PaperlayerView exact revision on arXiv

Source-linked AI summary

HarmTrace: Anchor-Calibrated Decoupled Optimization for Fine-Grained Target Identification in Harmful Memes

Yujia Li, Yiqun Zhang, Zihan Cheng, Yijie Huang, Tenglong Ye, Zihan Wang, Xiaocui Yang, Shi Feng, Yifei Zhang, Daling Wang

arXiv:2608.16622v1cs.CVcs.AI

TL;DR

Harmful meme detection often gets the harmfulness label right while failing to identify the attacked target and supporting evidence jointly. The paper introduces Meme3W, JRA, and HarmTrace, which improves both joint target-identification correctness and harmfulness accuracy, raising Qwen3-VL-8B JRA from 17.58% to 52.51%.

  • Problem

    Existing harmful meme datasets lack annotations for all target-identification fields, preventing record-level evaluation of their joint correctness.

  • Method

    HarmTrace combines entity-aware supervised fine-tuning with conditional policy optimization that decouples harmfulness and target-identification advantages using a Virtual Positive Anchor.

  • Results

    JRA improves across both evaluated backbones, increasing from 17.58% to 52.51% on Qwen3-VL-8B and from 6.62% to 49.09% on InternVL3-8B.

  • Takeaways & Limitations

    Meme3W and JRA make attacked targets and their textual and visual evidence explicit for structured moderation review.

Abstract

from arXiv · show

Multimodal harmful meme detection is typically formulated as image--text harmfulness classification. A model may correctly predict harmfulness while misidentifying the attacked target or its supporting evidence. We therefore extend harmful meme detection with fine-grained target identification, asking what type of target is attacked, who is targeted, and where the target appears in the meme. The model predicts harmfulness for every meme and, for harmful memes, outputs the target category, target entity, textual mention, and visual region. To support this task, we introduce Meme3W, which unifies multiple public harmful meme datasets and provides human-verified annotations for harmful instances. We further introduce Joint Record Accuracy (JRA), a strict record-level metric requiring the harmfulness label and all target-identification fields to be jointly correct. Experiments with representative multimodal large language models reveal a substantial gap between harmfulness accuracy and JRA. To narrow this gap, we propose HarmTrace, an anchor-calibrated decoupled optimization framework. HarmTrace strengthens target-entity supervision through entity-aware supervised fine-tuning. It then applies Conditional Target-identification Policy Optimization (CTPO) to decouple harmfulness and target-identification advantages, restricting target-identification optimization to label-correct responses for harmful examples. CTPO uses a Virtual Positive Anchor (VPA) as a fully correct reference for target-identification advantage normalization. HarmTrace improves both JRA and harmfulness accuracy across the evaluated backbones, with JRA on the Qwen3-VL-8B backbone increasing from 17.58\% to 52.51\%. Our code is publicly available at https://github.com/llly1234/HarmTrace-for-Harmful-Memes.

Introduction

The paper extends harmful meme detection with traceable, fine-grained target identification and introduces Meme3W and JRA for unified annotation and strict record-level evaluation. It proposes HarmTrace, which improves target-entity supervision and decouples optimization of harmfulness from target identification.

  • Task formulation: For harmful memes, the model identifies the target category, target entity, textual mention, and visual region alongside harmfulness.These fields form a traceable record connecting the harmfulness judgment to the attacked target and supporting evidence.
  • Dataset and metric: Meme3W unifies multiple public harmful meme datasets and provides human-verified annotations for harmful instances.Existing datasets annotate only subsets of the required fields, preventing record-level evaluation of their joint correctness.
  • Dataset and metric: Joint Record Accuracy (JRA) requires the harmfulness label and all target-identification fields to be jointly correct.Representative multimodal large language models show harmfulness accuracy consistently exceeding JRA across model scales.
  • HarmTrace: HarmTrace combines entity-aware supervised initialization with conditional policy optimization to narrow the gap between harmfulness accuracy and target identification.Its Entity-aware Supervised Fine-Tuning upweights target-entity tokens, strengthening supervision for the field linking target category with textual and visual grounding.
  • HarmTrace: HarmTrace decouples harmfulness and target-identification credit assignment through anchor-calibrated optimization.The framework is presented as an anchor-calibrated decoupled optimization approach for fine-grained target identification in harmful memes.

Related Work

Related work has expanded harmful meme understanding from binary classification toward target, explanation, and multilingual or multitask supervision. However, existing resources do not jointly annotate concrete target entities with textual and visual evidence, while reinforcement learning provides established posttraining foundations for LLMs and MLLMs.

  • Harmful Meme Understanding: Harmful meme datasets have progressed from hateful/non-hateful classification to misogyny types, harmfulness levels, coarse targets, explanations, and multilingual multitask resources.Hateful Memes, MAMI, Harm-C, PrideMM, MemeMind, MemeIntel, and MemeLens represent this progression.
  • Harmful Meme Understanding: Existing datasets lack unified annotations for the concrete target entity and its supporting textual and visual evidence.They also do not formulate these fields jointly with harmfulness prediction.
  • Reinforcement Learning Posttraining: Reinforcement learning posttraining methods include PPO with clipped updates and a learned value function, DPO for preference-pair optimization, and GRPO for critic-free group-based advantage estimation.Recent variants further refine group-based optimization through dynamic sampling, process-level rewards, and negative examples.

Meme3W: A Fine-Grained Target Identification Dataset for Harmful Memes

Meme3W extends harmful meme detection with structured target identification and builds a unified, human-verified benchmark from four public datasets. Its annotations capture target category, entity, textual evidence, and visual regions, with a multi-stage MLLM-assisted human annotation and adjudication process.

  • Task and annotation schema: Meme3W predicts harmfulness for every meme and, for harmful memes, identifies the target category, target entity, textual mention, and visual region.Non-harmful samples have null non-visual target fields and an empty visual-region list.
  • Dataset construction: Meme3W curates samples from PrideMM, MAMI, Hateful Memes, and Harm-C, then re-annotates selected samples under a unified schema.The original datasets do not jointly identify attacked targets and their textual and visual grounding.
  • Dataset construction: 10,662 samples, including 4,418 harmful samples, form the benchmark after manual screening, duplicate removal, and perceptual near-duplicate split assignment.Harmful samples span group background, gender, religion and caste, and health condition.
  • Annotation pipeline: Three MLLMs independently initialize candidate annotations, with hidden and randomly ordered model identities reducing model-specific anchoring.The candidates are normalized to the predefined format, and malformed fields are removed.
  • Annotation pipeline: Each sample is independently reviewed by two trained annotators, disagreements are adjudicated by a third, and a 200-case candidate-blind audit achieves an unweighted mean agreement of 0.827.Annotators may revise any MLLM-provided field based on the sample evidence.

Method

HarmTrace is an anchor-calibrated decoupled optimization framework comprising entity-aware supervised fine-tuning and Conditional Target-identification Policy Optimization. It strengthens target-entity supervision, separates harmfulness from target-identification optimization, and uses a Virtual Positive Anchor for incomplete responses.

  • Framework overview: HarmTrace combines Entity-aware Supervised Fine-Tuning (E-SFT) with Conditional Target-identification Policy Optimization (CTPO).The framework is designed to improve joint correctness of harmfulness and target-identification predictions.
  • Conditional target-identification policy optimization: CTPO decouples harmfulness and target-identification advantages, applying target-identification optimization only to label-correct harmful responses.Invalid-format or schema-violating responses receive zero rewards, while target-identification rewards combine applicable field scores with schema-applicability consistency.
  • Entity-aware supervised fine-tuning: E-SFT upweights target-entity value tokens because uniform weighting gives this short but semantically central field little sequence-loss contribution.The target entity identifies who is attacked and links the target category to textual and visual evidence; λent > 1 controls its supervision weight.
  • Optimization objective: The E-SFT-initialized policy serves as πref, and CTPO optimizes the resulting combined advantage with a standard clipped GRPO objective.The combined advantage retains separately normalized harmfulness and target-identification terms.
  • Virtual Positive Anchor: VPA adds a virtual fully correct score rmax = 1 to target-identification normalization, preventing misleading positive advantages or vanished advantages when partial rewards are unequal or tied.When the label-correct harmful subset C is nonempty, VPA affects normalization statistics only and contributes no policy-loss term; when C is empty, target-identification advantages are zero.

Experiments

Experiments evaluate HarmTrace on Meme3W with harmfulness, joint-record, and field-level metrics. Results show a substantial harmfulness–JRA gap, while entity-aware supervision, decoupled optimization, and VPA each improve jointly correct target identification.

  • Metrics: JRA requires correct harmfulness and every target-identification field on gold-harmful samples, with exact, relaxed-overlap, and IoU matching criteria.The thresholds are 1 for category, 0.7 for entity and textual mention, and 0.5 for visual regions.
  • Main Results: 47.95% is the best JRA among general-purpose MLLMs, while most smaller models remain below 25% despite higher harmfulness accuracy.The results reveal a gap between detecting harmfulness and jointly identifying the target correctly.
  • Main Results: 34.93 points: HarmTrace raises Qwen3-VL-8B JRA from 17.58% to 52.51%.Harmfulness accuracy and F1 also improve on both evaluated backbones.
  • Main Results: 42.47 points: HarmTrace raises InternVL3-8B JRA from 6.62% to 49.09%.The method improves both field-level target identification and joint correctness.
  • Entity-Aware Supervision: 45.89%: E-SFT with λent = 10 provides the most balanced ablation performance, improving over standard SFT’s JRA of 43.15%.Other weights win on some individual fields, but λent = 10 yields more consistent full-record performance.
  • RL-Stage Components: Under E-SFT initialization, decoupled optimization raises JRA from 49.09% to 50.91%, and VPA further raises it to 52.51%.Both components improve all evaluated target-identification fields, and HarmTrace outperforms the compared generic RL methods across reported metrics.

Conclusion · A Meme3W Construction and Validation · A.1 Data Curation, Unified Schema, and Annotation Prompt

The paper frames harmful-meme analysis as structured target identification, introduces Meme3W and JRA, and proposes HarmTrace to improve joint prediction. Meme3W unifies four datasets under human-verified annotations, while its schema and prompts standardize target evidence and model outputs.

  • Conclusion: HarmTrace combines entity-aware supervision, decoupled credit assignment, and a Virtual Positive Anchor to improve structured harmful-meme prediction.The framework targets harmfulness, target category, target entity, textual mention, and visual region jointly.
  • A Meme3W Construction and Validation: Meme3W unifies four multimodal meme datasets whose original annotations did not jointly identify attacked targets and their textual or visual grounding.The sources are PrideMM, MAMI, Hateful Memes, and Harm-C.
  • A.1 Data Curation, Unified Schema, and Annotation Prompt: Harmfulness is defined as harmful behavior directed toward a clear target, including insults, stereotyping, dehumanization, threats, discrimination, and related harms.Ordinary humor, non-targeted profanity, general criticism, and attacks on criminals or criminal activities are treated as non-harmful.
  • A.1 Data Curation, Unified Schema, and Annotation Prompt: Meme3W annotates each meme with harmfulness, target category, target entity, textual mention, and visual region under a unified schema.Non-harmful memes use null target-identification fields except for visual_region, which is an empty list; harmful memes always include target category and entity.
  • A.1 Data Curation, Unified Schema, and Annotation Prompt: Each model response is a flat JSON object whose five prediction fields are label, target_category, target_entity, text_mention, and visual_region.The think field stores auxiliary reasoning, while semantic matching and target rewards use the five structured fields.
  • A.1 Data Curation, Unified Schema, and Annotation Prompt: The shared prompting protocol requires models to analyze both image and text, determine target evidence, and classify harmfulness and target category.Textual mentions are recorded only when the target is explicitly referred to, and visual regions only when it is explicitly depicted.
  • A.1 Data Curation, Unified Schema, and Annotation Prompt: Output normalization represents textual evidence as an exact target-referencing span and visual evidence as bounding boxes formatted [x1, y1, x2, y2].Candidate models receive the meme image, associated text, task instructions, and unified output schema.

A.2 Human Annotation and Quality Control

Human annotation combines strict multimodal labeling rules with independent review, adjudication, and entity canonicalization. A candidate-blind audit on 200 cases preserved the relative model ordering, suggesting candidate assistance did not alter the main comparison.

  • Annotation requirements: Annotators determine harmfulness and assign each harmful meme exactly one target category, excluding unclear or multi-category cases.They interpret indirect harmfulness from the meme’s complete meaning and the author’s perspective.
  • Annotation requirements: Textual mentions are copied exactly, while visual boxes tightly cover complete target regions and use multiple boxes for repeated instances.Missing textual mentions are null, and absent visual depictions are represented by [].
  • Quality control: Two annotators independently label each meme using anonymized, randomly ordered MLLM candidates, with disagreements reviewed by a third annotator and resolved through discussion.Textual mentions and visual regions must correspond accurately to the attacked target in their respective modalities.
  • Entity canonicalization: Entity canonicalization normalizes casing, punctuation, whitespace, and equivalent variants while preserving distinctions between broader groups, subgroups, and identity-changing modifiers.The procedure is applied before target-entity agreement and evaluation metrics are computed.
  • Candidate-blind audit: On 200 candidate-blind audit cases spanning all four categories and varied grounding conditions, re-evaluation preserved the relative model ordering from the final gold annotations.This suggests candidate assistance did not alter the main comparative conclusion.

A.3 Dataset Statistics and Split Integrity

Meme3W contains 10,662 memes, including 4,418 harmful and 6,244 non-harmful examples, with split integrity checked through exact and perceptual duplicate audits. The dataset release includes structured annotations, fixed splits, guidelines, prompts, and evaluation code for research on harmful-content understanding and moderation.

  • Dataset statistics: Meme3W contains 10,662 memes: 4,418 harmful and 6,244 non-harmful examples.The harmful subset’s attack-target distribution and target-modality composition are reported separately.
  • Split integrity: No exact image duplicates occur across training, validation, and test splits under pixel-level hashing.Near-duplicate candidates identified with perceptual hashing are manually reviewed.
  • Split integrity: Verified near-duplicate groups are assigned to the same split, while recurring templates with different content remain distinct samples.This procedure covers perceptual near-duplicates without collapsing legitimately different meme instances.
  • Data release and responsible use: The release will provide structured annotations, fixed data splits, annotation guidelines, a shared prompt, and evaluation code.Raw images or source identifiers will be distributed according to the licenses of the corresponding source datasets.
  • Data release and responsible use: Meme3W contains offensive and discriminatory content and is intended for research on harmful-content understanding and moderation.The responsible-use statement accompanies the planned dataset release.

B Experimental Details and Implementation … B.3 Reward Components and Active Target-Identification Fields

The appendix standardizes evaluation, training, teacher-trajectory filtering, and reward computation for fine-grained harmful-meme target identification. It defines strict structured-output validation, conditional target rewards, active evidence fields, and graded component weighting.

  • B.1 Implementation and Evaluation Protocol: All evaluated models use shared instructions, a five-step analysis procedure, an explain-then-answer format, and a flat schema whose five prediction fields determine evaluation.The think field is excluded from evaluation; malformed structured outputs are invalid predictions.
  • B.1 Implementation and Evaluation Protocol: Configurations use official or publicly released instruction-tuned models, common parsing rules, and an SFT-to-RL pipeline, with trainable methods using LoRA rank 64 and α = 128.Hyperparameters and checkpoint selection are fixed exclusively on validation data before test evaluation.
  • B.2 Teacher-Trajectory Generation and Filtering: 6,005 of 9,066 generated Gemini 3 Flash trajectories are retained after requiring parseability and gold-matching correctness for all five prediction fields.The retained trajectories support cold-start SFT and E-SFT, while later policy optimization uses the full training set.
  • B.3 Reward Components and Active Target-Identification Fields: Only the five prediction fields enter semantic reward computation, after parsing and verification against the unified schema, field types, and bounding-box coordinates.Invalid JSON, fields, values, or coordinates fail format validation.
  • B.3 Reward Components and Active Target-Identification Fields: Target-identification rewards apply only to format-valid, label-correct responses for gold-harmful samples; non-harmful predictions require null target fields and an empty visual region.This condition decouples target-identification scoring from incorrect harmfulness predictions.
  • B.3 Reward Components and Active Target-Identification Fields: Category, entity, and schema consistency are always active, whereas textual and visual rewards are included only when corresponding gold evidence exists.The active components provide graded partial credit while preserving complete-record consistency.
  • B.3 Reward Components and Active Target-Identification Fields: The reward weights are 0.25 for category, 0.25 for entity, 0.20 for textual mention, 0.20 for visual region, and 0.10 for schema consistency, summing to 1.When textual or visual evidence is absent, the denominator renormalizes the remaining active weights, and the resulting reward lies in [0, 1].
  • B.3 Reward Components and Active Target-Identification Fields: Visual-region scoring uses soft matching with coverage, precision, center proximity, and IoU, while greedily averaging multiple-region matches and penalizing additional poorly matched boxes.The component parameters are (γIoU, γCov, γPrec, γctr) = (0.55, 0.20, 0.15, 0.10), τsoft = 0.6, and the low-score penalty is 0.05 below 0.20.

B.4 Threshold Sensitivity and Visual Matching Robustness

HarmTrace consistently outperforms GRPO across entity, textual-mention, visual-IoU, and alternative visual-region matching settings. The results indicate that the reported JRA ordering is robust to threshold choices and matching implementation.

  • Entity and text threshold sensitivity: HarmTrace remains above GRPO across all 25 target-entity and textual-mention threshold combinations, with ΔJRA ranging from 3.20 to 4.80 points.The thresholds τe and τs are varied over {0.5, 0.6, 0.7, 0.8, 1.0}.
  • Visual IoU threshold sensitivity: HarmTrace remains above GRPO at every evaluated visual-IoU threshold when τe = τs = 0.7.The varied visual threshold is applied to minimum-enclosing-rectangle matching.
  • Visual-region matching robustness: HarmTrace remains above GRPO under minimum-enclosing-rectangle IoU, one-to-one bipartite matching, and geometric set IoU.All matching rules use an IoU threshold of 0.5, with the remaining JRA criteria unchanged.

B.5 Additional Ablations and Robustness Analyses · C. Qualitative Case Studies · D. Ethical Considerations

Additional analyses show HarmTrace’s JRA gains are statistically supported and concentrated in selected target categories, while qualitative cases demonstrate both complete successes and crossmodal target-identification failures. The paper also specifies dataset-release safeguards, annotator protections, and research-oriented intended use.

  • B.5 Additional Ablations and Robustness Analyses: 52.51% JRA exceeds E-SFT’s 45.89% by 6.62 points, with a paired 95% interval of [2.51, 10.96].Using 10,000 paired percentile-bootstrap resamples of 438 gold-harmful test memes, HarmTrace also exceeds GRPO’s 49.09% by 3.42 points.
  • B.5 Additional Ablations and Robustness Analyses: HarmTrace’s category-wise gains are largest for group background and gender, improving over GRPO by 6.16 and 8.74 points, respectively.It improves over E-SFT by 9.58 and 11.65 points in those categories.
  • B.5 Additional Ablations and Robustness Analyses: HarmTrace is slightly below GRPO on religion and caste and health condition by 1.80 and 1.29 points, corresponding to only two and one test examples.It remains above E-SFT on both categories.
  • C. Qualitative Case Studies: In two representative successful cases, HarmTrace correctly predicts harmfulness, target category, target entity, textual mention, and visual region, satisfying all JRA criteria.These cases are presented as image-grounded and joint text–image target-identification successes.
  • C. Qualitative Case Studies: Two failure cases show crossmodal target misidentification: following an explicit man mention instead of an implicitly targeted woman, and confusing a text-only girl target with a pictured Black man.The first error misses the derogatory use of “dishwasher” for the woman; the second relies on the visual person rather than the textual target.
  • D. Ethical Considerations: Meme3W will follow the licenses and redistribution requirements of PrideMM, MAMI, Hateful Memes, and Harm-C, releasing annotations, source identifiers, and processing code when raw images cannot be redistributed.The release will include content warnings and a procedure for reviewing removal requests because data may contain identifiable individuals, slurs, or stigmatizing content.
  • D. Ethical Considerations: Five graduate-student annotators were warned about potentially offensive content, participated voluntarily, could skip examples or withdraw, and were paid $10 per hour.MLLM outputs served only as editable annotation candidates, with disagreements resolved through additional oversight.
  • D. Ethical Considerations: Meme3W is intended for harmful-content understanding, safety evaluation, model analysis, and content-moderation review, with annotations making targets and textual and visual evidence explicit.The qualitative examples include harmful stereotypes involving Down syndrome, race, sexism, and sexual violence.
Loading 2608.16622v1…