Live or Lie: Action-Aware Capsule Multiple Instance Learning for Risk Assessment in Live Streaming Platforms
Yiran Qiao, Jing Chen, Xiang Ao, Qiwei Zhong, Yang Liu, Qing He
KDD'26 August Track
cs.LG, cs.AI
2026-02-03
ICT-CAS and ByteDance treat a live room as an MIL bag of user-timeslot capsules, jointly modeling time and collusion. May PR-AUC reaches 0.7676, 4.4% above TimeMIL.
Live-room risk labels sit at room level: this room violated policy, with no tag for which user or which 100 seconds. The actual pattern is often a host and a few shills aligning inside a short window. A like or a comment looks harmless alone. A flat sequence model dilutes that local signal across 30 minutes and thousands of actions.
Classic MIL assumes independent instances and a positive bag as soon as one instance is positive. Live-room instances are not independent: risk is alignment across users and slots. Time-series MIL (TimeMIL, TAIL-MIL) was built for regularly sampled variable channels. Here the user axis is a discrete actor with irregular join-leave, so the two-dimensional U×T grid does not match those methods.
AC-MIL treats a room as a bag. An instance is a capsule: one user's actions inside one 100-second slot. The pipeline is serial then parallel.
An action-field encoder concatenates a learned action-type embedding with a Chinese-BERT text projection, prepends [CLS], and runs a Transformer for global action context. A capsule constructor compresses each slot with an LSTM. Relational reasoning builds an adaptive graph over capsules with four edge types: adjacent slots, same user, host-viewer, and residual auxiliary. Graph-aware attention updates capsules and yields [CLS]-to-capsule attention as the localization map for moderators.
In parallel, a user view runs a GRU along each user's capsules then attention-pools users with an extra bias on the host. A timeslot view pools users inside a slot, then a GRU over the slot sequence. Four level vectors (action, capsule, user, timeslot) each pass a gate and a weighted sum becomes the room vector, trained with BCE.
Douyin May and June. May trains on 176,347 rooms and tests on 22,462; June trains on 79,552 and tests on 10,967. First 30 minutes, negatives at 1:10, top-50 active viewers, sequences capped at 2,096 tokens.
May PR-AUC is 0.7676 versus TimeMIL 0.7353 (+4.4%), F1 0.7002 versus 0.6790, [email protected] 0.8722 versus 0.8599, [email protected] 0.1260 versus 0.1436. June PR-AUC is 0.7311 versus TAIL-MIL 0.7029 (+4.0%). MIL baselines as a group beat flat Transformer, Reformer and Informer.
June ablations: drop the action-field encoder and PR-AUC is 0.7146 (2.3% relative drop); drop graph-aware capsule reasoning, 0.7188; drop the user view, 0.7267; drop the timeslot view, 0.7163. Slot length 50–150s and viewer count 30–70 move the metrics only slightly; the default 100s × 50 viewers is stable.
On 13–14 July 2025 production logs, PR-AUC is 0.7355 against an online Transformer at 0.6381 and XGBoost at 0.4512; [email protected] is 0.8390 versus 0.7864. t-SNE separates risky and benign rooms more cleanly than TimeMIL.
This is the base model for the group's later live-risk papers: CS-VAR and LPCD use it as backbone or reference. The reusable engineering idea is the grid, user × timeslot as the instance, which keeps "who did what in which window" while training on room labels only. Capsule attention can circle fragments such as a handicraft-job pitch with timed shill gifts, or a scoreboard plus coded talk with shills pointing at a pinned link, so a takedown can cite a behavior segment rather than a single room score.
A 4% PR-AUC lift sits on top of already-usable TimeMIL / TAIL-MIL. What you buy is two-dimensional localization, not a new detection ceiling.
Capsules have no instance labels. The "explanation" is [CLS] attention, with no human span-level ground truth, so it is not a verified evidence chain. Keeping only the top-50 viewers drops low-activity shill accounts on purpose. The actual scam often closes off-platform; the model sees the in-room script and collusion and will miss silent, content-only rooms. All data is Douyin, with the same 1:10 sampling the later papers reuse; online tables use the same ratio on logs. The claim of a "first" MIL study of live-room risk is better read as: among public methods, this is the industrial U×T capsule-MIL experiment.