Teach the Restoration, Skip the Runtime Step

TL;DR for operators

ReCAST¹ treats de-obfuscation as something a classifier should learn during training, not necessarily something a production system should execute before every classification. A Qwen3.5-9B student first learns to identify disguised spans, classify the obfuscation, reconstruct normalized text, and assign a risk label. It is then adapted to classify the original obfuscated SMS directly.

On the paper’s real-production Chinese SMS test set, ReCAST reaches 86.6% accuracy and 89.5% Risk Recall, versus 75.8% and 79.2% for direct same-backbone classification. An explicit restoration-then-classification pipeline reaches 83.4% and 86.2%, but requires 1.42 seconds average latency, compared with 0.71 seconds for ReCAST.

For operators, the result supports a specific design option: when a strong offline model can recover adversarially disguised meaning but is too expensive for the request path, use that capability to construct structured supervision and transfer it into the production classifier. The evidence does not yet show that this works equally well outside Chinese SMS, below the 9B scale, with different teachers, or under live production drift.

Obfuscation creates a semantic recovery problem before it creates a classification problem

A risky SMS does not have to become unreadable to evade a classifier. Characters can be decomposed, replaced by homophones or similar glyphs, separated by spaces or symbols, mixed with alphanumeric forms, or embedded in coded jargon. A human may still reconstruct the intended expression while token matching and learned lexical cues become less reliable.

That leaves a production team with several plausible responses. It can collect more labeled obfuscated examples. It can use a stronger model. Or it can normalize each incoming message before classification.

The last option is attractive because it makes the hidden expression explicit. It also puts semantic recovery directly into the serving path. If every message requires one pass for restoration and another for classification, latency, throughput, concurrency, and serving cost inherit that extra stage.

ReCAST changes where that recovery work happens. The large DeepSeek-V4-Pro teacher is used offline to help construct structured supervision. The deployable model is a Qwen3.5-9B student that ultimately predicts the four risk labels directly.

More obfuscated examples do not reproduce the gain

The main benchmark helps separate structured supervision from simple exposure to more adversarial data.

These trainable headline results are reported over four random seeds. Aug-CLS receives 20,000 additional synthetic obfuscated classification examples, yet remains 6.0 accuracy points and 4.4 Risk Recall points below ReCAST.

That comparison matters because it narrows the interpretation. The advantage is not adequately explained by giving the model more disguised SMS with final labels. ReCAST changes the information supplied during training.

In its first stage, the student generates a structured output containing the obfuscated span, its obfuscation type, restored text, and risk category. The model is therefore supervised on where the corruption occurred and what the corrupted expression was intended to represent.

The second stage shifts the same model toward direct classification of the original obfuscated message. Ninety percent of examples use classification format; 10% retain the earlier full restoration format as rehearsal.

The restoration output is no longer required in the normal inference path.

The ordering experiment makes the mechanism more credible

One could still argue that restoration and classification examples merely need to be present somewhere in training. The paper tests that possibility with a Joint-Shuffled control.

This control matches initialization, total exposure to restoration and classification formats, and computational budget, but removes the ordered transition from restoration learning to classification adaptation. On a representative checkpoint, Joint-Shuffled reaches 84.1% accuracy and 86.8% Risk Recall, compared with 86.4% and 89.7% for stage-wise ReCAST.

This is an ablation, not another four-seed headline comparison. Its purpose is narrower: test whether supervision order contributes beyond supervision quantity.

The remaining component ablations point in the same direction. Removing the 10% restoration replay during Stage 2 lowers the representative checkpoint from 86.4% to 84.5% accuracy and from 89.7% to 87.4% Risk Recall. Removing Stage 2 entirely produces 82.9% accuracy. Within that no-Stage-2 setting, additionally removing span/type supervision drops accuracy to 73.8%, while removing restored-text supervision yields 78.6%.

Taken together, these tests support a training sequence in which the model first acquires an explicit recovery capability and then learns to use that capability for the end task. They do not establish that this ordering is universally optimal for intermediate-supervision problems.

Restoration survives even when restoration leaves the request path

The paper also checks whether the learned recovery capability disappears during classification adaptation.

On 200 manually annotated obfuscated risky messages, the Stage 1 model achieves 92.0% exact match on detected obfuscated span sets and 3.5% normalized character-level edit distance for restoration. After Stage 2, the final model still reaches 89.0% span exact match and 4.9% edit distance.

That diagnostic is mechanism evidence rather than the main deployment metric. It is consistent with the interpretation that classification fine-tuning does not simply overwrite the earlier de-obfuscation capability.

This also resolves a likely architectural misunderstanding: ReCAST is not primarily a runtime restoration pipeline. Restoration is made explicit so the student can learn it; the deployed classifier then uses the resulting representation implicitly.

The latency comparison shows why the distinction matters. Pipeline-CLS performs explicit restoration and classification and averages 1.42 seconds, with 2.52-second P95 latency. ReCAST averages 0.71 seconds with 1.20-second P95, only slightly above Direct-CLS at 0.67 seconds average latency in the same controlled serving setup.

For risk teams, move expensive semantics upstream when the capability can be retained

The direct business inference is about allocation of computation, not simply benchmark accuracy.

A telecom or messaging risk team with access to a capable offline model may not need to invoke that model on every production message. If expensive semantic recovery can be expressed as structured intermediate supervision and retained after downstream adaptation, more of the cost can be paid during data construction and training instead of repeatedly during serving.

ReCAST also suggests a useful labeling workflow for evolving evasion patterns. Newly observed failures can be annotated not only with the final risk category but with the location, type, and normalized interpretation of the obfuscation. That produces supervision about the failure mechanism rather than another label-only example.

The residual errors still matter operationally. In the representative checkpoint, benign false-positive rate is 2.8%, compared with 6.8% for Direct-CLS. But fraud remains the hardest class: recall is 77.5%, and 38 of 258 fraud messages are classified as benign. A model with stronger obfuscation robustness is therefore not equivalent to a complete risk-control policy.

For consequential filtering or enforcement, the paper itself leaves room for trusted-sender signals, rules, thresholds, human review, and correction mechanisms around the classifier.

The evidence stops before live deployment and cross-domain generalization

The benchmark is stronger than a purely synthetic evaluation: validation and test messages are independently human-annotated production SMS, and the 1,000-message test set is excluded from LLM-assisted training-data generation. Same-backbone controls, matched-budget ordering tests, component ablations, restoration diagnostics, and common serving measurements make the within-benchmark comparison reasonably informative.

The external boundary is much tighter.

The experiments cover Chinese SMS, one four-class risk taxonomy, one 9B student, and one DeepSeek-V4-Pro teacher. Synthetic data and structured supervision may inherit the teacher’s coverage gaps or biases. Raw production messages are not released, limiting independent replication. Serving measurements come from a controlled offline H100/vLLM configuration rather than full live traffic with changing sender behavior and attack patterns.

For another channel, language, risk domain, or smaller model, the paper provides a design hypothesis to test—not a transferred performance guarantee.

Teach the capability where you can afford it

ReCAST’s strongest contribution is not another preprocessing stage. It is evidence that preprocessing-like semantic work can sometimes be made explicit during training and then internalized into a classifier that remains single-pass at inference.

In the reported SMS setting, that produces a better result than more classification-only augmentation and a better robustness-latency trade-off than restoring every message online. The mechanism experiments further suggest that the structure and ordering of supervision contribute to the gain.

For systems facing adversarially disguised inputs, this changes the architecture question. Before adding another expensive model call to every request, test whether the capability that call provides can instead be taught offline, retained through adaptation, and invoked implicitly by the production model.

Cognaptus: Automate the Present, Incubate the Future.