Research map / Large language models / Instruction and fine-tuning
IF-Guide: Influence Function-Guided Detoxification of LLMs
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes IF-Guide, which uses EK-FAC influence functions with differential, token-level attribution to find toxic training tokens and suppresses them via a penalty term during pre-training or fine-tuning, reducing toxicity without human preference data.
Problem
LLMs learn toxic behaviors from training data, and existing mitigations (filtering, DPO, RAD decoding) are reactive, coarse, or require human preference data; the paper asks how to identify toxic training content via influence and suppress its effect during training.
Approach
Adapts influence functions into a token-level, differential score (toxic minus non-toxic query gradients, computed with EK-FAC), selects toxic tokens with document ranking and a 2% budget, and trains with a penalized next-token loss that lowers the likelihood of selected tokens.
Key results
- IF-Guide reduces RTP full-set EMT by 4.2-5.5x and TP by 6.8-10.4x across Pythia-160M to Llama-3.2-1B, outperforming DPO and filtering baselines.
- Combining IF-Guide with RAD yields EMT and TP reductions of 14.3-18.0x and 21.2-32.9x on the full RTP set.
- A 160M-parameter proxy model (Pythia-160M) identifies toxic tokens effectively for targets up to 1B, with proxies up to 7.5x smaller than targets giving speed-ups up to 19x.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use IF-Guide instead of RAD | Pythia-160M · RealToxicityPrompts Full | EMT: 0.118 -> 0.101 | Helped |
| Use IF-Guide instead of RAD | Pythia-1B · RealToxicityPrompts Full | TP: 0.138 -> 0.065 | Helped |
| Combine IF-Guide with RAD | Pythia-160M · RealToxicityPrompts Full | EMT: 0.101 -> 0.031 | Helped |
| Add 1 neighboring context token per influential token (ablation) | IF-Guide on Pythia-410M · RTP | EMT: 0.44 -> 0.24 | Helped |
| Add 2 neighboring context tokens per influential token (ablation) | IF-Guide on Pythia-410M · RTP | EMT: 0.24 -> 0.48 | Hurt |
| Add suppression penalty with lambda=1 rather than lambda=0 (ablation) | IF-Guide on Pythia-410M · RTP | EMT: 0.30 -> 0.14 | Helped |
| Increase toxic-token limit from 5M to 20M (ablation) | IF-Guide on Pythia-410M · RTP | EMT: 0.32->0.11 | Helped |
| Increase toxic-token limit to 25M (ablation) | IF-Guide on Pythia-410M · RTP | PPL: 26.33 | Hurt |
| Set toxic-token threshold to percentile 99 rather than 95 (ablation) | IF-Guide on Pythia-410M · RTP | EMT: 0.22->0.14 | Helped |
| Raise toxic-token threshold from percentile 99 to 99.5 (ablation) | IF-Guide on Pythia-410M · RTP | EMT: 0.14->0.21 | Hurt |
| Use 10k rather than 1k toxic/non-toxic query examples (ablation) | IF-Guide · RTP | EMT: 1k queries: 0.24; minimal differences at 10k (< 0.02) | Helped |
| Replace attribution-based selection with toxicity-classifier filtering (ablation) | IF-Guide on Pythia-410M · RTP | EMT | Hurt |
Surprising findings
- Standard influence functions are ineffective at reducing toxicity: removing up to 50% of top-influence examples yields only modest toxicity gains while significantly degrading perplexity and accuracy.
- Larger proxy models do not consistently improve results; the smallest proxy sometimes matches the largest.
Limitations
- Influence estimation remains prohibitively expensive for commercial-scale models and trillion-token corpora.
- Relies on automated toxicity classifiers (Detoxify, ToxiGen-RoBERTa) that may have biases and miss subtle toxicity.
- Experiments use a one-billion-token academic-scale corpus; PPL degrades for larger models, possibly due to limited data.
Experimental setup
Datasets: OpenWebText RealToxicityPrompts LAMBADA AttaQ BOLD The Pile
Benchmarks: RealToxicityPrompts BOLD AttaQ LAMBADA OpenWebText perplexity
Metrics: expected maximum toxicity toxicity probability perplexity accuracy attack success rate
Baselines: Word Filtering Toxicity Filtering DPO RAD Naive influence + suppression
Builds on: influence functions (Koh and Liang) EK-FAC (Grosse et al.) DPO RAD Kronfluence
Closest papers by meaning
- Large Language Models can Become Strong Self-Detoxifiers (ICLR 2025 · similarity 0.89)
- When Bad Data Leads to Good Models (ICML 2025 · similarity 0.89)
- Redefining Experts: Interpretable Decomposition of Language Models for Toxicity Mitigation (NeurIPS 2025 · similarity 0.88)
- Model Editing as a Robust and Denoised variant of DPO: A Case Study on Toxicity (ICLR 2025 · similarity 0.88)
- UniDetox: Universal Detoxification of Large Language Models via Dataset Distillation (ICLR 2025 · similarity 0.87)
- A Mechanistic Understanding of Alignment Algorithms: A Case Study on DPO and Toxicity (ICML 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.