Social media platforms are deploying machine learning based offensive language classification systems to combat hateful, racist, and other forms of offensive speech at scale. However, despite their real-world deployment, we do not yet comprehensively understand the extent to which offensive language classifiers are robust against adversarial attacks. Prior work in this space is limited to studying robustness of offensive language classifiers against primitive attacks such as misspellings and extraneous spaces. To address this gap, we systematically analyze the robustness of state-of-the-art offensive language classifiers against more crafty adversarial attacks that leverage greedy-and attention-based word selection and context-aware embeddings for word replacement. Our results on multiple datasets show that these crafty adversarial attacks can degrade the accuracy of offensive language classifiers by more than 50% while also being able to preserve the readability and meaning of the modified text. Online social media platforms are dealing with an unprecedented scale of offensive (e.g., hateful, threatening, profane, racist, and xenophobic) language (Twitter; Facebook; Reddit). Given the scale of the problem, online social media platforms now increasingly rely on machine learning based systems to proactively and automatically detect offensive language (Rosen, 2020; Gadde and Derella, 2020; Kastrenakes, 2019; Hutchinson, 2020). The research community is actively working to improve the quality of offensive language classification (Zampieri et al., 2020, 2019b; Liu et al., 2019; Nikolov and Radivchev, 2019; Mahata et al., 2019; Arango et al., 2020; Agrawal and Awekar, 2018;  This paper examines offensive language as a case study. The reader is cautioned that the paper contains unavoidable strong language given the nature of the research.  Our code and data are available at: https://github.com/JonRusert/RobustnessOfOffensiveClassifiers Fortuna and Nunes, 2018). A variety of offensive language classifiers ranging from traditional shallow models (SVM, Random Forest), deep learning models (CNN, LSTM, GRU), to transformer-based models (BERT, GPT-2) have been proposed in prior literature (Liu et al., 2019; Nikolov and Radivchev, 2019; Mahata et al., 2019). Amongst these approaches, BERT-based transformer models have achieved state-of-the-art performance while ensembles of deep learning models also generally perform well (Zampieri et al., 2019b, 2020). It remains unclear whether the state-of-the-art offensive language classifiers are robust to adversarial attacks. While adversarial attacks are of broad interest in the ML/NLP community (Hsieh et al., 2019; Behjati et al., 2019), they are of particular interest for offensive language classification because malicious users can make subtle perturbations such that the offensive text is still intelligible to humans but evades detection by machine learning classifiers. Prior work on the robustness of text classification is limited to analyzing the impact on classifiers of primitive adversarial changes such as deliberate misspellings (Li et al., 2019), adding extraneous spaces (Grndahl et al., 2018), or changing words with their synonyms (Jin et al., 2020; Ren et al., 2019; Li et al., 2020). However, the primitive attacks can be easily defended against a spell checker can fix misspellings and a word segmenter can correctly identify word boundaries even with extra spaces (Rojas-Galeano, 2017; Li et al., 2019). Additionally, a normal synonym substitution will not theoretically hold for offensive language as less offensive language will be substituted and thus meaning will be lost. Crucially, we do not know how effective these text classifiers are against crafty adversarial attacks employing more advanced strategies for text modifications. To address this gap, we analyze the robustness of offensive language classifiers against an adversary who uses a novel word embedding to identify 7424 word replacements and a surrogate offense classifier in a black-box setting to guide modifications. This embedding is purpose-built to evade offensive language classifiers by leveraging an evasion collection that comprises of evasive offensive text gathered from online social media. Using this embedding, the adversary modifies the offensive text while also being able to preserve text readability and semantics. We present a comprehensive evaluation of the state-of-the-art BERT and CNN/LSTM based offensive language classifiers, as well as an offensive lexicon and Google's Perspective API, on two datasets. We summarize our key contributions below. We systematically study the ability of an adversary who uses a novel, crafty strategy to attack and bypass offensive language classifiers. The adversary first builds a new embedding from a special evasion collection, then uses it alongside a surrogate offensive language classifier deployed in black-box mode to launch the attack. We explore variations of our adversarial strategy. These include greedy versus attention based selection of text words to replace. These also include two different versions of embeddings for word substitutions. We evaluate robustness of state-of-the-art offensive language classifiers, as well as a real-world offensive language classification system on two datasets from Twitter and Reddit. Our results show that 50% of our attacks cause an accuracy drop of  24% and 69% of attacks cause drops  20% against classifiers across datasets. Ethics Statement: We acknowledge that our research demonstrating attacks against offensive language classifiers could be used by bad agents. Our goal is to highlight the vulnerability within offensive language classifiers. We hope our work will inspire further research to improve their robustness against the presented and similar attacks. The adversary's goal is to modify his/her offensive post in such a manner as to evade detection by offensive language classifiers while simultaneously preserving semantics and readability for humans. To make suitable modifications, the adversary is assumed to have black-box access to a surrogate offensive language classifier that is different from the one used by the online social media platform. The adversary leverages feedback from this surrogate classifier to guide modifications using a novel approach that we propose. Our goal is to evaluate the extent to which the adversary can evade detection by an unknown offensive language classifier under this threat model. We evaluate the following offensive language classifiers under our threat model. 1. NULI (Liu et al., 2019) is a BERT (Devlin et al., 2019) based system trained on offensive language. During preprocessing, emojis are converted into English phrases 1 and hash-tags are segmented 2 . This was the top-ranked system in OffensEval (Zampieri et al., 2019b). 2. Vradivchev (Nikolov and Radivchev, 2019) is also a BERT based system trained on offensive language data. The preprocessing step includes removing symbols @" and #", tok-enization and lowercasing, splitting hashtags, and removing stopwords. This was the second best system in OffensEval. 3. MIDAS (Mahata et al., 2019) is a voting ensemble of three deep learning systems: a CNN, a BLSTM, and a BLSTM fed into a Bidirectional Gated Recurrent Unit (BGRU). This was the top non-BERT system in OffensEval 3 . 4. Offensive Lexicon (Wiegand et al., 2018) is a simple method that classifies a post as offensive if at least one word is in a lexicon of offensive words. We use their lexicon. 5. Perspective API (Perspective) by Google (Jigsaw) provides a toxicity model that classifies whether a post is rude, disrespectful, or unreasonable. The production model uses a CNN trained with fine-tuned GloVe word embeddings and provides toxicity probability. We use 0.5 threshold to classify a post as offensive as in Pavlopoulos et al. (2019). This section describes our adversarial attack method as well as a recent visual adversarial attack (Eger et al., 2019) and a simpler attack (Grndahl et al., 2018) for baseline comparison. The adversary's attack involves selecting words to replace in the input text and deciding on suitable replacements. Selection. There are several ways to approach word selection for replacement. Here we explore a greedy approach (Hsieh et al., 2019) and an approach using attention weights (Xu et al., 2018). For the greedy approach, we first remove each word one at a time (retaining the rest in the text) and get the drop in classification probability for the text from the surrogate offensive classifier. Words are removed until the offensive label is flipped (ac-cording to the classifier). The removed words make up the full list of possible replacements. The adversary then selects the word that causes the largest drop for replacement. If replacing this word is insufficient to bypass the surrogate classifier then the word with the next largest drop is also selected for replacement and so on. For the attention approach, we leverage a BLSTM with attention which is trained on the target classification task. Note that this BLSTM is different from the one found in MIDAS. To select words, we give the input text to the BLSTM and examine the attention weights estimated during classification. The adversary selects the word with the highest attention weight. If replacing this word is insufficient to bypass the surrogate classifier then the word with the next largest attention weight is also selected for replacement and so on. The attention approach can potentially find replacements that greedy approach may not. Specifically, the greedy approach may miss instances where the combination of words cause offense rather than single words. Replacement. Figure 1 depicts our framework for substituting the selected word with another word. First, a candidate list of 20 most similar words (closest vectors) is obtained from an embedding space. Next, we replace the selected word with its most similar word and check the modified text against the surrogate classifier. If the modified text is declared not offensive, then this word is chosen Selected Word Embedding Top-20 most similar words Replace word with most similar word OffenseClassifier offensive Not offensive Select next word Yes No Replace with least offensive Words remain? as the replacement. Otherwise, the process continues with the next most similar word. If the candidate list is exhausted without misclassification by the surrogate classifier, we choose the replacement word which causes the largest drop in classification probability. Embeddings. The key idea here is to design a context-aware word embedding for crafty replacements. To this end, we first build a text collection of 13 million deleted tweets through retrospective analysis using the Twitter API (Thomas et al., 2011; Le et al., 2019). Next we filter out the tweets from this set that are labeled as offensive by any of the offensive language classifiers in Section 2.2. 4 The remaining set of 8.5 million deleted tweets contains offensive tweets that were likely flagged by users or human moderators. 5 We expect this set of deleted tweets to contain crafty substitutions and expressions that are likely to evade detection by state-of-the-art offensive language classifiers. We refer to this set of deleted tweets as the evasion collection and this is the data that the adversary uses to train word embeddings. We explore the following embeddings: These are pretrained GloVe embeddings on 2 billion tweets. The vocabulary size of this model is 1,193,514 tokens. This represents a baseline off-the-shelf word embedding. 2. GloVe embedding fine-tuned with evasion collection ( F T ): We use the evasion collection to fine-tune the pretrained GloVe embeddings. Fine tuning is done over 10 epochs. The resulting vocabulary size is 1,312,106 tokens. Figure 2 illustrates this approach. Insights into the embeddings. Our intuition of crafty substitutions being present in the evasion collection is backed up by examination of the embeddings. Using a set of offensive words as probes we find that on average the position of the first evasive word amongst the 20 most similar words in P re is 11, while for F T this number is 3, implying that F T is more likely to offer an evasive replacement. We expand on these insights and analysis in Section 6. Furthermore, as fine-tuning the embeddings may introduce garbage words (non english, often meaningless words) as replacements, we add in a filter to the candidates when using the FT embeddings. This filter only allows candidates which have been used in tweets by 3 distinct authors in the evasion dataset. Finally, as checking every candidate can be time consuming and inefficient, we apply this filter only when we substitute text words that were not in the original Pre embeddings. VIPER. We implement a recent visual adversarial attack called VIPER (Eger et al., 2019) that aims to generate adversarial text for any classification task. VIPER (VIsual PERturber) replaces characters in the text with visually nearest neighbors determined from a visual embedding space. Each character present in the text is selected for replacement with a fixed probability p . VIPER strategically chooses replacements from non standard unicode characters assuming that systems rarely train outside the standard unicode space. As the main comparison, we choose their description-based character embedding space (DCES) in our experiments since it had the best tradeoff between attack success and readability. DCES represents characters by their unicode textual descriptions. The nearest neighbor substitute is the character whose description refers to the same letter in the same case. We also compare with their simpler, easy character embedding space (ECES), which contains only nearest neighbor for character replacement. We used VIPER with p = 0.1 and 0.4, the first for better readability and the second for better likelihood of attack success. Note that higher p values correspond to more changes in the text. Grondahl. Grndahl et al. (2018) explored rather simple attack methods such as modifying whitespace and misdirection by adding a misleading word. We implement several of their adversarial attacks. These are: adding a space after every character, removing all spaces between characters, adding the word love' to the input text, and finally removing all spaces then adding love.' This last attack strategy outperformed others in their evaluation. Offensive Language Identification Dataset (OLID). OLID was used in SemEval-6 2019: OffensEval, a shared task on classifying offensive language (Zampieri et al., 2019a). This collection is annotated by experienced annotators to ensure high quality. OLID contains 14,100 English tweets (text only): split into 13,240 (4,400 offensive, 8,840 nonoffensive) training tweets and 860 (240 offensive, 620 non-offensive) test tweets. Semi-Supervised Offensive Language Identification Dataset (SOLID) . SOLID is an expansion of OLID used in SemEval 2020: OffensEval, which continued the task of classifying offensive language (Rosenthal et al., 2020). SOLID was constructed from tweets via semi-supervised manner using democratic co-training with OLID as a seed dataset. SOLID contains 9,000,000 tweets as an expansion for training, and 5,993 test tweets, (3,002 offensive, 2,991 non-offensive). = Accuracy Original  Accuracy Modified , where Accuracy Original is the classifier's accuracy on original text and Accuracy Modified is the classifier's accuracy on the modified text. Larger drops imply better evasion of offensive language classifiers by the adversary. Readability and semantic preservation: We measure readability of the modified text and its semantic preservation through manual evaluation. More specifically, for readability, human reviewers are 7427 asked to examine the modified text and rate it as one of: {The text is easy to read', The text can be read with some difficulty', The text is hard to read'}. For semantic preservation, reviewers are given the original texts alongside the modified versions and are asked whether text B' (modified text) conveys the same meaning as text A' (orig-inal text). The choices are {Yes, Text B conveys the same meaning as Text A', Text B conveys partially the meaning of Text A', No, Text B does not convey the same meaning as Text A'}. We use the OLID and SOLID test sets to assess the success of our attack strategies. Amongst the several offensive language classifiers considered in this work (see Section 2.2), we make one classifier available to the adversary as a surrogate black-box classifier to guide adversarial modification of each test tweet. Note that we do not use Lexicon as an internal classifier as it does not provide useful feedback (only returning 0 or 1 for positive class probabilities). We then evaluate the drop in classification accuracy (  ) for each of the remaining classifiers. In this section, we first present the results of our proposed adversarial attack approach and then those of existing approaches from prior literature on the OLID dataset. Evaluation was also performed on the SOLID dataset and the results followed a similar trend. Full results for all attacks are located in the appendix. Table 1 presents the results on the OLID dataset. Rows specify the attack strategy. The first column identifies the surrogate offensive language classifier used by the adversary to guide modifications. The remaining columns specify the offensive language classifier whose robustness is being evaluated. Cell values are drops in accuracy after adversarial modification. Accuracy here refers to the percentage of offensive tweets correctly predicted as offensive. Classification accuracy for original text is given in the first row of the table. So for example, the final accuracy for NULI where the adversary uses GS-Pre and MIDAS is 44 (61-17). Blocks of rows labeled with prefix GS stand for results with greedy word selection strategy while AS stand for results with BLSTM-attention based word selection. Note that diagonal entries, where the surrogate classifier is the same as the one being tested for robustness are ignored because the adversary is expected to be quite successful under this condition. We indeed find that the accuracy drops close to 0% in these cases. Additionally, for the Lexicon based method, we find it does not perform as well as the other classifiers, thereby excluding it from the state-of-the-art (SOTA) category. Offensive language classifiers are susceptible to our adversarial attacks. Table 1 shows that our adversarial attacks are quite successful against crafty offensive language classifiers. For OLID, classifiers see a drop of accuracy in the range of 1146 6 . In fact, 50% of attacks cause a drop of  24 and 69% of attacks cause a drop of  20. This shows the vulnerability of offensive language classifiers and their vulnerability under our threat model. Greedy select (GS) outperforms Attention select (AS) attacks. Greedy Select achieves higher average drops in accuracy across classifiers. For example, GS -F T achieves an average drop of 26 against NULI while AS -F T achieves only a drop of 17. This holds true for both replacement embeddings. Although lower, AS still achieves strong drops against vradivchev (average of 35). This indicates the strength of a greedy approach, however, attention selection may be more viable in a setting where the number of queries is limited. FT embeddings and Pre embeddings see success against different systems. Comparing to P re embeddings, F T we see different leads in dropped accuracy depending on the classifier. F T see great success against NULI and vradivchev, while P re see success against the other three. This indicates that the evasion collection can help add power, especially against popular (BERT-based) classifiers. are the most and least robust to attacks. Focusing on the GS -F T embedding, NULI has a mean drop in accuracy of 26 (range: 18 39), the lowest across SOTA offensive language classifiers. In contrast, vradivchev, performs the best with accuracy of 69 but is also the most vulnerable to our attack model with a mean drop in accuracy of 37 6 Note: The BLSTM attention classifier used for attention based word selection could also be used as an internal classifier. However, since this strategy did not perform as well as SOTA classifiers so we do not include these results in the main analysis. (range: 29 46), the highest drop of any offensive language classifier. This mean is 27 for Perspective and 29 for MIDAS. The stark difference between the two BERT systems' robustness most likely stems from the preprocessing step. BERT is a context-aware system. While NULI's preprocessing helps add context (e.g. converting emojis to text), vradivchev's hinders it. Specifically, vradivchev removes stop words. This could be a problem as removing this additional information causes the system to miss out on context during training. Then, as the attack is more likely to focus on changing non-stop words, vradivchev then loses both contextual information (via stop word removal) as well as offense indicating tokens (the main information it focused on during training). for the adversary while MIDAS the least effective. Again, focusing on GS-F T , NULI helps the adversary as the surrogate classifier the most by causing an average accuracy drop of 32 (range: 19 46), compared to vradivchev (avg: 28, range: 18 39), Perspective (avg: 25, range: 13 37), and MIDAS (avg: 21, range: 13 29). This again emphasizes BERT based methods' ability to understand context and use it effectively in attacks, also seen in previous research (Li et al., 2020). Grondahl. Table 2 shows the results when methods proposed by Grndahl et al. (2018) are used to obfuscate. Note that this approach does not use a surrogate classifier. The simpler whitespace and love' word based attacks proposed by Grndahl et al. (2018) have little to no effect on offensive language classifiers which contain a word segmentation pre-processing step. These classifiers include NULI (average drop: -3), vradivchev (average drop: 11), and Lexicon (average drop:0). MIDAS being ill equipped in this regard sees a drop of 64 when all spaces are removed and love' is added to the text. However, when we add a simple word segmentation step during pre-processing the attack loses effectiveness. For example, the Remove space, Add love' attack is reduced to a drop of 33 with this shielding pre-processing step, compared to 64 without it. Similarly, Perspective also sees drops up to 38 in these settings. VIPER. Like a whitespace attack, VIPER attacks can be easily prevented using a trivial text preprocessing step. To demonstrate this, we added 7429 a pre-processing shielding' step to each system which replaces any non-standard characters with standard ones. The results for shielded VIPER attacks are found in Table 2 (Note: The full results for non-shielding against VIPER are found in the appendix.). This is in essence logically the reverse of VIPER's obfuscation by character translation process. Non-standard characters are those which exist outside a-zA-Z', numbers, and punctuation. To do this, as do the VIPER authors, we leverage the NamesList from the unicode database 7 . For any non-standard character, the description is searched for in the NamesList and the character which appears after LETTER in the description is used for substitution. For example, '  a 'is described as LATIN SMALL LETTER A WITH INVERTED BREVE, and hence would be replaced with a'. This simple pre-processing step reduces VIPER's average attack rate from 37 to 7 as shown in the VIPER results. In contrast, our proposed attack is not preventable through such simple preprocessing. The attack results against SOLID are found in Table 3. We see similar attack success as seen in OLID, finding even greater drops. Specifically, 75% of attacks cause a drop of  40 and 100% attacks cause a drop of at least 33. F T embeddings maintain a majority of the meaning and readability. We test readability of a sample of 50 tweets from the SOLID dataset, of which all were modified by F T . We asked three crowdworkers to assess the 50 tweets for readability. For comparison, we asked additional crowdworkers to assess the readability of the original texts. This helps explore the true drop in readability of a text. Additionally, we showed three other crowdworkers the original text as well and asked them to assess if the obfuscated texted conveyed the same meaning as the original (see Section 4.2 for details). We finally combined the crowdworkers votes by taking a majority vote for each example. Table 4 presents the results. We find that F T scored slightly less in terms of readability than the original texts, but finds replacements with similar meaning. Specifically, readability drops from 74% 7 https://www.unicode.org/Public/UCD/ latest/ucd/NamesList.txt to 70% for fully readable, but nearly two thirds retain the same meaning and 96% retain at least partial meaning. These numbers help indicate the strength of the attack, even when leveraging a crafty collection of word substitutions. To provide insights into texts which retained full meaning versus partial, Table 5 shows a few examples of tweets in their respective categories as voted by crowdworkers. F T is able to find many appropriate, non traditional replacements. For example, shit is replaced with shxt, in several instances which helps maintain meaning while evading classification. As another example, phis-ing a mispelling of phishing is substituted for fake. In context, this substitution makes sense. Note that while some examples are misspellings, these crafty modifications are ones that are mined from our large evasion text collection and not algorithmically-generated mispellings. However, some errors are found after replacement. For example, in the Not Similar instance F T replaces fuck with bruh, and shut with walked. These errors demonstrate room for improvement when selecting a candidate. As discussed in Section 3.1, the adversary's strategy is to make crafty word replacements using a new embedding generated from an evasion collection (here made of deleted tweets not detected by an offense classifier). Results show that these embeddings successfully support the adversary at evading offensive language classifiers while maintaining readability and semantics. For further insights, we compare the off-the-shelf pretrained ( P re ) embedding with the embedding fine-tuned on the evasion collection ( F T ). We examine the embeddings using the 59 words as probes which are both in the offensive Lexicon (Wiegand et al., 2018) and in the OLID test. For each word we get the 20 most similar words from P re and from F T for comparison. words closer to offensive probe words. We calculate the average position of the first evasive word 8 amongst the 20 most similar words. P re has an average distance of 11, while F T has an average distance of 3. Thus, on average, F T is more likely to find evasive replacements. For example, in P re dispicable appears as the 3rd most similar word to despicable , but it is the most similar in F T . Since 8 Evasion is determined by Perspective API. F T could contain some unintelligible words, we repeat the experiment to filter out substitute words used by less than 3 different users. The same overall trend still holds. Updated embeddings learn creative replacements. We manually compare the entries in the two lists ( F T and P re ) of substitute words for each probe word. F T learns creative replacements absent in P re . Examples include the word azz being the most similar word to ass in F T , but being absent within the most similar word list for P re . Similarly, niggah appears as a replacement for bitch in F T , but not in P re . These examples, along with the previous distance analysis, illustrate the craftiness in our evasion dataset. We first review related work on robustness of text classification in general and then closely related research on evading offensive language classifiers. Evading Text Classifiers. Prior work has explored ways to evade text classification in general. Li et al. (2019) showed that character-level perturbations such as misspellings and word-level perturbations using off-the-shelf GloVe embeddings can evade text classifiers. Deri and Knight (2015) proposed an approach to create portmanteaus, which could be extended to adversarial texts. Behjati et al. (2019) added a sequence of words to any input to evade text classifiers. Zhao et al. (2018) proposed a GAN to generate adversarial attacks on text classification tasks. (Li et al., 2020) leverage BERT to propose solutions for replacement words, (Jin et al., 2020) leverage word embeddings, and (Ren et al., 2019) leverage WordNet. In contrast to prior work evading text classifiers, our work includes approaches to leverage embeddings built from a special evasion text collection. Robustness of Text Classifiers. Our work is also relevant to prior studies of the robustness of text classifiers to adversarial inputs. Rojas-Galeano (2017) showed that primitive adversarial attacks (e.g., misspellings) can be detected and countered using edit distance. Hsieh et al. (2019) evaluated the robustness of self-attentive models in tasks of sentiment analysis, machine translation, and textual entailment. We examine robustness of similar models, however, we fine tune our embeddings to be task specific, while they do not, and we also test on the state-of-the-art offensive language classifiers. Evading Offensive Language Classifiers. Grndahl et al. (2018) examined robustness of hate speech classifiers against adding typos, whitespace, and non-hate words to text. As discussed earlier, prior work has shown that such primitive perturbations can be detected and reversed (Li et al., 2019; Rojas-Galeano, 2017). In contrast, we focus on more crafty text perturbations in our work. Ji and Knight (2018) surveyed the ways text has been encoded by humans to avoid censorship and explain challenges which automated systems would have to overcome. This work does not propose an automated approach for text perturbation. Eger et al. (2019) proposed VIPER for visual adversarial attacks. We implemented VIPER and (Grndahl et al., 2018) as baseline attacks and showed that our approach is more successful overall. Overall, our work advances the research in this space by investigating robustness of offensive language classifiers against crafty adversarial attacks. In this paper, we showed that state-of-the-art offensive language classifiers are vulnerable to crafty adversarial attacks. Our proposed adversarial attacks that leverage greedy and attention-based word selection and context-aware embeddings for word replacement were able to evade offensive language classifiers while preserving readability and semantics much better than prior simpler adversarial attacks. We report accuracy drops of up to 46 points or 67% against state-of-the-art offensive language classifiers. Furthermore, unlike VIPER and simpler attacks, our proposed attack cannot be easily prevented using pre-processing strategies. The user study showed that our adversarial attack was able to maintain similar readability with only a slight drop in semantic preservation. Our work also suggests ways to improve the robustness of offensive language classifiers through adversarial training (Kurakin et al., 2017; Madry et al., 2018; Tramr et al., 2018). More specifically, our attack relies on the evasion collection, which contains crafty adversarial examples that evade detection by offensive language classifiers but are flagged based on manual feedback by users or human moderators. Thus, offensive language classifiers can be adversarially trained on the latest evasion collection from time to time to improve their robustness to the ever evolving adversarial attacks. In this context it is noteworthy that continuous availability of large-scale manual feedback is quite unique to the problem of offensive language classification, where popular online social media platforms employ thousands of human moderators (Barrett, 2020).
abstain abstain abstain method result abstain abstain other abstain abstain abstain abstain abstain abstain abstain method objective abstain abstain method objective objective abstain objective abstain abstain method result objective objective result abstain abstain abstain abstain method abstain abstain abstain abstain abstain abstain abstain abstain abstain method abstain abstain method method abstain abstain abstain method method abstain abstain abstain abstain method abstain method abstain abstain abstain abstain abstain method abstain method abstain abstain abstain method abstain abstain method method abstain method method method abstain abstain abstain method abstain abstain abstain abstain method method method method abstain method abstain method abstain abstain abstain method abstain abstain method method abstain abstain abstain method abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain method abstain abstain abstain abstain result abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain result result abstain result abstain abstain result abstain abstain abstain abstain abstain abstain abstain result abstain abstain abstain abstain abstain result abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain result abstain abstain abstain abstain abstain abstain result abstain abstain result other abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain abstain method method abstain abstain abstain abstain abstain abstain abstain method abstain abstain method abstain abstain abstain abstain objective other other other other other other other objective other abstain other other abstain other other other objective other objective other abstain objective result objective abstain objective result result abstain abstain abstain