1 Introduction↩︎

Throughout human history, toxic expressions have consistently appeared in communication, and detecting such expressions has long been recognized as an ethically significant challenge. With the advent of Language Models (LM), research has shifted from traditional rule-based methods to LM-driven approaches that leverage their language comprehension abilities to detect toxic text [1]–[5]. Recently, researchers have increasingly focused on detoxification, which rewrites toxic text into non-toxic alternatives [6]–[8].

Meanwhile, users intentionally obfuscate toxic expressions to evade automatic moderation systems. Such obfuscation modifies surface forms while preserving the original intent, which complicates reliable detection. Several studies investigate this challenge by evaluating model robustness to textual perturbation in toxicity detection. Works such as [9] and [10] show that minor typographical or orthographic alterations can severely degrade toxicity detection performance of models, revealing vulnerabilities of language models to obfuscated inputs. These findings indicate that obfuscation poses a substantial challenge for current toxicity detection models.

Most existing toxicity datasets and benchmarks focus on non-obfuscated text [17], [18]. Moreover, existing obfuscation approaches rely on simple techniques such as homophone replacement or emoji insertion [19]–[21]. In addition, existing resources do not provide jointly aligned toxic content with its obfuscated variants, which makes unified experimentation difficult.

In particular, Korean is an agglutinative language with flexible spacing and rich morphological variation [22], [23] which allows surface forms to change without disrupting meaning. Its writing system further enables obfuscation through phonological variation and visual similarity that remain easily interpretable to native speakers. These linguistic characteristics lead to diverse and systematic, obfuscation patterns in real-world usage. Despite this, obfuscation in Korean toxic text remains relatively underexplored in existing research.

In response to these limitations, we introduce KOTOX, a Korean Toxic dataset designed for deobfuscation and detoxification. We organize Korean obfuscation into linguistically grounded classes, and define transformation rules derived from real-world instances. By using these rules, we provide paired neutral and toxic sentences along with their obfuscated counterparts, which allows models to learn both text recovery and toxic rewriting.

We support three evaluation tasks: (i) Obfuscated Toxic Text Classification, (ii) Neutral Text Deobfuscation, and (iii) Obfuscated Toxic Text Sanitization. We evaluate these tasks using multiple toxicity classifiers and large language models under zero-shot, few-shot, and fine-tuning settings. The results show that training with KOTOX improves robustness to obfuscated toxic text while preserving performance on non-obfuscated inputs. To the best of our knowledge, KOTOX is the first high-quality paired dataset of obfuscated Korean toxic text. We expect KOTOX to facilitate a deeper analysis of obfuscated toxic content in Korean.

2 Related Works↩︎

2.1 Toxicity Classification↩︎

Early studies on toxic text classification primarily employed lexical or keyword-based approaches [24], [25]. The development of deep learning accelerated the creation of various toxic datasets for model training. Representative datasets such as SBIC [11] and ToxiGen [13] cover a wide spectrum of abusive, hateful, and biased texts collected from social media. For toxicity classification, previous research explored encoder-based fine-tuning approaches [26]–[28], as well as contrastive learning methods [2], [29].

2.2 Detoxification↩︎

Unlike classification, detoxification requires rewriting toxic text into a neutral counterpart while preserving its semantic content. Motivated by the need, paired corpora such as ParaDetox [15] and K/DA [16] provide parallel toxic-neutral sentences for model supervision. Meanwhile, these paired corpora are utilized to train models that rewrite toxic language into neutral forms, or to suppress toxic content generation during decoding [7].

2.3 Obfuscated Toxicity↩︎

In recent years, researchers recognized the need to evaluate model robustness against intrinsically complex or intentionally obfuscated toxic language. Within this line of work, several studies focused on obfuscation-based robustness. HateCheck [10] employed leetspeak or orthographic perturbations to challenge toxic detection models, while ToxiCloakCN [9] showed that homophone and emoji substitutions in Chinese substantially degrade model performance. Together, these findings indicate that even surface-level obfuscation can effectively undermine both toxicity detection and detoxification systems.

2.4 Limitations of Previous Works↩︎

Existing toxic datasets exhibit two key limitations. First, they address either non-obfuscated toxic texts for detoxification or obfuscated toxic texts for detection in isolation, leaving no dataset that jointly captures both toxicity and obfuscation. Second, they mainly target narrow surface changes (e.g., homophones, or emojis substitutions), yielding limited variety. These limitations highlight the need for a paired, obfuscation-aware dataset that includes both neutral and toxic texts along with their obfuscated counterparts. Such a resource enables integrated evaluation and training on toxicity and obfuscation within a unified framework.

3 Overview of KOTOX & Tasks↩︎

We introduce a KOTOX, a Korean neutral-toxic pair dataset that includes corresponding obfuscated counterparts. We extend obfuscation beyond simple spelling or visual modifications in prior work by leveraging linguistic properties of Korean and its writing system, Hangeul. Korean is an agglutinative language, and Hangeul is a compositional script in which a syllable block decomposes into three parts (e.g., ㅊ+ㅐ+ㄱ \(\rightarrow\) 책). This structure enables fine-grained phonological and iconological transformations. The resulting pairs constitute a challenging benchmark for robustness analysis.

3.1 Task Definitions↩︎

We define three tasks that jointly address toxicity and obfuscation, enabled by the KOTOX dataset. These tasks are more challenging than conventional settings and can be utilized for evaluating the robustness of LLMs.

3.1.0.1 Obfuscated Toxic Text Classification

Given an obfuscated text, the goal of the task is to classify whether the given text is toxic or not. This mirrors standard toxicity classification but explicitly evaluates robustness under obfuscation.

3.1.0.2 Neutral Text Deobfuscation

Given an obfuscated neutral text, the goal of the task is to generate its deobfuscated neutral text. This task is newly defined in our work and can be regarded as a form of constrained translation.

3.1.0.3 Obfuscated Toxic Text Sanitization

Given an obfuscated toxic text, the goal of the task is to generate the deobfuscated neutral text that preserves semantics while removing toxicity. This task combines detoxification and deobfuscation in one step—the most challenging setting supported in KOTOX.

3.2 Class of Korean Obfuscation↩︎

Figure 2 illustrates our approach to construct a Korean obfuscation dataset. We classify obfuscation methods into five categories based on the linguistic taxonomy of Korean. Two Korean experts analyze 144 real-world obfuscated instances collected from user reviews on platforms (e.g., Agoda, Google Maps, and Booking.com), and they identify recurring obfuscation characteristics used by native speakers. We organize these characteristics into a structured taxonomy and define 17 transformation rules accordingly, as summarized in Table [main:tab:transformation95rules].

3.2.0.1 Phonological approach.

We adopt a phonological approach that treats phonemes as the smallest units of sound. Korean exhibits unique phonological properties, where small textual changes yield diverse but phonetically similar sounds. This characteristic enables obfuscation by replacing words with phonetically close alternatives or by modifying text to match actual pronunciation. We define 8 rules for this phonological process, and Appendix 10.1 describes these rules in detail.

3.2.0.2 Iconological approach.

The iconological approach converts text by leveraging visual similarity. It substitutes characters with visually analogous symbols, numbers, or foreign scripts, such as Chinese characters. Hangeul, the Korean writing system, consists of syllabic blocks that can be decomposed into up to three components. These transformations preserve readability while introducing iconological variation. We establish three rules for this process, detailed in Appendix 10.2.

3.2.0.3 Transliteration-based approach.

This approach converts text into another language that shares the same pronunciation. Obfuscation occurs when Korean pronunciation is transcribed into English letters or replaced with Chinese characters that sound identical. Alternatively, obfuscation can be achieved by translating a Korean word into a foreign-language synonym and then phonetically transcribing it into Hangeul. We specify three rules for this approach, presented in Appendix 10.3.

3.2.0.4 Syntactic approach.

The syntactic approach operates at the word and sentence levels rather than at the character level. Korean differs from English due to its agglutinative morphology and grammar-dependent spacing, which allows deviations to obscure meaning. Korean word recognition relies on holistic syllabic blocks rather than sequential phonemes, which enables readers to infer meaning even when internal character order changes. We exploit these linguistic characteristics to establish two transformation rules. The details of the rules appear in Appendix 10.4.

3.2.0.5 Pragmatic approach.

This process perturbs text by inserting irrelevant elements, such as symbols or onomatopoeia. Prior work reports that adding such elements can evoke positive sentiment, thereby reducing the effectiveness of toxicity detection in large language models [10]. Appendix 10.5 provides details of the rule-based pragmatic approach.

4 KOTOX Construction↩︎

Figure 2 illustrates the overall process of our data construction. Based on the previously defined rules, we construct neutral-toxic paired data containing corresponding obfuscations, enabling three tasks: obfuscated toxic text classification, neutral text deobfuscation, and obfuscated toxic text sanitization.

4.1 Source Dataset Preprocessing↩︎

We use the K/DA dataset [16], consisting of Korean neutral-toxic sentence pairs, as the source corpus for constructing KOTOX dataset. We identify several quality issues within the original data, including imbalance, misaligned neutrality, semantic ill-formedness, and ethical concerns such as the exposure of personal information. For a reliable alignment, three Korean natives conducted a manual filtering process based on a 10-item rubric covering label fidelity, linguistic validity, and data distribution integrity. The experts independently reviewed 7,555 pairs, achieving a Gwet’s AC1 score of 0.7408 (\(p < 0.001\)), indicating inter-annotator agreement. This rigorous refinement yielded 2,294 high-quality pairs, ensuring a reliable and balanced foundation for the KOTOX. The details appear in Appendix 11.1.

4.2 Construct Obfuscation of Text↩︎

Using the filtered neutral-toxic pairs, we construct KOTOX by applying the implemented transformation rules to each pair. For every source pair, three augmented pairs are generated by repeating the rule-application process \(k\in\{2,3,4\}\) times.

As shown in Alg. 3, given a single pair, the algorithm samples a rule \(r\) from the rule set \(\mathcal{R}\) and applies it to both the neutral and toxic sides. If the applied result violates any sanity check (SanityCheck), a new rule is resampled and reapplied until successful modification is achieved. This mechanism ensures that each pass introduces a meaningful transformation and avoids trivial or destructive overlaps among rules.

4.3 Dataset statistics↩︎

The dataset follows an 8:1:1 split for training, validation, and testing, resulting in 5,505 training instances, 687 validation instances, and 690 test instances. The details of dataset statistics are presented in Appendix 11.4.

5 Experimental Settings↩︎

5.1 Classification↩︎

To investigate the detection capability of different models, we conduct a toxic text classification task. We compare model performance on non-obfuscated dataset (Toxic) and obfuscated dataset (Ours) using F1-score to examine their understanding of obfuscated toxic content. For LMs, we perform supervised-fine-tuning (SFT) independently on each dataset and conduct cross-validation across them. For LLMs, we apply few-shot prompting using examples from the corresponding datasets.

5.1.0.1 Classification models.

We use three LMs fine-tuned on toxic datasets for the classification task, along with one open-source and one closed-source LLM. HateBERT² was fine-tuned on Reddit posts, offensiveRoBERTa³ (RoBERTa) was fine-tuned on Kaggle toxic comment challenge dataset, and toxicity-xlmr-v2⁴ (XLM-R) was fine-tuned on multilingual corpora covering 15 languages from various language families. Qwen2.5⁵ is a strong multilingual instruction-tuned LLM and GPT-4.1 is a closed-source LLM representing the proprietary models.

5.2 Deobfuscation and Sanitization↩︎

For the Deobfuscation and Sanitization tasks, we perform experiments in two settings: LLM prompting and fine-tuning. The experiments consist of zero-shot prompting, five-shot prompting, and SFT. We train the SFT models using LoRA and repeat each experiment three times for consistency. Detailed configurations are provided in Appendix 12.

5.2.0.1 LLMs.

We employ four LLMs selected to ensure linguistic diversity. The open-source set comprises Qwen2.5, along with two Korean-focused LLMs, EXAONE 3.5⁶ and Bllossom⁷. These three models have comparable parameter sizes and are all instruction-tuned. We also use GPT-4.1.

5.2.0.2 Toxicity & similarity metrics.

We report evaluation results using two common metrics for both deobfuscation and sanitization, and one additional metric for sanitization. To measure similarity with the reference text, we use BertScore [30] and chrF [31]. To evaluate the toxicity of sanitized outputs, we employ Google Jigsaw’s Perspective API⁸, which is widely adopted in detoxification tasks.

6 Experimental Results↩︎

6.1 Obfuscated Toxic Text Classification↩︎

Table [main:tab:class95main] presents the result of the toxic classification task. Since none of the three LMs were pretrained on Korean data, the performance without tuning (Base) is considerably low. However, XLM-R achieves relatively higher performance due to multilingual pretraining. Models fine-tuned only on the non-obfuscated toxic dataset (Toxic) shows substantially lower performance on the obfuscated evaluation set (Ours) than on the Toxic set. This result indicates that understanding toxic expressions alone is insufficient for detecting obfuscated toxic text.

Models trained exclusively on Ours set achieve higher performance on the Toxic evaluation set than models trained only on the Toxic set. Moreover, the performance gap between the Ours and Toxic evaluations decrease by up to 34.67%p. Finally, when the models were trained on both the Toxic and Ours set (Comb.), the results were comparable to those obtained when using only our dataset. This confirms that our dataset enhances the detection of obfuscated toxic text without degrading performance on the original toxic data.

For LLMs, both Qwen2.5 and GPT-4.1 show stronger performance on the Toxic dataset in the zero-shot (Base) setting than the LM baselines, while their performance noticeably degrades on the obfuscated dataset. The five-shot results further indicate that few-shot prompting does not consistently improve performance, and the degree of improvement differs across models and datasets. GPT-4.1 benefits from few-shot prompting more reliably than Qwen2.5, which suggests that Korean obfuscation affects LLMs in different ways. These findings show that the proposed benchmark captures differences in obfuscation robustness across models and reveals variation in their ability to interpret obfuscated Korean text.

6.2 Neutral Text Deobfuscation↩︎

Table 2 shows the experimental results for deobfuscating obfuscated neutral texts. We conduct experiments under three configurations: zero-shot, five-shot, and supervised fine-tuning (SFT). In the zero-shot setting, all models exhibit lower deobfuscation performance, even though they are pretrained on Korean dataset. In the five-shot setting yields small improvements in BERTScore across models. All open-source models achieve their best performance under the SFT setting.

The chrF score, an n-gram-based metric, increases substantially compared to the zero-shot results under SFT. The BERTScore, which measures semantic similarity based on embedding, shows improvements of up to 11%p SFT. The closed-source model GPT achieves the highest overall performance. These results suggest that existing LLMs, which are typically trained on clean and noise-free text, have limited understanding of obfuscated Korean text. By contrast, models fine-tuned on our dataset acquire a better understanding of obfuscation patterns, demonstrating improved robustness and comprehension of obfuscated Korean toxic texts.

6.3 Obfuscated Toxic Text Sanitization↩︎

Figure 3 presents the results of transforming obfuscated toxic texts into deobfuscated neutral texts. The Sanitization task shows very low performance in the zero-shot setting, similar to the deobfuscation experiments.

In the five-shot setting shows slight improvements in BERTScore and chrF. However, the Perspective API scores increase in the five-shot setting, where higher values indicate higher toxicity. These results indicate that models often succeed in deobfuscation but fail to mitigate toxic content in the five-shot setting. Manual inspection of the generated outputs confirms that models recover surface forms while retaining toxic meaning in many cases. These observations suggest that five-shot prompting does not provide sufficient understanding of obfuscation for successful sanitization.

The SFT setting achieves the best performance, consistent with the deobfuscation results. Models fine-tuned on KOTOX show improved ability to interpret obfuscated sentences and generate non-toxic outputs. These results indicate that current LLMs still have limited understanding of obfuscated Korean text, making them highly vulnerable to obfuscated toxic content. Therefore, our dataset is essential for building models that are robust to toxicity and resilient against obfuscated language.

7 Dataset Analysis↩︎

7.1 Rule analysis↩︎

Figure 4 presents the classification error ratio of HateBERT fine-tuned on the KOTOX for each applied rule. The error ratio represents the proportion of incorrect predictions for each rule. Figure 12 illustrates the correlation among the rules. The rules exhibit very little correlation with one another, which allows each rule to be interpreted independently. Rule 15 corresponds to the spacing perturbation rule and shows the highest error ratio. Although spacing changes do not significantly affect human understanding of the original meaning, they severely impact LMs because the models process text at the token level. When token boundaries are disrupted, model performance becomes highly vulnerable. Rule 17, which is symbol/emoji insertion, also causes a high error ratio. These symbols are unrelated to the textual context and hinder the model’s ability to detect toxicity. They can also induce misleadingly positive sentiment, thereby threatening the model’s robustness. In contrast, within the phonological approach, rules such as 8, which are based on clearly defined pronunciation patterns, tend to yield lower error ratios. This suggests that LMs can more easily capture systematic phonological transformations than irregular or noise-like modifications.

7.2 Semantic Preservation↩︎

5.7pt

We conduct a human deobfuscation evaluation on 500 sampled KOTOX test set to verify whether sentence meaning remains preserved after applying transformation rules. Table [main:tab:human95eval] presents the results of the human evaluation and Qwen2.5 result fine-tuned on our dataset. Three native Korean speakers perform the deobfuscation task. Human evaluation achieves BERTScore values that are 17.75%p higher and chrF scores that are 45.81%p higher than those of the fine-tuned Qwen2.5 model, and it shows consistently strong performance in the 90% range. These results indicate that sentence meaning remains intact even under the application of many transformation rules. The high level of human performance indicates that the proposed rules are practically applicable. The comparison with current LLM performance show that existing LLMs still exhibit limited understanding of obfuscated Korean text.

7.3 Evaluation on Wild Data↩︎

We examine how models trained on KOTOX perform on wild data to evaluate their real-world generalization. We collect 144 obfuscated review instances from online platforms such as Agoda, Google Maps to construct the wild dataset. We conduct evaluation under zero-shot, five-shot, and supervised fine-tuning settings, where the five-shot settings use examples from KOTOX, and the supervised fine-tuning setting also fine-tunes Qwen2.5 on KOTOX. Table 5 presents the evaluation results.

The results show slightly lower performance on the wild dataset than on KOTOX, while overall performance patterns remain similar. This observation suggests that the wild dataset presents marginally higher difficulty than our dataset. At the same time, the consistent performance trends indicate that applying multiple transformation rules does not introduce excessive or unrealistic difficulty to the sentences. In the supervised fine-tuning setting, Qwen2.5 fine-tuned on our dataset outperforms the non-fine-tuned settings on the wild dataset, which indicates that training on our dataset helps the model better understand real-world obfuscated examples. These findings demonstrate that KOTOX captures real-world characteristics of Korean online communities.

8 Conclusion↩︎

In this paper, we propose KOTOX, a neutral-toxic paired dataset that includes obfuscated counterparts. We categorize obfuscation approaches into five classes based on Korean linguistic properties and define the corresponding transformation rules. By applying these rules, we construct a neutral-toxic paired dataset in which each instance includes its corresponding obfuscated counterpart. Using our dataset, we conduct classification, deobfuscation, and sanitization tasks, demonstrating that the dataset effectively facilitates these tasks. As far as we are aware, this is the first obfuscation and detoxification dataset in Korean, and we expect it will contribute to further research on improving the understanding of Korean obfuscation.

Limitations↩︎

Our study focuses exclusively on the Korean language and Hangeul. This design choice can be considered as both a limitation and a strength. KOTOX and its transformation rules may not directly generalize to other linguistic or cultural contexts. However, Korean presents unique phonological and orthographic characteristics that make obfuscation phenomena particularly rich and distinctive. Our dataset and analysis are therefore deliberately tailored to explore these language-specific traits in depth, providing insights that would be lost in a broad multilingual setting. In future work, we plan to extend the obfuscation taxonomy and data construction framework to other languages.

Ethical Considerations↩︎

Our work involves the collection and analysis of toxic and offensive language, which inherently raises ethical concerns. All toxic samples used in KOTOX originate from publicly available sources, and sensitive or personally identifiable information was carefully removed during data filtering by following the rubrics in Table 15 in Appendix. 4.1. While our dataset includes harmful expressions for research purposes, it is intended solely for academic use in developing safer and more robust language technologies. We strongly discourage any misuse of KOTOX or its contents for generating, amplifying, or spreading offensive material.

9 Preliminary↩︎

9.1 Korean Language & Hangeul↩︎

Korean is an agglutinative and morphologically rich language in which grammatical relations are expressed through affixes and particles. Its writing system, Hangeul, is a compositional and featural phonemic script: each syllable block is formed by combining an initial consonant, a medial vowel, and an optional final consonant (e.g., ㅊ+ㅐ+ㄱ \(\rightarrow\) 책). This block-based structure allows fine-grained phonological and visual variations, making Korean particularly suitable for studying diverse obfuscation phenomena.

As shown in Table 6, the proposed obfuscation classes exploit inherent linguistic and orthographic properties of Korean and Hangeul. The compositional structure of syllables, visual regularity of graphemes, and multilingual familiarity shared by Korean users collectively enable diverse and controllable transformation strategies. These characteristics make Korean particularly suitable for studying systematic and fine-grained text obfuscation.

9.2 Korean Language-Specific Properties↩︎

9.2.1 Combinatorial syllabic phonology.↩︎

Korean phonology is organized around syllabic units by the combination of initial consonant, medial vowel, and final consonant. This block-based composition induces dense neighborhoods of near-homophones at the syllable level, further enriched by the lenis–aspirated–tense triplets (e.g., ㄱ/ㅋ/ㄲ, ㄷ/ㅌ/ㄸ) and pervasive liaison/coarticulation phenomena. As a result, preserving the global “sound impression” while altering one or more sub-syllabic elements is structurally easy and perceptually tolerable for human readers. These properties systematically increase the search space for sound-preserving edits (replacement, addition) without severely degrading legibility, which directly enables phonological obfuscation.

9.2.2 Latent multiscript competence.↩︎

Due to historical and educational exposure, Korean users routinely navigate multiple scripts (Hangeul, basic chinese character, and Latin alphabet), and are familiar with bidirectional phonetic transcription conventions. This latent multiscript competence supports intuitive cross-script rendering of Korean words and names, and facilitates obfuscation by swapping to visually or phonetically similar forms in other scripts (or by re-Hangeulization after translation). The community-level familiarity with such code-mixed writing (e.g., signage, names, media) lowers the cognitive cost of interpreting transliterations, thereby making transliteration-based obfuscation particularly viable.

9.3 Hangeul Orthographic Properties↩︎

9.3.1 Decomposability and visual iconicity.↩︎

Hangeul graphemes are explicitly decomposable into consonants and vowels within a square syllabic layout. The clear sub-graphemic structure, together with geometric regularities of the block, affords visually motivated substitutions at both the character and consonant levels and rotation-based variants. Human readers retain robust recognition under such geometric perturbations due to the script’s iconic regularity and redundancy, which, in turn, makes iconological obfuscation effective.

9.3.2 Syllable-oriented segmentation↩︎

Hangeul is written in syllabic blocks, and Korean readers parse strings with strong syllable-level awareness. Combined with historically variable spacing practices and the grammatical role of postpositional particles, this yields high tolerance to segmentation perturbations and syllable-level rearrangements: many strings remain human-recoverable despite spacing noise or local anagrams. This property directly supports syntactic obfuscation that disrupts surface structure while preserving overall interpretability.

10 Classes of Obfuscation↩︎

10.1 Phonological Approach↩︎

The phonological approach exploits the similarity in pronunciation between sounds, modifying the phonemic components of a syllable while preserving overall phonetic perception. Three types of edits are applied—replacement, addition, and liaison—each operating on the sub-syllabic structure of Hangeul. Deletions are not employed, as they tend to remove excessive information and distort readability. Because Korean exhibits systematic phonological alternations (liaison), these operations are especially effective for generating natural yet obfuscated variants. As noted in Appendix 9.2.1, each syllable in Hangeul can be decomposed into multiple components, which facilitates diverse and fine-grained variations.

10.1.0.1 Replacement.

We replace sub-syllabic units that share close phonetic features: (i) Initial consonant, (ii) Medial vowel, and (iii) Final consonant. Each is substituted with a phonetically similar unit so that the pronunciation remains recognizable. Additionally, (iv) orthographic resyllabification is applied, where syllables are recomposed according to common phonological rules to reflect natural sound shifts. Korean provides rich substitution options owing to its lenis–aspirated–tense triplets (e.g., ㄱ/ㅋ/ㄲ) and various semi-vowels and diphthongs, which enable fine-grained and diverse replacements. As shown in Table 8, representative phonological substitution dictionaries such as lenis–tense and lenis–aspirated mappings form the basis of these replacement rules.

10.1.0.2 Insertion.

Additions insert new phonemes while retaining the original pronunciation pattern. (i) Initial consonant insertion: the silent consonant ‘ㅇ’ allows prefixing repeated or weak consonant sounds without changing syllable integrity. (ii) Medial vowel insertion: Korean vowels include semi-vowels (e.g., ㅏ\(\rightarrow\)ㅑ, ㅜ\(\rightarrow\)ㅟ) that can be naturally inserted to create similar but extended sounds. (iii) Final consonant insertion: since the final consonant position in Hangeul is optional, a new consonant can be appended—often drawn from the onset of the following syllable—to mimic natural articulation.

10.1.0.3 Liaison.

Liaison refers to the phonological process where the final consonant of a syllable is carried over to the initial position of the next. We simulate this by two variations: (i) forward liaison and (ii) reverse liaison, which performs the inverse mapping to obscure standard pronunciation patterns. These operations reflect natural pronunciation flow while introducing subtle orthographic perturbations that remain intelligible to human readers.

10.2 Iconological Approach↩︎

The iconological approach leverages the visual decomposability of Hangeul consonants and the independence of their graphical forms. As discussed in Sec. 9.3.1, the clear sub-graphemic structure of Hangeul, together with the geometric regularity of its syllabic blocks, enables visually motivated substitutions at both the character and consonant levels, as well as rotation-based variants. As illustrated in Table 9, Hangeul allows a variety of iconographic transformations owing to its syllabic block structure and clear geometric regularity. These transformations are designed to modify the visual appearance of text while maintaining overall recognizability to human readers.

10.2.0.1 Look-alike substitution.

This method substitutes Hangeul characters with visually similar glyphs. These substitutes can be other Hangeul characters or visually analogous symbols drawn from CJK (Chinese, Japanese, Korean) characters, Latin scripts, or even emojis.

Specifically, these substitutions occur at two different levels of granularity: (i) at the character level, entire syllable blocks are replaced with visually similar symbols. This is particularly frequent among Hangeul variants, emojis, and CJK characters. Due to their visual complexity, CJK characters are often effective at mimicking the overall structure of a complete Hangeul syllable. (ii) at the sub-syllabic level, individual graphemes (consonants and vowels) are replaced with shape-correlated symbols. For instance, the Hangeul letter ‘ㅇ’ can be replaced by the Latin ‘O’, or ‘ㅑ’ by ‘F’. Because Hangeul is a featural script where consonants and vowels are combined into blocks, this sub-syllabic structure allows for highly flexible and diverse look-alike substitutions.

10.2.0.2 Rotation.

Rotation-based obfuscation manipulates the glyph orientation of Hangeul characters. By rotating syllable blocks or subcomponents by \(90^{\circ}\) or \(180^{\circ}\), we produce text that visually resembles the original while disrupting standard orthographic patterns. Such geometric perturbations preserve readability to humans but often confuse automatic recognition models. For example, a \(90^{\circ}\) rotation of the Hangeul ‘비’ results in ‘뜨’, creating a visually similar but semantically different character.

10.3 Transliteration-based Approach↩︎

As discussed in Sec. 9.2.2, Korean users are inherently familiar with multiple writing systems, including Hangeul, basic Chinese characters (Hanja), and the Latin alphabet, due to historical and educational exposure. This multilingual competence enables intuitive transliteration-based obfuscation, where parts of text are replaced with characters or sounds drawn from other scripts that share phonetic or semantic associations. Broadly, two strategies are employed: one exploits phonetic similarity (sound-based substitution), and the other leverages semantic equivalence (meaning-based substitution).

10.3.0.1 Phonetic transliteration.

Phonetic transliteration replaces parts of a Korean word with CJK or Latin characters that share similar pronunciation. For instance, the Chinese character 水 (pronounced “su”) can substitute the syllable 수 in 수상해, resulting in 水상해. Partial substitutions that target only specific consonants or vowels are also possible (e.g., 게시판 → gㅔ시판). Such CJK or Latin replacements preserve phonetic resemblance while introducing script-level variation that hinders automatic recognition.

10.3.0.2 Semantic transliteration.

Semantic transliteration exploits the meaning of the original phrase by translating it into a foreign language and then re-Hangeulizing the phonetic rendering of the translated words. For example, the Korean verb 부탁해 can be semantically translated into Japanese as ください, and then phoneticized back into Hangeul as 구다사이. This substitution thus conveys the same meaning through a cross-lingual phonetic rendering that remains easily interpretable to Korean readers. This approach leverages bilingual familiarity—especially with English and Japanese—to generate natural yet obfuscated variants easily interpretable by Korean readers.

10.3.0.3 LLM-based obfuscation.

Unlike other obfuscation classes, the transliteration-based approach is difficult to implement in a purely rule-based manner, as it often requires contextual awareness and semantic substitution rather than simple character mapping. Among its variants, phonetic transliteration with CJK characters can be handled deterministically through predefined rules, whereas Latin-based and semantic transliteration demand higher-level reasoning and cross-lingual understanding. To address this, we employ a lightweight and efficient language model, GPT-5 nano, to perform LLM-assisted obfuscation for these cases.

While Hanja (CJK) characters align one-to-one with Hangeul syllables, Latin script does not exhibit such a direct correspondence, which frequently led to undesirable substitutions that altered contextually important words. In contrast, semantic transliteration inherently involves translation into a foreign language, making LLM utilization not only beneficial but necessary.

As shown in Figure 5 and Figure 6, we design carefully crafted prompts to guide the model in generating contextually appropriate obfuscations. Unlike the few-shot or zero-shot prompts used for English tasks, these prompts were written in Korean to better align with the linguistic characteristics of Hangeul and to encourage the model to reflect native Korean phonological and orthographic nuances.

The robustness of these obfuscation methods, including both LLM-based and rule-based approaches, is indirectly validated in Subsection 7.2. Specifically, the results from the human de-obfuscation task demonstrate that our obfuscation techniques successfully preserve the original semantics. This high level of semantic preservation ensures that the obfuscated text remains interpretable to humans and retains its toxic intent.

None

None

10.4 Syntactic Obfuscation↩︎

As noted in Sec. 9.3.2, Hangeul is written in syllabic blocks and Korean readers parse text with strong syllable-level awareness. Combined with historically flexible spacing and the grammatical role of postpositions, this yields high tolerance to segmentation noise and local rearrangements. Thus, surface perturbations that disrupt spacing or syllable order often remain human-recoverable while confusing automatic detectors.

10.4.0.1 Spacing perturbation.

We randomly insert or remove spaces at plausible boundaries (e.g., between syllable blocks or morphemes), preserving word order while altering the visual segmentation. When composed with other rules, spacing noise increases ambiguity without severely degrading readability. As shown in Table 12, while text remains easily understandable when only spacing perturbations are applied, the introduction of syllable-level anagrams significantly amplifies the difficulty of de-obfuscation.

10.4.0.2 Syllable-level anagram.

We locally reorder syllables within a word/phrase under constraints that keep the syllable inventory intact and limit edit distance. Unlike alphabetic scripts (character-by-character decoding) or logographic scripts (character-as-morpheme), the block-based unit in Hangeul often allows such micro-rearrangements to stay interpretable to human readers.

10.5 Pragmatic Obfuscation↩︎

Pragmatic obfuscation is language-agnostic and alters discourse cues rather than lexical content. We insert visually salient symbols or emojis near sentiment-bearing tokens, which can soften perceived polarity or distract pattern-based heuristics, thereby reducing toxicity detection rates while keeping the underlying proposition intact. Such modifications exploit the tendency of large language models and toxicity classifiers to rely on surface-level emotional markers rather than deep semantic understanding.

10.5.0.1 Irrelevant symbol insertion.

We constrain the symbol injection rate and avoid splitting inside syllable blocks or linguistic morphemes. Hearts, brackets, or emoticons are placed around target spans to modulate tone (e.g., °♡, 《 》, ≥ㅅ≤), creating a visually disfluent but emotionally softened expression. These pragmatic cues preserve human readability and contextual meaning while significantly degrading the reliability of automatic toxicity detection, highlighting a unique challenge in modeling human-like interpretation of style and intent.

11 Dataset Construction Details↩︎

11.1 Details of Filtering K/DA↩︎

To construct our obfuscated Korean toxic text dataset, we use K/DA [16] as the primary source. K/DA is a Korean paired dataset originally developed for the detoxification task, where neutral sentences were transformed into toxic counterparts through LLM-based rewriting. To capture rapidly evolving slang and online expressions, K/DA first collected toxic text from various online communities and built a large corpus. For each neutral sentence, similar toxic samples were retrieved using a semantic similarity metric and then provided as examples to an LLM, which generated corresponding toxic paraphrases.

Despite its scale and utility, K/DA presents several quality limitations. A non-negligible number of cases contain mislabeling, where already-toxic sentences are annotated as neutral. Some sentences are syntactically or semantically ill-formed to the point of being uninterpretable. The dataset also includes real personal names, posing potential ethical concerns. Furthermore, a single neutral sentence in K/DA is often paired with multiple, near-duplicate toxic variants, resulting in redundancy, lexical imbalance between neutral and toxic subsets, and suboptimal suitability for classification tasks.

To address these issues, we conduct a manual filtering process. Following the rubric in Table 15, three native Korean annotators independently reviewed all 7,555 neutral–toxic pairs without discussion. If a neutral sentence was deemed problematic, the entire set of pairs linked to that neutral sample was removed, whereas if the toxic side alone was flawed, only the corresponding pair was discarded. Inter-annotator consistency was evaluated using Gwet’s AC1 coefficient, which yielded a score of 0.7408 (\(p < 0.001\), \(z = 125.75\), \(SE = 0.0059\)). This value indicates a high level of agreement among annotators, supporting the reliability of the filtering decisions.

After filtering, only the 5,160 pairs marked as valid by all annotators were retained. We further exclude extremely short sentences consisting of two tokens or fewer, as they offered limited opportunity for meaningful obfuscation. In cases where multiple toxic variants were associated with the same neutral sentence, a single toxic example was randomly selected. The resulting corpus comprises 2,294 high-quality neutral–toxic pairs, which serve as the foundation for our obfuscated dataset.

11.2 Dataset Construction Environment↩︎

We utilize several libraries for data generation, including hgtk 0.2.1, six 1.17.0, openai 1.109.1, jamo 0.4.1, KoNLPy 0.6.0, and KoG2Padvanced⁹.

11.3 Hyperparameters for Dataset Construction↩︎

During dataset construction, each neutral-toxic pair from K/DA was processed through the obfuscation procedure described in Alg. 3. For each pair, a set of transformation rules was applied up to \(k\) times. Since the scope of application differs across rules—some can be applied to nearly every token, while others only affect limited contexts—we control the overall rewrite intensity using a global rewrite rate. Specifically, the rate was set to 0.5 or 0.3 of the total number of tokens in a sentence, depending on rule coverage. The detailed per-rule rewrite rates used for all 17 rules are summarized in Table 16.

11.4 Dataset Statistics↩︎

Statistic highlights the key strengths of KOTOX compared to existing toxic datasets. Previous datasets lack a sufficient volume of obfuscated samples or fail to provide direct pairs of original and obfuscated text. In contrast, our dataset goes beyond simple neutral-toxic pairs by providing aligned obfuscated versions for each sentence. Furthermore, we distinguish our work by applying diverse obfuscation methods across five major categories, ensuring both the breadth and depth of the benchmarks required to evaluate model robustness against evolving toxic expressions.

Table 17 summarizes the statistics of the final KOTOX dataset generated through the aforementioned obfuscation process. The dataset contains a total of 6,882 neutral–toxic pairs, evenly divided into three difficulty levels according to the number of applied rules per sentence. Easy, Normal, and Hard subsets of KOTOX are constructed by applying two, three, and four random transformation rules to each sample, respectively. Table 18, 19, 20 further provide qualitative examples illustrating how different rule combinations are reflected across difficulty levels.

As illustrated in Figure 7, the applied rules exhibit a non-uniform distribution across the datasets, which results from differences in the text spans each rule covers. A large proportion of the applied rules belong to the Phonological approach (rule 1-8). This is because, unlike other rules that require specific character-level conditions, phonological transformations can be applied more freely at the phoneme level.

12 Experimental Details↩︎

12.1 Details of LMs used for Classification↩︎

We use three transformer-based language models fine-tuned on toxic or offensive text corpora for toxicity classification.

12.1.0.1 HateBERT

HateBERT [26] is a BERT model further pre-trained on Reddit posts containing abusive and offensive language. It is optimized for English toxic comment detection and serves as a strong domain-adapted baseline.

12.1.0.2 Multilingual-Toxic-XLM-RoBERTa

This model is based on XLM-RoBERTa and fine-tuned on multilingual toxic datasets covering 15 languages. It enables cross-lingual toxicity detection and serves as our multilingual baseline.

12.1.0.3 Toxicity-XLMR-v2

Toxicity-XLMR-v2 is a large XLM-RoBERTa model fine-tuned on diverse multilingual corpora for toxicity classification. It provides strong generalization across languages and complements the English-centric HateBERT.

12.2 Details of LLMs Used for Deobfuscation and Sanitization↩︎

All models used in our experiments are instruction-tuned large language models (LLMs).

12.2.0.1 Qwen2.5

Qwen2.5 is a multilingual causal LLM by Alibaba with significantly improved Korean capability over its predecessors. Although version 3 is available, we use 2.5 since the newer “thinking” mode often produces overly verbose outputs unsuitable for our tasks.

12.2.0.2 Exaone 3.5

Exaone 3.5, developed by LG AI Research, is a Korean-specialized LLM. We adopt version 3.5 instead of 4.0 to avoid verbosity issues from the new “thinking” control while maintaining strong linguistic quality and response stability.

12.2.0.3 LLaMA-3-Korean-Bllossom

LLaMA-3-Korean-Bllossom extends Meta’s LLaMA-3 through continued Korean pretraining and instruction tuning. It serves as an open-source alternative emphasizing fluency and consistency in Korean generation.

12.2.0.4 GPT-4.1

GPT-4.1 is OpenAI’s closed-source frontier LLM, representing one of the most capable general-purpose models currently available. It serves as a strong closed-source baseline for deobfuscation and sanitization tasks.

12.3 Details of Metrics↩︎

12.3.0.1 Accuracy

Accuracy measures the proportion of correctly predicted samples. However, in balanced binary classification tasks, a trivial model that always predicts a single class can easily achieve 50% accuracy. Therefore, it is often reported together with F1-score for a more reliable assessment.

12.3.0.2 F1-score

F1-score is the harmonic mean of Precision and Recall. In binary or imbalanced classification tasks, F1-score is widely preferred over accuracy since it better captures the balance between false positives and false negatives. We treat the harmful class as the positive label when computing F1-score, which is a common convention in hate speech detection studies.

12.3.0.3 BERTScore

Since our dataset is in Korean, we employ the multilingual BERT-based implementation of BERTScore following the default configuration of the official library. This allows semantic similarity to be computed across diverse linguistic variations.

12.3.0.4 chrF

Korean exhibits agglutinative morphology, where particles and affixes are attached to word stems. As a result, token-level \(n\)-gram metrics such as BLEU or ROUGE may underestimate similarity. We therefore report character-level matching scores using chrF, which better captures morphological overlap.

12.3.0.5 Perspective API

We additionally use Google’s Perspective API to estimate toxicity scores of generated sentences. This tool is widely adopted in toxicity and hate-speech detection research for providing a standardized toxicity estimation.

12.4 Experimental Environments↩︎

We conduct training and inference on Ryzen 9950x and Threadripper 9960X CPUs, and NVIDIA RTX Pro 6000 GPUs. The experiments were performed on Rochy Linux 9.6 using PyTorch 2.8.0, Transformers 4.56.2, BitsAndBytes 0.48.0, Kernels 0.10.2, PEFT 0.17.1, Scikit-learn 1.7.2, EasyDict 1.13, Pandas 2.3.3, Accelerate 1.10.1. For evaluation metrics, we additionally use Evaluate 0.4.6, SacreBLEU 2.5.1, BERTScore 0.3.13, OpenAI 1.109.1.

12.5 Hyperparameters for Fine-tuning↩︎

12.5.0.1 Classification.

We fine-tune the LM using supervised learning for the classification task. The fine-tuning process employed a dropout rate of 0.1, with hyperparameters set as follows: 15 epochs, a batch size of 16, a learning rate of 2e-5, a maximum sequence length of 245, and the AdamW optimizer. The model with the best evaluation loss was selected as the final checkpoint. Each experiment was repeated with seeds 42, 43, and 44.

12.5.0.2 Deobfuscation and Sanitization.

For each task, we fine-tune the LLM using LoRA (\(\alpha\)=16, dropout=0.1, r=64) under 16-bit precision. The fine-tuning configuration included 5 epochs, a batch size of 16, a learning rate of 2e-5, a weight decay of 1e-2, a maximum sequence length of 1024, the AdamW optimizer, a warmup ratio of 0.03, and a cosine learning rate scheduler. The best-performing model based on evaluation loss was selected, and each experiment was repeated with seeds 42, 43, 44. For both Deobfuscation and Sanitization tasks, we apply zero-shot and five-shot prompting schemes. Prompt templates for the Deobfuscation task are shown in Figures 8 and 9, and for the Sanitization task in Figures 10 and 11.

None

None

None

None

13 Additional Experimental Results↩︎

13.1 Full Results on Classification↩︎

Table 21 shows the classification F1-score and standard deviations. Similar to the F1-scores, models fine-tuned on the combined dataset of non-obfuscated toxic text and obfuscated text generally achieved higher performance than those trained on a single type of data. Furthermore, models trained solely on the obfuscated dataset also performed well in detecting non-obfuscated toxic texts, indicating their generalization capability.

Figure 12 shows the rule-wise correlation matrix of HateBERT fine-tuned on the easy dataset. The easy dataset contains samples with two applied rules per instance. As observed, there are no strong correlations between the rules, suggesting that each rule operates independently.

13.2 Among Difficulty Levels↩︎

Table. 22 illustrates the classification performance of HateBERT across different dataset difficulty levels. No-Obf refers to the original toxic dataset without obfuscation. Each row represents the dataset used for fine-tuning, and each column denotes the evaluation dataset. The model trained on the total dataset achieved the highest overall performance. Excluding total, the easy dataset yielded the best results. This suggests that the model learns to capture the characteristics of transformation rules from data with fewer applied rules, enabling it to better generalize to more challenging datasets with multiple obfuscations.

References↩︎

---

1. Corresponding author.↩︎

2. GroNLP/hateBERT↩︎

3. unitary/multilingual-toxic-xlm-roberta↩︎

4. textdetox/xlmr-large-toxicity-classifier-v2↩︎

5. Qwen/Qwen2.5-7B-Instruct↩︎

6. LGAI-EXAONE/EXAONE-3.5-7.8B-Instruct↩︎

7. MLP-KTLim/llama-3-Korean-Bllossom-8B↩︎

8. https://perspectiveapi.com/↩︎

9. https://github.com/seongmin-mun/KoG2Padvanced.git↩︎