx2.F2), Stage 4\)\.f4f\_\{4\}combines indicator features with severity context; the same evidence maps to different types depending on severity:

Severity misestimation inverts the type prediction\. Each stage thus provides the semantic frame for the next—not merely additional information, but a different interpretive lens—and any broken link propagates irrecoverable error\.

#### Evidence Span Extraction and Intermediate Supervision

For interpretability, token\-level BIO evidence spans are extracted to localize harmful text segments:𝐞^ℓ=softmax​\(MLPev​\(\[𝐱ℓ;maxj⁡𝐇ℓ,j⋅𝟏D\]\)\)\\hat\{\\mathbf\{e\}\}\_\{\\ell\}=\\text\{softmax\}\(\\text\{MLP\}\_\{\\text\{ev\}\}\(\[\\mathbf\{x\}\_\{\\ell\};\\max\_\{j\}\\mathbf\{H\}\_\{\\ell,j\}\\cdot\\mathbf\{1\}\_\{D\}\]\)\), withMLPev:ℝ2​D→ℝD→ℝ2\\text\{MLP\}\_\{\\text\{ev\}\}:\\mathbb\{R\}^\{2D\}\\rightarrow\\mathbb\{R\}^\{D\}\\rightarrow\\mathbb\{R\}^\{2\}\.

The ordered reasoning chain applies auxiliary training objectives as structured regularization:

ℒchain=ℒtypechain\+0\.5⋅ℒseveritychain\+0\.3⋅ℒtopic\\mathcal\{L\}\_\{\\text\{chain\}\}=\\mathcal\{L\}\_\{\\text\{type\}\}^\{\\text\{chain\}\}\+0\.5\\cdot\\mathcal\{L\}\_\{\\text\{severity\}\}^\{\\text\{chain\}\}\+0\.3\\cdot\\mathcal\{L\}\_\{\\text\{topic\}\}\(4\)using cross\-entropy for topic and severity, and binary cross\-entropy for multi\-label type classification\.

### Aggregating Direct Predictions

BRACEemploys a70/30 blended prediction: direct MLP heads provide the primary classification signal \(70%\), while the ordered reasoning chain provides complementary regularization \(30%\)\. The chain alone introduces error cascading; direct heads alone lack inductive bias\.

#### Direct Harm Type Head

The direct harm type head reads from𝐟aug\\mathbf\{f\}^\{\\text\{aug\}\}\(prototype\-augmented features capture category\-level semantics\):𝐲^direct=MLPht​\(𝐟aug\)\\hat\{\\mathbf\{y\}\}^\{\\text\{direct\}\}=\\text\{MLP\}\_\{\\text\{ht\}\}\(\\mathbf\{f\}^\{\\text\{aug\}\}\)\(MLPht:ℝD→ℝD→ℝC\\text\{MLP\}\_\{\\text\{ht\}\}:\\mathbb\{R\}^\{D\}\\rightarrow\\mathbb\{R\}^\{D\}\\rightarrow\\mathbb\{R\}^\{C\}\)\. Final logits blend as𝐲^=0\.7​𝐲^direct\+0\.3​𝐲^chain\\hat\{\\mathbf\{y\}\}=0\.7\\hat\{\\mathbf\{y\}\}^\{\\text\{direct\}\}\+0\.3\\hat\{\\mathbf\{y\}\}^\{\\text\{chain\}\}\.

#### Direct Severity Head

In contrast, severity assessment reads from the holistic CLS embedding:𝐯^direct=MLPsevdirect​\(𝐱cls\)\\hat\{\\mathbf\{v\}\}^\{\\text\{direct\}\}=\\text\{MLP\}\_\{\\text\{sev\}\}^\{\\text\{direct\}\}\(\\mathbf\{x\}\_\{\\text\{cls\}\}\)\(MLPsevdirect:ℝD→ℝD/2→ℝ5\\text\{MLP\}\_\{\\text\{sev\}\}^\{\\text\{direct\}\}:\\mathbb\{R\}^\{D\}\\rightarrow\\mathbb\{R\}^\{D/2\}\\rightarrow\\mathbb\{R\}^\{5\}\)\. Final severity logits blend as𝐯^=0\.7​𝐯^direct\+0\.3​𝐯^chain\\hat\{\\mathbf\{v\}\}=0\.7\\hat\{\\mathbf\{v\}\}^\{\\text\{direct\}\}\+0\.3\\hat\{\\mathbf\{v\}\}^\{\\text\{chain\}\}\.

### Augmenting ORC via Prototype Memory

The Prototype Memory Bank instantiates𝐏∈ℝC×K×D\\mathbf\{P\}\\in\\mathbb\{R\}^\{C\\times K\\times D\}withKKprototypes per harm category\.

#### Prototype Bank and Augmentation

The Prototype Bank is initialized after the first training epoch: for each categorycc,𝐩c,0=𝝁c\\mathbf\{p\}\_\{c,0\}=\\boldsymbol\{\\mu\}\_\{c\}\(class centroid\), and𝐩c,k=𝝁c\+0\.5⋅𝝈c⊙ϵk\\mathbf\{p\}\_\{c,k\}=\\boldsymbol\{\\mu\}\_\{c\}\+0\.5\\cdot\\boldsymbol\{\\sigma\}\_\{c\}\\odot\\boldsymbol\{\\epsilon\}\_\{k\}\(k≥1k\\geq 1\) withϵk∼𝒩​\(0,𝐈\)\\boldsymbol\{\\epsilon\}\_\{k\}\\sim\\mathcal\{N\}\(0,\\mathbf\{I\}\)and orthogonalization\(Saxe, McClelland, and Ganguli[2014](https://arxiv.org/html/2608.08451#bib.bib28)\)to maximize inter\-prototype separation\.

Augmentation proceeds in three stages\.Stage 1 — Similarity:cosine similarity to all prototypes:

sc,k=⟨𝐟,𝐩c,k⟩‖𝐟‖⋅‖𝐩c,k‖,∀c∈\[C\],k∈\[K\]s\_\{c,k\}=\\frac\{\\langle\\mathbf\{f\},\\mathbf\{p\}\_\{c,k\}\\rangle\}\{\\\|\\mathbf\{f\}\\\|\\cdot\\\|\\mathbf\{p\}\_\{c,k\}\\\|\},\\quad\\forall c\\in\[C\],k\\in\[K\]\(5\)Stage 2 — Category Context:per category, the top\-22prototypes are softmax\-weighted with learnable temperatureτ\\tau, producing a category context vector𝐜c∈ℝD\\mathbf\{c\}\_\{c\}\\in\\mathbb\{R\}^\{D\}:

𝐜c=∑r=12exp⁡\(sc,kr/τ\)∑j=12exp⁡\(sc,kj/τ\)⋅𝐩c,kr\\mathbf\{c\}\_\{c\}=\\sum\_\{r=1\}^\{2\}\\frac\{\\exp\(s\_\{c,k\_\{r\}\}/\\tau\)\}\{\\sum\_\{j=1\}^\{2\}\\exp\(s\_\{c,k\_\{j\}\}/\\tau\)\}\\cdot\\mathbf\{p\}\_\{c,k\_\{r\}\}\(6\)Stage 3 — Cross\-Attention Fusion:the stacked category contexts𝐂∈ℝC×D\\mathbf\{C\}\\in\\mathbb\{R\}^\{C\\times D\}enrich the input feature through multi\-head cross\-attention with a residual connection:

𝐟aug=LayerNorm​\(𝐟\+MultiHeadAttn​\(𝐟,𝐂,𝐂\)\)\\mathbf\{f\}^\{\\text\{aug\}\}=\\text\{LayerNorm\}\\bigl\(\\mathbf\{f\}\+\\text\{MultiHeadAttn\}\(\\mathbf\{f\},\\mathbf\{C\},\\mathbf\{C\}\)\\bigr\)\(7\)𝐟aug\\mathbf\{f\}^\{\\text\{aug\}\}encodes category\-level semantics for the direct harm type head\.

#### Prototype Bank Maintenance

Prototypes adapt via EMA \(m=0\.99m=0\.99\(He et al\.[2020](https://arxiv.org/html/2608.08451#bib.bib5)\)\) on the closest match:𝐩c,k∗←m⋅𝐩c,k∗\+\(1−m\)⋅𝐟\\mathbf\{p\}\_\{c,k^\{\*\}\}\\leftarrow m\\cdot\\mathbf\{p\}\_\{c,k^\{\*\}\}\+\(1\-m\)\\cdot\\mathbf\{f\}\. A graduated cosine threshold \(0\.3→\\rightarrow0\.7 over 80% training\) avoids dead prototypes: whenmaxk⁡s​\(𝐟,𝐩c,k\)<θreplace=0\.5\\max\_\{k\}s\(\\mathbf\{f\},\\mathbf\{p\}\_\{c,k\}\)<\\theta\_\{\\text\{replace\}\}=0\.5, soft replacement activates \(𝐩←0\.9​𝐩\+0\.1​𝐟\\mathbf\{p\}\\leftarrow 0\.9\\mathbf\{p\}\+0\.1\\mathbf\{f\}\)\. The Bank is trained with multi\-positive InfoNCE\(Khosla et al\.[2020](https://arxiv.org/html/2608.08451#bib.bib14)\), pulling samples toward allKKprototypes of their category:

ℒproto=−1B​∑i=1Blog⁡∑k=1Kexp⁡\(s​\(𝐟i,𝐩ci,k\)/τ\)∑c=1C∑k=1Kexp⁡\(s​\(𝐟i,𝐩c,k\)/τ\)\\mathcal\{L\}\_\{\\text\{proto\}\}=\-\\frac\{1\}\{B\}\\sum\_\{i=1\}^\{B\}\\log\\frac\{\\sum\_\{k=1\}^\{K\}\\exp\(s\(\\mathbf\{f\}\_\{i\},\\mathbf\{p\}\_\{c\_\{i\},k\}\)/\\tau\)\}\{\\sum\_\{c=1\}^\{C\}\\sum\_\{k=1\}^\{K\}\\exp\(s\(\\mathbf\{f\}\_\{i\},\\mathbf\{p\}\_\{c,k\}\)/\\tau\)\}\(8\)Diversity regularization penalizes high pairwise cosine similarity within each category to prevent collapse:

ℒdiv=1C​∑c=1Cmax⁡\(0,1K​\(K−1\)​∑k≠k′⟨𝐩¯c,k,𝐩¯c,k′⟩−0\.3\)\\mathcal\{L\}\_\{\\text\{div\}\}=\\frac\{1\}\{C\}\\sum\_\{c=1\}^\{C\}\\max\\bigl\(0,\\frac\{1\}\{K\(K\-1\)\}\\sum\_\{k\\neq k^\{\\prime\}\}\\langle\\bar\{\\mathbf\{p\}\}\_\{c,k\},\\bar\{\\mathbf\{p\}\}\_\{c,k^\{\\prime\}\}\\rangle\-0\.3\\bigr\)\(9\)where𝐩¯\\bar\{\\mathbf\{p\}\}denotes L2\-normalized prototypes\.

### MoE Router & Outputs

Binary detection uses a lightweight Mixture\-of\-Experts \(MoE\) router withE=6E=6experts \(one per harm category plus a general expert\)\. The gate produces soft routing weights𝐠=softmax​\(MLPgate​\(𝐱cls\)\)∈ℝE\\mathbf\{g\}=\\text\{softmax\}\(\\text\{MLP\}\_\{\\text\{gate\}\}\(\\mathbf\{x\}\_\{\\text\{cls\}\}\)\)\\in\\mathbb\{R\}^\{E\}, and the binary logit isy^bin=∑e=1Ege⋅Experte​\(𝐱cls\)\\hat\{y\}\_\{\\text\{bin\}\}=\\sum\_\{e=1\}^\{E\}g\_\{e\}\\cdot\\text\{Expert\}\_\{e\}\(\\mathbf\{x\}\_\{\\text\{cls\}\}\)\. Load balancing regularization\(Fedus, Zoph, and Shazeer[2022](https://arxiv.org/html/2608.08451#bib.bib3)\)prevents expert collapse\.

Outputs\.The framework produces three final predictions\. Forharm type, the 70/30 blend combines the direct head on𝐟aug\\mathbf\{f\}^\{\\text\{aug\}\}with the chain’s type prediction:𝐲^=0\.7​𝐲^direct\+0\.3​𝐲^chain\\hat\{\\mathbf\{y\}\}=0\.7\\hat\{\\mathbf\{y\}\}^\{\\text\{direct\}\}\+0\.3\\hat\{\\mathbf\{y\}\}^\{\\text\{chain\}\}, yielding a distribution over H1–H5\. Forseverity, the same 70/30 blend fuses the direct severity head on𝐱cls\\mathbf\{x\}\_\{\\text\{cls\}\}with the chain’s severity assessment:𝐯^=0\.7​𝐯^direct\+0\.3​𝐯^chain\\hat\{\\mathbf\{v\}\}=0\.7\\hat\{\\mathbf\{v\}\}^\{\\text\{direct\}\}\+0\.3\\hat\{\\mathbf\{v\}\}^\{\\text\{chain\}\}, producing a distribution over L0–L4\. Forbinaryharmful/benign detection, the MoE router prediction is used directly \(no blend\)\. This three\-output design routes each prediction target through its optimal feature path: prototype\-augmented features for fine\-grained type discrimination, the holistic CLS embedding for severity and binary judgments, and the chain as a shared regularizer across all targets\.

To train the BRACE, we optimize the model by combining a multi\-task objective as follows:

ℒtotal\\displaystyle\\mathcal\{L\}\_\{\\text\{total\}\}=ℒbin\+0\.5​ℒtype\+0\.3​ℒproto\\displaystyle=\\mathcal\{L\}\_\{\\text\{bin\}\}\+5\\mathcal\{L\}\_\{\\text\{type\}\}\+3\\mathcal\{L\}\_\{\\text\{proto\}\}\(10\)\+0\.1​ℒchain\+0\.1​ℒsev\+0\.1​ℒdiv\+0\.01​ℒbal\\displaystyle\\quad\+1\\mathcal\{L\}\_\{\\text\{chain\}\}\+1\\mathcal\{L\}\_\{\\text\{sev\}\}\+1\\mathcal\{L\}\_\{\\text\{div\}\}\+01\\mathcal\{L\}\_\{\\text\{bal\}\}whereℒbin\\mathcal\{L\}\_\{\\text\{bin\}\}is Focal Loss \(α=0\.25\\alpha\{=\}0\.25,γ=2\.0\\gamma\{=\}2\.0\)\(Lin et al\.[2017](https://arxiv.org/html/2608.08451#bib.bib19)\),ℒtype\\mathcal\{L\}\_\{\\text\{type\}\}is multi\-label BCE,ℒproto\\mathcal\{L\}\_\{\\text\{proto\}\}the contrastive loss,ℒchain\\mathcal\{L\}\_\{\\text\{chain\}\}chain intermediate supervision,ℒsev\\mathcal\{L\}\_\{\\text\{sev\}\}cross\-entropy,ℒdiv\\mathcal\{L\}\_\{\\text\{div\}\}diversity regularization, andℒbal\\mathcal\{L\}\_\{\\text\{bal\}\}MoE load balancing\(Fedus, Zoph, and Shazeer[2022](https://arxiv.org/html/2608.08451#bib.bib3)\)\. Althoughℒchain\\mathcal\{L\}\_\{\\text\{chain\}\}has low explicit weight \(0\.1\), its predictions participate inℒtype\\mathcal\{L\}\_\{\\text\{type\}\}andℒsev\\mathcal\{L\}\_\{\\text\{sev\}\}through the 70/30 blend \(≈0\.7\\approx 0\.7effective supervision\)\. Full hyperparameters are provided in Experimental Design\.

## Experimental Design

To evaluateBRACEon a comprehensive benchmark spanning 4 domain groups and 5 harm categories\. We structure our evaluation in two research questions:

- •RQ1 \(Performance\): How doesBRACEcompare across backbone architectures on harm type, severity, and binary detection vs\. linear probe baselines?
- •RQ2 \(Ablation Study\): How does each component contribute to the BRACE?We aim to evaluate the contribution of ORC, blend ratio between direct heads, and chain prediction methods, as well as the contribution of the reasoning stage cumulatively\.

Some additional experimental results, e\.g\., per\-category diagnostics, leave\-one\-type\-out generalization, statistical validation, interpretability, and severity analysis, are provided in the Technical Supplement\.

### Datasets and Data Preparation

We construct a multi\-source Chinese\-English\-Spanish dataset with 60,000 dialogues across 5 harm categories \(12,000 per category\), consolidating 25 public sources into 4 domain groups: \(1\)ECTC Chinese Platform\(domain 0\), comprising 22 safety benchmarks—BeaverTails\(Ji et al\.[2023](https://arxiv.org/html/2608.08451#bib.bib9)\), PKU\-SafeRLHF\(Ji et al\.[2025](https://arxiv.org/html/2608.08451#bib.bib8)\), Safety\-Prompts\(Sun et al\.[2023](https://arxiv.org/html/2608.08451#bib.bib30)\), ToxiCN\(Lu et al\.[2023](https://arxiv.org/html/2608.08451#bib.bib20)\), JADE\(Zhang, Pan, and Yang[2023](https://arxiv.org/html/2608.08451#bib.bib37)\), DGHate\(Vidgen et al\.[2021](https://arxiv.org/html/2608.08451#bib.bib31)\), HateCheck\(Röttger et al\.[2021](https://arxiv.org/html/2608.08451#bib.bib27),[2022](https://arxiv.org/html/2608.08451#bib.bib26)\), Davidson\(Davidson et al\.[2017](https://arxiv.org/html/2608.08451#bib.bib1)\), LMSYS\-Chat\-1M\(Zheng et al\.[2024](https://arxiv.org/html/2608.08451#bib.bib38)\), the unalignment\-toxic DPO corpus\(Lee et al\.[2024](https://arxiv.org/html/2608.08451#bib.bib16)\), Jigsaw\(Wulczyn, Thain, and Dixon[2017](https://arxiv.org/html/2608.08451#bib.bib35)\), and community\-sourced Chinese corpora; \(2\)Reddit\(domain 1\), English dialogues self\-crawled via Pushshift API; \(3\)MentalRiskES\(Mármol\-Romero et al\.[2024](https://arxiv.org/html/2608.08451#bib.bib22)\)\(domain 2\), Spanish mental health risk; and \(4\)PsySUICIDE\(Qiu, Ma, and Lan[2024](https://arxiv.org/html/2608.08451#bib.bib25)\)\(domain 3\), Chinese suicide risk\. The dataset is partitioned into 42,000/9,000/9,000 train/val/test with source\-level stratification\. Full details are in the Technical Supplement; the dataset will be released upon publication\. Table[1](https://arxiv.org/html/2608.08451#Sx4.T1)summarizes the scale\.

Table 1:Dataset scale\.Table 2:Per\-category and overall performance across backbones\. LP = linear probe \(frozen encoder \+ classifier\)\.Δ\\Delta% = relative Harm m\-F1 gain of BRACE over LP\. Best per metric inbold\.BackboneCond\.H1H2H3H4H5HarmType m\-F1Δ\\Delta%Encoder BackbonesRoBERTa\-wwm \(102M\)LP0\.71320\.73980\.64410\.73470\.67570\.7015—BRACE0\.97250\.99370\.85780\.98550\.86200\.9343\+33\.2%ERNIE\-Med \(93M\)LP0\.64250\.66810\.57730\.66310\.62150\.6345—BRACE0\.96990\.99250\.85250\.98410\.85760\.9313\+46\.8%ERNIE\-Mini \(27M\)LP0\.61170\.63560\.54910\.63050\.59010\.6034—BRACE0\.96820\.99170\.85050\.98330\.85430\.9296\+54\.1%BERT\-base \(102M\)LP0\.69450\.72020\.62720\.71480\.65830\.6830—BRACE0\.95900\.98700\.84050\.97750\.84850\.9225\+35\.1%Decoder BackbonesChineseGuard\-1\.5BBRACE0\.97800\.99450\.88200\.99000\.89550\.9480—Qwen3\-1\.7BBRACE0\.97850\.99480\.88250\.99050\.89620\.9485—Each dialogue is labeled with harm type \(H1 Pornography, H2 Gambling, H3 Violence, H4 Suicide/Self\-harm, H5 Other Illegal\), severity \(L0 normal–L4 critical\), binary label,𝒯=20\\mathcal\{T\}\{=\}20conversational topics,ℐ=32\\mathcal\{I\}\{=\}32harm language indicators, and BIO\-tagged evidence spans\. DeepSeek\-V4\-Pro generates initial proposals via few\-shot prompting; three trained annotators independently review each proposal with a third adjudicator resolving disagreements\. We report Cohen’sκ\\kappaon a dual\-annotated calibration subset: LLM–Human agreement \(proposals vs\. final labels\) and Human–Human agreement \(pairwise among reviewers\) as the upper bound\. LLM proposals achieve substantial agreement with adjudicated labels, with Human–Humanκ\\kappaexceeding LLM–Humanκ\\kappaby a consistent margin\.

### Baselines

We compareBRACEagainst three categories\.Linear probe:a linear classifier on frozen CLS embeddings from four pre\-trained encoders \(RoBERTa\-wwm\-ext, ERNIE\-3\.0\-Medium, ERNIE\-3\.0\-Mini, BERT\-base\-Chinese\)\.Fine\-tuned multi\-task:the same encoders unfrozen with a 2\-layer MLP head, jointly optimized on harm type, severity, and binary detection\.LLM baselines:Qwen3\-1\.7B and ChineseGuard\-1\.5B under zero\-shot prompting and LoRA fine\-tuning \(r=8r\{=\}8,α=16\\alpha\{=\}16\)\.

### Evaluation Metrics

For harm type classification, we use per\-class and macro\-averaged F1 \(Harm m\-F1\) as the primary metric, with predicted probabilities binarized at a threshold of 0\.5\. Severity estimation is evaluated via overall accuracy and per\-level F1 scores across five severity levels \(L0–L4\)\. Binary detection performance is measured by binary F1\. All encoder\-based results are reported as the mean over three random seeds \(42, 123, 456\), while decoder experiments use a single seed due to computational constraints\.

### Implementation Details

Our primary encoder isRoBERTa\-wwm\-ext\(102M parameters,D=768D\{=\}768\), selected based on backbone comparison results\. Large language model baselines useQwen3\-1\.7BandChineseGuard\-1\.5Bwith LoRA fine\-tuning \(r=8r\{=\}8,α=16\\alpha\{=\}16\)\. ThePrototype Memory BankmaintainsK=8K\{=\}8learnable vectors per category with temperatureτ=0\.07\\tau\{=\}0\.07and exponential moving average momentumm=0\.99m\{=\}0\.99for prototype updates\. The ORC operates over𝒯=20\\mathcal\{T\}\{=\}20conversational topics andℐ=32\\mathcal\{I\}\{=\}32harm language indicators across 5 severity levels \(L0–L4\)\. We optimize withAdamW, using a learning rate of2×10−52\{\\times\}10^\{\-5\}for the encoder backbone and1×10−41\{\\times\}10^\{\-4\}for newly initialized modules \(prototype bank, reasoning chain, router, and task heads\)\. Training uses a batch size of 16 with gradient accumulation steps of 2 \(effective batch size 32\) and a maximum sequence length of 512 tokens\. All encoder experiments are reported as the mean over 3 random seeds \(42, 123, 456\); decoder experiments use a single seed due to computational constraints\.

## Results

### Performance of BRACE \(RQ1\)

To compare BRACE against baseline methods, we structure the experimental evaluation around three core research questions\. All encoder\-based backbones are reported as 3‑seed mean performance on a unified test set comprising 9,000 samples\. For decoder‑only models, we adopt LoRA fine‑tuning, while linear probing is omitted as it yields near‑random zero‑shot m‑F1 on this fine‑grained five‑way harmful content classification task\.

Table[2](https://arxiv.org/html/2608.08451#Sx4.T2)shows the comprehensive comparative results across all models and harm categories; we can see that three robust patterns emerge, which collectively underscore the cross‑category generalizability and practical deployability of our approach\. First, per‑category intrinsic difficulty is structurally stratified—H2 \(gambling\) and H4 \(suicide\) approach ceiling performance \(0\.98–0\.99\), whereas H3 \(violence, 0\.84–0\.88\) and H5 \(other‑illegal, 0\.85–0\.90\) consistently remain the most challenging, reflecting their high intra‑class variance and semantic heterogeneity\. Crucially, the relative improvement yielded by BRACE is inversely correlated with the linear‑probing baseline: on the lightweight ERNIE‑Mini \(27M\), it achieves a striking \+54\.1% gain, converging within 0\.005 m‑F1 of much larger 100M‑parameter encoders \(p=0\.265p=0\.265\), which firmly confirms that our method is backbone‑agnostic and scales effectively across architectural scales\. Moreover, for decoder‑based models, Qwen3‑1\.7B further pushes the hardest categories, lifting H3 to 0\.883 and H5 to 0\.896—gains of \+0\.025 and \+0\.034 over the RoBERTa counterpart\. These quantitative results demonstrate that BRACE delivers consistent improvements across diverse harmful content types\. The case studies in Figure[3](https://arxiv.org/html/2608.08451#Sx5.F3)further illustrate this qualitatively: across cross\-lingual suicide risk \(H4\), religiously framed violence \(H3\), and culturally specific hate speech \(H5\), BRACE correctly resolves semantic ambiguity where flat classifiers misjudge, confirming that the ORC provides discriminative signals beyond surface\-form correlations\.

![Refer to caption](https://arxiv.org/html/2608.08451v1/Figures/fig4.jpg)Figure 3:Three representative boundary cases demonstrating ORC\-based disambiguation of harmful types\.
### Ablation Study \(RQ2\)

Table 3:Component ablation and reasoning depth \(ERNIE\-3\.0\-Medium\)\.Δ\\Delta= Harm m\-F1 change\.ConfigurationHarm m\-F1 \(Δ\\Delta\)FullBRACE0\.931w/o Prototype Memory0\.867 \(\-0\.064\)w/o Ordered Reasoning Chain0\.830 \(\-0\.101\)w/o MoE Router0\.929 \(\-0\.002\)Chain Depth \(cumulative, 70/30 blend\)Depth 1 \(Topic\)0\.894Depth 2 \(w/ Indicators\)0\.910 \(\+0\.016\)Depth 3 \(w/ Severity\)0\.924 \(\+0\.014\)Depth 4 \(w/ Type\)0\.931 \(\+0\.007\)
“w/o” removes only the named component\. See Technical Supplement for per\-category ablation and Binary F1\.

![Refer to caption](https://arxiv.org/html/2608.08451v1/Figures/fig3.jpg)Figure 4:The t\-SNE results’ distribution of dimensionality reduction across different types of harmful dialogues\.Table[3](https://arxiv.org/html/2608.08451#Sx5.T3)shows the gain from ORC, which is cumulative across reasoning depths: indicator detection \(\+0\.016\) and severity assessment \(\+0\.014\) are the largest individual steps, each corresponding to further separation in the t‑SNE space—first distinguishing harmful cues, then grading severity levels\. In contrast, the MoE router affects only Binary F1 \(‑0\.046, see Technical Supplement\) and leaves inter‑class distances nearly unchanged, confirming its role as a binary‑only specialist with negligible influence on the multi‑class discriminative structure\. Thus, ORC drives the global distance expansion and multi‑class performance, while the router plays a complementary but secondary part\.

The t‑SNE projection of prototype vectors \(Fig\.[4](https://arxiv.org/html/2608.08451#Sx5.F4)\) confirms this: ORC markedly enlarges inter‑class distances among harmful categories, while its removal collapses these distances into overlapping clusters\. Quantitatively, ORC removal induces the largest Harm m‑F1 drop \(‑0\.101\), far exceeding prototype memory removal \(‑0\.064\)\. This 1\.6×\\timesgap confirms ORC as the primary mechanism for semantic separability\.

## Related Works

### Harmful Content Detection

Harmful content detection has progressed from binary toxic classification\(Kiela et al\.[2020](https://arxiv.org/html/2608.08451#bib.bib15)\)to fine\-grained taxonomies\(Mathew et al\.[2021](https://arxiv.org/html/2608.08451#bib.bib23)\)and Chinese\-specific benchmarks\(Wang et al\.[2026](https://arxiv.org/html/2608.08451#bib.bib32); Ma, Zhang, and Chen[2025](https://arxiv.org/html/2608.08451#bib.bib21); Zhang et al\.[2025](https://arxiv.org/html/2608.08451#bib.bib36)\)\. Forever\-shiftingexpressions, RepMD\(Jiang et al\.[2026a](https://arxiv.org/html/2608.08451#bib.bib10)\)and JADE\(Jiang et al\.[2026b](https://arxiv.org/html/2608.08451#bib.bib11)\)address lexical evasion;BRACEshares the invariant\-principles insight but embeds it as architectural regularization\. Reasoning\-enhanced safety\(Li et al\.[2025a](https://arxiv.org/html/2608.08451#bib.bib17),[b](https://arxiv.org/html/2608.08451#bib.bib18); Wei et al\.[2022](https://arxiv.org/html/2608.08451#bib.bib33)\)uses intermediate reasoning as inference;BRACEemploys the chain as aregularizerwith direct heads delivering primary predictions\.

### Prototype Learning and Expert Routing

Prototype\-based methods represent classes through exemplar vectors\(Snell, Swersky, and Zemel[2017](https://arxiv.org/html/2608.08451#bib.bib29); Khosla et al\.[2020](https://arxiv.org/html/2608.08451#bib.bib14); Ho et al\.[2024](https://arxiv.org/html/2608.08451#bib.bib6)\);BRACE’s prototypes produce augmented representations via cross\-attention rather than classifying directly\. Mixture\-of\-Experts\(Wu et al\.[2024](https://arxiv.org/html/2608.08451#bib.bib34); Goyal et al\.[2025](https://arxiv.org/html/2608.08451#bib.bib4)\)scales capacity through conditional computation;BRACEorganizes experts around harm categories, isolating binary detection from harm type features\. For multi\-task learning,BRACEroutes fine\-grained classification through𝐟aug\\mathbf\{f\}^\{\\text\{aug\}\}and holistic judgments through𝐱cls\\mathbf\{x\}\_\{\\text\{cls\}\}, avoiding gradient competition from shared feature access\.

## Conclusion

In this paper, we proposeBRACE, which encodes the ORC as four differentiable stages \(Topic→\\rightarrowIndicator→\\rightarrowSeverity→\\rightarrowType\) with intermediate supervision, serving as a structured regularizer blended with direct heads, and supported by prototype\-based feature augmentation and feature path disentanglement\. Evaluation across over 20 dialogue safety benchmarks and 3 additional domain\-specific sources shows that, with a RoBERTa\-wwm\-ext backbone,BRACEachieves a harm type macro F1 of0\.934and severity accuracy of0\.818\. Binary detection performance, per\-category diagnostics, and cross\-backbone statistical tests are reported in Table[2](https://arxiv.org/html/2608.08451#Sx4.T2)and the Technical Supplement\. Decoder backbones further improve performance, reaching a harm type macro F1 of0\.949\. Ablation studies show that all components contribute to BRACE, and the structural decomposition of ORC enables BRACE to distinguish harmful types with semantic ambiguity,

## References

- Davidson et al\. \(2017\)Davidson, T\.; Warmsley, D\.; Macy, M\.; and Weber, I\. 2017\.Automated Hate Speech Detection and the Problem of Offensive Language\.In*Proceedings of the 11th International Conference on Web and Social Media \(ICWSM\)*, 512–515\.
- Equitz and Cover \(1991\)Equitz, W\. H\. R\.; and Cover, T\. M\. 1991\.Successive Refinement of Information\.*IEEE Transactions on Information Theory*, 37\(2\): 269–275\.
- Fedus, Zoph, and Shazeer \(2022\)Fedus, W\.; Zoph, B\.; and Shazeer, N\. 2022\.Switch Transformers: Scaling to Trillion Parameter Models with Simple and Efficient Sparsity\.*Journal of Machine Learning Research*, 23\(120\): 1–39\.
- Goyal et al\. \(2025\)Goyal, A\.; Zhan, X\.; Chen, Y\.; Saha, K\.; and Chandrasekharan, E\. 2025\.MoMoE: Mixture of Moderation Experts Framework for AI\-Assisted Online Governance\.In*Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing \(EMNLP\)*\.
- He et al\. \(2020\)He, K\.; Fan, H\.; Wu, Y\.; Xie, S\.; and Girshick, R\. 2020\.Momentum Contrast for Unsupervised Visual Representation Learning\.In*Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition \(CVPR\)*, 9726–9735\.
- Ho et al\. \(2024\)Ho, S\.; Liu, M\.; Du, L\.; Gao, L\.; and Long, G\. 2024\.Prototype\-Guided Memory Replay for Continual Learning\.*IEEE Transactions on Neural Networks and Learning Systems*\.
- Huertas\-García et al\. \(2023\)Huertas\-García, Á\.; Martín, A\.; Huertas\-Tato, J\.; and Camacho, D\. 2023\.Countering Malicious Content Moderation Evasion in Online Social Networks: Simulation and Detection of Word Camouflage\.*Applied Soft Computing*, 145: 110574\.
- Ji et al\. \(2025\)Ji, J\.; Hong, D\.; Zhang, B\.; Chen, B\.; Dai, J\.; Zheng, B\.; Qiu, T\.; Zhou, J\.; Wang, K\.; Li, B\.; Han, S\.; Guo, Y\.; and Yang, Y\. 2025\.PKU\-SafeRLHF: Towards Multi\-Level Safety Alignment for LLMs with Human Preference\.In*Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics \(ACL\)*, 31983–32016\.
- Ji et al\. \(2023\)Ji, J\.; Liu, M\.; Dai, J\.; Pan, X\.; Zhang, C\.; Bian, C\.; Chen, B\.; Sun, R\.; Wang, Y\.; and Yang, Y\. 2023\.BeaverTails: Towards Improved Safety Alignment of LLM via a Human\-Preference Dataset\.In*Advances in Neural Information Processing Systems \(NeurIPS\)*, volume 36\.Datasets and Benchmarks Track\.
- Jiang et al\. \(2026a\)Jiang, Z\.; Li, M\.; Wang, J\.; Huang, Y\.; Huang, J\.; Chang, Z\.; Li, Z\.; and Wang, Q\. 2026a\.All Changes May Have Invariant Principles: Improving Ever\-Shifting Harmful Meme Detection via Design Concept Reproduction\.In*Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\)*, 17595–17613\.
- Jiang et al\. \(2026b\)Jiang, Z\.; Liu, M\.; Qin, Y\.; and Liu, B\. 2026b\.Breaking Free from Ivory Tower: Evaluating and Enhancing Real\-world Chinese Underground Adversarial Jargon Detection\.In*Proceedings of the 47th IEEE Symposium on Security and Privacy \(S&P\)*, 417–435\.
- Kang et al\. \(2025\)Kang, H\.; Chen, J\.; Li, Y\.; Miao, X\.; Xu, M\.; Zhou, S\.; Zhong, M\.; Zhu, Y\.; and Qian, T\. 2025\.Developing Continuous Toxicity Detection Against Increasing Types of Perturbed Toxic Text\.*Computers & Security*\.
- Khapre et al\. \(2025\)Khapre, S\.; Mersha, M\. A\.; Shakil, H\.; Baruah, J\.; and Kalita, J\. 2025\.Toxicity in Online Platforms and AI Systems: A Survey of Needs, Challenges, Mitigations, and Future Directions\.*Expert Systems with Applications*\.ArXiv:2509\.25539\.
- Khosla et al\. \(2020\)Khosla, P\.; Teterwak, P\.; Wang, C\.; Sarna, A\.; Tian, Y\.; Isola, P\.; Maschinot, A\.; Liu, C\.; and Krishnan, D\. 2020\.Supervised Contrastive Learning\.In*Advances in Neural Information Processing Systems*, volume 33, 18661–18673\.
- Kiela et al\. \(2020\)Kiela, D\.; Firooz, H\.; Mohan, A\.; Goswami, V\.; Singh, A\.; Ringshia, P\.; and Testuggine, D\. 2020\.The Hateful Memes Challenge: Detecting Hate Speech in Multimodal Memes\.In*Advances in Neural Information Processing Systems*, volume 33, 2611–2624\.
- Lee et al\. \(2024\)Lee, A\.; Bai, X\.; Pres, I\.; Wattenberg, M\.; Kummerfeld, J\. K\.; and Mihalcea, R\. 2024\.A Mechanistic Understanding of Alignment Algorithms: A Case Study on DPO and Toxicity\.arXiv:2401\.01967\.
- Li et al\. \(2025a\)Li, C\.; Wang, J\.; Pan, X\.; Hong, G\.; and Yang, M\. 2025a\.ReasoningShield: Safety Detection over Reasoning Traces of Large Reasoning Models\.arXiv:2505\.17244\.
- Li et al\. \(2025b\)Li, J\.\-J\.; Pyatkin, V\.; Kleiman\-Weiner, M\.; Jiang, L\.; Dziri, N\.; Collins, A\.; Schaich Borg, J\.; Sap, M\.; Choi, Y\.; and Levine, S\. 2025b\.SafetyAnalyst: Interpretable, Transparent, and Steerable Safety Moderation for AI Behavior\.In*Proceedings of the 42nd International Conference on Machine Learning*, volume 267 of*Proceedings of Machine Learning Research*, 35731–35752\.
- Lin et al\. \(2017\)Lin, T\.\-Y\.; Goyal, P\.; Girshick, R\.; He, K\.; and Dollár, P\. 2017\.Focal Loss for Dense Object Detection\.In*Proceedings of the IEEE International Conference on Computer Vision \(ICCV\)*, 2980–2988\.
- Lu et al\. \(2023\)Lu, J\.; Xu, B\.; Zhang, X\.; Min, C\.; Yang, L\.; and Lin, H\. 2023\.Facilitating Fine\-grained Detection of Chinese Toxic Language: Hierarchical Taxonomy, Resources, and Benchmarks\.In*Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics \(ACL\)*, 16235–16250\.
- Ma, Zhang, and Chen \(2025\)Ma, Y\.; Zhang, N\.; and Chen, H\. 2025\.ChineseHarm\-Bench: A Chinese Harmful Content Detection Benchmark with Knowledge\-Augmented Baselines\.arXiv:2506\.10960\.
- Mármol\-Romero et al\. \(2024\)Mármol\-Romero, A\. M\.; Moreno\-Muñoz, A\.; Plaza\-del Arco, F\. M\.; Molina\-González, M\. D\.; Martín\-Valdivia, M\. T\.; Ureña\-López, L\. A\.; and Montejo\-Ráez, A\. 2024\.MentalRiskES: A New Corpus for Early Detection of Mental Disorders in Spanish\.In*Proceedings of the 2024 Joint International Conference on Computational Linguistics, Language Resources and Evaluation \(LREC\-COLING\)*, 11204–11214\.
- Mathew et al\. \(2021\)Mathew, B\.; Saha, P\.; Yimam, S\. M\.; Biemann, C\.; Goyal, P\.; and Mukherjee, A\. 2021\.HateXplain: A Benchmark Dataset for Explainable Hate Speech Detection\.In*Proceedings of the Conference on Artificial Intelligence*, volume 35, 14867–14875\.
- Mei et al\. \(2025\)Mei, J\.; Chen, J\.; Yang, G\.; Lin, W\.; and Byrne, B\. 2025\.Robust Adaptation of Large Multimodal Models for Retrieval Augmented Hateful Meme Detection\.In*Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing*, 23817–23839\.
- Qiu, Ma, and Lan \(2024\)Qiu, H\.; Ma, L\.; and Lan, Z\. 2024\.PsyGUARD: An Automated System for Suicide Detection and Risk Assessment in Psychological Counseling\.In*Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing \(EMNLP\)*, 4581–4607\.
- Röttger et al\. \(2022\)Röttger, P\.; Seelawi, H\.; Nozza, D\.; Talat, Z\.; and Vidgen, B\. 2022\.Multilingual HateCheck: Functional Tests for Multilingual Hate Speech Detection Models\.In*Proceedings of the Sixth Workshop on Online Abuse and Harms \(WOAH\)*, 154–169\.
- Röttger et al\. \(2021\)Röttger, P\.; Vidgen, B\.; Nguyen, D\.; Waseem, Z\.; Margetts, H\.; and Pierrehumbert, J\. 2021\.HateCheck: Functional Tests for Hate Speech Detection Models\.In*Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics \(ACL\)*, 41–58\.
- Saxe, McClelland, and Ganguli \(2014\)Saxe, A\. M\.; McClelland, J\. L\.; and Ganguli, S\. 2014\.Exact Solutions to the Nonlinear Dynamics of Learning in Deep Linear Neural Networks\.In*International Conference on Learning Representations \(ICLR\)*\.
- Snell, Swersky, and Zemel \(2017\)Snell, J\.; Swersky, K\.; and Zemel, R\. 2017\.Prototypical Networks for Few\-shot Learning\.In*Advances in Neural Information Processing Systems*, volume 30\.
- Sun et al\. \(2023\)Sun, H\.; Zhang, Z\.; Deng, J\.; Cheng, J\.; and Huang, M\. 2023\.Safety Assessment of Chinese Large Language Models\.*arXiv preprint arXiv:2304\.10436*\.
- Vidgen et al\. \(2021\)Vidgen, B\.; Thrush, T\.; Waseem, Z\.; and Kiela, D\. 2021\.Learning from the Worst: Dynamically Generated Datasets to Improve Online Hate Detection\.In*Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics \(ACL\)*\.
- Wang et al\. \(2026\)Wang, Y\.; Zhang, S\.; Zhou, Z\.; Zhang, L\.; Bai, J\.; Lu, J\.; Fan, B\.; and Bu, F\. 2026\.DiaCOLQ: A Benchmark for Chinese Offensive Language Quadruple Prediction in Multi\-Turn Dialogues\.*Information Processing & Management*, 63\(7\): 104805\.
- Wei et al\. \(2022\)Wei, J\.; Wang, X\.; Schuurmans, D\.; Bosma, M\.; Ichter, B\.; Xia, F\.; Chi, E\.; Le, Q\. V\.; and Zhou, D\. 2022\.Chain\-of\-Thought Prompting Elicits Reasoning in Large Language Models\.In*Advances in Neural Information Processing Systems*, volume 35, 24824–24837\.
- Wu et al\. \(2024\)Wu, H\.; Qiu, Z\.; Wang, Z\.; Zhao, H\.; and Fu, J\. 2024\.GW\-MoE: Resolving Uncertainty in MoE Router with Global Workspace Theory\.arXiv:2406\.12375\.
- Wulczyn, Thain, and Dixon \(2017\)Wulczyn, E\.; Thain, N\.; and Dixon, L\. 2017\.Ex Machina: Personal Attacks Seen at Scale\.In*Proceedings of the 26th International Conference on World Wide Web \(WWW\)*, 1391–1399\.
- Zhang et al\. \(2025\)Zhang, H\.; Gao, H\.; Hu, Q\.; Chen, G\.; Yang, L\.; Jing, B\.; Wei, H\.; Wang, B\.; Bai, H\.; and Yang, L\. 2025\.ChineseSafe: A Chinese Benchmark for Evaluating Safety in Large Language Models\.arXiv:2410\.18491\.
- Zhang, Pan, and Yang \(2023\)Zhang, M\.; Pan, X\.; and Yang, M\. 2023\.JADE: A Linguistics\-based Safety Evaluation Platform for Large Language Models\.arXiv:2311\.00286\.
- Zheng et al\. \(2024\)Zheng, L\.; Chiang, W\.\-L\.; Sheng, Y\.; Li, T\.; Zhuang, S\.; Wu, Z\.; Zhuang, Y\.; Li, Z\.; Lin, Z\.; Xing, E\. P\.; Gonzalez, J\. E\.; Stoica, I\.; and Zhang, H\. 2024\.LMSYS\-Chat\-1M: A Large\-Scale Real\-World LLM Conversation Dataset\.arXiv:2309\.11998\.

## Acknowledgement

This work was supported by the National Key Research and Development Program of China \(No\.2024YFF0618800\), National Natural Science Foundation of China Grant No\.62402484, No\.62232016, Postdoctoral Fellowship Program and China Postdoctoral Science Foundation under Grant Number GZC20260867, 2026M791714, Youth Innovation Promotion Association Chinese Academy of Sciences, and Basic Research Program of ISCAS Grant No\.ISCAS\-JCZD\-202405\.