Live or Lie: Action-Aware Capsule Multiple Instance Learning for Risk Assessment in Live Streaming Platforms

TL;DR

This work tackles room-level risk assessment in live streaming under weak supervision by formulating it as a MIL problem where each room is a bag of user-time capsules. It introduces AC-MIL, a hierarchical architecture that combines Action Field Encoding, Capsule Construction, Relational Capsule Reasoning, Dual-View Integration, and Cross-Level Risk Decoding to model both local actions and cross-user coordination. Across large Douyin datasets, AC-MIL achieves state-of-the-art performance with strong recall and low false alarm rates, while providing capsule-level interpretability to identify actionable risky segments. The approach offers a scalable, interpretable framework for real-time moderation in live platforms.

Abstract

Live streaming has become a cornerstone of today's internet, enabling massive real-time social interactions. However, it faces severe risks arising from sparse, coordinated malicious behaviors among multiple participants, which are often concealed within normal activities and challenging to detect timely and accurately. In this work, we provide a pioneering study on risk assessment in live streaming rooms, characterized by weak supervision where only room-level labels are available. We formulate the task as a Multiple Instance Learning (MIL) problem, treating each room as a bag and defining structured user-timeslot capsules as instances. These capsules represent subsequences of user actions within specific time windows, encapsulating localized behavioral patterns. Based on this formulation, we propose AC-MIL, an Action-aware Capsule MIL framework that models both individual behaviors and group-level coordination patterns. AC-MIL captures multi-granular semantics and behavioral cues through a serial and parallel architecture that jointly encodes temporal dynamics and cross-user dependencies. These signals are integrated for robust room-level risk prediction, while also offering interpretable evidence at the behavior segment level. Extensive experiments on large-scale industrial datasets from Douyin demonstrate that AC-MIL significantly outperforms MIL and sequential baselines, establishing new state-of-the-art performance in room-level risk assessment for live streaming. Moreover, AC-MIL provides capsule-level interpretability, enabling identification of risky behavior segments as actionable evidence for intervention. The project page is available at: https://qiaoyran.github.io/AC-MIL/.

Figures (6)

• Figure 1: Illustration of a toy live streaming room. (a) A virtual screenshot showing the streamer continuously delivering verbal and visual content, alongside multiple interactive feature icons for viewers. (b) Viewers engage with the streamer in real time through chats, likes, virtual gifts, etc., while the streamer responds viewer interactions.
• Figure 2: Overview of AC-MIL, a hierarchical serial-parallel framework that models raw user actions to produce room-level risk predictions. Key components include: (a) Action Field Encoder for contextualizing raw behaviors; (b) Capsule Constructor that structures actions into interpretable user–time capsules; (c) Relational Capsule Reasoner modeling dependencies via graph-aware self-attention (also providing capsule-level interpretability); (d) Dual-View Integrator capturing user- and time-centric views; and (e) Cross-Level Risk Decoder aggregating multi-granular contextual signals for final risk scoring.
• Figure 3: An illustrative case of collusive fraud detected by AC-MIL. Left: Attention heatmap over the User-Timeslot capsule space. Right: The streamer promotes a fake part-time job, followed by planted viewers. Victims are later charged for training and materials before the scammers vanish.
• Figure 4: Visualization of room representations learned by AC-MIL and TimeMIL, where salmon nodes represent risky rooms and turquoise nodes represent benign ones.
• Figure 5: An illustrative case of covert gambling promotion detected by AC-MIL. Left: Attention heatmap over the User-Timeslot capsule space. Right: High-attention regions reveal a set of risky capsules: The streamer leverages ambiguous gestures and subtle hints to attract potential gamblers, who begin to inquire about betting. Later, collusive viewers indirectly suggest where to find the gambling link (also acknowledged by the streamer), forming a case of off-platform gambling redirection.

Theorems & Definitions (2)

• definition 1
• definition 2