Multi-Label Active Learning for Doxing Detection: Enabling Large-Scale Analysis of the Dynamics and Network Organization of Harmful Behavior

Doxing is often studied as a harmful disclosure of personal information, but fine-grained detection requires distinguishing how such information is used against a target. Studying these distinctions at scale requires labels difficult to produce when relevant behaviors are rare, unevenly distributed, and overlapping. We address this challenge with a multi-label scheme anchored in the established distinction among deanonymizing, targeting, and delegitimizing doxing, and we extend that scheme to related processes through which personal information is requested, morally framed, or connected to calls for action. Using multi-label active learning with RoBERTa, we apply this framework to 1.3 million comments from three target-centered boards in a hostile forum environment from 2014 to 2025. After each annotation cycle, RoBERTa is retrained on the expanded set, while uncertainty and diversity guide selection of informative cases. This makes fine-grained labeling feasible at corpus scale while keeping reliability visible. Demonstrating this value, key findings include that deanonymizing and targeting doxing are rare, textually elaborate, strongly connected, and locally concentrated, whereas delegitimizing doxing is far more common in our setting. Doxing follows no uniform life cycle here but varies across target contexts and can continue beyond early identification across years of hostile discussion. Requests for information are consistent with a preparatory or validating role, hostile moral framing operates as a broad background condition, and action-oriented hostility is more context-specific. Timestamped reply links and reactions show that doxing-related output is concentrated among highly active and interactionally prominent users and that prior same-type interaction is associated with later doxing.