HarmTrace: Anchor-Calibrated Decoupled Optimization for Fine-Grained Target Identification in Harmful Memes

AI summary

Overview

Research area: multimodal harmful meme detection, specifically fine-grained target identification in image–text memes, using multimodal large language models (MLLMs) and reinforcement-learning post-training.

Technical level: Advanced. The paper assumes familiarity with supervised fine-tuning, LoRA, GRPO-style policy optimization, advantage normalization, and structured-output evaluation.

One-sentence scope: The paper defines a task that predicts not only whether a meme is harmful but also what kind of target is attacked, which entity is targeted, and which text span and image region provide the evidence, and it introduces a dataset, a strict joint metric, and an optimization framework to improve that joint prediction.

What This Paper Is About

Most harmful meme systems only output a binary harmfulness label. That label can be correct while the model still gets the attacked target wrong, which makes the decision hard to review or contest. The authors extend the task so a model must additionally identify the target category, the target entity, the textual mention, and the visual region for harmful memes, and they build the data, metric, and training method needed to make that extension measurable.

Key Contributions

1. A new task formulation and dataset (Meme3W). The paper extends harmful meme detection with fine-grained target identification and constructs Meme3W, which unifies samples from PrideMM, MAMI, Hateful Memes, and Harm-C under one schema with human-verified annotations. It contains 10,662 samples, including 4,418 harmful samples, split into training (85%), validation (5%), and test (10%).

2. A strict record-level metric (Joint Record Accuracy, JRA). JRA counts a prediction as correct only when the harmfulness label and every target-identification field are jointly correct, with field thresholds of (1, 0.7, 0.7, 0.5) for category, entity, textual mention, and visual region respectively.

3. The HarmTrace framework. HarmTrace combines Entity-aware Supervised Fine-Tuning (E-SFT), which upweights target-entity tokens, with Conditional Target-identification Policy Optimization (CTPO), which normalizes harmfulness and target-identification advantages separately and restricts target-identification updates to label-correct harmful responses.

4. The Virtual Positive Anchor (VPA). A virtual fully correct reward (r_max = 1) is added to the target-identification normalization statistics so that all-incomplete rollout groups do not receive either inflated or vanished advantages.

Main Findings

• A large gap between harmfulness accuracy and joint correctness. Across the evaluated MLLMs, harmfulness accuracy consistently exceeds JRA. The best JRA among general-purpose MLLMs is 47.95% (Gemini3-Flash, with 74.88 label accuracy), while smaller MLLMs generally remain below 25%.

• Scaling alone does not close the gap. The paper reports no consistent advantage for larger models on JRA; for example, Qwen3-VL-235B-A22B reaches 76.01 label accuracy but 21.46 JRA.

• HarmTrace substantially raises JRA on both evaluated backbones. JRA rises from 17.58% to 52.51% on Qwen3-VL-8B and from 6.62% to 49.09% on InternVL3-8B, which the authors describe as absolute improvements of 34.93 and 42.47 points.

• Gains do not come at the cost of harmfulness detection. HarmTrace (Qwen3-VL-8B) reaches 80.15 label accuracy and 76.77 F1; HarmTrace (InternVL3-8B) reaches 80.06 and 76.02. On Qwen3-VL-8B, all evaluated target-identification fields also improve over the base model (category EM 72.60, entity F1_rel 68.72, text mention EM 60.73 and F1 64.93, IoU50 66.67, IoU75 62.56).

• E-SFT beats standard SFT across tested entity-token weights. Standard SFT lifts JRA from 17.58% to 43.15%; E-SFT gives 44.75 at λ_ent = 5, 45.89 at λ_ent = 10, and 44.98 at λ_ent = 15, with λ_ent = 10 described as the most balanced.

• Decoupled optimization and VPA each add gains, and do so under every starting point. Under E-SFT initialization, decoupled optimization raises JRA from 49.09% to 50.91%, and adding VPA raises it further to 52.51%. Starting from plain SFT, the sequence is 45.21 → 47.26 → 49.54; starting from the base model without SFT it is 18.72 → 20.32 → 22.37.

• HarmTrace outperforms generic RL methods under the same E-SFT initialization on Qwen3-VL-8B. JRA: PPO 46.80, GRPO 49.09, DAPO 47.03, PAPO 48.40, HarmTrace 52.51. HarmTrace also reports the highest scores on all reported harmfulness and target-identification fields.

• VPA changes credit assignment in the intended direction. The paper reports that VPA reduces zero-advantage incomplete groups and lowers the positive advantage of the best incomplete responses.

Methodology in Plain English

The authors first build the data. They take four existing meme datasets and re-annotate selected samples under one shared schema. Unclear or unrecognizable images are removed, exact duplicates are dropped, and near-duplicate groups are kept in the same split. Each meme gets a harmfulness label; harmful memes also get a target category (one of group background, religion and caste, gender, or health condition), a target entity, and—only when the evidence exists—an exact textual mention and bounding boxes for the target region. Non-harmful memes have no attacked target, so their target fields are set to null and the visual-region field to an empty list.

Annotations come from a three-stage pipeline. Three MLLMs (Gemini-3-Flash, GPT-5.2, Qwen3.5-397B) each propose a candidate annotation. Five trained graduate annotators then review each sample independently in pairs, using the model outputs only as editable references. Disagreements go to a third annotator for discussion and resolution. Field-level agreement before adjudication is Cohen's κ = 0.908 for target category, normalized agreement 0.813 for target entity, token-F1 0.824 for textual mention, and IoU@0.75 0.818 for visual regions. A candidate-blind audit of 200 cases, where annotators saw only the raw sample and the guidelines, produced an unweighted mean of 0.827 against the final gold annotations.

For the model side, HarmTrace uses an "explain-then-answer" output: a reasoning field followed by the five structured fields. Training happens in two phases. First, cold-start supervised fine-tuning uses Gemini-3-Flash trajectories that survived a filter checking format and agreement with the gold annotation. This is where E-SFT differs from ordinary SFT—both use the same trajectories, but E-SFT gives extra weight to the tokens of the target-entity value, because that entity is short yet acts as the link between the category and the multimodal evidence.

Second, reinforcement learning uses group-based sampling. Each meme gets a group of responses; malformed responses get zero reward. One reward measures whether the harmfulness label is correct. A second reward, computed only for label-correct harmful responses, measures how well the target-identification fields match, and it penalizes both missing required grounding and hallucinated grounding where none applies. Instead of merging these into one score, the method normalizes them into two separate advantages—label advantage over the whole group, target-identification advantage over only the label-correct harmful subset—and adds them. A virtual fully correct anchor is inserted into the target-identification normalization statistics to prevent the degenerate cases where the best partial answer looks excellent or where tied rewards wipe out all signal. The summed advantage is then used in a standard clipped GRPO-style objective with a KL term against the E-SFT policy as reference.

Training used 3 epochs on 2 × NVIDIA H200 GPUs with LoRA (rank = 64, α = 128) and a rollout group size of 8.

Why This Matters

Research impact. The paper argues that harmfulness classification accuracy is an insufficient measure of harmful meme understanding, and it supplies both a benchmark and a strict metric for that claim. It also shows that RL post-training techniques developed mainly for math, coding, and general reasoning can be adapted to a structured multimodal judgment task by decoupling credit assignment rather than merging it.

Real-world applications.

• Content moderation review queues, where moderators need to see not just a flag but the attacked target and the text and image evidence behind it.
• Regulatory transparency and appeal processes, since the paper notes the EU Digital Services Act (Chiarella 2022) expects moderation decisions to be reasoned and open to review and contestation.
• Advertiser and platform brand-safety tooling that needs to distinguish an attack on a protected group from attacks on criminals, terrorists, or criminal activity, which the paper classifies as non-harmful.
• Dataset auditing and annotation tooling, since Meme3W's schema and pipeline can be reused to check whether existing labels cover the actual attacked target.

Industry relevance. The method improves open-source 8B-class backbones to levels competitive with much larger and closed-source models on JRA (52.51 for HarmTrace on Qwen3-VL-8B versus 47.95 for the best general-purpose MLLM and 28.31 for GPT-5.2). That matters for platforms that cannot send every meme to a proprietary API, and the reported harmfulness accuracy gains (80.15 on Qwen3-VL-8B) suggest the approach is deployable alongside, not instead of, detection.

Future Directions

• Scaling to larger MLLMs. The paper states explicitly that future work will evaluate HarmTrace on larger MLLMs; the current experiments use Qwen3-VL-8B and InternVL3-8B as the two evaluated backbones.
• Multilingual and cross-cultural coverage. Meme3W's annotators were selected for strong English proficiency, and the dataset is built from English-language sources (PrideMM, MAMI, Hateful Memes, Harm-C). Extending the schema and pipeline to other languages is an open question, particularly given that several related resources cited in the paper are being extended in that direction.
• Broader taxonomies and long-tail targets. The current taxonomy has four target categories and a heavy skew toward group background in the pre-augmentation Hateful Memes subset (1,463 of 3,548, or 41.23%). Whether the method holds up under finer-grained or more balanced target taxonomies is untested here.
• How strict the joint metric should be. JRA uses fixed thresholds (τ_c = 1, τ_e = τ_s = 0.7, τ_B = 0.5). The paper does not report sensitivity of model rankings to those thresholds, which is a natural follow-up question for the field.

Target Audience

Researchers and graduate students working on multimodal content moderation, hateful meme detection, or structured multimodal generation; practitioners building moderation systems who need target-level and evidence-level output rather than binary flags; and researchers in RL post-training for MLLMs who are interested in how advantage normalization behaves when a task has a gate—here, harmfulness correctness—that must hold before a second reward is applied.

Authors’ abstract

Multimodal harmful meme detection is typically formulated as image--text harmfulness classification. A model may correctly predict harmfulness while misidentifying the attacked target or its supporting evidence. We therefore extend harmful meme detection with fine-grained target identification, asking what type of target is attacked, who is targeted, and where the target appears in the meme. The model predicts harmfulness for every meme and, for harmful memes, outputs the target category, target entity, textual mention, and visual region. To support this task, we introduce Meme3W, which unifies multiple public harmful meme datasets and provides human-verified annotations for harmful instances. We further introduce Joint Record Accuracy (JRA), a strict record-level metric requiring the harmfulness label and all target-identification fields to be jointly correct. Experiments with representative multimodal large language models reveal a substantial gap between harmfulness accuracy and JRA. To narrow this gap, we propose HarmTrace, an anchor-calibrated decoupled optimization framework. HarmTrace strengthens target-entity supervision through entity-aware supervised fine-tuning. It then applies Conditional Target-identification Policy Optimization (CTPO) to decouple harmfulness and target-identification advantages, restricting target-identification optimization to label-correct responses for harmful examples. CTPO uses a Virtual Positive Anchor (VPA) as a fully correct reference for target-identification advantage normalization. HarmTrace improves both JRA and harmfulness accuracy across the evaluated backbones, with JRA on the Qwen3-VL-8B backbone increasing from 17.58\% to 52.51\%. Our code is publicly available at https://github.com/llly1234/HarmTrace-for-Harmful-Memes.