PaperlayerView exact revision on arXiv

Source-linked AI summary

Whitewashing Hate, Smearing Harmless Content: Annotator-Style Rebuttal Attacks on LLM-Based Moderation

Junyu Lu, Kaiyuan Liu, Jingyi Kang, Deyi Ji, Hailong Zhang, Lanyun Zhu, Qi Zhu, Bo Xu, Liang Yang, Hongfei Lin

arXiv:2608.22230v1cs.CL

TL;DR

LLM moderation workflows expose initially correct judgments to misleading reviewer feedback, but the directional vulnerability of such attacks remains insufficiently understood. The paper introduces a multi-strategy, multi-turn rejudge protocol and finds substantial, model-specific degradation that defenses reduce without eliminating, motivating direction-aware safeguards.

  • Problem

    The study addresses limited evidence about the security of reviewer feedback and the directional difference between whitewashing and smearing in LLM-based moderation.

  • Method

    The paper evaluates fabricated annotator-style rebuttals using a rejudge protocol spanning direct, decision-boundary, rationale, combined, and sequential attacks across multiple models and two datasets.

  • Results

    Annotator-style rebuttals broadly degrade initially correct judgments, become more damaging across turns, and reveal stable model-specific asymmetries between whitewashing and smearing.

  • Takeaways & Limitations

    Explicit reasoning prompts and defensive instructions reduce attack effects but do not eliminate them, highlighting the need for direction-aware safeguards and feedback-robustness evaluation.

  • Takeaways & Limitations

    The evaluation covers selected models and English text-only moderation, leaving broader model-family, multilingual, and multimodal generality for future work.

Abstract

from arXiv · show

Large language models (LLMs) are increasingly used for hate speech moderation, often within human--AI workflows in which reviewers provide feedback before a final decision. Such feedback introduces two manipulation directions: whitewashing hateful content as normal and smearing normal content as hateful. This study examines the susceptibility of initially correct model judgments to annotator-style rebuttals and analyzes whether attack effectiveness differs across manipulation directions. We introduce a rejudge protocol that extends direct contradiction with decision-boundary perturbations and adversarial rationales. Experiments with multiple LLMs on two hate speech datasets show that annotator-style rebuttals substantially degrade moderation performance, with stronger effects in multi-turn settings. The results further reveal stable, model-specific asymmetries between whitewashing and smearing across attack configurations, indicating distinct directional vulnerability patterns. Explicit reasoning prompts and defensive instructions reduce these effects but do not eliminate them. These findings highlight the need for direction-aware safeguards and dedicated feedback-robustness evaluation in human--AI moderation workflows.

1 Introduction

LLMs improve hate-speech moderation efficiency but create a feedback attack surface when reviewers provide misleading rebuttals. This study examines whitewashing and smearing, introduces a broader rejudge protocol, and finds substantial, direction-specific vulnerability.

  • Human–AI moderation combines model judgments with reviewer feedback, creating an attack surface when rebuttals are incorrect or misleading.
  • Whitewashing reframes hateful content as harmless, whereas smearing reframes normal content as prejudiced, producing under-moderation and over-moderation, respectively.
  • The rejudge protocol extends direct contradiction with decision-boundary perturbations, misleading rationales, combined attacks, and sequential multi-turn rebuttals.
  • Experiments across multiple LLMs and two datasets show that rebuttals broadly undermine initially correct judgments, with stronger effects in multi-turn settings.
  • Whitewashing and smearing produce stable, model-specific asymmetries, while explicit reasoning prompts and defensive instructions reduce but do not eliminate vulnerability.

2 Rejudge Framework

The rejudge framework models fabricated reviewer feedback as a post-decision attack on initially correct hate-speech judgments. It distinguishes attack direction and separates direct, boundary, rationale, and combined rebuttal mechanisms.

  • 2.1 Task Overview: The model first produces a judgment, then re-evaluates the same input with its previous decision and an adversarial annotator-style rebuttal.
  • 2.1 Task Overview: The primary analysis targets initially correct predictions and defines attack success as changing the revised judgment to the opposite label.
  • 2.2 Attack Directions: Whitewashing targets hateful content for revision to normal, while smearing targets normal content for revision to hateful.
  • 2.2 Rebuttal Strategies: Four strategies manipulate disagreement, the decision boundary, the instance rationale, or both boundary and rationale together.
  • 2.3 Implementation: The attack construction uses linguist-designed boundary criteria and manually reviewed GPT-5.1-generated adversarial rationales.

3 Experimental Setup

Experiments use two binary-labeled hate-speech datasets and a diverse set of closed-source and open-weight LLMs. Performance is measured before and after adversarial rebuttals using aggregate and class-wise metrics.

  • Datasets: Experiments use SBIC, covering stereotypes and social biases, and IHC, covering explicit and implicit hate with context-dependent expressions.
  • Datasets: Both datasets’ original annotations are mapped into hateful and normal binary labels.
  • Backbone Models: The main experiments evaluate GPT-5.1, Gemini-2.5, Qwen3-8B, and Gemma4-E4B, with additional models examined for broader coverage.
  • Evaluation Metrics: Accuracy and macro-F1 are reported before and after attacks, alongside class-wise accuracy for gold-hateful and gold-normal samples.

4 Evaluation of Rebuttal Attacks

Annotator-style rebuttals degrade performance and confidence, with effects shaped by model, attack strategy, and direction. Sequential attacks can accumulate, while neutral reassessment does not reliably restore the original judgment.

  • 4.1 Overall Attack Effectiveness: All four rebuttal strategies degrade most models, but the most damaging strategy remains largely consistent across datasets and differs by model.
  • 4.1 Overall Attack Effectiveness: GPT-5.1’s strongest-attack relative accuracy decline is 24.5%, versus 48.5% for Gemini-2.5 despite similar SBIC baseline accuracy.
  • 4.1 Overall Attack Effectiveness: On IHC under boundary+rationale, average relative decline is 69.7% for normal-sample accuracy and 23.1% for hateful-sample accuracy across four models.
  • 4.2 Confidence-Level Analysis: Confidence analysis shows that correct predictions can suffer substantial probability loss even without a hard-label flip.
  • 4.2 Confidence-Level Analysis: Averaged across two models and four attacks, whitewashing yields 20.5% flipped and 74.3% stable predictions, while smearing yields 57.0% flipped and 38.2% stable predictions.
  • 4.3 Sequential Rebuttal Attacks: Different rebuttal mechanisms accumulate across turns, reducing accuracy by 18.3% for GPT-5.1 and 30.2% for Qwen3-8B.
  • 4.3 Sequential Rebuttal Attacks: Attack order is model-specific: Qwen3-8B is more vulnerable to boundary→rationale, whereas GPT-5.1 is more vulnerable to rationale→boundary.
  • 4.3 Sequential Rebuttal Attacks: Neutral reassessment leaves accuracy below the original level, with GPT-5.1 declining a further 9.21%–14.48% and Qwen3-8B changing 0.40%–5.50%.

5 Defense Against Rebuttal Attacks

The study evaluates lightweight defenses against annotator-style rebuttal attacks and finds that defenses recover some performance, but along different class directions and without restoring clean performance.

  • Defense setup: Three inference-time defenses are compared under the strongest boundary+rationale attack: Hedge, Sanity, and Independence.Hedge adds symmetric pro-gold feedback before the attacker; Sanity and Independence are issued after the revised judgment.
  • Prior-Prepending Hedge Defense: Countervailing reviewer feedback improves aggregate accuracy and macro-F1, but defended accuracy remains below the clean baseline.The hedge weakens the adversarial signal without neutralizing it.
  • Prior-Prepending Hedge Defense: Hedge recovery is concentrated on hateful samples and can reduce normal-class accuracy, especially for Gemma4-E4B.On SBIC, Gemma4-E4B normal-class accuracy decreases by 6.22%, while hateful-class accuracy approaches 99%.
  • Post-Rebuttal Defensive Prompting: Post-rebuttal defensive prompting improves performance, but gains are model-dependent and remain incomplete.Independence improves Qwen3-8B by up to 22.03% on SBIC, whereas Gemma4-E4B improves by less than 3%.
  • Post-Rebuttal Defensive Prompting: Post-rebuttal prompting mainly repairs normal-class predictions, making it more effective against smearing than whitewashing.For Qwen3-8B, Independence raises normal-class accuracy by 26.05% on IHC and 40.57% on SBIC, while hateful-class accuracy barely changes.
  • Comparison of the two defenses: The two defenses are complementary because Hedge pulls predictions toward hateful and post-rebuttal prompting pulls them toward normal.Their recovery patterns are also modulated by the model’s intrinsic class prior.

6 Related Work

Related work places this study at the intersection of LLM-based hate speech moderation and adversarial robustness research. Prior systems use LLMs in moderation workflows, while prior attacks mainly target instructions or inputs rather than post-decision reviewer feedback.

  • LLM-based hate speech moderation: LLMs have been studied as end-to-end hate speech moderators, specialized detectors, and components of human–AI moderation pipelines.These systems can provide contextual information and preliminary judgments.
  • LLM-based hate speech moderation: LLM moderation remains sensitive to borderline and contextually ambiguous cases, especially when implicit hate requires inferring stereotypes and intentions.
  • LLM Safety and Adversarial Robustness: LLM safety research has examined prompt injection, jailbreaking, indirect attacks, and adversarial effects that accumulate across multiple turns.

7 Conclusion and Future Work

The paper identifies fabricated reviewer feedback as a post-decision attack that creates directional, model-specific vulnerabilities in collaborative hate speech moderation. Its results support safeguards tailored to those vulnerabilities, while future work broadens models, modalities, languages, and defenses.

  • Conclusion: The rejudge protocol shows that fabricated reviewer feedback can reverse initially correct judgments, reduce confidence, and remain influential across multiple turns.
  • Conclusion: Models exhibit distinct directional vulnerability profiles, so safeguards should be tailored to whitewashing and smearing risks.
  • Future Work: Future work targets side-specific calibration, reviewer-claim verification, longer dialogues, multilingual and multimodal moderation, and model-specific risk assessment.

Limitations

The evaluation is limited to selected models, English text-only moderation, and primarily prompt-based defenses, leaving broader model, modality, language, and training-based generality for future work.

  • Scope limitations: The study evaluates a selected set of closed- and open-weight models rather than a broader range of model families.Future work should test newly released models and whether directional vulnerability patterns remain consistent.
  • Scope limitations: The current evaluation focuses on English text-only moderation, excluding multimodal and multilingual settings.
  • Defense limitations: The study primarily evaluates vulnerability and lightweight prompt defenses, leaving training-based approaches for future comparison.

Ethics Statement

The study uses fabricated annotator-style rebuttals to test whether hate-speech judgments can be redirected, while incorporating controls and responsible-use safeguards. Its protocol compares attack directions, rebuttal mechanisms, sequential interactions, and defensive or correction conditions.

  • Ethics Statement: The study reinterprets existing SBIC and IHC samples rather than generating new hateful content.Fabricated rebuttals support adversarial labels without adding hateful text.
  • Ethics Statement: Whitewashing targets hateful content for a normal label, whereas smearing targets normal content for a hateful label.These directions correspond to under-moderation and over-moderation, respectively.
  • Ethics Statement: The evaluation includes direct, boundary, rationale, and boundary+rationale rebuttals, with boundary rules changing the moderation threshold and rationales supplying instance-specific interpretations.The whitewashing rule raises the hateful-label threshold, while the smearing rule lowers it.
  • Ethics Statement: The protocol also includes gold-aligned correction, post-hoc rationalization, and a hedge defense that places pro-gold feedback before the anti-gold rebuttal.The defense retains the attacker in the recency position while presenting opposing judgments.
  • Ethics Statement: Sequential evaluation combines boundary and rationale follow-ups and uses neutral reassessment to control for changes caused solely by another reconsideration round.Cross-type sequences include boundary→rationale and rationale→boundary.

A.2 More Implementation Details

Implementation details cover rationale validation, model execution, stance analysis, and supplemental model comparisons. The additional results show substantial degradation and model-specific directional vulnerability patterns under annotator-style rebuttals.

  • A.2 More Implementation Details: Over 97.6% of generated rationales were judged relevant, plausible, and supportive of their intended adversarial labels.Invalid rationales were revised or discarded.
  • A.2 More Implementation Details: Closed-source models used official APIs, while open-weight models ran locally with greedy decoding and temperature 0.The open-weight experiments used Transformers on NVIDIA H20 GPUs.
  • A.2 More Implementation Details: The rationale analysis classifies final explanations by whether models admit updating, reread content to support the annotator, or firmly defend their original reading.Alignment is determined from the final revised verdict, while intermediate leanings are ignored.
  • A.2 More Implementation Details: Claude-4.5’s SBIC accuracy fell from 85.62% baseline to 37.64% under bnd+rat, while Llama-3.1-8B reached 4.17% on SBIC and 1.82% on IHC.These results extend the observed model-specific asymmetries to additional models.
  • A.2 More Implementation Details: Llama-3.1-8B showed a pronounced whitewashing tendency, whereas Claude-4.5 showed stronger smearing under direct and rationale rebuttals.Claude-4.5 was more balanced under boundary-based attacks.

B.2 Additional Confidence-Level Analysis

Additional confidence-level analyses show that whitewashing and smearing produce sharply different confidence effects, and that the dominant vulnerability direction can reverse across models.

  • B.2 Additional Confidence-Level Analysis: Gemma4-E4B had flip rates of at most 4.00% under whitewashing but became highly vulnerable to smearing.Under bnd+rat, Pg decreased by 0.025 on hateful samples and 0.750 on normal samples.
  • B.2 Additional Confidence-Level Analysis: Qwen3-8B and Gemma4-E4B therefore showed smearing-oriented confidence asymmetry across datasets.The reported pattern persisted beyond the original SBIC analysis on IHC.
  • B.2 Additional Confidence-Level Analysis: Llama-3.1-8B showed the opposite pattern: boundary attacks reduced hateful-sample Pg from above 0.90 to around 0.01, with flip rates above 99%.Smearing also degraded performance but left comparatively more residual confidence on normal samples.

B.3 Correction Analysis

Gold-aligned correction improves model judgments, but attack and correction effects are class-selective and model-dependent. Rebuttal channels overlap substantially, while their combination reaches a broader vulnerable sample set; SFT stabilizes both directions but leaves residual smearing vulnerability.

  • Correction Analysis: Across 16 paired settings, attack decreases accuracy by 26.49% from baseline, while correction increases it by 14.77%, producing an average 41.26% gap.The largest gap is 75.00% for Qwen3-8B on SBIC under bnd+rat.
  • Correction Analysis: Direct rebuttals generally produce the smallest accuracy change, whereas bnd+rat produces the largest, with rationale and boundary between them.Qwen3-8B shows larger attack–correction gaps than Gemma4-E4B in most settings.
  • Class-wise Effects: Attack effects are class-asymmetric: normal-acc declines more than hateful-acc across most settings, indicating greater vulnerability to smearing than whitewashing.For Qwen3-8B under bnd+rat, normal-acc falls to 2.02% on IHC and 6.41% on SBIC, while hateful-acc remains 57.04% and 38.10%.
  • Class-wise Effects: Correction gains are also class-selective, primarily improving normal-acc for Qwen3-8B and hateful-acc for Gemma4-E4B.Qwen3-8B gains 16.10%–42.31% on IHC normal samples and 12.82%–28.11% on SBIC normal samples, while Gemma4-E4B gains are concentrated on hateful samples.
  • Attack Complementarity: Overlap and Jaccard reveal model-level differences in whether rationale and boundary attacks flip the same samples.For Qwen3-8B, both measures are high; for Gemma4-E4B, overlap is high but Jaccard is lower because the boundary flip set is much smaller.
  • Attack Complementarity: The combined boundary+rationale attack covers 95% of rationale flips and 88% of boundary flips on average across eight settings.Combining channels reaches vulnerable samples captured by either attack.
  • Attack Complementarity: Rationale-only flips often involve ambiguous inputs, whereas boundary-only flips more often involve recognizable hateful cues and uncertain classification criteria.Rationale changes the model’s interpretation; boundary changes how broadly it defines hateful content.
  • SFT Preview: SFT reduces average relative declines from 59.71% to 0.60% for hateful accuracy and from 92.50% to 4.29% for normal accuracy, consistently across models and datasets.Residual degradation remains larger on normal samples; the largest residual decline is 7.28% for Llama-3.1-8B on IHC.
Loading 2608.22230v1…