Deja Vu in Plots: Leveraging Cross-Session Evidence with Retrieval-Augmented LLMs for Live Streaming Risk Assessment

TL;DR

This paper introduces CS-VAR, a retrieval-augmented model that leverages cross-session evidence and LLM guidance to improve real-time risk detection in live streaming, addressing challenges of recurring malicious behaviors.

Contribution

We propose a novel retrieval-augmented risk detector that transfers insights from large language models to small, efficient session-level models for live streaming safety.

Findings

Achieves state-of-the-art performance on large-scale datasets.

Effectively detects recurring malicious behaviors across streams.

Provides interpretable signals for moderation.

Abstract

The rise of live streaming has transformed online interaction, enabling massive real-time engagement but also exposing platforms to complex risks such as scams and coordinated malicious behaviors. Detecting these risks is challenging because harmful actions often accumulate gradually and recur across seemingly unrelated streams. To address this, we propose CS-VAR (Cross-Session Evidence-Aware Retrieval-Augmented Detector) for live streaming risk assessment. In CS-VAR, a lightweight, domain-specific model performs fast session-level risk inference, guided during training by a Large Language Model (LLM) that reasons over retrieved cross-session behavioral evidence and transfers its local-to-global insights to the small model. This design enables the small model to recognize recurring patterns across streams, perform structured risk assessment, and maintain efficiency for real-time deployment. Extensive offline experiments on large-scale industrial datasets, combined with online validation, demonstrate the state-of-the-art performance of CS-VAR. Furthermore, CS-VAR provides interpretable, localized signals that effectively empower real-world moderation for live streaming.