Brand safety in 2026: keyword blocklists are dead, contextual AI is alive — 12 dimensions in 50ms

Back in 2022 we worked on a blue-chip brand's safety list. 4,800 forbidden keywords across six languages. The advertiser was a car manufacturer, and 'crash' was of course on the blocklist. Six months later we realised: 'crash test' articles were being blocked — exactly the content the manufacturer would have wanted. The keyword blocklist is dead. In 2026 we classify with contextual AI.

Why the keyword approach broke

Three structural failures.

False positive rate: in our measurements, keyword-based blocking incorrectly filters 11-14% of brand-safe pages. On a 2 billion HUF campaign that is 220-280M HUF in lost impressions.

False negative rate: 23% of genuinely harmful pages slip through because they avoid the forbidden keyword. 'Assassination' blocked, 'incident' not. Same content.

Unmaintainability: lists go stale within six months. In 2024 we audited a client's 18,000-row list — 41% was pre-2018 vocabulary, and 6% referenced URLs that no longer exist.

The 12 dimensions we score today

The contextual AI classifies the page on 12 independent dimensions, each with a 0.0-1.0 confidence score. The 12 are IAB-aligned but partly proprietary.

1. Violence (graphic / news reportage / fictional distinction)
2. Adult content
3. Drugs and alcohol
4. Political sensitivity (country-specific thresholds)
5. Religious sensitivity
6. Hate speech
7. Tragedy and catastrophe (recent vs. historical)
8. Financial speculation / scam
9. Health misinformation
10. Product conflict (competitor mentions)
11. Child presence (not harmful, just a context signal)
12. Tone: humorous / serious / critical / promotional

The advertiser does not get a global 'safe / unsafe' bit; they get 12 scores and configure the threshold per brand. An energy drink tolerates a 0.7 'tone: critical' page; an insurer does not.

The latency that matters

In an RTB transaction we have 80-120 milliseconds total for the entire auction. Brand-safety classification gets a 50ms hard limit out of that. We do not run an LLM here — Sonnet 4.6 takes 600-900ms to first token. The 12-dimension classifier is a distilled, page-text fine-tuned 180M-parameter model. 38ms mean on GPU, 47ms p99. The 'tone' dimension is served separately by a smaller classifier, 12ms.

The distillation training set: 280,000 pages, every one labelled by two human auditors. Review rounds: 4. Inter-annotator agreement (Cohen's kappa): 0.81 averaged across the 12 dimensions.

Caching and real-time

Most pages do not change radically inside 24 hours. URL-level cache, 6-hour TTL, roughly 78% cache-hit rate on a typical day. That means the 50ms SLA actually only applies to the 22% of pages we have not seen.

Refresh is triggered: if the page HTML hash differs from the cached version, we reclassify. Breaking-news pages get re-evaluated hourly.

The measured result

A 2025 Q4 audit against the legacy keyword list, aggregated across six advertisers:

• False positives dropped: 12.4% → 1.8% (-10.6 percentage points)
• False negatives dropped: 23% → 4.1%
• Inventory reach increased: +18% at the same brand-safety threshold
• Advertiser complaint tickets: 7/month → 1/month (each a rare contextual-AI edge case, not structural)

What AI does not solve

The model does not decide for you what counts as brand safe. Threshold configuration remains human work, per brand, per campaign. And the audit trail is mandatory: every blocked or allowed page carries a 12-score decision record that the advertiser can query through an IAB-aligned dashboard.

The model does not understand every context. Satire is consistently mislabelled. Region-varying political sensitivity is handled uniformly. For these we have an escalation queue — 0.4% of pages per month go to human audit.

Takeaway

Brand safety in 2026 is not a forbidden-word problem. It is a confidence-scored, context-aware, multi-dimensional decision. The 12 scores are individually interpretable and individually tunable per brand. The 50ms latency and 78% cache hit rate are not optimisation side effects — they are what makes the system viable inside RTB.