Building Abuse Datasets Without the Victims: What ConVAWG Actually Does

TL;DR: ConVAWG builds synthetic, multi-turn abuse dialogues from real crime definitions and case reviews so researchers can study how abuse unfolds over time, and its main contribution is treating abuse as a relationship across turns rather than a single toxic sentence.

Most abuse-detection work has been stuck at the sentence level. Is this message toxic, yes or no. That framing catches a slur or a direct threat, and it misses almost everything about how coercive control actually works: the slow isolation, the surveillance, the pattern that only reads as abuse when you see the whole conversation. ConVAWG, described in the paper “ConVAWG: A Retrieval-Grounded Framework for Controlled Synthetic Dialogue Generation in Violence Against Women and Girls” (arXiv, cs.CL / cs.AI / cs.LG), is an attempt to fix that gap by generating fake conversations that behave like real ones.

I want to be careful here. This is a sensitive domain, and the paper knows it. The whole reason synthetic data exists in this space is that real conversations between abusers and victims are nearly impossible to release. Privacy law, legal exposure, and basic ethics make large real datasets a non-starter. So the researchers built a pipeline to manufacture plausible ones instead.

Why generate abuse dialogues at all?

The honest answer is a data problem. You cannot study conversational abuse dynamics without conversations, and you cannot get the conversations because releasing them would re-victimize real people. That leaves researchers with two bad options: work from thin, sentence-level toxicity corpora that miss the relational structure, or work from nothing.

Synthetic data is the third path. The bet ConVAWG makes is that if you ground the generation in real structure (official crime definitions, real demographic distributions, actual case reviews), you get dialogues that are fictional in their specifics but faithful in their patterns. That fidelity is the entire value proposition. A synthetic dataset that reads like a screenwriter’s guess at abuse is worse than useless, because a detector trained on it learns fiction.

The paper frames abuse as “relational and temporally unfolding,” which is the right frame. Threats and coercion can sit directly in the text. But surveillance, isolation, stalking, and physical violence often get planned, disclosed, or merely referred to across many turns. You need the timeline to see them.

How does the ConVAWG pipeline actually work?

This is where the framework earns its keep, because it is not just “prompt a model to write an abusive chat.” It is a staged construction. Based on the paper’s own description, the pipeline runs roughly like this.

It starts from persona seeds and demographic patterns reported by the UK Office for National Statistics, so the fictional participants reflect real population distributions rather than a model’s stereotypes. It pulls in official crime definitions, which anchors what counts as which offense. And it retrieves real Domestic Homicide Review cases as grounding material, which is the part that gives the scenarios their spine.

From those inputs it builds hierarchical event timelines. This is the temporal move made concrete: a scenario is not a blob of chat, it is a structured sequence of events that unfold. Those timelines then get converted into multi-scene role-play dialogues, so a single scenario spans multiple exchanges rather than one snapshot.

The last step is the interesting one for anyone who follows interpretability work. The authors apply what they call “targeted activation-steered toxicity control” to appropriate utterances. In plain terms, instead of prompting a model to be more or less abusive, they steer the model’s internal activations to dial the toxicity of specific lines up or down. That is the same family of technique as activation steering used in alignment research, applied here as a content-control knob. It is a more surgical way to hit a target tone than prompt engineering, and it means the toxicity is placed deliberately rather than sprayed across every turn.

The output is over 6,000 multi-turn dialogue events across 200 scenarios, with metadata at the scenario, event, and turn level. That layered metadata is what makes the release usable for training and evaluation: you can query not just “is this turn toxic” but “where does this turn sit in the arc of the scenario.”

Is the synthetic data actually good enough to use?

The paper claims yes, and reports four kinds of evidence: human evaluation, LLM-as-Judge assessment, ablations, and downstream tasks. Taken together the authors describe “strong dialogue quality and domain fidelity.”

I read that with the usual caution. Human evaluation is the load-bearing piece here, and the paper does not give me the numbers or annotator details in the abstract, so I am taking the strength claim as reported rather than confirmed. LLM-as-Judge is convenient but circular in a domain like this: a judge model has its own blind spots about what abuse looks like, and if the generator and the judge share a base model, they can agree while both being wrong. Ablations are the more trustworthy signal, because they show which pipeline stages actually matter. If removing the Domestic Homicide Review grounding tanks fidelity, that tells you the grounding is doing real work and not decoration.

The downstream task evaluation is what I would push on hardest if I were reviewing. A synthetic dataset justifies itself when a model trained on it transfers to real data. The abstract says downstream tasks were run and results were strong, but does not specify whether transfer to any real-world benchmark was tested. Without that, “strong downstream performance” could mean strong on other synthetic data, which proves less than it sounds.

What should a builder take from this?

The reusable idea, independent of this specific domain, is the construction pattern: ground synthetic generation in real structure, model the phenomenon as a timeline rather than a snapshot, and control tone with activation steering instead of prompt begging. If you are building any dataset for a behavior that unfolds over a conversation (fraud grooming, radicalization, customer-service escalation), that three-part recipe transfers directly.

Practitioner’s take: if you want to build on ConVAWG, do not treat the 6,000 events as ground truth. Treat them as a scaffold, and spend your effort on the one thing the paper cannot do for you, which is validating transfer to real, held-out data through a partner who has ethical access to it (a helpline, an academic group under IRB review). The catch most readers will miss is the LLM-as-Judge circularity: if you evaluate a detector you trained on this data using the same model family that generated it, you will get a flattering number that means almost nothing. And the harder, non-technical catch: a synthetic abuse corpus is a dual-use artifact. The same relational patterns that train a detector can teach a model to imitate coercion. Anyone releasing or extending this needs an access and licensing story, not just a benchmark score.