Seeing the Unseen: Rethinking Illicit Promotion Detection with In-Context Learning

TL;DR

This paper explores using In-Context Learning (ICL) for detecting illicit online promotion, demonstrating its ability to generalize, discover new threats, and operate across platforms with minimal labeled data.

Contribution

It introduces ICL as a unified, efficient framework for illicit promotion detection, capable of generalizing to unseen threats and discovering new illicit categories without extensive retraining.

Findings

ICL achieves comparable performance to fine-tuned models with 22x fewer labeled examples.

ICL generalizes to new illicit categories with less than 6% performance drop.

Deployed on real-world data, ICL attains 92.6% accuracy and detects overlooked borderline content.

Abstract

Illicit online promotion is a persistent threat that evolves to evade detection. Existing moderation systems remain tethered to platform-specific supervision and static taxonomies, a reactive paradigm that struggles to generalize across domains or uncover novel threats. This paper presents a systematic study of In-Context Learning (ICL) as a unified framework for illicit promotion detection. Through rigorous analysis, we show that properly configured ICL achieves performance comparable to fine-tuned models using 22x fewer labeled examples. We demonstrate three key capabilities: (1) Generalization to unseen threats: ICL generalizes to new illicit categories without category-specific demonstrations, with a performance drop of less than 6% for most evaluated categories. (2) Autonomous discovery: A novel two-stage pipeline distills 2,900 free-form labels into coherent taxonomies, surfacing eight previously undocumented illicit categories such as usury and illegal immigration. (3) Cross-platform generalization: Deployed on 200,000 real-world samples from search engines and Twitter without adaptation, ICL achieves 92.6% accuracy. Furthermore, 61.8% of its uniquely flagged samples correspond to borderline or obfuscated content missed by existing detectors. Our findings position ICL as a new paradigm for content moderation, combining the precision of specialized classifiers with cross-platform generalization and autonomous threat discovery. By shifting to inference-time reasoning, ICL offers a path toward proactively adaptive moderation systems.