Identifying predictive factors of cyberbullying perpetration via deep learning: a two-stage training approach to class imbalance with weighted loss

Abstract

Background

Although machine learning has been widely used to investigate problematic behaviors such as cyberbullying, class imbalance in behavioral datasets remains a persistent challenge. This study, based on the General Aggression Model and the Social-Ecological Framework, aims to improve the identification of cyberbullying perpetrators through a deep learning framework that combines a two-stage training strategy with a class-weighted loss function.

Methods

A total of 660 Chinese university students (including 54 self-reported perpetrators) were recruited from schools.

Results

The deep learning model achieved a recall of 0.92, significantly outperforming conventional methods such as LightGBM and Random Forest which showed low recall for the minority class. SHAP analysis revealed that screen time, negative emotions, school connectedness, online disinhibition, exposure to violent media and deviant peer affiliation were the most influential predictors. Interaction analyses revealed that school connectedness may buffer the impact of multiple risk factors.

Conclusions

The framework effectively addresses extreme class imbalance for cyberbullying detection, offering both strong performance and interpretable insights for prevention.

Supplementary Information

The online version contains supplementary material available at 10.1186/s40359-026-04980-x.

Introduction

Cyberbullying has emerged as a critical societal concern accompanying the rapid proliferation of internet technologies and mobile communication devices. Defined as intentional, repetitive, and hostile online behaviors intended to harm others through digital media, cyberbullying significantly differs from traditional bullying due to its persistent accessibility, widespread visibility, potential for anonymity, and reduced physical power imbalances [1]. Previous studies have reported a cyberbullying prevalence of 7.82% (633/8,098) among college students within the past 12 months [2]. Additionally, research involving an adult sample revealed that approximately 19.3% (1,261/6,529) reported ever experiencing cyberbullying, with 4.1% (268/6,529) having experienced it within the past month [3]. Cyberbullying manifests in diverse forms, including posting mean or harmful comments about others online, sharing malicious or hurtful images or videos, spreading false rumors, sending threats via digital messages, and impersonating someone online with malicious intent [1]. These behaviors can severely impact individuals’ psychological well-being, leading to increased anxiety, depression, diminished academic performance, and in extreme cases, suicidal ideation [4].

Recent research has made notable progress in deep learning-based cyberbullying-related analysis, including facial-expression-driven classroom analytics for cyberbullying mitigation, multimodal emotion recognition frameworks for online social media, and uncertainty-aware multimodal fusion methods that improve prediction reliability [5–7]. However, these approaches primarily rely on media-rich inputs (e.g., images, speech, and text), which may be difficult to collect consistently in routine educational and psychological practice. In contrast, questionnaire-based assessment remains highly practical in educational settings because it is scalable, cost-effective, and feasible for timely screening, early intervention, and prevention. Despite increasing interest in questionnaire-based cyberbullying research, robust identification of high-risk individuals remains limited [8]. A key challenge stems from the pronounced class imbalance commonly found in cyberbullying-related datasets, where instances of perpetration are considerably less frequent than non-perpetration cases. This imbalance complicates the precise identification of predictive factors using traditional methods. To address this critical issue, the current study aims to apply an innovative two-stage training approach with a weighted loss function within a deep learning framework. Our objective is to effectively mitigate class imbalance issues, enhance prediction accuracy, and identify crucial predictive factors of cyberbullying perpetration among university students, ultimately informing targeted preventative strategies.

Theories and predictive factors of cyberbullying

The General Aggression Model (GAM) initially developed to explain diverse aggressive behaviors, including cyberbullying [9], provides a useful framework for the present study. GAM suggests that aggressive behaviors result from interactions between individual traits (e.g., aggressive tendencies, values, emotional states) and situational cues (e.g., provocation, exposure to violent media). These inputs influence internal states, particularly cognitive processes (such as hostile thoughts and aggressive scripts) and emotional responses (such as anger), ultimately determining aggressive actions. Accordingly, the current study selects individual characteristics (dark personality, self-control, anxiety, negative emotions, moral disengagement, hostile attribution bias, normative beliefs about aggression) and situational factors (screen time, school connectedness, peer support, deviant peer affiliation, exposure to violent media) as predictive variables within the GAM’ s framework. Building upon this, the Social-Ecological Framework emphasizes the pervasive impact of digital environments across individual and contextual levels [10]. Therefore, this study also incorporates variables related to online contexts, such as online disinhibition, online anonymity, and online power imbalance.

First, individual factors are considered. According to the General Theory of Crime [11], self-control is a central factor in determining an individual’ s propensity to engage in criminal or deviant behavior. Research has consistently demonstrated that low self-control is a significant predictor of traditional forms of bullying; however, it may play an even more pronounced role in cyberbullying [12]. The “Dark Triad” of personality, comprising Machiavellianism, subclinical psychopathy, and narcissism [13]. These traits commonly share features such as low agreeableness, reduced empathy, moral disengagement, and interpersonal manipulation [14]. A growing body of research has linked the Dark Triad to a variety of online deviant behaviors, including cyberbullying [15]. Drawing from social cognitive theory, individuals use disengagement strategies to shift the responsibility for norm-violating behavior onto external circumstances, thereby justifying their actions and reducing internal moral conflict [16]. Empirical evidence supports that individuals with higher levels of moral disengagement are significantly more likely to participate in cyberbullying [17]. The Social Information Processing Model (SIP) highlights how individuals interpret and respond to social cues, particularly in ambiguous situations [18]. A central mechanism in this model is hostile attribution bias, the tendency to perceive others’ ambiguous actions as intentionally hostile [19]. Individuals with high levels of hostile attribution bias may interpret neutral or ambiguous online communication as deliberately antagonistic, thus increasing the probability of reactive cyberbullying [20]. Moreover, according to SIP, beliefs about the acceptability of aggressive behavior can be conceptualized as part of one’s knowledge structures, also known as the database or social scripts [18]. These internalized cognitive structures, shaped by past social experiences or dispositional factors, influence how individuals encode, interpret, and respond to social cues. Deficiencies or biases in these processes can increase the likelihood of selecting aggressive problem-solving strategies, ultimately elevating the risk of engaging in aggressive behavior [21]. Negative emotions have been shown to significantly influence the likelihood of engaging in cyberbullying [22]. Individuals experiencing adverse emotional states, such as anger, frustration, or distress, may resort to deviant behaviors as a maladaptive coping strategy [23]. Among various forms of negative affect, anxiety has emerged as a particularly salient predictor [24]. Empirical findings have supported that higher levels of anxiety are positively correlated with an increased likelihood of perpetrating online aggression [25].

Second, environmental factors are considered. Social Bond Theory posits that individuals are less likely to engage in deviant behaviors when they maintain strong bonds with society’s conventional institutions and norms [26]. This framework identifies key social bond indicators such as peer support and school connectedness, both of which play protective roles against adolescent involvement in cyberbullying. Peer support provides emotional reassurance, social validation, and access to interpersonal resources, thereby mitigating feelings of isolation and reducing the need to engage in cyberbullying as a means of asserting social status or dominance [27]. Likewise, school connectedness, referring to a student’s sense of belonging, emotional attachment, and positive identification with their school environment, has been found to be a significant negative predictor of cyberbullying behavior [28]. Social Learning Theory emphasizes that individual behavior formation and change are based on observing and imitating the behavior of others [29]. Deviant peer affiliation, defined as interactions and close relationships with peers who exhibit problematic behaviors such as cheating, theft, or physical violence [30], has been shown to significantly contribute to externalizing behaviors in adolescents, including aggression [31]. Similarly, just as adolescents may learn behaviors through interactions with deviant peers, they may also develop aggressive tendencies by observing and internalizing violent content in media. Prior studies have demonstrated that prolonged exposure to violent media is associated with increased aggressive behavior [32].

Third, online context factors are considered. According to the Barlett Gentile Cyberbullying Model (BGCM), cyberbullying behavior is largely shaped by an individual’s learned beliefs about the acceptability and utility of online aggression [33]. A central tenet of the BGCM is that certain unique features of the online environment facilitate the development of aggressive beliefs and lower the psychological barriers to engaging in cyberbullying [34]. One such feature is online disinhibition, which refers to the tendency for individuals to express themselves more freely and aggressively in virtual spaces than they would in face-to-face interactions [35]. Closely related is the role of online anonymity, another key predictor emphasized in the BGCM [36]. Anonymity reduces perceived accountability and social evaluation, allowing individuals to engage in hostile behavior without fear of identification or retaliation [37]. Empirical studies have supported this claim, showing that anonymous users are significantly more likely to post aggressive or bullying content compared to those with identifiable profiles [38]. Additionally, online power imbalance is a contributing factor to cyberbullying perpetration [39]. Unlike traditional bullying, cyberbullying occurs in a virtual space where physical dominance, such as greater strength or body size, is no longer relevant. As a result, perpetrators do not need to rely on or be concerned about physical superiority over their victims [33]. However, some studies argue that traditional forms of power imbalance may still carry over into digital contexts [40]. Screen time is a key correlate of cyberbullying. Evidence suggests that among active social media users, longer online engagement is associated with higher involvement in cyberbullying and other risk-related digital behaviors [41].

Challenges of class imbalance

A persistent challenge in the domain of cyberbullying detection lies in the pronounced class imbalance between bullying and non-bullying instances, with the former being relatively rare yet critically important for early intervention and prevention. Although traditional machine learning algorithms—such as Logistic Regression, Naive Bayes, Support Vector Machines (SVM), K-Nearest Neighbors (KNN), Decision Trees, Random Forests, XGBoost, and LightGBM—have been widely applied in text classification and behavioral prediction tasks, their classification performance often deteriorates substantially under highly imbalanced data distributions. These models typically optimize global loss functions (e.g., log loss or mean squared error), which inherently prioritize the accurate classification of the majority class while failing to sufficiently capture the minority class. Even with the application of oversampling strategies such as SMOTE, these models may suffer from overfitting to synthetic or non-representative samples, thereby failing to meaningfully improve the recall of the minority class.

Specifically, Logistic Regression and Naive Bayes tend to learn conservative decision boundaries under severe imbalance, sacrificing the detection of extreme or rare cases. SVMs, when exposed to asymmetric class distributions, may have their margin boundaries dominated by the majority class. KNN models are highly sensitive to local data density and are thus less capable of identifying bullying instances that are sparsely distributed in the feature space. Although tree-based models (e.g., Decision Trees, Random Forests, XGBoost, LightGBM) offer a certain degree of robustness, their splitting criteria still tend to favor feature regions that best explain the majority class, leading to highly skewed prediction outcomes. Collectively, these limitations result in a critical consequence: despite apparently strong performance on global metrics such as overall accuracy, the recall for the bullying class may remain close to zero, ultimately failing to achieve the core objective of identifying individuals at risk and supporting meaningful intervention.

Despite the growing interest in automated approaches to cyberbullying detection, current research leveraging machine learning methods in questionnaire-based settings remains notably sparse. To date, only a limited number of studies have applied machine learning to survey data for predicting cyber-aggressive behavior. A study employed a LightGBM model to identify predictive factors of cyber-aggressive behavior and utilized SHAP for post-hoc interpretability [42]. However, the model was evaluated solely using regression error metrics such as MAE (0.30), MSE (0.14), and RMSE (0.38), without reporting a confusion matrix or any classification-specific performance indicators (e.g., accuracy, precision, recall, or F1-score). This omission makes it difficult to assess the model’s ability to discriminate between bullies and non-bullies. Under such conditions, the scientific validity of subsequent model interpretation becomes questionable, as feature importance explanations may be misleading when derived from a model whose discriminative capacity has not been demonstrated. Moreover, cyberbullying detection tasks are frequently challenged by highly imbalanced data distributions, where the minority class—often the bullies—is substantially underrepresented. In such cases, traditional machine learning models, even when combined with oversampling techniques like SMOTE, may still fail to accurately identify the minority class. A model may exhibit deceptively low error rates under standard regression metrics such as MAE or RMSE, yet lack the capability to detect actual instances of bullying behavior. This limitation is particularly problematic in applications focused on identifying aggressors, as a model that fails to detect the target group offers limited utility for intervention and prevention strategies.

The current study

To address these limitations, the present study proposes a deep learning-based framework designed to enhance sensitivity to minority-class instances under real-world imbalanced conditions. The training process begins with a pretraining phase on a randomly sampled, balanced subset of the data to ensure equal representation of bullying and non-bullying cases. This stage enables the model to learn robust and generalizable feature representations without being biased toward the majority class. Subsequently, the model undergoes fine-tuning on the full, imbalanced dataset, during which a class-weighted loss function is employed to further emphasize the correct classification of bullying instances. Additionally, layer freezing techniques are applied to retain the learned representations from the pretraining phase. This two-stage design allows the model to benefit both from the statistical stability of balanced training and from the ecological validity of the imbalanced real-world distribution. By embedding imbalance-aware learning into both the model architecture and training objectives, this approach offers a more coherent and effective alternative to traditional machine learning workflows. It also lays the foundation for more interpretable and actionable predictions, a goal further enhanced by our incorporation of model interpretability techniques. Moreover, given the complexity and sensitivity of psychosocial data, interpretability is equally critical for informing practical intervention and theory-relevant interpretation. To this end, the present study integrates SHAP (SHapley Additive exPlanations) as a post-hoc model explanation tool to systematically analyze the deep learning model’s outputs. SHAP, grounded in cooperative game theory, provides both global and local feature attribution by decomposing each prediction into individual feature contributions. This allows us to identify which psychosocial variables most significantly influence the model’s bullying predictions. We apply SHAP analysis to the entire validation set to generate summary plots of feature importance and further explore interaction effects between key protective and high-risk factors through dedicated scatterplots. This interpretability process not only enhances confidence in the model’s decision rationale but also offers valuable insights for data-driven intervention design and policy formulation.

Methods

Participants

Participants were recruited using a cluster random sampling method from several universities in China. A total of 687 questionnaires were distributed, and 660 valid responses were retained for analysis, resulting in a valid response rate of approximately 96%. Invalid questionnaires were excluded based on failure to pass lie detection items embedded in the survey, which were designed to assess the attentiveness and honesty of participants’ responses. The final sample consisted of college students with a mean age of 19.42 years (SD = 2.94). Among them, 30.2% were male, 14.2% were only children, 8.6% came from single-parent families, and 91.2% reported screen time exceeding four hours per day.

Measures

Cyberbullying perpetration

The survey used nine items from the Cyberbullying Questionnaire to assess the extent to which participants had recently engaged in cyberbullying behaviors [1]. These items measured various forms of cyberbullying perpetration, such as sending hurtful or threatening messages, spreading rumors online, excluding others from digital groups, and posting embarrassing or harmful content about others on social media platforms. Participants rated the frequency of each behavior in the previous 30 days using a 5-point Likert scale: 0 = “never,” 1 = “once,” 2 = “a few times,” 3 = “several times,” and 4 = “many times.” Consistent with prior research, a response of “once” or higher was used as a cutoff point to classify participants as cyberbullying perpetrators [43–44]. Those who reported engaging in any of the listed behaviors at or above this threshold were categorized as having committed cyberbullying, while those below the threshold were categorized as non-perpetrators. As a result, cyberbullying perpetration was recoded into a binary variable (“have engaged in cyberbullying” vs. “have not engaged in cyberbullying”) for the present analyses, in alignment with the screening-oriented classification objective.

Predictive factors

This study included demographic information (5 variables: gender, age, screen time, only child status, and single-parent family), environmental factors (4 variables: exposure to violent media, school connectedness, peer support, and deviant peer affiliation), individual factors (7 variables: self-control, moral disengagement, anxiety, negative emotions, dark personality traits, normative beliefs about aggression and hostile attribution bias), and online context factors (3 variables: online disinhibition, online anonymity, and online power imbalance) as predictors of cyberbullying. The measurement methods, number of items, and scoring formats for each variable are detailed in Table 1.

Table 1.

Details of the predictors of cyberbullying included in this study

Type	Variables	Measurement Scale	Number of items	Scoring
Demographic information	Gender	Self-administered	1	1 = Male, 2 = Female
	Age	Self-administered	1	Open-ended
	Only Child	Self-administered	1	1 = Yes, 2 = No
	Single-Parent Family	Self-administered	1	1 = Yes, 2 = No
Environmental factors	Exposure to Violent Media	[45]	6	frequency (Likert, 1– 5)×Violence Score (Likert, 1–7)
	School Connectedness	[46]	10	Likert, 1–5
	Peer Support	[47]	3	Likert, 1–7
	Deviant Peer Affiliation	[30]	8	Likert, 1–5
Individual factors	Self-Control	[48]	13	Likert, 1–4
	Moral Disengagement	[49]	15	Likert, 1–5
	Anxiety	[50]	7	Likert, 1–4
	Negative Emotions	[51]	10	Likert, 1–5
	Dark personalit	[52]	12	Likert, 1–7
	Normative Beliefs About Aggression	[53]	8	Likert, 1–4
	Hostile Attribution Bias	[54]	5	Likert, 1–4
Online contexts factors	Online Disinhibition	[33]	4	Likert, 1–5
	Online Anonymity	[55]	5	Likert, 1–5
	Online Power Imbalance		5	Likert, 1–5
	Screen Time	Self-administered	1	1 = Less than 1 h 2 = 1–2 h … 7 = More than 8 h

Statistical analysis

Analyses were conducted in Python. Data handling and numerical operations used pandas and NumPy. The custom deep neural network was implemented in PyTorch (torch.nn, torch.optim, DataLoader), with CPU execution fixed via the os module for reproducibility. Conventional baselines (logistic regression, naïve Bayes, decision tree, k‑nearest neighbors, SVM, random forest) and evaluation metrics (accuracy, precision, recall, F1, confusion matrices) were provided by scikit‑learn. Gradient boosting comparators employed XGBoost and LightGBM. Class imbalance was mitigated using SMOTE from imbalanced‑learn. Model interpretability relied on SHAP for interaction visualization. Visualizations (dependence/interaction plots, confusion matrices) were generated with Matplotlib.

Data preprocessing

The dataset utilized in this study was derived from a structured questionnaire and comprised 660 samples with 22 feature variables. Categorical variables such as gender, only child status, and single-parent family status were one-hot encoded in the original dataset. Among all samples, 54 (8.2%) were labeled as “have engaged in cyberbullying”, revealing a pronounced class imbalance. To establish a robust training and validation pipeline, we randomly sampled 24 cyberbullying instances and 136 non-cyberbullying instances to construct a validation set of 160 samples. The remaining data formed the training set for subsequent model development.

For the two-stage deep learning approach, a balanced pretraining subset was created by randomly selecting 30 cyberbullying and 30 non-cyberbullying samples from the training set. This subset enabled the model to learn generalized representations without being biased by class disproportionality. To address class imbalance and improve recall for cyberbullying cases, the model was fine-tuned on the full training set using a class-weighted loss function.

For traditional machine learning models, all Boolean variables were converted to binary form (0/1), and features were standardized (zero mean and unit variance) to ensure consistency across model inputs. To further address class imbalance, SMOTE was applied to the training data to generate synthetic cyberbullying instances and achieve class parity.

Machine learning approaches

To establish a performance baseline for subsequent deep learning models, this study implemented several commonly used supervised machine learning algorithms, including Logistic Regression, Naive Bayes, SVM, KNN, Decision Tree, Random Forest, XGBoost, and LightGBM. Due to the highly imbalanced distribution of cyberbullying (n = 54) versus non-cyberbullying (n = 606) instances, the SMOTE algorithm was applied to synthetically augment the minority class in the training set, thereby achieving a balanced class distribution. After oversampling, all feature variables were standardized to follow a standard normal distribution. This preprocessing step is particularly beneficial for distance-based models such as KNN and gradient-based models like SVM and Logistic Regression, enhancing model stability and predictive performance. Each model was trained on the balanced training dataset and evaluated on a hold-out validation set containing 136 non-cyberbullying and 24 cyberbullying samples. To comprehensively assess performance under imbalanced conditions, we report not only accuracy but also precision, recall, F1-score, and confusion matrices. These metrics reveal not only overall model effectiveness but also the relative ability to detect minority-class instances (i.e., cyberbullying behavior), thereby offering empirical insights for further model refinement. Each metric was computed from the confusion matrix counts—true positives (TP), false positives (FP), false negatives (FN), and true negatives (TN)—according to

1

2

3

4

Deep learning approach

To overcome the limitations of traditional classifiers in identifying minority classes under extreme imbalance, we designed a two-stage deep neural network architecture to enhance generalization and sensitivity in cyberbullying detection tasks. In the first stage, the pretraining phase, the model is trained on a balanced subset generated via random undersampling, enabling it to learn discriminative representations between cyberbullying and non-cyberbullying samples while avoiding early-stage majority class dominance. This phase employs a three-layer multilayer perceptron (MLP) with ReLU activation and Dropout regularization to enhance generalization. In the second stage, the fine-tuning phase, model parameters are further optimized using the full imbalanced training set. A class-weighted cross-entropy loss is used to emphasize the minority class during learning. To preserve the stability of representations learned during pretraining, all network layers except the output layer are frozen in this stage.

Figure 1. illustrates the model architecture during the pretraining phase. The input layer consists of 22 standardized features corresponding to one-hot encoded and numerically transformed questionnaire variables. The core of the network comprises three fully connected hidden layers with 128, 64, and 32 neurons, respectively, each activated by the Rectified Linear Unit (ReLU) function. Mathematically, ReLU is defined as:

Fig. 1.

Network structure during pretraining on a balanced dataset (30 cyberbullying vs. 30 non-cyberbullying samples)

5

This non-linearity preserves sparse activations and mitigates gradient vanishing, accelerating training and improving model trainability in deep structures. The model is initially trained on a small, class-balanced subset (30 cyberbullying and 30 non-cyberbullying samples) to enable the learning of unbiased behavioral representations. During pretraining, Dropout regularization is applied with a 30% rate to randomly suppress neuron activations, thereby preventing overfitting on small datasets. Figure 2. illustrates the effect of Dropout in reducing co-adaptation and enhancing generalization.

Fig. 2.

Schematic illustration of dropout regularization during training

Following pretraining, the model proceeds to the fine-tuning stage, where it is trained on the full, imbalanced training set. Figure 3. depicts the model architecture used during this stage. During fine-tuning, only the output layer is unfrozen, while all other layers remain fixed to preserve previously learned features. A class-weighted cross-entropy loss is employed:

Fig. 3.

Fine-tuning phase with frozen feature-extraction layers

6

Where denotes the total number of training samples, represents the logit output for class of -th sample, is the ground-truth label, and is the weight associated with the corresponding class. This loss function computes the predicted probability of the true class using the softmax function and incorporates class-specific weights to enhance the model’s ability to learn from minority classes, thereby mitigating the effects of class imbalance.

Random seeds were fixed at 42 for PyTorch and NumPy. Training was performed with Adam optimizer. During pretraining, the learning rate was 1 × 10^− 3, weight decay was 1 × 10^− 5, batch size was 16, and the model was trained for 10 epochs using cross-entropy loss. During fine-tuning, all hidden layers were frozen and only the final classification layer was updated using Adam (learning rate 1 × 10^− 4; weight decay 1 × 10^− 5; batch size 16) for 20 epochs. We did not use early stopping. Instead, within the pre-specified fine-tuning epochs, the best checkpoint was selected based on the highest positive-class recall (TPR) on the validation set under the default decision rule.

Model interpretability

To improve the interpretability of our deep learning framework, we employed SHAP (SHapley Additive exPlanations) as a post-hoc interpretive tool to quantify the contribution of each feature to individual predictions. SHAP is grounded in cooperative game theory and assigns a Shapley value to each input feature, representing its marginal contribution to the model output. It ensures both local accuracy and global consistency, providing a unified interpretative framework for population-level analysis. Unlike traditional feature importance metrics, SHAP also preserves the directionality of feature influence. SHAP values were computed for all validation set samples and visualized using multiple techniques. The summary plot ranks feature importance and shows value distributions, while bar plots illustrate the average absolute contributions of each variable, offering insights into global influence. To understand marginal dependencies, we used dependence plots that reveal the functional relationship between feature values and model predictions, highlighting non-linearities. Additionally, SHAP interaction plots were employed to explore interaction-like predictive patterns between psychosocial variables in the model output. Importantly, SHAP was used to interpret model behavior and predictive attribution, rather than to establish causal effects or theoretically definitive mechanisms.

Results

Performance comparison between machine learning and deep learning models

Table 2 summarizes the evaluation metrics for all tested models. Among the machine learning models, LightGBM, XGBoost, and Random Forest achieved the highest overall accuracy (0.88). However, their recall values for the cyberbullying class were low, ranging from 0.25 to 0.33. Naive Bayes achieved the highest recall among classical models (0.50), but with lower accuracy (0.74) and precision (0.29).

Table 2.

Model performance

Model		Accuracy	Precision	Recall	F1-Score
Machine Learning	LightGBM	0.88	0.75	0.25	0.38
	XGBoost	0.88	0.67	0.33	0.44
	Logistic Regression	0.83	0.41	0.38	0.39
	Naive Bayes	0.74	0.29	0.50	0.37
	Decision Tree	0.79	0.31	0.33	0.32
	KNN	0.84	0.43	0.25	0.32
	SVM	0.85	0.50	0.13	0.20
	Random Forest	0.88	0.70	0.29	0.41
Deep learning model		0.68	0.31	0.92	0.46

In comparison, the custom deep learning model achieved a markedly higher recall of 0.92, substantially outperforming all machine learning models on this metric. Although its overall accuracy (0.68) and precision (0.31) were lower, it yielded the highest F1-score (0.46), indicating improved balance between precision and recall in identifying cyberbullying cases.

Figure 4 presents the confusion matrices for all tested machine learning models. These models correctly classified the majority of non-cyberbullying cases (typically over 120 true negatives), but correctly identified only 3 to 12 cyberbullying instances out of 24. Figure 5 shows the confusion matrix for the custom deep learning model. This model correctly identified 22 out of 24 cyberbullying cases, while producing 2 false negatives and 49 false positives.

Fig. 4.

Confusion matrix of machine learning models. Note. (A) Logistic regression; (B) Naïve Bayes; (C) KNN; (D) SVM; (E) LightGBM; (F) Random forest; (G) XGBoost; (H) Decision tree.

Fig. 5.

Confusion matrix of the deep learning model

To assess whether the proposed deep-learning pipeline is unnecessarily complex, we added a simplified ablation under the same train/validation split (no pretraining, no layer freezing, no class-weighted loss, and a shallower MLP; see Supplementary Table S1). The simplified model achieved higher overall accuracy on the imbalanced validation set, but its positive-class recall/TPR dropped dramatically (detecting only 1 of 24 positive cases), indicating a strong majority-class bias. In contrast, the proposed strategy substantially improved positive-case detection, which is more aligned with the screening-oriented objective of minimizing false negatives.

To address concerns about the small 30/30 pretraining subset and the potential instability introduced by freezing hidden layers, we conducted a repeated stability analysis using 5 runs with different random seeds (which jointly vary model initialization, mini-batch order, and pretraining-subset sampling). As summarized in Supplementary Table S2, performance showed non-trivial variability across runs, but the frozen strategy maintained a higher mean positive-class recall/TPR than the no-freeze variant (0.7917 ± 0.1102 vs. 0.7000 ± 0.0801), consistent with the screening-oriented objective of prioritizing sensitivity. Detailed run-level results are provided in Supplementary Table S3.

To further disentangle architectural effects from training-strategy effects, we conducted additional same-architecture comparisons under the identical train/validation split. Within the same deep MLP architecture, removing layer freezing reduced positive-class recall from 0.92 to 0.79, removing class-weighted loss reduced recall to 0.83, and removing pretraining/freezing while retaining only class weighting reduced recall to 0.63. A plain deep MLP without the proposed imbalance-aware strategy showed very poor recall (0.08). In contrast, under the same pretraining + freezing + class-weighted setting, a shallow MLP achieved lower recall than the deep MLP (0.67 vs. 0.92). These results suggest that the performance gain should be interpreted at the level of the overall pipeline rather than architecture alone. Specifically, the imbalance-aware training strategy appears to be the primary contributor to minority-class sensitivity, while the deeper architecture provides additional benefit.

Model interpretability analysis based on SHAP

Feature importance

Figure 6 presents the mean absolute SHAP values for all input variables. The top contributing features include screen time, negative emotions, school connectedness, online disinhibition, exposure to violent media and deviant peer affiliation. Conversely, variables such as online anonymity, only child status, and age display relatively low SHAP values, implying limited influence on model predictions.

Fig. 6.

Mean absolute SHAP values for feature importance

Figure 7 further elaborates on feature importance by incorporating the direction and distribution of SHAP values across samples. High values of screen time, negative emotions, and online disinhibition (in red) are predominantly associated with positive SHAP values. Conversely, high school connectedness and peer support values are generally linked with negative SHAP values.

Fig. 7.

SHAp summary plot with feature value distributions

Marginal effects of key predictors

Given the large number of input variables, we selected a subset of the most impactful predictors for deeper analysis using partial dependence plots (PDPs), as shown in Fig. 8. This subset includes the top six variables based on their SHAP importance: screen time (Fig. 8(A)), negative emotions (Fig. 8(B)), school connectedness (Fig. 8(C)), online disinhibition (Fig. 8(D)), exposure to violent media (Fig. 8(E)), and deviant peer affiliation (Fig. 8(F)). These PDPs illustrate the marginal effect of each feature on the model’ s predicted output, while holding all other features constant. Clear monotonic relationships were observed in several cases. For instance, SHAP values increase steadily with higher levels of screen time, negative emotions, and online disinhibition, indicating a strong positive association with predicted cyberbullying risk. Conversely, school connectedness displays a negative relationship, indicating that higher school connectedness is associated with lower model-predicted cyberbullying risk. Figure 8 (E) and (F) show SHAP dependence plots for exposure to violent media and deviant peer affiliation. The x‑axis denotes the feature value; the y‑axis is the SHAP contribution (log‑odds). Both features exhibit positive associations with the predicted probability of cyberbullying. For exposure to violent media, contributions rise sharply beyond approximately 0.5 and then display a diminishing marginal increase (suggesting a possible threshold or saturation). Deviant peer affiliation shows an almost monotonic increase across its range. Vertical dispersion at a given x indicates heterogeneity due to interactions with other features.

Fig. 8.

SHAP-based partial dependence plots of key predictors on cyberbullying classification. Note. (A) Partial dependence plot: Screen time; (B) Partial dependence plot: Negative emotions; (C) Partial dependence plot: School connectedness; (D) Partial dependence plot: Online disinhibition; (E) Partial dependence plot: Exposure to violent media; (F) Partial dependence plot: Deviant peer affiliation.

Interaction effects of school connectedness with risk factors

Figure 9 shows consistent interaction-like SHAP patterns in which higher levels of school connectedness are associated with weaker positive SHAP contributions from several risk-related variables. In Fig. 9(A), the critical value for school connectedness lies around the midpoint of the scale. For participants with lower levels of school connectedness, SHAP values associated with screen time increase notably, suggesting that excessive screen time substantially elevates the predicted risk of cyberbullying perpetration. However, when school connectedness is high, the contribution of screen time to the model’s prediction diminishes, with SHAP values remaining close to or below zero regardless of screen time levels. A similar buffering pattern is observed in Fig. 9(B). Among participants with low school connectedness, increases in negative emotions correspond to more positive SHAP values, indicating a higher predicted risk. In contrast, when school connectedness is high, the effect of negative emotions on predicted cyberbullying risk weakens or disappears entirely. Similar patterns are seen in Fig. 9(C). The predicted risk of cyberbullying increases with rising disinhibition scores, but primarily among individuals with weak school ties. In contrast, those with stronger school connectedness show lower and more stable SHAP values across online disinhibition levels. For individuals with low school connectedness, violent media exposure strongly elevates the predicted risk of cyberbullying, as indicated by increasingly positive SHAP values. However, this effect is attenuated when school connectedness is high, where SHAP values tend to remain neutral or negative regardless of exposure levels (Fig. 9(D)). Finally, Fig. 9(E) shows that deviant peer affiliation is a potent risk factor for cyberbullying, particularly for those with weak school connectedness. The SHAP values grow more positive as deviant peer affiliation increases under low school bonding conditions. Yet, among participants with high school connectedness, this trend flattens.

Fig. 9.

SHAP interaction effects between school connectedness and key risk factors. Note. A Interaction: school connectedness & screen time; B Interaction: school connectedness & negative emotions; C Interaction: school connectedness & online disinihibion; D Interaction: school connectedness & exposure to violent media; E Interaction: school connectedness & deviant peer affiliation.

Threshold sensitivity analysis

To quantitatively characterize the trade-off associated with prioritizing Recall, we performed a post hoc threshold sensitivity analysis on the validation set using the saved best-model probabilities (Supplementary Table S4). Across thresholds (0.10–0.90), Precision, Recall (TPR), Accuracy, Specificity, and confusion-matrix counts changed substantially, indicating a threshold-dependent operating-point trade-off. At the default threshold of 0.50 (used in the main analysis), the model achieved Recall/TPR = 0.92 (22/24 positive cases detected), Precision = 0.31, Accuracy = 0.68, and Specificity = 0.64, with FP = 49 and FN = 2. When the threshold was increased to 0.70, FP decreased to 5 and Specificity increased to 0.96, while Precision increased to 0.58 and Accuracy to 0.86; however, Recall/TPR decreased to 0.29 (7/24 positive cases detected). At threshold = 0.80, FP = 0 and Precision = 1.00, but Recall/TPR further decreased to 0.04 (1/24 positive case detected).

Discussion

This study proposes and evaluates a custom deep neural network for predicting cyberbullying behavior among university students based on questionnaire data. Compared with conventional machine learning baselines, including logistic regression, naïve Bayes, decision tree, k-nearest neighbors, support vector machines, random forest, LightGBM, and XGBoost, the proposed model demonstrates superior recall and F1-score, despite showing slightly lower overall accuracy than some tree-based ensembles. This performance profile aligns well with the practical demands of cyberbullying detection, where minimizing FN is more critical than avoiding FP. The reduced precision can be primarily attributed to two factors: first, label noise from self-report questionnaires, which are susceptible to social-desirability bias—true perpetrators who deny involvement are labeled as negatives, causing risk-consistent positive predictions to be counted as false positives; second, recall-oriented optimization in both architectural design and loss weighting, which shifts the decision boundary toward the positive class to suppress FN at the cost of increased FP. Despite this trade-off, the model’s capacity to represent complex nonlinear psychosocial interactions makes it a valuable high-sensitivity front-end screening tool for early identification of cyberbullying cases.

The proposed deep learning model identified six features with the strongest predictive contributions to cyberbullying perpetration: screen time, negative emotions, school connectedness, online disinhibition, exposure to violent media, and deviant peer affiliation. Among these, school connectedness functioned as a protective factor, consistently associated with lower predicted cyberbullying risk and observed to moderate the influence of other risk variables. In contrast, higher levels of negative emotions, online disinhibition, deviant peer affiliation and exposure to violent media were all linked to elevated model-predicted probabilities of cyberbullying behavior. These findings suggest that cyberbullying involvement is shaped by a confluence of individual, environmental, and online contextual factors. Specifically, among individual factors, individuals with higher levels of negative emotions were more likely to engage in cyberbullying, consistent with previous findings [22]. When experiencing negative emotions, they may adopt aggressive behaviors, including cyberbullying, as a way to release negative emotions or as a maladaptive strategy to cope with internal psychological discomfort [23]. Environmental factors played diverse and significant roles in shaping cyberbullying behavior, with school connectedness emerging as one of the strongest features associated with lower model-predicted risk within this domain. As a strong predictive feature that also showed interaction-like patterns, school connectedness was associated with weaker positive predictive effects of several risk-related variables across the individual, environmental, and online contextual domains, including negative emotions, exposure to violent media, and excessive screen use. In prior adolescent samples, those with low school connectedness exhibited a higher predicted risk of cyberbullying involvement and were more susceptible to the cumulative effects of other risk factors [20]. In addition, two environmental risk factors, exposure to violent media and deviant peer affiliation, aligned closely with the Social Learning Theory [29]. Consistent with prior research, repeated exposure to aggressive media content may normalize hostile behaviors by reinforcing aggressive scripts and desensitizing emotional regulation [32, 34], while association with deviant peers may increase behavioral modeling of antisocial conduct and perceived acceptance of aggression [31, 56]. Among online context factors, screen time and online disinhibition emerged as the most influential predictors of cyberbullying, with screen time ranking as the single most important feature across all variables examined. This finding is consistent with prior studies linking excessive digital media use to a range of psychosocial and behavioral problems [57]. Screen time, while it may act as a behavioral signal reflecting deeper vulnerabilities such as social isolation, poor emotion regulation, and reduced engagement in offline protective activities (e.g., family interaction, physical exercise), also may increase exposure to online risk contexts. Prolonged exposure to screen-based environments not only increases opportunities for online conflict but may also facilitate emotional fatigue, cognitive disengagement, and risk normalization within unmoderated digital platforms [58]. Moreover, online disinhibition also emerged as a robust predictor of cyberbullying. This aligns with the well-established online disinhibition effect [35], which posits that individuals feel less inhibited and more willing to express themselves freely in online spaces.

Theoretical and practical implications

Theoretically, the findings of this study are broadly consistent with both the General Aggression Model and the Social-Ecological Framework [9, 10], offering an integrated explanation of how cyberbullying behavior emerges from the interaction of individual, environmental, and online contextual factors. Methodologically, the study contributes to emerging efforts to address the challenges of behavior prediction in highly imbalanced data settings. Unlike many traditional approaches that optimize for overall accuracy and thus often underperform on minority-class detection, our recall-oriented custom deep neural network is specifically designed to minimize false negatives, which is critical in the cyberbullying domain where under-identification of actual perpetrators undermines intervention efforts. The model’s capacity to capture complex, nonlinear feature interactions, supported by SHAP-based interpretability, demonstrates a promising computational pathway for handling other psychosocial or behavioral prediction tasks marked by class imbalance, latent confounding, and multi-level influences. This modeling paradigm can inform future studies aiming to detect low-base-rate events such as substance abuse, self-harm, or school violence within university student populations. The threshold sensitivity analysis provides a quantitative explanation for the observed pattern of high Recall accompanied by more false positives at the default threshold. Specifically, the results show that the false-positive burden is not an uncontrollable defect of the model, but a threshold-dependent trade-off: increasing the decision threshold can markedly reduce false positives and improve Precision/Specificity, but only at the cost of substantially lower Recall (i.e., more false negatives). This trade-off is especially important in our imbalanced validation set, where higher Accuracy at more conservative thresholds partly reflects predicting fewer positive cases and therefore does not necessarily indicate better screening utility. Because the intended use of our model is first-stage screening / risk flagging rather than stand-alone diagnosis, we prioritized sensitivity (Recall/TPR) to reduce missed high-risk cases, while recognizing that this choice increases false positives and requires follow-up assessment (e.g., counselor review or secondary screening).

Practically, the identified predictors provide a focused set of targets for early screening and prevention efforts. For instance, elevated screen time or self-reported negative emotions may serve as low-cost, scalable warning signals in digital well-being monitoring systems. The buffering effect of school connectedness also suggests that school climate interventions aimed at strengthening peer belonging and institutional support could yield downstream benefits in reducing cyberbullying [59]. Additionally, insights into the role of violent media and deviant peer affiliation may guide parental mediation strategies and media literacy programs, encouraging critical engagement with online content and fostering prosocial digital norms. Finally, the model’ s success in using questionnaire-based psychosocial data to flag high-risk individuals suggests a potential deployment pathway within school-based mental health assessments or digital wellness platforms.

Research limitations and future directions

This study has several limitations that warrant consideration. Firstly, this study uses cross-sectional data, which prevents us from drawing any causal conclusions regarding the relationships between variables. To more effectively investigate the causal pathways between risk and protective factors and the occurrence of cyberbullying perpetration, future research should consider implementing longitudinal designs. Second, the use of self-reported data to measure cyberbullying behaviors may introduce bias and contribute to false positives in the predictive model. Specifically, the model may identify a student as a cyberbully, while the individual denies such behavior in self-assessments. This discrepancy can stem from social desirability bias, whereby participants underreport socially undesirable behaviors to present themselves in a more favorable light. Consequently, future studies could benefit from incorporating multi-informant reports to to enhance the reliability and validity of the outcome measures. Third, while the SHAP approach provided valuable insights into feature importance and interactions at the input-feature level, these findings should be interpreted with caution. They indicate how the model assigns predictive importance to variables in the current dataset and, while generally consistent with prior literature, do not by themselves establish causal relationships or verify theoretical mechanisms. In addition, the interpretability of deep learning models remains limited, particularly in explaining complex hierarchical representations learned in hidden layers. Future research could extend interpretability analyses by employing advanced methodologies such as layer-wise relevance propagation or feature visualization techniques to elucidate higher-order representations and decision-making mechanisms embedded within neural networks. Such deeper interpretability would significantly enhance model transparency and facilitate the translation of findings into targeted interventions and preventive strategies in practical contexts. Fourth, in this study, participants were classified as perpetrators if they reported engaging in any listed cyberbullying behavior at least once in the past 30 days. This dichotomous labeling strategy may obscure meaningful differences within the positive class, particularly between occasional and repeated perpetrators. Future work should examine alternative outcome formulations when item-level frequency information is available, such as stricter dichotomization thresholds (e.g., “once or more” vs. “repeated”), ordinal classification (e.g., none / once / repeated), frequency-based regression, or stratified/hierarchical modeling of perpetration intensity. Such approaches may help reduce within-class heterogeneity and improve alignment between model outputs and clinically or educationally meaningful risk levels. Lastly, although the repeated analysis across five random seeds showed that the frozen fine-tuning strategy retained a higher mean Recall/TPR than the no-freeze variant, the results also exhibited non-trivial variability across runs. This suggests that model performance remains sensitive to random initialization, mini-batch ordering, and sampling of the small 30/30 pretraining subset. Therefore, the present findings should be interpreted as promising but not fully stable estimates. Future studies should further examine robustness using larger samples, repeated cross-validation or nested resampling, alternative pretraining-subset sizes, and external validation datasets.

Abbreviations

GAM

General Aggression Model

SIP

Social Information Processing Model

BGCM

Barlett Gentile Cyberbullying Model

SVM

Support Vector Machines

KNN

K-Nearest Neighbors

TP

True positives

FP

False positives

FN

False negatives

TN

True negatives

Authors' contributions

H.Z. conceived of the study, participated in its design, collected and curated data, drafted the manuscript, and provided critical revisions to the manuscript; Y.C. conceived of the study, participated in its design, contributed to data analysis and interpretation, and provided critical revisions to the manuscript. X.Q. collected data, assisted with data curation and validation, and provided critical revisions to the manuscript; M.C. collected and curated data, participated in data analysis and interpretation, and provided critical revisions to the manuscript; Q.Z. participated in its design, developed the software, prepared the visualizations, drafted the manuscript, and provided critical revisions to the manuscript; H.J. collected data, validated the results, performed the statistical analysis, and provided critical revisions to the manuscript; J.L. supervised the study, provided resources, administered the project, and provided critical revisions to the manuscript. All authors reviewed and approved the final manuscript.

Funding

This work was supported by the Natural Science Foundation of Fujian Province of China (Grant numbers. 2025J011118).

Data availability

Data and the code are available on request from authors.

Declarations

Ethics approval and consent to participate

All research procedures followed were in accordance with the ethical standards of the World Medical Association (Declaration of Helsinki) for research involving human subjects. All procedures were reviewed and approved by the Academic Ethics and Moral Committee of Shanghai Normal University (Decision No. 097 of 2023). Written informed consent to participate in the study was obtained from all individual participants included in the study.

Consent for publication

Not applicable.

Competing interests

The authors declare no competing interests.