Research map / Large language models / Instruction and fine-tuning
Large Language Models can Become Strong Self-Detoxifiers
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes SASA, a training-free controlled decoding method that learns a Bayes-optimal linear toxic/non-toxic subspace from the LM's own embeddings and reweights next-token sampling by the margin to reduce toxicity.
Problem
Reducing toxic output of LLMs at inference time without an external reward model or any retraining, while keeping fluency.
Approach
Learn a closed-form Gaussian discriminant (linear) subspace over the LM's own last-token context embeddings from a labeled toxicity dataset, and at each decoding step add beta times the softmax-normalized margin to the logits; the paper proves this is the optimal solution to an expected-margin minus KL-regularized objective.
Key results
- On challenging RTP with Llama-2-7b at beta=500, SASA reaches 0.426 avg. max toxicity vs 0.481 for RAD, at perplexity 7.20 vs 7.33.
- On AttaQ with Llama-2-7b, SASA reduces avg. max toxicity to 0.142 vs 0.264 for RAD, with lower perplexity (6.3 vs 10.5 as stated in intro).
- On challenging RTP with Llama-3.1-8b-Instruct, SASA lowers avg. max toxicity from 0.727 to 0.234 at beta=500.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply SASA β=500 instead of the unmodified model | GPT2-Large · RTP non-toxic prompts | Avg. Max Toxicity: 0.327 -> 0.083 | Helped |
| Use SASA β=500 instead of RAD β=500 | GPT2-Large · RTP non-toxic prompts | Avg. Max Toxicity: 0.114 -> 0.083 | Helped |
| Apply SASA β=500 instead of the unmodified model | Llama-2-7B · RTP non-toxic prompts | Toxic Rate: 0.190 -> 0.021 | Helped |
| Use SASA β=500 instead of RAD β=500 | Llama-2-7B · RTP challenging | Avg. Max Toxicity: 0.481 -> 0.426 | Helped |
| Use SASA β=500 instead of RAD β=500 | Llama-2-7B · RTP challenging | Perplexity: 7.33 -> 7.20 | Helped |
| Apply SASA β=500 instead of the unmodified model | Llama-2-7B · BOLD first 1000 samples | Avg. Max Toxicity: 0.214 -> 0.0229 | Helped |
| Use SASA β=500 instead of RAD β=500 | Llama-2-7B · AttaQ | Avg. Max Toxicity: 0.264 -> 0.142 | Helped |
| Apply SASA β=500 instead of the unmodified model | Llama-3.1-8B-Instruct · RTP challenging | Toxic Rate: 0.892 -> 0.171 | Helped |
| Add word filtering to SASA β=500 (ablation) | SASA on Llama-2-7B · RTP challenging | Avg. Max Toxicity: 0.426 -> 0.178 | Helped |
| Add word filtering to SASA β=500 (ablation) | SASA on Llama-2-7B · RTP challenging | Perplexity: 7.195 -> 19.657 | Hurt |
Surprising findings
- Self-embedding linear subspace from the LM's own representations matches or beats the external reward-model method RAD on several benchmarks.
- SASA is less effective on GPT2-Large than Llama-2-7b, suggesting smaller LMs yield weaker subspaces.
Limitations
- Effectiveness depends on the quality of the LM's internal representations; smaller models like GPT2-Large show weaker gains.
- Perplexity rises at larger beta, and word filtering combined with SASA trades off fluency.
- Relies on Perspective API for evaluation, which has known false positives and version drift.
Experimental setup
Datasets: Jigsaw Unintended Bias in Toxicity Classification RealToxicityPrompts BOLD AttaQ
Benchmarks: RealToxicityPrompts BOLD AttaQ
Metrics: average maximum toxicity toxic rate perplexity
Baselines: RAD PPLM GeDi DExperts Rectification DAPT PPO Quark Self-Debiasing ToxificationReversal
Builds on: RAD PPLM Rectification
Closest papers by meaning
- UniDetox: Universal Detoxification of Large Language Models via Dataset Distillation (ICLR 2025 · similarity 0.92)
- Detoxifying Large Language Models via Autoregressive Reward Guided Representation Editing (NeurIPS 2025 · similarity 0.91)
- IF-Guide: Influence Function-Guided Detoxification of LLMs (NeurIPS 2025 · similarity 0.89)
- Redefining Experts: Interpretable Decomposition of Language Models for Toxicity Mitigation (NeurIPS 2025 · similarity 0.87)
- When Bad Data Leads to Good Models (ICML 2025 · similarity 0.87)
- Model Editing as a Robust and Denoised variant of DPO: A Case Study on Toxicity (ICLR 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.