SIRF: A Spec-Internalized Risk Foundation Model for Industrial Content Risk Control
Suwan Wu, Yumeng Lin, Pengcheng Yuan, Xiaolong Jiang
cs.AI · cs.CL · cs.LG
Quick verdict
Claims +15.1pp Black Recall@P95 via policy-internalizing CPT on same-source 8B; controlled study credible but proprietary, single-platform, n=1000 eval.
Summary
This industry-track paper (EMNLP 2026, Xiaohongshu) introduces SIRF, a risk-control model that internalizes roughly a hundred platform policies into model weights via continued pretraining (CPT) on ~70M synthetic tokens — EntiGraph entity-relation expansion, MAGA multi-genre rewriting, and account-level chain-of-thought distillation quality-gated by an LLM judge — with no new human annotation, though self-generated verdicts act as weak supervision. In a controlled same-source comparison (Qwen3-8B-SFT vs SIRF-8B-SFT, identical SFT data and verdict-only output, differing only in CPT), SIRF reaches 71.3% Black Recall@P95 on an n=1000 production-distribution set versus 56.2% for the baseline (+15.1pp, bootstrap 95% CI [+11.7, +18.5]), above all included logprob-available models including 400B-scale ones; a component ablation attributes the gain to policy content (domain-only CPT: 55.7). General ability is largely preserved on 10 public benchmarks. SIRF runs in production as an adjudication layer (+20% false-positive release) and transfers to a freezing domain (~70% relative mis-penalization reduction, A/B-validated). Main limitations: thresholds are fitted on the evaluation set itself, the margin shrinks to +1.4pp on a balanced set, data and code are not released, and the setting is a single Chinese-language platform.
Review complete
Assessment at a glance
6
risk flags identified
● high 0
● medium 3
● low 3
4 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Policy-grounded CPT on ~70M synthesized tokens (no new human labels) lifts same-source 8B Black Recall@P95 from 56.2 to 71.3 (+15.1pp, 95% CI [+11.7, +18.5]) without harming general ability.
- The gain is attributable to policy content rather than in-domain token volume: domain-only CPT scores 55.7, statistically indistinguishable from no CPT (56.2).
- Internalization is mechanism-level: CPT injects policy-aligned signal strength (Logit Lens, Gray 0.66 vs 0.40) while SFT supplies output routing; CPT-only emits 100% non-classification first tokens.
- Deployed at second-level, verdict-only latency, SIRF recovers +20% of the tree model's false positives as an adjudication layer and transfers to the freezing domain with ~70% relative mis-penalization reduction, A/B-validated.
Strengths
Clean single-factor attribution design
All three 8B arms start from the identical Qwen3-VL-8B-Instruct checkpoint (vision tower frozen), share the same 40,989-sample SFT set (3 epochs) and verdict-only output form; only the CPT stage differs (§3.2, Table 1). The paired bootstrap (+15.1pp, 95% CI [+11.7, +18.5], positive in 1000/1000 resamples) matches this design.
Component ablation isolates policy content
§4.3 / Table 6: domain-only CPT scores 55.7 vs 56.2 with no CPT — in-domain tokens alone buy nothing — while policy-carrying arms reach 64.6 (EntiGraph+MAGA), 69.5 (CoT only), 70.6 (w/o CoT), 71.3 (full). Authors explicitly refuse to over-read within-step-noise differences.
Unusually candid negative reporting
Mechanism and production triangulation
Weaknesses
Headline gain is distribution- and cutoff-specific
Thresholds fitted on the evaluation set itself
Circular ground truth
Missing guard-model baselines; interface-limited comparison
Zero released artifacts; thin transfer evidence
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
SIRF (EMNLP 2026 Industry Track; Xiaohongshu) targets account-level three-way risk classification (Black/Gray/White, 20+ fine subclasses) under four production constraints: high precision, second-level latency, verdict-only output, and a re-thresholdable confidence score. The central claim is architectural: rather than injecting ~hundred policies at inference (RAG/long context) or training a pure classifier, internalize the stable rule layer into the weights via policy-grounded continued pretraining (CPT) on ~70M fully synthetic tokens — EntiGraph entity-relation expansion, MAGA 5-genre × 4-audience rewriting, and account-level CoT distillation (SEADA, teacher Qwen3.5-397B-A17B, LLM-judge quality gate). Headline: 71.3 Black Recall@P95 vs 56.2 for an identical-SFT baseline (+15.1pp, 95% CI [+11.7, +18.5]), plus deployment as a tree-model adjudication layer and a freezing-domain transfer.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 5 weaknesses, analyzed in detail
- 6 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is SIRF and who built it?
SIRF (Spec-Internalized Risk Foundation Model) is a content-risk-control model from Xiaohongshu, presented at the EMNLP 2026 Industry Track. It internalizes roughly a hundred platform risk policies into an 8B model's weights via continued pretraining on ~70M synthetic tokens (EntiGraph expansion, MAGA rewriting, account-level chain-of-thought distillation), then answers with a verdict-only label plus a confidence score, enabling second-level, high-precision account risk decisions without retrieving policies at inference time.
What does Black Recall@P95 mean and why does it matter?
It is the fraction of truly risky (Black) accounts that the model catches when the threshold is set so that precision on the risky class is at least 95%. It answers the operational question: how much risk can be auto-handled while wrongly penalizing almost no one. SIRF-8B reaches 71.3% on a 1000-sample production-distribution set, versus 56.2% for an identically fine-tuned baseline without the policy-internalizing pretraining stage.
Why are Claude, Doubao and GLM excluded from the model comparisons?
Their APIs do not return token logprobs, so the first-token confidence score the paper uses for thresholding and Recall@P cannot be computed for them. The authors state this is an interface limitation, not a capability judgment, and rest their core attribution claim on the controlled same-source 8B comparison instead of the cross-model table.
Does the 70M-token continued pretraining hurt the model's general abilities?
Mostly no. Across 10 public benchmarks (MMLU, MMLU-Pro, GSM8K, C-Eval, CMMLU, AGIEval-CN, HellaSwag, WinoGrande, ARC-Challenge, TriviaQA) at 8B/14B/32B, scores are nearly flat — the largest change at 8B is MMLU-Pro dropping 3.6 points. The authors do concede that text-only continued pretraining weakens instruction-following, which they deem tolerable because deployment emits only a verdict label.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures appear only as captions in the extraction; trends cited from figure-referenced content (e.g., the Figure 3 P-sweep dominance and Figure 4 radar overlap) could not be visually verified, though the same quantities are given numerically in Tables 1-6 and the text.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.