# Countering Malicious Content Moderation Evasion in Online Social Networks:
Simulation and Detection of Word Camouflage

Álvaro Huertas-García
Department of Computer Systems Engineering
Universidad Politécnica de Madrid
Madrid, Spain
<EMAIL_ADDRESS>
& Alejandro Martín
Department of Computer Systems Engineering
Universidad Politécnica de Madrid
Madrid, Spain
<EMAIL_ADDRESS>
& Javier Huertas-Tato
Department of Computer Systems Engineering
Universidad Politécnica de Madrid
Madrid, Spain
<EMAIL_ADDRESS>
& David Camacho
Department of Computer Systems Engineering
Universidad Politécnica de Madrid
Madrid, Spain
<EMAIL_ADDRESS>
Use footnote for providing further information about author (webpage,
alternative address)— _not_ for acknowledging funding agencies.

###### Abstract

Content moderation is the process of screening and monitoring user-generated
content online. It plays a crucial role in stopping content resulting from
unacceptable behaviors such as hate speech, harassment, violence against
specific groups, terrorism, racism, xenophobia, homophobia, or misogyny, to
mention some few, in Online Social Platforms. These platforms make use of a
plethora of tools to detect and manage malicious information; however,
malicious actors also improve their skills, developing strategies to surpass
these barriers and continuing to spread misleading information. Twisting and
camouflaging keywords are among the most used techniques to evade platform
content moderation systems. In response to this recent ongoing issue, this
paper presents an innovative approach to address this linguistic trend in
social networks through the simulation of different content evasion techniques
and a multilingual Transformer model for content evasion detection. In this
way, we share with the rest of the scientific community a multilingual public
tool, named “pyleetspeak” to generate/simulate in a customizable way the
phenomenon of content evasion through automatic word camouflage and a
multilingual Named-Entity Recognition (NER) Transformer-based model tuned for
its recognition and detection. The multilingual NER model is evaluated in
different textual scenarios, detecting different types and mixtures of
camouflage techniques, achieving an overall weighted F1 score of 0.8795. This
article contributes significantly to countering malicious information by
developing multilingual tools to simulate and detect new methods of evasion of
content on social networks, making the fight against information disorders
more effective.

_K_ eywords Information Disorders $\cdot$ Leetspeak $\cdot$ Word camouflage
$\cdot$ Multilingualism $\cdot$ Content Evasion

##  1 Introduction

Regardless of the communication actions between users and their multimedia
content, almost every social network today deals with malicious information
(that is, misinformation, disinformation, misleading information or any other
kind of information pollution) and the ostensible polarization of media
discourse [1].

Content moderation has become one of the main ways social media platforms
manage this situation. Moderation of content is critical to maintaining a safe
and welcoming online environment. It involves reviewing and removing content
that violates the rules and policies of a website or platform [2]. However, as
these policies improve and new techniques are employed to monitor their
compliance, so does how users can evade content moderation efforts [3]. This
effect entails severe consequences for both the platform and its users. If
content moderation evasion is not addressed adequately, it can lead to the
spread of harmful or illegal content, which can damage the reputation of the
platform and put its users at risk [4, 5]. Therefore, it is essential to
provide these platforms with effective strategies to combat content moderation
evasion.

In 2016, Facebook started an initiative against false claims pointing out
those disproved by fact-checkers [6]. Later in 2020, with the emergence of the
coronavirus, Twitter applied similar actions to manage the overabundance of
dis/mis-information related to the COVID-19 pandemic, highlighting tweets that
were considered to deliberately disseminate incorrect information to undermine
public health [7, 8, 9]. Additionally, since the origin of the pandemic,
Twitter has facilitated developers and researchers access to their
conversational content, providing a specific COVID-19 streaming endpoint [10]
and an academic version of their API without timeline limitations [11],
allowing a better study of the spread of hoaxes [12]. Due to the same
situation, the YouTube video platform recently established moderation policies
for removing videos containing COVID-19 misinformation and limiting
recommendations for anti-vaccination videos [13].

Undoubtedly, the COVID-19 pandemic has made evident the importance of fighting
information disorders and moderating the content published on social networks.
Moreover, content filtering has also received considerable critical attention
in other fields such as terrorism, hate speech, misogyny, and sexism [3, 5].
For example, in 2017, Facebook, Google, Twitter, and Microsoft created the
Global Internet Forum to Counter Terrorism (GIFCT) group, which collaborates
with the European Commission to combat illegal online hate speech [14].
Instagram, Pinterest, and Tumblr are committed to limiting the results of
searches with hashtags related to eating disorders and sexual abuse, among
others [3, 5].

Nevertheless, malicious actors present on these platforms are aware of these
content-moderation rules. Recently, to evade this content filtering, it has
been demonstrated that these actors twist and camouflage key parts of speech
using different techniques such as leetspeak [5, 15] (which involves
generating visually similar character strings by replacing alphabet characters
with other symbols), word inversion or inserting punctuation characters into
words, procedures belonging to the named word camouflaging [16]. These evasion
methods threaten the capabilities of the platform’s systems and allow
malicious actors to continue spreading falsehood, misleading, and harmful
content, as shown below in Section 2.2.

The primary purpose of this study is to provide new instruments in response to
these rapid changes in content moderation evasion. The following are the new
contributions of our research concerning previous studies.

  * •

We present and share with the rest of the scientific community a novel
methodology to generate/simulate the content evasion phenomenon from a
multilingual level in a customizable way. For the sake of reproducibility, the
methodology approach is presented as a public Python package named
“pyleetspeak”111https://pypi.org/project/pyleetspeak/. It should be noted that
the tool is customizable and is not language dependent.

  * •

We present a curated synthetic multilingual
dataset222https://github.com/Huertas97/XX_NER_WordCamouflage of camouflaged
words with applied quality filters. The dataset is shared in different formats
to facilitate its applicability to other researchers. The languages considered
are English, Spanish, French, Italian, and German.

  * •

We derive a multilingual Transformer-based
model333https://huggingface.co/Huertas97/xx_LeetSpeakNER_mstsb_mpnet to detect
and discern different word camouflage techniques to prevent content evasion.

  * •

We evaluated the potential of multiclass camouflage Named Entity Recognition
at the multilingual level by comparing the developed multilingual model with
monolingual baseline models for the different languages considered.

  * •

Finally, we continue previous research [17] by reaffirming the usefulness of
multilingual pre-training in semantic similarity (mSTSb) to increase the
generalizability of multilingual models.

This paper is organized as follows. Section 2 begins by examining previous
work on content moderation and content moderation evasion techniques. Section
3 introduces our new methodology to simulate content moderation evasion and
generate annotated data. Section 4 explains the data used to generate word
camouflage and train multilingual word camouflage NER models. It also explains
the experimental setup for the development of Transformer-based models for
detecting word camouflaging. The experimental results are discussed in Section
5. Finally, our conclusions are drawn in the final section 6.

##  2 Literature Review

###  2.1 Content moderation

Content moderation is the process of screening and monitoring user-generated
content online to suppress communications that are deemed undesirable. As
Gerrard & Thornham [18] have highlighted at present, there are two dominant
forms of social media content moderation: automated and human. However, the
growing amount of content uploaded to social media platforms makes it
impossible to rely exclusively on the human content moderation approach.

Traditional practices to limit the disruption that can be caused by antisocial
behavior consist of blocking messages based on basic text properties (e.g.,
length), interaction parameters (e.g., posting frequency, reply frequency), or
according to the standards of designated moderators [19]. These practices had
some drawbacks, such as their applicability to small, medium-sized
conversations. These initial practices led to more sophisticated and scalable
forms of automated moderation [20, 21].

Although these systems from online content platforms remain opaque and poorly
understood, two different methods are known. In some cases, automated systems
employ fingerprinting or hash matching techniques to compare new content
against known data and databases of unwanted or flagged content [18, 22]. In
other cases, automated systems will be machine learning systems trained on
large datasets to spot new or previously unseen allegedly illegal material and
remove it, block it, or filter it, which can also be used to create more
training data or assist in human moderation [20, 21, 23]. Consequently, these
automated content filtering methods benefit from data sharing. For example,
the four members of GIFCT share best practices and databases to develop their
automated systems. An example of the importance of this data sharing is the
Christchurch attack in New Zealand in 2019, where a terrorist broadcast the
murder of more than 50 people on Facebook live stream. After that incident,
Facebook shared this information with other platforms. Every video or image
uploaded by ordinary users from any of these platforms would now be checked
against it to check whether it should be blocked or not [18, 22].

In the literature, many examples illustrate the significant role that
automated systems are already playing in content moderation. According to
[24], 98% of the videos YouTube removes for violent extremism are flagged by
machine learning algorithms and help human reviewers remove videos nearly five
times faster. Moreover, the visualization time for harmful antivaccine content
videos has been reduced by more than 70% after YouTube limited the
recommendation for such videos [25]. In 2021, Twitter temporarily locked
Donald Trump’s account for allegedly inciting an attack on the United States
Capitol and permanently suspended it for violating Twitter’s Glorification of
Violence guidelines [26]. Twitter has also been testing features to allow
people to report potentially misleading information, and has recently expanded
to Brazil, the Philippines, and Spain [27]. Additionally, in 2021, Facebook
has started a campaign to explicitly ban “any content that denies or distorts
the Holocaust” [28]. Similarly, other researchers have also developed machine
learning solutions to help security administrators detect phishing content in
emails and social networks [29]. Other researchs [30, 31] have explored the
application of machine learning classifier on online social networks to
facilitate content-based filtering assistance to avoid unwanted content
displayed on the user wall.

These situations and incidents like those raised during the COVID-19 pandemic
clearly show that automated moderation systems have become necessary to manage
growing public expectations for greater responsibility, safety, and security
on the platforms [14]. Nevertheless, content filtering automated systems
depend on their ability to analyze the material uploaded, potentially
vulnerable to recent content evasion techniques, such as word camouflaging.

Table 1: Examples of Leetspeak technique applied in different situations

Case of study | Original | Camouflaged | Source
---|---|---|---
Gaming | noobs |  |
owned |  |  |
skiils |  |  |
fear | n00bz |  |
pwn3d |  |  |
sk11lz |  |  |
ph34r | Blashki et al. 2005 |  |
Password | HBOpassword | #B0p4$$w0r|) | $Honget~{}al.2021$
Cybersquatting | incibe.es | incive.es |
incIbe.es |  |  |
inci-be.es |  |  |
inicbe.es | Instituto Nacional |  |
de |  |  |
Ciberseguridad |  |  |
(INCIBE) |  |  |
Social Media |  |  |
COVID-19 |  |  |
Infodemic | vacuna |  |
covid | v4cun4 |  |
b4cun4 |  |  |
v@(u¬a |  |  |
nacuva |  |  |
V.A.C.U.N.A |  |  |
k0 b1t |  |  |
K0b1d |  |  |
c0*vid |  |  |
C(o(v(i(d |  EU Disinfolab |  |

###  2.2 Content Moderation Evasion Techniques

Before proceeding further, we would like to provide a sensitive content
disclaimer to warn the reader that there is a possibility of finding offensive
content in the examples included in the work presented.

Community-driven Internet spaces, especially social networks, have always
presented unique dialects and slang terminology [32, 33]. These ever-changing
dialects are the natural result of short codes to facilitate communication,
user interactions on social networking platforms, and the adaptation of
language to new technologies [15]. However, the emergence of new terms or
dialects can result from intentionally camouflaging messages without impacting
the information transmitted to avoid content moderation.

One of the main techniques for this purpose is leetspeak. Leetspeak is a
written language in which characters are changed to other characters or
combinations of characters that visually resemble the original [32, 34] (see
Table 2.1). Even though there is still a great deal of uncertainty about its
origin, there is no doubt that its initial use was related to content evasion.

One reliable hypothesis [32] holds that hackers initially used leetspeak in
the early stages of the Internet to prevent their content from being
accessible. At that time, most search systems searched for keywords in the
text to recommend relevant content, and users who were reluctant to share
their information substituted certain letters in words to avoid being included
in searches. Other observations [35] indicate that leetspeak’ origins can be
found on Bulletin Board Systems, much like today’s forums, to avoid censorship
measures present in instant messaging systems.

There is also controversy as to why the term leetspeak was coined. In their
analysis of the adaptation of language by a community of young people who play
computer games, Blashki et al. [32] proposed that the root term “leet” was
originated from 31337 “eleet”, the UDP port used by a hacker group to access
Windows 95 using the Back Orifice hacking program. Other researches [35]
propose that it was first considered “elite” as only a few people could encode
and decode it, therefore using the term “leet” to refer to this particular
group. Subsequently, the use of leetspeak became more popular, and it became
integrated into the gaming community, particularly by Counter Strike and World
of Warcraft players [32, 35].

Table 2: Examples of word camouflage using different methods from pyleetspeak. Word | Leetspeaker | Punctuation |  Inversion
---|---|---|---
Basic | Intermediate | Advanced
Vacuna |  | V@c_n@
---
V$\Delta$cün$\Delta$
| \/4[u|\|4
---
V.qün$\Delta$
| |/a[L|/\/a
---
\/4[V|\|/\
| ’V’a’c’u’n’a
---
Vac’u=na
nacuVa
Covid |  | C0v1d
---
Cøv¡d
| k.vb!t
---
C0▼!t
| [ov|d
---
C[]\|!|>
| ?C?o?v?i?d
---
’C-ovid
vidCo
Plandemia |  | Plnd£m*
---
Pland.mi$\Delta$
|  P |
---
P
la¬t€mla
P$1\Delta\pi$d3ia
| |>landem[]/\
---
Pl/\nde[V]1a
| !P!l!a!n!d!e!m!i!a
---
Plan/demi/a
dePlanmia
Inmigrant |  | 1nmigr_nt
---
Inm*grnt
| I$\pi$mig$\Delta$nt
---
In¡ga$\pi$t
| In[]V[]igr/\nt
---
In^^][(_+ra|\|t
| .I.n.m.i.g.r.a.n.t
---
+I+nmi+gran
migrantIn
Dictatorship |  | Dict*t*rship
---
Dict$\Delta$t0rship
| Dict.Tørs#i P |
---
P
Di©tat*rz#lp
| Ditat(0)/2ship
---
(|ict/\t$<>$rship|7
| Dicta:torsh:ip
---
D|i|c|t|a|t|o|r|s|h|i|p
Dicortatship
Genocide |  | Genøcld
---
G%nocide
| G3$\pi$o©ite
---
Gen©id@
| 9e|\|o[i[)e
---
Gen$<>$ci|$>$e
| G;enoc;i;de
---
G=e=n=o=c=i=d=e
oGencide

Nowadays, leetspeak is mainly associated with online multiplayer gamers [33].
Interestingly, the leetspeak camouflaging technique is also explored in the
field of password generation and password security. Golla et al. [36] mention
the practice of using leetspeak to modify characters in passwords to make them
more secure, but at the same time facilitate remembering them [34]. Passwords
replaced with leetspeak have been tested with password strength estimators,
such as zxcvbn [37], and get a high-security rating, as they combine alphabet
characters, numbers, and special symbols [38]. In the same way, leetspeak has
been related to cybersquatting, the registration of a domain name that is the
trademark of another [39] (see Table 2.1).

Remarkably, the work of Peng et al. [40] reveals the vulnerability of machine
learning algorithms in detecting spam in emails when they included leetspeak.
Because leetspeak uses unconventional spelling and punctuation, the revealed
the difficulty for the automatic systems to accurately identify and interpret
the words and phrases being used. Hence, this can make it easier for attackers
to evade detection and spread harmful or illegal content. To address this
vulnerability, in this works we develop Transformer-based models trained on a
wide range of text inputs, including examples of word camouflage, to improve
their accuracy and ability to identify this type of language.

Previous studies [41, 42] have analyzed a variety of slangs, including
leetspeak, in social media, but since the emergence of coronavirus in 2019,
this situation has become more pronounced, with leetspeak being a way to
circumvent censorship. In [16] the authors analyzed how malicious actors
camouflage virus-related Spanish keywords to spread misleading content,
revealing their skills in developing new techniques to continue spreading
their message and the complexity of tackling this phenomenon (see Table 2.1).

Finally, evidence of the presence of these methods of content evasion in
social networks can be clearly observed through a comparison of the search
results for terms associated with hateful behaviour and which do not comply
with the Community Guidelines in original and camouflaged formats.

The term “self-harm” on the TikTok platform is associated with the health and
well-being of people and is part of their community guidelines for safety.
Searching for this term redirects to an official contact for hope
support444https://www.tiktok.com/search?q=self-harm. However, if we change the
search term to “s3lf-harm” we bypass moderation and access videos with
potential content depicting, promoting, normalizing or glorifying activities
that could lead to suicide or self-
harm555https://www.tiktok.com/search?q=s3lf-harm. Other examples are the term
“incel”, which in an extreme way refers to those who have violent or hateful
attitudes towards women or towards society in general [43]. This term does not
return any results and redirects us to the community
guidelines666https://www.tiktok.com/search?q=incel. Again, we can bypass this
moderation and access content by using “1ncel”
instead777https://www.tiktok.com/search?q=1ncel. The same happens in other
languages. For example, the search for the Spanish terms “violación” and
“pornografía”, in English “rape” and “pornography”, does not return any
results888https://www.tiktok.com/tag/violacion999https://www.tiktok.com/search?q=pornografía,
unlike their camouflaged version
“v1olaci0n”101010https://www.tiktok.com/tag/v1olaci0n and
“p0rnograf!a”111111https://www.tiktok.com/search?q=p0rnograf!a with content
with more than 8 million views.

As a result of these findings, developing tools that mimic and detect content
avoidance techniques are essential for content moderation in the fight against
information disorders.

##  3 Methodology

This section shows the methodology for generating camouflage data that will be
used to train and evaluate models in the detection of camouflaged words in
content evasion. Firstly, we describe how camouflage techniques are simulated
by developing a public Python package that applies the rules described in the
literature. Secondly, we explain how these camouflaging techniques are applied
to an input text to obtain a camouflaged version of the input text with NER
annotation to obtain training and evaluation data for the models.

###  3.1 Simulation of Word Camouflage Techniques

Taking into account the importance of linguistic characters used in a language
to generate camouflaged versions, it is necessary to point out that the tools
developed in the package are multilingual (+20 languages121212ar, az, da, de,
el, en, es, fi, fr, hu, id, it, kk, nb, ne, nl, pt, ro, ru, sl, sv, tg, tr).
This tool has been tested in English, Spanish, French, Italian, and German.
However, it can be easily extensible to the rest of Latin-derived alphabet
languages (i.e., most of the Western European languages). As a reminder, the
tool described below is publicly available in the Python “pyleetspeak”
package1.

We have designed three approaches to emulate content evasion strategies based
on text camouflage modification. These methods were developed in relation to
the results described in the analysis by Romero-Vicente et al. [16] of recent
content avoidance techniques on social networks: LeetSpeaker,
PuntctuationCamouflage and InversionCamouflage modules.

####  3.1.1 LeetSpeaker module

This module applies the well-known leetspeak method to produce visually
similar character strings by replacing alphabet characters with special
symbols or numbers. There are many ways to use leetspeak, from basic vowel
substitutions to advanced combinations of various punctuation marks and
symbols.

The leetspeak alphabet in its simplest form substitutes vowels, but it can be
pretty complex when substituting consonants as well. As a consequence, the
leetspeak modifications implemented in the package are organized into five
different modes depending on the visual complexity of the camouflage. The
implemented changes, available in our
repository131313https://github.com/Huertas97/pyleetspeak/blob/main/pyleetspeak/modes.py,
have been obtained from different sources [15, 16, 32, 34, 35, 37, 44].
Nevertheless, the tool is flexible, as new possible substitutions can be
specified for its adaptability to new unexplored or ever-evolving scenarios.

Similarly, in the case of LeetSpeaker, other parameters that can be set to
customize the camouflage result are the probability of changing a character
type (e.g., change “a" for “@") and the frequency of substitution, named
chg_prb and chg_frq in the package, respectively. The frequency of
substitution refers to the number of positions to change among all matches of
the same character (e.g., whether to replace the two “a" letters with the “@"
symbol in “vaccination"). In the case of an original character that has more
than one possible substitution, one is randomly selected from a uniform
probability distribution.

In a real scenario, such as social networks, users tend to use the same type
of substitution for all occurrences of the same character. To emulate this
situation, it is possible to define whether or not the transformations
performed by LeetSpeaker and PunctuationCamouflage should be independent of
each other using the uniform_change parameter. In other words, it determines
whether the same substitution character should be used in all positions where
the original text is modified. For example, if “a" can be replaced by “@" or
“4", select whether “vaccination" should be “v4ccin4tion" or “v@ccin4tion".

####  3.1.2 PuntctuationCamouflage module

Another method to create visually similar character strings is to insert
punctuation symbols into the text (see Table 2).

Regarding PunctuationCamouflage module, it can be further customized to inject
punctuation symbols in hyphenate locations (i.e., syllables) or between any
character. In addition, the number of punctuation symbols to inject can be
specified. Interestingly, Romero-Vicente et al. [16] reported that malicious
actors usually use punctuation camouflaging, inserting punctuation symbols
between all letters of keywords (e.g., “C.O.V.I.D.-1.9”). This behavior can
also be reproduced in pyleetspeak without previously specifying the input text
length to be camouflaged using the word_splitting parameter. The default
punctuation symbols applied come from the built-in Python “string" module, but
the user can specify the symbols to use.

####  3.1.3 InversionCamouflage module

Although not as common as the previous methods, word inversion can also be
used to confuse moderating algorithms. For this reason, InversionCamouflage
module creates new camouflaged versions of words by inverting the order of the
syllables (see Table 2).

Word inversion is implemented by detecting the syllables that constitute a
word. Once the word has been separated into its syllables, two of these
syllables are randomly selected and inverted with respect to each other. As in
the previous methods, the inversion is customizable and it is possible to
indicate the maximum distance between two syllables to be interchanged. If
there are several possibilities for syllable interchange, one is chosen at
random.

Further details on the adopted methodology can be found in our repository.
Similarly, this tool can be tested in the demo application Leetspeaker
App141414https://github.com/Huertas97/LeetSpeaker_App developed with Dash
[45], and other examples of the package “pyleetspeak” package are shown in
Table 2.

Figure 1: Named Entity Recognition data generation diagram. $p_{L}$, $p_{I}$
and $p_{P}$ represent the probability of applying leetspeak, inversion, and
punctuation camouflage techniques. $p_{M}$ represents the probability of
applying a mixture of different techniques once a technique has been
previously applied.

###  3.2 Word camouflage NER data generator

As depicted in Figure 1, “pyleetspeak” package transforms an input text into a
camouflaged version. The use of word camouflaging usually involves changing
the most critical words of a sentence instead of leetspeak all the words in
the text. Thus, KeyBERT [46] is used to extract the most semantically relevant
words and apply them different word camouflaging methods presented above.
Finally, the camouflaged entities in the output text are annotated in Spacy
format [47].

KeyBERT incorporates state-of-the-art Transformer models for keyword
extraction [12]. This method represents a viable alternative to traditional
statistical methods for keyword extraction, as it benefits from the use of
powerful Transformer-based models [48, 49]. These state-of-the-art models have
recently radically transformed the Natural Language Processing area for their
ability to generate powerful semantically aware text representations.
Precisely, KeyBERT exploits this semantic awareness to compute words and text
embeddings, then extracts the most semantically relevant words of a text using
cosine similarity as similarity function. Consequently, the most similar words
are the keywords that best describe the meaning of the text. By incorporating
KeyBERT into our NER data generator, we better meet the expectations of real-
world scenarios in which malicious actors camouflage vital concepts in
conversation to evade content moderation. Additionally, we employ the mstsb-
paraphrase-multilingual-mpnet-base-v2 fine-tuned on the multilingual Semantic
Textual Similarity Benchmark [17] as the Transformer model for keyword
extraction. However, any other HuggingFace [50] model can be selected. The
tool has been optionally adapted to always incorporate user-specified keywords
to better control the camouflaged output.

Finally, the camouflaged NER annotated data generated is composed of 4
different types of entities. LEETSPEAK, PUNCT_CAMO, INV_CAMO represent the
different camouflage methods implemented, and the MIX entity, which represents
the combination of leetspeak and punctuation camouflage. It is also worth
noting that, in order to increase the interpretability of the process, besides
the annotated camouflage data, the tool returns a dictionary containing the
parameters applied to each instance (e.g., keywords extracted, type of
camouflage applied, values of the parameters).

Table 3: Breakdown of the multilingual data corpus after quality filtering according to each language, resource and division to develop NER word camouflage models. |  | EN |  |  | ES |  |  |  FR |  |  | IT |  |  | DE |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---
| Train | Dev | $Test$ |  Train | Dev | Test |  Train |  Dev |  Test | Train | Dev | Test | $Train$ | Dev | Test
| News Commentary
---
645 | 73 | $80$ |  11341 | 1255 | 1398 |  589 |  69 |  72 | 130 | 15 | 16 | $859$ | 94 | 103
ParaCrawl | 19678 | 2180 | $2445$ |  23113 | 2580 | 2853 |  21424 |  2373 |  2656 | 22279 | 2474 | 2772 | $20813$ | 2334 | 2563
TED2020 | 15548 | 1712 | $1907$ |  15717 | 1758 | 1938 |  14225 |  1580 |  1751 | 15091 | 1680 | 1879 | $14742$ | 1667 | 1818
WikiMatrix | 15557 | 1707 | $1927$ |  15529 | 1717 | 1903 |  14489 |  1626 |  1806 | 15124 | 1662 | 1889 | $14457$ | 1618 | 1782
Total | 51428 | 5672 | $6359$ |  65700 | 7310 | 8092 |  50727 |  5648 |  6285 | 52624 | 5831 | 6556 | $50871$ | 5713 | 6266

##  4 Experimental Setup

This section presents the collected multilingual non-camouflaged text data,
how they are camouflaged to simulate content evasion, and finally, the
monolingual and multilingual models trained for NER word camouflage detection.

###  4.1 Non-Camouflaged Training Data

To the best of our knowledge, no dataset with annotated word camouflage
modifications is available to train and evaluate our models. Although there
are some existing datasets in the field, none of them meet our specific needs
and, therefore, we cannot use them directly. In fact, one of the main
contributions of our work is precisely the creation of a new publicly
available dataset2 that fills the existing gap and that we hope will be useful
to other researchers in the future.

The dataset with synthetic camouflaged words is elaborated from non-
camouflaged texts since, to train the models for word camouflage detection,
the camouflage modifications present in the text must be previously annotated.
Therefore, we employ non-camouflaged datasets, as it allows us to control that
the camouflaging belongs exclusively to the modifications derived by our word
camouflage generator tool.

We have chosen the following resources due to the variety of text types among
these resources:

  * •

OPUS News-Commentary [51]: A parallel corpus of political and economic news
commentaries in 12 languages was crawled from the web site Project Syndicate
provided by WMT.

  * •

OPUS ParaCrawl [52]: Multilingual parallel corpora from around 150k website
domains and across 23 EU languages collected in the ParaCrawl project [53]
cofinanced by the European Union.

  * •

TED2020 [54]: This dataset contains a crawl of nearly $4000$ TED and TED-X
transcripts from July 2020. The transcripts have been translated by a global
community of volunteers into more than 100 languages.

  * •

WikiMatrix [55]: Mined parallel sentences from the content of Wikipedia
articles in 85 languages. In this project, a 1.04 score threshold was used for
parallel text extraction.

The languages considered in this work are English, Spanish, French, Italian,
and German. For each language, data is extracted from the different resources
shown above, discarding those texts with a length of less than 3 characters.
Subsequently, the extracted data are camouflaged, discarding the annotated
data that do not pass the Spacy quality
filter151515https://spacy.io/api/cli#debug-data and are split in a stratified
way into train (81%), validation (9%) and test (10%) sets to perform training
and evaluation of multilingual and monolingual NER models. The breakdown of
the final data considered in this work according to the language and type of
resource can be found in Table 3 and is publicly available on GitHub2.

The parameters used to camouflage the data with the camouflage tool previously
presented and how the quality of the data is evaluated with the Spacy tool
will be explained in Subsection 4.2 below.

###  4.2 Annotated NER data: Camouflaging parameters and Quality filter

To carry out camouflage and annotation of the modified words in the data shown
in the previous section, we assigned different occurrence probabilities to the
camouflage methods using the methodology presented in Section 3. As shown in
Figure 1, in 10% of the cases, word inversion is employed. In the remaining
cases, leetspeak is applied with 45% probability, 25% punctuation camouflage,
and 30% combination of both. Although the use of inversion modification in
conjunction with other camouflage techniques is potentially available, we have
not found any evidence to support this approach. Therefore, in our work, we
have applied inversion modification in a stand-alone mode and the camouflaging
techniques in a distribution that we believe best reflect the reality,
although they are fully customizable.

For the sake of reproducibility, all the values used in the various parameters
to generate the NER data are shown in Table 4. To ensure that the different
train, validation and test splits have the same distribution of entity types,
the parameters of the NER data generator are equally employed across languages
to create the camouflaged data version.

Upon obtaining the modified datasets, the Spacy data debugger15 is applied.
This quality filter removes possible duplicates from the source data, checks
that there are no overlaps between the training and evaluation data, that
there are a good number of examples for all labels, there are examples with no
occurrences available for all labels, there are no entities consisting of or
starting/ending with blanks, and there are no entities crossing sentence
boundaries.

Finally, the camouflaged annotated data obtained are saved in Spacy formats.
The customizable “pyleetspeak” tool presented also provides a format converter
to transform Spacy NER format to JSON, BILUO, or IOB format, the one used by
the Hugging Face community.

The curated synthetic multilingual dataset obtained is available on GitHub2 in
the different formats indicated above.

Table 4: Summary of parameter values used to camouflage and annotate text data
to develop NER models.

LeetSpeaker |  | change_prb = 0.8
---
change_frq = 0.5
probability basic modes = 0.5
probability intermediate modes = 0.4
probability advanced mode = 0.1
probability uniform_change = 0.6
| Punctuation
---
Camouflage
| probability hyphenation = 0.5
---
probability uniform_change = 0.6
probability word_spliting = 0.5
number injections = randint(1, lenght)
| Inversion
---
Camouflage
max distance = randint(1, 4)
KeyBERT |  | model =
---
mstsb-paraphrase-multilingual-mpnet-base-v2
max number of keywords = 5
keywords n_gram = (1, 1)

Table 5: Parameters considered during the training of the models for word
camouflaged Named Entity Recognition wit Spacy

learning rate | initial_rate = 0.00005
---|---
total_steps = 20000
scheduler = warmup_linear
warmup_steps = 250
epochs | max_epochs = 0
max_steps = 20000
patience = 1600
accumulate_gradient | 3
optimizer | AdamW
beta = 10.9
beta2 = 0.999
eps = 1e-8
grad_clip = 1
l2 = 0.01
l2_is_weight_decay = true
eval_frequency | 200
dropout | 0.1

###  4.3 Word Camouflage NER models

As mentioned above, one of the objectives of this work is to develop a
multilingual detector model to address the problem of content evasion by word
camouflage from a multilingual perspective. Likewise, another objective is to
continue the research carried out in our previous work [17] focused on the
usefulness of semantic similarity as a generalization task at the multilingual
level. This is why we include the model developed in the previous work and its
baseline, and other remarkable multilingual models. Accordingly, the
multilingual models fitted to the Named Entity Recognition task of camouflaged
words are presented below. In the following sections of the article, we will
refer to the various multilingual models that we have tested using their
abbreviations. This is done to make the text more concise and easier to read,
while still providing enough information for the reader to understand the
context.

  * •

paraphrase-multilingual-mpnet-base-v2 (MPNET-base): Distilled version of the
MPNet model from Microsoft [56] fine-tuned with large-scale paraphrase data
using XLM-RoBERTa as the student model. This model is included as a baseline
to corroborate the usefulness of the multilingual pre-train in semantic
similarity showed in our previous work [17], as it does not includes any fine-
tuning on semantic similarity.

  * •

mstsb-paraphrase-multilingual-mpnet-base-v2 (MPNET-ideal): Previous model
fitted with multilingual train data from the Semantic Textual Similairty
Benchmark (STSb) [57] extended version to 15 languages (mSTSb) [17]. This
model has shown to enhance the performance across languages, outperform
monolingual models and the capability of generalize to new tasks. This model
has been presented previously in the 22nd International Conference on
Intelligent Data Engineering and Automated Learning (IDEAL) [17].

  * •

bloomz-560m (BLOOMz) [58]: Fine-tuned variant of the pre-trained multilingual
BLOOM [59] and mT5 [60] model families on cross-lingual task mixture of 13
training tasks in 46 languages with English prompts capable of following human
instructions in dozens of languages zero-shot. The version used is the version
of 560M parameters.

  * •

xlm-roberta-base (XLM-R): Base-sized XLM-RoBERTa [61] model totalizing
$\sim$125M parameters. XLM-RoBERTa is RoBERTa model [62], robust version of
BERT, pre-trained on CommonCrawl data containing 100 languages.

  * •

Model 5 - bert-base-multilingual-cased (mBERT): BERT [63] transformer model
pre-trained on a large corpus of 104 languages Wikipedia articles using the
self-supervised masked language modelling (MLM) objective with $\sim$177M
parameters.

The best multilingual model obtained for the NER task is compared with the
monolingual model fine-tuned for the NER task in each language included.
Therefore, the following monolingual models are considered as baseline:

  * •

roberta-base [62]: English baseline model. Pre-trained model in English using
a masked language modeling (MLM) on Wikipedia articles and BookCorpus [64].

  * •

roberta-base-bne [65]: Spanish baseline model. Masked language model for the
Spanish language based on the RoBERTa base model pre-trained using spanish web
crawlings performed by the National Library of Spain from 2009 to 2019.

  * •

camembert-base [66]: French baseline model. Masked language model for French
based on the RoBERTa base model pre-trained using the French portion of the
Open Super-large Crawled Aggregated coRpus (OSCAR) [67].

  * •

robit-roberta-base-it [68]: Italian baseline model. Masked language model for
French based on the RoBERTa base model pre-trained solely on the Italian
portion of the OSCAR dataset.

  * •

gottbert-base [68]: German baseline model. Masked language model for French
based on the BERT base model pre-trained solely on the German portion of the
OSCAR dataset.

The models were fine-tuned using the Spacy interface [47] as the camouflage
NER data is in Spacy format. For the sake of reproducibility, the parameters
and hyperparameters used during the training process can be consulted in Table
5. A more detailed view of these parameters and training metrics is available
at Weight & Biases161616https://wandb.ai/aida-group/ASOC-LeetSpeakNER-full-XX-
MultiNER/overview. Additionally, the models are publicly available on Hugging
Face3 either for direct use or for integration into other Spacy pipelines.

##  5 Experiments and Results

The experiments presented in this section aim to develop the best multilingual
NER model for word camouflage detection. Then compare this best multilingual
model against the monolingual baseline models. Finally, we analyze the
detection performance of different camouflage entities by visualizing the
confusion matrices of the best multilingual model. As the NER word camouflaged
detection task considered in this work consists of four imbalanced mutually
exclusive classes (see Subsections 3.2 and 4.2), the F1 score metric is
reported with its different variants, micro, macro and weighted averages.
After all, F1 score variants include both precision and recall because they
rely on the model’s True Positives (TP), False Positives (FP) and False
Negatives (FN).

The macro-averaged F1 score represents the unweighted mean; this is computing
the arithmetic mean of all the per-class F1 scores. On the other hand, the
micro-averaged F1 score computes the proportion of correctly classified
observations out of all observations, as it computes a global average F1 score
by summing the respective TP, FP, FN values across all classes. Finally, the
F1-weighted average is calculated by taking the mean of all per-class F1
scores while considering each class’s support.

Since the models are tested on an imbalanced dataset, the F1 macro and F1
weighted averages are preferred. It is important to note that the F1-macro
metric allows us to evaluate the models considering that all classes are
equally important. At the same time, F1-weighted assigns higher contributions
to the classes with more examples in the dataset. As explained in the
Methodology Section 4.2 not all types of camouflage are applied in the same
proportion, so we have paid particular attention to the F1-weighted mean.
Similarly, note that test results are reported in general and broken down by
dataset. The overall result is obtained by considering all instances of the
datasets as a whole and not the average of the individual results.

###  5.1 Multilingual NER word camouflage models

Table 6: F1-Macro, F1-micro and F1 weighted average test results for the
multilingual models according to the overall and each dataset, following the
nomenclature and order shown in Subsection 4.3. In bold the best result, in
italics the second best.

|  | MPNET-base | $MPNET-ideal$ |  BLOOMz | XLM-R | mBERT
---|---|---|---|---|---|---
News |  |  |  |  |  |
Comentary | F1-Macro | 0.9398 | $0.9455$ |  0.8221 | 0.9470 | 0.9458
| F1-Micro | 0.9892 | 0.9908 |  0.9653 | 0.9916 | 0.9900
| F1-Weighted | 0.8855 | 0.9019 |  0.6845 | 0.8843 | 0.8915
ParaCrawl | F1-Macro | 0.9306 | 0.9316 |  0.7942 | 0.9336 | 0.9274
| F1-Micro | 0.9880 | 0.9887 |  0.9617 | 0.9890 | 0.9846
| F1-Weighted | 0.8720 | 0.8760 |  0.6457 | 0.8633 | 0.8643
TED2020 | F1-Macro | 0.9400 | 0.9437 |  0.8062 | 0.9397 | 0.9404
| F1-Micro | 0.9880 | 0.9893 |  0.9597 | 0.9883 | 0.9867
| F1-Weighted | 0.8863 | 0.8933 |  0.6652 | 0.8746 | 0.8837
WikiMatrix | F1-Macro | 0.9195 | 0.9291 |  0.7860 | 0.9239 | 0.9279
| F1-Micro | 0.9810 | 0.9839 |  0.9465 | 0.9827 | 0.9816
| F1-Weighted | 0.8516 | 0.8664 |  0.6324 | 0.8427 | 0.8598
Overall | F1-Macro | 0.9308 | 0.9350 |  0.7971 | 0.9334 | 0.9321
| F1-Micro | 0.9866 | 0.9880 |  0.9582 | 0.9876 | 0.9849
| F1-Weighted | 0.8712 | 0.8795 |  0.6499 | 0.8620 | 0.8698

Table 7: F1-Macro, F1-micro, and F1 weighted average test results for the best
multilingual model (i.e., MPNET-ideal from Subsection 4.3) and each
monolingual baseline model for the languages considered according to the
overall and each data set.

|  |  EN |  ES |  FR |  IT |  DE
---|---|---|---|---|---|---
|  |  |  |  |  |
News Comentary |  F1-Macro |  EN Model |  0.9172 |  ES Model |  0.9501 |  FR Model |  0.9365 |  IT Model |  0.8270 |  DE Model |  0.9607
|  |  |  |  |
F1-Micro |  0.9864 |  0.9901 |  0.9880 |  0.9612 |  0.9909
|  |  |  |  |  |  |  |  |  |
F1-Weighted |  |  0.8522 |  |  0.9025 |  |  0.8705 |  |  0.6982 |  |  0.9210
|  |  |  |  |  |  |  |  |  |
|  F1-Macro |  MPNET- ideal |  0.9167 |  MPNET- ideal |  0.9487 |  MPNET- ideal |  0.8771 |  MPNET- ideal |  0.8783 |  MPNET- ideal |  0.9733
|  |  |  |  |  |
|  F1-Micro |  0.9868 |  0.9917 |  0.9756 |  0.9835 |  0.9940
|  |  |  |  |  |  |  |  |  |  |
|  F1-Weighted |  |  0.8515 |  |  0.9081 |  |  0.7872 |  |  0.8133 |  |  0.9484
|  |  |  |  |  |  |  |  |  |  |
ParaCrawl |  F1-Macro |  EN Model |  0.8381 |  ES Model |  0.9387 |  FR Model |  0.9338 |  IT Model |  0.8265 |  DE Model |  0.9521
|  |  |  |  |
F1-Micro |  0.9639 |  0.9852 |  0.9863 |  0.9586 |  0.9884
|  |  |  |  |  |  |  |  |  |
F1-Weighted |  |  0.7376 |  |  0.8921 |  |  0.8713 |  |  0.6915 |  |  0.9048
|  |  |  |  |  |  |  |  |  |
|  F1-Macro |  MPNET- ideal |  0.8690 |  MPNET- ideal |  0.9422 |  MPNET- ideal |  0.9373 |  MPNET- ideal |  0.9396 |  MPNET- ideal |  0.9504
|  |  |  |  |  |
|  F1-Micro |  0.9809 |  0.9903 |  0.9909 |  0.9897 |  0.9909
|  |  |  |  |  |  |  |  |  |  |
|  F1-Weighted |  |  0.7750 |  |  0.8977 |  |  0.8847 |  |  0.8849 |  |  0.9126
|  |  |  |  |  |  |  |  |  |  |
TED2020 |  F1-Macro |  EN Model |  0.9102 |  ES Model |  0.9552 |  FR Model |  0.9325 |  IT Model |  0.8535 |  DE Model |  0.9577
|  |  |  |  |
F1-Micro |  0.9806 |  0.9890 |  0.9840 |  0.9612 |  0.9882
|  |  |  |  |  |  |  |  |  |
F1-Weighted |  |  0.8286 |  |  0.9104 |  |  0.8704 |  |  0.7353 |  |  0.9140
|  |  |  |  |  |  |  |  |  |
|  F1-Macro |  MPNET- ideal |  0.9224 |  MPNET- ideal |  0.9528 |  MPNET- ideal |  0.9376 |  MPNET- ideal |  0.9469 |  MPNET- ideal |  0.9574
|  |  |  |  |  |
|  F1-Micro |  0.9854 |  0.9909 |  0.9892 |  0.9898 |  0.9911
|  |  |  |  |  |  |  |  |  |  |
|  F1-Weighted |  |  0.8500 |  |  0.9153 |  |  0.8844 |  |  0.8972 |  |  0.9181
|  |  |  |  |  |  |  |  |  |  |
WikiMatrix |  F1-Macro |  EN Model |  0.8889 |  ES Model |  0.9323 |  FR Model |  0.9024 |  IT Model |  0.8332 |  DE Model |  0.9417
|  |  |  |  |
F1-Micro |  0.9724 |  0.9805 |  0.9751 |  0.9524 |  0.9813
|  |  |  |  |  |  |  |  |  |
F1-Weighted |  |  0.7998 |  |  0.8720 |  |  0.8186 |  |  0.6991 |  |  0.8829
|  |  |  |  |  |  |  |  |  |
|  F1-Macro |  MPNET- ideal |  0.9032 |  MPNET- ideal |  0.9349 |  MPNET- ideal |  0.9198 |  MPNET- ideal |  0.9475 |  MPNET- ideal |  0.9380
|  |  |  |  |  |
|  F1-Micro |  0.9785 |  0.9849 |  0.9831 |  0.9882 |  0.9852
|  |  |  |  |  |  |  |  |  |  |
|  F1-Weighted |  |  0.8245 |  |  0.8805 |  |  0.8503 |  |  0.8954 |  |  0.8827
|  |  |  |  |  |  |  |  |  |  |
Overall |  F1-Macro |  EN Model |  0.8749 |  ES Model |  0.9434 |  FR Model |  0.9254 |  IT Model |  0.8364 |  DE Model |  0.9512
|  |  |  |  |
F1-Micro |  0.9712 |  0.9863 |  0.9834 |  0.9578 |  0.9869
|  |  |  |  |  |  |  |  |  |
F1-Weighted |  |  0.7831 |  |  0.8938 |  |  0.8572 |  |  0.7061 |  |  0.9020
|  |  |  |  |  |  |  |  |  |
|  F1-Macro |  MPNET- ideal |  0.8958 |  MPNET- ideal |  0.9445 |  MPNET- ideal |  0.9320 |  MPNET- ideal |  0.9439 |  MPNET- ideal |  0.9495
|  |  |  |  |  |
|  F1-Micro |  0.9817 |  0.9898 |  0.9886 |  0.9893 |  0.9898
|  |  |  |  |  |  |  |  |  |  |
|  F1-Weighted |  |  0.8126 |  |  0.9002 |  |  0.8739 |  |  0.8913 |  |  0.9069
|  |  |  |  |  |  |  |  |  |  |

The results of NER word camouflage detection in the test partitions for the
different trained multilingual models are presented in Table 5.1.

From these results, we can see how MPNET-ideal (see Section 4.3), the one
previously developed using the semantic textual similarity pre-training task
with the multilingual extended mSTSb dataset [17], shows the best performance
in most datasets and is the best in general. It should be noted that MPNET-
ideal outperforms MPNET-base, which corresponds to the same model and
architecture, but without pre-training in mSTSb. This result corroborates the
suitability of the semantic similarity task as a method of providing
generality knowledge to a model and the benefit of the multilingual extension
of a dataset shown in our previous work [17].

Remarkably, the models perform adequately in the different scenarios, since
there are no significant differences in the results obtained between the other
datasets. However, the WikiMatrix and ParaCrawl datasets show the lowest
scores. This could be due to the diversity of symbols present in the data,
since both are the result of multilingual Wikipedia and Internet crawls, which
can differ between languages and also include URLs, programming code, or
mathematical formulas with the variability of symbols that this implies. On
the contrary, the News Commentary and TED2020 datasets show better scores
since they correspond to natural text in a formal and informal style,
respectively, but with less variability of symbols. It should also be noted
that good results are obtained in a few shot scenario, such as the News
Commentary dataset, which is the dataset with the lowest number of instances
(see Table 3). This indicates generalization and transfer knowledge
capabilities to different scenarios.

###  5.2 Monolingual Baseline NER word camouflage models

The best multilingual model, MPNET-ideal, is compared with the monolingual
baseline models. The results of these models and their comparison are shown in
Table 7.

In particular, the test results in the overall dataset show how the
multilingual model outperforms the monolingual baseline models. The most
significant difference is found in the Italian language. The Italian
monolingual baseline model has the lowest weighted F1 score of 0.7061 across
languages; however, the multilingual model improves the score to 0.8913.
Similarly, in the case of English and French, the baseline performance with an
F1 score weighted of 0.7831 and 0.8572 is improved to 0.8126 and 0.8739,
respectively. Although not to the same extent, the Spanish and German
languages also improve the baseline model scores.

Our experiments are consistent with previous result [17] as corroborate the
usefulness of extending a dataset at the multilingual level to improve the
performance of a multilingual model over those of monolingual models. This is
an advantage in terms of using multilingual models over monolingual ones.
Lower computational cost is required, and feasibility and applicability are
increased since instead of a monolingual model to detect camouflage in each
language, a single model can be used for all of them with better and more
consistent results across languages.

###  5.3 Multilingual NER Confusion Matrix Analisys

The scores presented above for MPNET-ideal, the best multilingual model, are
remarkable, as it achieves great results by detecting word camouflage and
distinguishing the type of word camouflage technique used. To analyze in
greater detail the capacity of the models to detect each of the different
entities, the corresponding confusion matrix is also provided (Figure 2). It
is important to note that the entity “O’ comes from “Outside" and refers to
those terms that are not entities to be detected.

As expected, one aspect of interest that emerged from the confusion matrices
is that, across all datasets, trying to differentiate “MIX" entities from
“LEETSPEAK" or “PUNCT_CAMO" entities is more complex as they are closely
related. In the same way, these matrixes show that detecting inversion
camouflage is harder than detecting punctuation or leetspeak camouflage as
inversion shows more false positive and false negative with “O" entity class.

Taken together, these results suggest that developing Transformer models to
detect word camouflage entities at a multilingual level is possible with great
results in different tested scenarios.

In addition, Figure 3 shows some synthetic examples of the split test in the
detection of camouflaged content. From this figure, we can see how the best
multilingual model is able to detect and differentiate the different content
avoidance strategies at multilingual levels from the simplest to the more
complex word camouflaging strategies. Likewise, an
application171717https://huggingface.co/spaces/Huertas97/LeetSpeak-NER has
been developed where the model can be tested.

Finally, real cases of the use of word camouflage have been incorporated to
test the performance of the proposed multilingual model.

(a)

(b)

(c)

(d)

(e)

Figure 2: Entity-level confusion matrix of word camouflage for the best
multilingual NER model on (a) the whole multilingual test data. Results also
broken down by dataset source: (b) News Commentary, (c) ParaCrawl, (d)
TED2020, and (e) WikiMatrix. The rows represent the actual camouflage type,
and in columns the type predicted by the model, where the number in each cell
indicates the number of entities.

##  6 Conclusions

This work has focused on continuing previous research conducted at the 22nd
International Conference on Intelligent Data Engineering and Automated
Learning (IDEAL) [17] on the usefulness of developing datasets and
multilingual solutions in the field of Natural Language Processing along with
the recent emerging content evasion phenomenon.

Content evasion involves modifying the wording or formatting of a text to
avoid detection by automated systems or human moderators. Besides, evidence of
its existence are easily to find on social networks5,7,10,11. Moreover,
content evasion detection can be useful for organisations and individuals who
want to monitor and filter out misinformation and terrorist, misogynistic, or
hateful language content from their platforms or networks. The counter of
content evasion is essential in the context of misinformation because it is a
tactic that is often used by those who spread false or misleading information
to avoid detection and removal of their content by social media platforms and
other online services. By detecting and removing content that has been evaded,
it is possible to reduce the spread of misinformation and protect users from
being exposed to harmful or misleading information. Furthermore, by cracking
down on content evasion, it is possible to make it more difficult for those
who spread misinformation or misbehave to continue doing so, which can help
reduce the overall prevalence of misinformation online.

Considerable progress has been made in this work regarding simulating and
detecting content evasion techniques. This work has presented the
“pyleetspeak” Python package1, a novel multilingual customisable tool to
simulate content evasion techniques based on textual modification and
camouflaging. Furthermore, this work also provides a curated synthetic
multilingual dataset2 obtained by applying the word camouflaging simulator on
texts from various resources. This publicly available tool and dataset provide
an initial step to counter new information disorder from malicious actors in
the co-evolving information warfare battleground from a multilingual point of
view.

Finally, the above resources have been employed to develop a powerful
multilingual NER camouflage detection model 3 that identifies different word
camouflage techniques. Our experiments results have corroborated the previous
research [17] by improving the perform of multilingual models in camouflaged
detection when using a pre-train in multilingual Semantic Textual Similarity
Benchmark (mSTSb). Additionally, the best multilingual model has been
evaluated in five languages (English, Spanish, French, Italian and German) and
has proved to outperforms with monolingual baseline models for the languages
considered.

This work has proved that it is possible to automatically address the
challenging task of identifying and flagging content that contains word
camouflaging. Considering potential applications and implications of this work
and future work, we would like to suggest that the use of “pyleetspeak” is not
limited to generating data for NER training word camouflage models; it can
also be applied as a data augmentation tool to make current content-dependent
AI systems more robust. Future studies will investigate the impact of word
camouflage on the performance of models trained on canonical text datasets
that are applied in real-world scenarios susceptible to word camouflage and
content evasion. Furthermore, we propose future research examining how word
camouflaging occurs in different circumstances. Data collection from other
content evasion cases combined with word camouflage NER detection provides an
excellent opportunity to gain insight into which words are most susceptible to
being camouflaged and which customised camouflaging methods are applied in
malicious communities. Therefore, the tools presented in this paper might help
to address the critical issue of author profiling. Furthermore, although the
proposed study has only been tested in English, Spanish, French and Italian
and German, our results prove that our work is easily extensible to other
languages and situations, as the tools developed currently support more than
20 languages and have obtained excellent results. Further implementations will
cover different content evasion strategies (i.e., paralanguage, use of
emoticons instead of original symbols).

(a)

(b)

(c)

(d)

(e)

Figure 3: Examples of word camouflage detection of the best multilingual NER
model in (a) English, (b) Spanish, (c) French, (d) Italian and (e) German.

## Acknowledgements

This research has been supported by the Spanish Ministry of Science and
Education under FightDIS (PID2020-117263GB-I00) and XAI-Disinfodemics
(PLEC2021-007681) grants, by Comunidad Autónoma de Madrid under S2018/
TCS-4566 (CYNAMON), by BBVA Foundation grants for scientific research teams
SARS-CoV-2 and COVID-19 under the grant: "CIVIC: Intelligent characterisation
of the veracity of the information related to COVID-19", and by IBERIFIER
(Iberian Digital Media Research and Fact-Checking Hub), funded by the European
Commission under the call CEF-TC-2020-2, grant number 2020-EU-IA-0252.
Finally, David Camacho has been supported by the Comunidad Autónoma de Madrid
under "Convenio Plurianual with the Universidad Politécnica de Madrid in the
actuation line of Programa de Excelencia para el Profesorado Universitario"

## References

  * [1] F. Fagan, Optimal social media content moderation and platform immunities, European Journal of Law and Economics 50 (3, SI) (2020) 437–449.  doi:10.1007/s10657-020-09653-7.
  * [2] N. Thilagavathi, R. Taarika, Content based filtering in online social network using inference algorithm, in: 2014 International Conference on Circuits, Power and Computing Technologies [ICCPCT-2014], 2014, pp. 1416–1420.  doi:10.1109/ICCPCT.2014.7054762.
  * [3] Y. Gerrard, Beyond the hashtag: Circumventing content moderation on social media, New Media & Society 20 (12) (2018) 4492–4511.  doi:10.1177/1461444818776611.
  * [4] L. Kelly, G. Kerr, J. Drennan, Avoidance of advertising in social networking sites, Journal of Interactive Advertising 10 (2) (2010) 16–27.  doi:10.1080/15252019.2010.10722167.
  * [5] S. Chancellor, J. A. Pater, T. Clear, E. Gilbert, M. De Choudhury, #thyghgapp: Instagram content moderation and lexical variation in pro-eating disorder communities, in: Proceedings of the 19th ACM Conference on Computer-Supported Cooperative Work & Social Computing, CSCW ’16, Association for Computing Machinery, New York, NY, USA, 2016, p. 1201–1213.  doi:10.1145/2818048.2819963.
  * [6] A. Mosseri, Addressing Hoaxes and Fake News (2016).
URL https://about.fb.com/news/2016/12/news-feed-fyi-addressing-hoaxes-and-
fake-news/

  * [7] R. Yoel, N. Pickles, Updating our approach to misleading information.
URL https://blog.twitter.com/en_us/topics/product/2020/updating-our-approach-
to-misleading-information

  * [8] F. Sharevski, R. Alsaadi, P. Jachim, E. Pieroni, Misinformation warnings: Twitter’s soft moderation effects on covid-19 vaccine belief echoes, Computers & Security 114 (2022) 102577.  doi:https://doi.org/10.1016/j.cose.2021.102577.
  * [9] L. S. Martinez, Health Misinformation and Rumors, John Wiley & Sons, Ltd, 2022, pp. 1–6.  doi:https://doi.org/10.1002/9781119678816.iehc0950.
  * [10] COVID-19 stream, publisher: Twitter Developer Platform.
URL https://developer.twitter.com/en/docs/labs/covid19-stream/overview

  * [11] Twitter API for Academic Research | Products, publisher: Twitter Developer Platform.
URL https://developer.twitter.com/en/products/twitter-api/academic-research

  * [12] A. Martín, J. Huertas-Tato, Á. Huertas-García, G. Villar-Rodríguez, D. Camacho, FacTeR-Check: Semi-automated fact-checking through semantic similarity and natural language inference, Knowledge-Based Systems 251 (2022) 109265.  doi:10.1016/j.knosys.2022.109265.
  * [13] Policy on medical misinformation about COVID-19, publisher: YouTube.
URL https://support.google.com/youtube/answer/9891785

  * [14] R. Gorwa, R. Binns, C. Katzenbach, Algorithmic content moderation: Technical and political challenges in the automation of platform governance (2020).  doi:10.31235/osf.io/fj6pg.
  * [15] M. Kavanagh, Bridge the generation gap by decoding leetspeak, Inside the Internet 12 (12) (2005) 11.
  * [16] A. Romero-Vicente, Word camouflage to evade content moderation (2021).
URL https://www.disinfo.eu/publications/word-camouflage-to-evade-content-
moderation/

  * [17] Á. Huertas-García, J. Huertas-Tato, A. Martín García, D. Camacho, Countering Misinformation Through Semantic-Aware Multilingual Models, in: Intelligent Data Engineering and Automated Learning – IDEAL 2021, Springer International Publishing, 2021, pp. 312–323.  doi:10.1007/978-3-030-91608-4_31.
  * [18] Y. Gerrard, H. Thornham, Content moderation: Social media’s sexist assemblages, New Media & Society 22 (7, SI) (2020) 1266–1286.  doi:{10.1177/1461444820912540}.
  * [19] C. Lampe, P. Resnick, Slash(dot) and burn: Distributed moderation in a large online conversation space, in: Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, CHI ’04, Association for Computing Machinery, New York, NY, USA, 2004, p. 543–550.  doi:10.1145/985692.985761.
  * [20] N. Elkin-Koren, Contesting algorithms: Restoring the public interest in content filtering by artificial intelligence, Big Data & Society 7 (2) (2020).  doi:{10.1177/2053951720932296}.
  * [21] J. Cobbe, Algorithmic Censorship by Social Platforms: Power and Resistance, Philosophy & Technology 34 (4) (2021) 739–766.  doi:10.1007/s13347-020-00429-0.
  * [22] D. Sumpter, Outnumbered: from Facebook and Google to fake news and filter-bubbles - the algorithms that control our lives, Bloomsbury Sigma, London, 2018, oCLC: on1035374425.
  * [23] Ofcom, Use of AI in online content moderation, publisher: Cambridge Consultants (2019).
URL https://www.cambridgeconsultants.com/insights/whitepaper/ofcom-use-ai-
online-content-moderation

  * [24] Global Internet Forum to Counter Terrorism | About.
URL https://perma.cc/44V5-554U

  * [25] F. Ferreira, Antivaccine videos slip through YouTube’s advertising policies, new study finds, Science (2020).  doi:10.1126/science.abf5402.
  * [26] Twitter Inc, Permanent suspension of @realDonaldTrump (2021).
URL https://blog.twitter.com/en_us/topics/company/2020/suspension

  * [27] T. Blog, Nuevo canal para reportar información potencialmente engañosa en Twitter (2022).
URL https://blog.twitter.com/es_es/topics/2022/nuevo-canal-para-reportar-
informacion-potencialmente-enganosa-en

  * [28] M. Bickert, Removing Holocaust Denial Content (2020).
URL https://about.fb.com/news/2020/10/removing-holocaust-denial-content/

  * [29] U. Ozker, O. K. Sahingoz, Content based phishing detection with machine learning, in: 2020 International Conference on Electrical Engineering (ICEE), 2020, pp. 1–6.  doi:10.1109/ICEE49691.2020.9249892.
  * [30] N. Thilagavathi, R. Taarika, Content based filtering in online social network using inference algorithm, in: 2014 International Conference on Circuits, Power and Computing Technologies [ICCPCT-2014], 2014, pp. 1416–1420.  doi:10.1109/ICCPCT.2014.7054762.
  * [31] A. S. Vairagade, R. A. Fadnavis, Automated content based short text classification for filtering undesired posts on facebook, in: 2016 World Conference on Futuristic Trends in Research and Innovation for Social Welfare (Startup Conclave), 2016, pp. 1–5.  doi:10.1109/STARTUP.2016.7583984.
  * [32] K. Blashki, S. Nichol, Game geek’s goss: linguistic creativity in young males within an online university forum (94$/\backslash/\backslash$3 933k’5 9055oneone), 2005.
  * [33] A. H. Shaari, K. B. A. Bataineh, Netspeak and a breach of formality: Informalization and fossilization of errors in writing among esl and efl learners, International Journal for Cross-Disciplinary Subjects in Education 6 (2015) 2165–2173.
  * [34] J. Kavrestad, F. Eriksson, M. Nohlberg, Understanding passwords - a taxonomy of password creation strategies, Information and Computer Security 27 (3) (2019) 453–467.  doi:{10.1108/ICS-06-2018-0077}.
  * [35] J. Fuchs, Gamespeak for n00bs - a linguistic and pragmatic analysis of gamers’ language, Ph.D. thesis, University of Graz (2013).
URL https://unipub.uni-graz.at/obvugrhs/content/titleinfo/231890?lang=en

  * [36] M. Golla, B. Beuscher, M. Duermuth, On the Security of Cracking-Resistant Password Vaults, in: CCS’16: Proceddings of the 2016 ACM SIGSAC Conference on Computer and Comunication Security, 2016, pp. 1230–1241.  doi:{10.1145/2976749.2978416}.
  * [37] D. L. Wheeler, Zxcvbn: Low-budget password strength estimation, in: Proceedings of the 25th USENIX Conference on Security Symposium, SEC’16, USENIX Association, USA, 2016, p. 157–173.
  * [38] K. H. Hong, U. G. Kang, B. M. Lee, Enhanced Evaluation Model of Security Strength for Passwords Using Integrated Korean and English Password Dictionaries, Security and Communication Networks 2021 (2021).  doi:{10.1155/2021/3122627}.
  * [39] Cybersquatting, qué es y cómo protegerse (2019).
URL https://www.incibe.es/protege-tu-empresa/blog/cybersquatting-y-protegerse

  * [40] W. Peng, L. Huang, J. Jia, E. Ingram, Enhancing the naive bayes spam filter through intelligent text modification detection, in: 2018 17th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/ 12th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE), 2018, pp. 849–854.  doi:10.1109/TrustCom/BigDataSE.2018.00122.
  * [41] T. Singh, M. Kumari, Role of text pre-processing in twitter sentiment analysis, Procedia Computer Science 89 (2016) 549–554.  doi:https://doi.org/10.1016/j.procs.2016.06.095.
  * [42] Z. Z. Izazi, T. M. Tengku-Sepora, Slangs on Social Media: Variations among Malay Language Users on Twitter, Pertanika Journal of Social Science and Humanities 28 (1) (2020) 17–34.
  * [43] S. Moskalenko, J. F.-G. González, N. Kates, J. Morton, Incel ideology, radicalization and mental health: A survey study, The Journal of Intelligence, Conflict, and Warfare 4 (3) (2022) 1–29.  doi:10.21810/jicw.v4i3.3817.
  * [44] R. Craenen, Leet speak cheat sheet.
URL https://www.gamehouse.com/blog/leet-speak-cheat-sheet/

  * [45] P. T. Inc., Collaborative data science (2015).
URL https://plot.ly

  * [46] M. Grootendorst, Keybert: Minimal keyword extraction with bert. (2020).  doi:10.5281/zenodo.4461265.
  * [47] I. Montani, M. Honnibal, S. Van Landeghem, A. Boyd, "spaCy: Industrial-strength Natural Language Processing in Python" (2020).  doi:10.5281/zenodo.1212303.
  * [48] A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, L. Kaiser, I. Polosukhin, Attention is all you need (2017).  arXiv:1706.03762.
  * [49] J. Devlin, M.-W. Chang, K. Lee, K. Toutanova, Bert: Pre-training of deep bidirectional transformers for language understanding (2019).  arXiv:1810.04805.
  * [50] T. Wolf, L. Debut, V. Sanh, J. Chaumond, C. Delangue, A. Moi, P. Cistac, T. Rault, R. Louf, M. Funtowicz, J. Davison, S. Shleifer, P. von Platen, C. Ma, Y. Jernite, J. Plu, C. Xu, T. L. Scao, S. Gugger, M. Drame, Q. Lhoest, A. M. Rush, Transformers: State-of-the-art natural language processing, in: Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, Association for Computational Linguistics, 2020, pp. 38–45.
  * [51] J. Tiedemann, Parallel data, tools and interfaces in opus, in: N. C. C. Chair), K. Choukri, T. Declerck, M. U. Dogan, B. Maegaard, J. Mariani, J. Odijk, S. Piperidis (Eds.), Proceedings of the Eight International Conference on Language Resources and Evaluation (LREC’12), European Language Resources Association (ELRA), Istanbul, Turkey, 2012.
  * [52] J. Tiedemann, Parallel data, tools and interfaces in OPUS, in: Proceedings of the Eighth International Conference on Language Resources and Evaluation (LREC’12), European Language Resources Association (ELRA), Istanbul, Turkey, 2012, pp. 2214–2218.
  * [53] M. Bañón, P. Chen, B. Haddow, K. Heafield, H. Hoang, M. Esplà-Gomis, M. L. Forcada, A. Kamran, F. Kirefu, P. Koehn, S. Ortiz Rojas, L. Pla Sempere, G. Ramírez-Sánchez, E. Sarrías, M. Strelec, B. Thompson, W. Waites, D. Wiggins, J. Zaragoza, ParaCrawl: Web-scale acquisition of parallel corpora, in: Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, Association for Computational Linguistics, Online, 2020, pp. 4555–4567.  doi:10.18653/v1/2020.acl-main.417.
  * [54] N. Reimers, I. Gurevych, Making monolingual sentence embeddings multilingual using knowledge distillation, arXiv preprint arXiv:2004.09813 (2020).
  * [55] H. Schwenk, V. Chaudhary, S. Sun, H. Gong, F. Guzmán, Wikimatrix: Mining 135m parallel sentences in 1620 language pairs from wikipedia (2019).  arXiv:1907.05791.
  * [56] K. Song, X. Tan, T. Qin, J. Lu, T.-Y. Liu, Mpnet: Masked and permuted pre-training for language understanding (2020).  arXiv:2004.09297.
  * [57] D. Cer, M. Diab, E. Agirre, I. Lopez-Gazpio, L. Specia, SemEval-2017 task 1: Semantic textual similarity multilingual and crosslingual focused evaluation, in: Proceedings of the 11th International Workshop on Semantic Evaluation (SemEval-2017), Association for Computational Linguistics, Vancouver, Canada, 2017, pp. 1–14.
  * [58] N. Muennighoff, T. Wang, L. Sutawika, A. Roberts, S. Biderman, T. L. Scao, M. S. Bari, S. Shen, Z.-X. Yong, H. Schoelkopf, X. Tang, D. Radev, A. F. Aji, K. Almubarak, S. Albanie, Z. Alyafeai, A. Webson, E. Raff, C. Raffel, Crosslingual generalization through multitask finetuning (2022).  doi:10.48550/ARXIV.2211.01786.
  * [59] T. L. Scao, A. Fan, C. Akiki, E. Pavlick, S. Ilić, D. Hesslow, R. Castagné, A. S. Luccioni, F. Yvon, M. Gallé, et al., Bloom: A 176b-parameter open-access multilingual language model, arXiv preprint arXiv:2211.05100 (2022).
  * [60] L. Xue, N. Constant, A. Roberts, M. Kale, R. Al-Rfou, A. Siddhant, A. Barua, C. Raffel, mt5: A massively multilingual pre-trained text-to-text transformer (2020).  doi:10.48550/ARXIV.2010.11934.
  * [61] A. Conneau, K. Khandelwal, N. Goyal, V. Chaudhary, G. Wenzek, F. Guzmán, E. Grave, M. Ott, L. Zettlemoyer, V. Stoyanov, Unsupervised Cross-lingual Representation Learning at Scale (2019).  doi:10.48550/ARXIV.1911.02116.
  * [62] Z. Liu, W. Lin, Y. Shi, J. Zhao, A Robustly Optimized BERT Pre-Training Approach with Post-Training, in: Chinese Computational Linguistics: 20th China National Conference, CCL 2021, Hohhot, China, August 13–15, 2021, Proceedings, Springer-Verlag, Berlin, Heidelberg, 2021, p. 471–484.  doi:10.1007/978-3-030-84186-7_31.
  * [63] J. Devlin, M.-W. Chang, K. Lee, K. Toutanova, BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding, in: Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1, Association for Computational Linguistics, Minneapolis, Minnesota, 2019, pp. 4171–4186.  doi:10.18653/v1/N19-1423.
  * [64] Y. Zhu, R. Kiros, R. Zemel, R. Salakhutdinov, R. Urtasun, A. Torralba, S. Fidler, Aligning books and movies: Towards story-like visual explanations by watching movies and reading books, in: The IEEE International Conference on Computer Vision (ICCV), 2015.
  * [65] A. Gutiérrez-Fandiño, J. Armengol-Estapé, M. Pàmies, J. Llop-Palao, J. Silveira-Ocampo, C. P. Carrino, A. Gonzalez-Agirre, C. Armentano-Oller, C. Rodriguez-Penagos, M. Villegas, Spanish language models (2021).  arXiv:2107.07253.
  * [66] L. Martin, B. Muller, P. J. O. Suárez, Y. Dupont, L. Romary, É. V. de la Clergerie, D. Seddah, B. Sagot, Camembert: a tasty french language model, in: Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, 2020.
  * [67] P. J. O. Suárez, B. Sagot, L. Romary, Asynchronous pipelines for processing huge corpora on medium to low resource infrastructures, Proceedings of the Workshop on Challenges in the Management of Large Corpora (CMLC-7) 2019. Cardiff, 22nd July 2019, Leibniz-Institut für Deutsche Sprache, Mannheim, 2019, pp. 9 – 16.  doi:10.14618/ids-pub-9021.
  * [68] R. Scheible, F. Thomczyk, P. Tippmann, V. Jaravine, M. Boeker, Gottbert: a pure german language model (2020).  doi:10.48550/ARXIV.2012.02110.

##  Appendix A Real Examples

(a) Link to the resource

(b) Link to the resource

(c) Link to the resource

(d) Link to the resource

(e) Link to the resource

(f) Link to the resource

(g) Link to the resource

(h) Link to the resource

(i) Link to the resource

(j) Link to the resource

(k) Link to the resource

(l) Link to the resource

(m) Link to the resource

(n) Link to the resource

(o) Link to the resource

(p) Link to the resource

(q) Link to the resource

(r) Link to the resource

(s) Link to the resource

(t) Link to the resource

(u) Link to the resource

(v) Link to the resource

(w) Link to the resource

(x) Link to the resource

(y) Link to the resource

(z) Link to the resource