Pith. sign in

REVIEW 4 major objections 6 minor 1 cited by

A test-time-only method steers language models away from toxic continuations by nudging prompt embeddings downhill on a black-box toxicity function.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 10:35 UTC pith:QBNPYWZS

load-bearing objection A neat, model-agnostic test-time detoxification method that works on the reported benchmarks, but the central claim that gradient estimation beats random perturbations is never tested — and the sensitivity analysis hints it may not hold. the 4 major comments →

arxiv 2602.02498 v2 pith:QBNPYWZS submitted 2026-01-14 cs.CL cs.AIcs.LG

Test-Time Detoxification without Training or Learning Anything

Baturay Saglam , Dionysis Kalogerias This is my paper
classification cs.CL cs.AIcs.LG
keywords detoxificationzeroth-order optimizationblack-box optimizationembedding steeringtest-time controlGaussian smoothingfinite-difference gradienttoxicity
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper claims that toxic generation can be reduced at inference time with no retraining, no gradient access, and no learned auxiliary components: the model is treated as a black box and the only control variable is the prompt's embedding matrix. The core move is to approximate the gradient of completion toxicity with respect to the input embeddings using a zeroth-order Gaussian-smoothed finite-difference estimator, then take a few normalized descent steps, with early stopping once toxicity falls below a threshold. The paper argues that this procedure achieves robust toxicity reductions across several models and benchmarks and, in most settings, the best toxicity–quality trade-off compared to existing decoding-based and steering-based baselines. The broader claim is that word embeddings are effective control variables for guiding autoregressive models toward safer text, opening a training-free, model-agnostic route to controllable generation.

Core claim

The central discovery is that a toxicity function evaluated on model completions can be minimized with respect to the prompt embedding matrix using only forward evaluations, via the Nesterov–Spokoiny randomized finite-difference estimator. Treating the composite objective Φ(X)=h(f(X)) as a black-box, the paper approximates ∇Φ with a Monte Carlo average of scaled directional evaluations, updates embeddings by gradient descent, normalizes steps, constrains cosine similarity to the original prompt, and stops as soon as toxicity falls below 0.5. Empirically, the method (TIDE) is reported to substantially reduce average maximum toxicity and toxicity rate on challenging prompts across GPT-2 Large,

What carries the argument

The Gaussian-smoothed zeroth-order gradient estimator (Equation 1): for an embedding matrix X perturbed tokenwise by Gaussian noise U, the gradient of the smoothed objective Φ_μ satisfies ∇Φ_μ(X)=E[((Φ(X+μU)−Φ(X))/μ) U]. Replacing the expectation with an N-sample Monte Carlo average yields a descent direction computable from forward evaluations alone. The method then couples this estimator with gradient normalization, a cosine-similarity constraint that keeps embeddings near the original prompt, and early stopping at a toxicity threshold, so that only a handful of iterations (typically under four) are needed.

Load-bearing premise

The method's theoretical grounding assumes that the composite toxicity objective is smooth (Lipschitz and Lipschitz-smooth) over the embedding regions traversed; if the toxicity landscape is rugged, the finite-difference estimates become noise and the descent mechanism lacks a guarantee, though the paper acknowledges this regularity condition is not verifiable from query access.

What would settle it

Run the method on a model and toxicity scorer where the toxicity score is adversarially constructed to be a high-frequency function of the prompt embeddings (e.g., a scorer that toggles between 0 and 1 with small embedding perturbations). If the finite-difference estimator fails to produce toxicity reductions beyond random chance, the smoothness assumption is shown to be load-bearing.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • If the central claim holds, safety filtering of LLM outputs can be performed at deployment time with no model modification, no training data, and no access to logits or hidden states, working on any model for which embeddings and forward passes are available.
  • The method positions embedding-space optimization as a near-optimal steering mechanism, suggesting that within this control family, further detoxification gains would come mainly from better toxicity objectives rather than from alternative steering rules.
  • Because the decoded optimized embeddings remain identical to the original prompt, the technique changes generation purely through what the model 'sees' in embedding space, which may extend to other black-box target behaviors (style, factuality) that can be scored by an external function.
  • The low query overhead—early stopping keeps the effective iteration count small—makes the method compatible with batched high-throughput inference pipelines, potentially enabling real-time safety intervention.
  • The theoretical link to gradient descent implies that when the objective is smooth enough, the steering direction is approximately optimal among embedding perturbations, giving a principled guarantee absent from heuristic steering methods.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same mechanism could serve as a general-purpose safety patch: any harm metric that can be scored from text (bias, hallucination likelihood, privacy leakage) might be reducible at test time without retraining, provided the score is a reasonably smooth function of the prompt.
  • The method's reliance on low-temperature decoding is a natural boundary: as temperature rises, the function being minimized becomes stochastic, and the finite-difference estimator would need explicit variance control; a natural extension is to smooth over multiple sampled completions rather than one.
  • If the decoded embeddings are genuinely invariant under optimization, the technique effectively performs a 'steering in disguise'—moving through directions that the tokenizer maps back to the same string—which suggests that gradient information is being translated into sampling-condition changes for the same prompt representation; this deserves inspection as a potential artifact or as evidence tha
  • A testable extension would be to apply the same zeroth-order embedding descent to a continuous numerical target (e.g., sentiment score, factual-consistency score) and check whether the observed monotone toxicity reductions generalize to other objectives, which would confirm or refute the paper's broader framing of embeddings as control variables.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes TIDE, a test-time detoxification procedure that treats the toxicity of a model completion as a black-box function of the prompt embedding matrix and approximates its gradient with a Gaussian-smoothed zeroth-order finite-difference estimator (Nesterov-Spokoiny). The estimated direction is used for a small number of normalized descent steps on the embeddings, with cosine-similarity projection and early stopping at a toxicity threshold. Experiments on GPT-2 Large, Gemma 2-2B, Qwen3-4B, and Llama 3.1-8B over AttaQ, BOLD, and the RTP challenging subset report lower toxicity at comparable or better perplexity than several decoding/steering baselines, at temperature 0.1. The paper also claims that TIDE provides a near-optimal embedding-space steering direction.

Significance. If the empirical claims are supported, TIDE would be an attractive safety tool: it requires no training, no gradient access, no auxiliary modules, and it transfers across model families. The evaluation is broad, the baselines were rerun with the current Perspective API, and code is promised. However, the load-bearing mechanism—that the finite-difference weighting in Eq. (2) yields a meaningful descent direction—is not isolated by any control experiment. In addition, hyperparameters are selected on a subset of the main evaluation benchmark, and the objective being optimized is the same Perspective toxicity score used in evaluation, with early stopping at the toxicity threshold mechanically suppressing the reported toxic-rate metric. These issues need to be resolved before the 'near-optimal steering' and 'robust detoxification' conclusions are accepted.

major comments (4)
  1. [Section 4.1, Eq. (2); Appendix C, Fig. 3b] The paper never compares TIDE with a random-search baseline using the same query budget. The sensitivity analysis shows N=1–8 performs comparably to N=128 and that toxicity varies non-monotonically with μ, so the observed gains could come from sampling many nearby embeddings combined with early stopping, normalization, and cosine projection, rather than from the Φ(X+μU_i)−Φ(X) weighting. Please add controls that use the same N evaluations but ignore the function-value weighting, e.g., (i) replacing the finite-difference coefficient by a constant or random sign, (ii) selecting the best of N random perturbations, and (iii) moving along a random normalized direction of the same step size. If any of these matches the TIDE toxicity–perplexity trade-off, Section 6's claim that TIDE estimates a near-optimal descent direction is unsupported.
  2. [Appendix B.1; Tables 2, 13–16] Hyperparameters were tuned on a subset of the RTP dataset (base toxicity > 0.9) and then a model-specific grid was used to select the best hyperparameters before reporting main results on the RTP challenging subset. Because RTP is the headline evaluation benchmark, the reported toxicity–perplexity trade-off is partly fitted rather than predictive. The AttaQ/BOLD results mitigate this, but they were produced with the same hyperparameters selected on RTP. Please report results on a held-out benchmark that played no role in hyperparameter selection, or use nested/leave-one-benchmark-out validation.
  3. [Section 4.2 (Early Stopping); Section 5 (Metrics)] The optimization objective Φ(X)=h(f(X)) is exactly the Perspective API toxicity score used in evaluation, and early stopping terminates as soon as h(f(X))<0.5. Consequently, the reported toxic rate (fraction of prompts with a completion above 0.5) is directly engineered to be low; e.g., Table 2 shows toxic rate 0.003 vs. 0.639 for the base model. This circularity makes the toxic-rate gains less informative. Please evaluate with an independent toxicity scorer or human annotation, and separate the score used for optimization from the score used for reporting.
  4. [Section 6.1; Section 4.1] The theoretical justification assumes Lipschitz continuity and Lipschitz smoothness of Φ and, in Nesterov–Spokoiny, deterministic function evaluations. The paper admits these conditions are 'not directly verifiable from query access,' and the experiments use stochastic decoding (temperature 0.1, M=3). Thus the claim in Section 6 that TIDE is 'near-optimal' among embedding-space steering methods goes beyond what the theory establishes. Please either provide a stochastic zeroth-order analysis or temper the optimality claim; at minimum, report confidence intervals over decoding seeds for the optimized toxicity and perplexity.
minor comments (6)
  1. [Section 5.1] The text says 'we set the threshold κ=0.5 to control computational cost,' but κ is the cosine similarity threshold (0.2 in Table 3). The early-stopping threshold is τ=0.5. Please correct the symbol.
  2. [Figures 2 and 4] The legends include 'InnerDetox,' but no method with that name appears in the baseline descriptions or in Table 2. Please clarify whether this is an alternate name for Toxification Reversal or a leftover from an earlier draft.
  3. [References] References [6] and [7] are the same PPLM paper; one duplicate should be removed.
  4. [Appendix C] The text says 'changing μ changes the smoothed objective fμ'; the paper elsewhere uses Φ_μ. Use consistent notation.
  5. [Algorithm 1 / Section 4] Methodology says 'typically K<4' but Algorithm 1 allows up to K iterations and experiments set K=10. Clarify whether K is a maximum and what the typical early-stopped iteration count means for the reported # iterations.
  6. [Abstract / Section 6] The abstract claims the 'best overall toxicity–quality trade-off' without stating the low-temperature condition. Given the paper's own limitation that high temperature makes Φ unstable, the abstract should hedge or explicitly mention the temperature setting.

Circularity Check

2 steps flagged

Toxic-rate metric is the algorithm's own early-stopping rule; RTP hyperparameters are tuned on the evaluation set, but the gradient-steering core is externally grounded and held-out benchmarks support the central claim.

specific steps
  1. self definitional [Section 4.2 (Early Stopping), Section 5 (Metrics), Table 3, Algorithm 1]
    "if h(f(X_{k+1})) < τ then break (Algorithm 1); 'toxicity rate, where the latter is the probability that at least one of the M completions has toxicity greater than 0.5' (Sec. 5); 'The toxicity threshold τ = 0.5 is used throughout.' (Table 3)"

    The reported Toxicity Rate counts completions with Φ > 0.5, while TIDE's termination condition is Φ < 0.5 with the same τ = 0.5. The near-zero Toxic Rate values (e.g., 0.003 in Table 2) are therefore the algorithm's own stopping predicate, not an independent measurement. This metric reduces by construction; the max/mean toxicity and perplexity results are less directly forced, so the circularity is partial.

  2. fitted input called prediction [Appendix B.1 (Hyperparameter Selection) and Section 5.1]
    "We first tuned hyperparameters on GPT-2 using the subset of the RTP dataset where the base model's average toxicity exceeds 0.9, which corresponds to roughly 100 samples. ... After selecting the best configuration, we constructed model-specific grids for the remaining models by scaling these values ... We then ran this scaled, model-specific grid to select the best hyperparameters for each model."

    The main RTP 'challenging' benchmark is also the source of the 100-sample tuning subset used to select μ, N, η, and κ. Reporting the resulting RTP toxicity–perplexity trade-off as evidence of the 'best overall toxicity–quality trade-off' therefore includes hyperparameters fitted to the same benchmark. The central claim retains independent support from AttaQ and BOLD, which were not used for tuning, limiting the severity.

full rationale

The derivation chain itself is mostly self-contained: the zeroth-order estimator in Eq. (2) is the standard Nesterov–Spokoiny finite-difference identity, cited to an external source, and the descent update directly minimizes the defined objective Φ = h(f(X)); that an optimizer reduces its own objective is not circular. The paper does not rely on a self-citation chain or imported uniqueness theorem: references [16], [39], and [42] are illustrative rather than load-bearing, and the sensitivity analysis independently shows small N is adequate. The significant caveats are two. First, the Toxicity Rate metric is defined by the same 0.5 threshold used in the early-stopping rule, so the near-zero toxic rates are engineered by the termination condition rather than discovered. Second, the RTP benchmark used for the headline trade-off is the same dataset from which the GPT-2 hyperparameter tuning subset is drawn, so part of the RTP advantage is fitted; held-out AttaQ/BOLD results mitigate this. The absence of a random-search control is an empirical-validity concern about whether the estimator is a true gradient direction, not a circularity, and therefore does not raise the score further.

Axiom & Free-Parameter Ledger

5 free parameters · 4 axioms · 0 invented entities

The method introduces no new physical or theoretical entities; the 'steering direction' is a standard zeroth-order gradient estimate. The free parameters are all hyperparameters of the optimization, tuned on the evaluation benchmark. The axioms are the unverifiable smoothness conditions, the low-temperature regime, and the regularization assumption, plus the imported standard ZO theory.

free parameters (5)
  • Perturbation scale μ = 0.03 (Llama 3.1-8B), 0.01 (Qwen3-4B), 0.05 (Gemma 2-2B), 0.1 (GPT-2 Large)
    Controls bias-variance of the Gaussian smoothing estimator; selected via grid search on an RTP subset (Appendix B.1).
  • Number of Monte Carlo samples N = 16, 8, 8, 8
    Number of random perturbations per gradient estimate; tuned per model; higher N reduces variance but increases forward passes.
  • Step size η = 0.3, 0.65, 1.0, 1.5
    Gradient descent step size after normalization; tuned per model via grid search.
  • Cosine similarity threshold κ = 0.2 (all models)
    Bound on how far updated embeddings can drift from the original prompt; tuned via grid search.
  • Early-stopping toxicity threshold τ = 0.5
    Standard threshold from prior detoxification work (Liu et al.; Deng and Raffel); not tuned in this paper.
axioms (4)
  • domain assumption The composite objective Φ(X) = h(f(X)) is Lipschitz continuous and Lipschitz-smooth over the embedding regions traversed by the optimization, so the Gaussian-smoothed gradient estimator (Eq. 1) has bounded bias and provides a useful descent direction.
    Section 4.1 acknowledges these conditions are 'not directly verifiable' in the black-box setting, yet the near-optimality discussion in Section 6 relies on them.
  • domain assumption At low decoding temperature (0.1), the stochasticity of the model's completions does not invalidate the finite-difference estimates; at higher temperatures the objective becomes too unstable.
    The low-temperature requirement is empirically observed (Section 5, Section 6.1) and is a restriction on the method's applicability that is not guaranteed by the ZO theory, which assumes deterministic evaluations.
  • domain assumption The cosine-similarity projection (κ=0.2) keeps the perturbed embeddings in a region where the model's outputs remain meaningful and where the decoded tokens stay identical to the original prompt.
    This ad hoc regularization is essential to the headline 'prompt unchanged' observation, but its adequacy is only validated empirically.
  • standard math Nesterov and Spokoiny's Gaussian-smoothing theory (identity Eq. 1 and the bias bounds) is valid and applicable as stated.
    The paper directly imports the ZO estimator theory from [35]; this is standard mathematical background.

pith-pipeline@v1.3.0-alltime-deepseek · 23371 in / 13764 out tokens · 131815 ms · 2026-08-03T10:35:52.429838+00:00 · methodology

0 comments
read the original abstract

Large language models can produce toxic or inappropriate text even for benign inputs, creating risks when deployed at scale. Detoxification is therefore important for safety and user trust, particularly when we want to reduce harmful content without sacrificing the model's generation quality. Many existing approaches rely on model retraining, gradients, or learned auxiliary components, which can be costly and may not transfer across model families or to truly black-box settings. We introduce a test-time procedure that approximates the gradient of completion toxicity with respect to the input embeddings and uses a small number of descent steps to steer generation toward less toxic continuations. This is achieved with zeroth-order optimization that requires only access to input embeddings, a toxicity scoring function, and forward evaluations of the model. Empirically, the approach delivers robust toxicity reductions across models and prompts and, in most settings, achieves the best overall toxicity-quality trade-off. More broadly, our work positions word embeddings as effective control variables and encourages wider use of black-box optimization to guide autoregressive language models toward scalable, safer text generation, without requiring any training or access to intermediate computations.

Figures

Figures reproduced from arXiv: 2602.02498 by Baturay Saglam, Dionysis Kalogerias.

Figure 1
Figure 1. Figure 1: Illustrative example of our test-time procedure, where model completions are shown in bold. We terminate optimization once the completion toxicity Φ falls below 0.5. The procedure shifts the embedding toward regions of lower toxicity in the landscape, as shown in the second panel, where the dashed line indicates the steepest descent (theoretical optimum). to reduce downstream toxicity—conceptually by follo… view at source ↗
Figure 2
Figure 2. Figure 2: Performance in terms of maximum toxicity versus fluency perplexity on prompts from the RealToxici￾tyPrompts benchmark, averaged over three completions generated with temperature 0.1. The best performance lies in the lower left. For RAD and SASA, only the results for 𝛽 = {50, 75, 100} are shown for clarity, with darker markers indicating larger 𝛽 values. A Better Toxicity–Fluency Trade-Off Under this relati… view at source ↗
Figure 3
Figure 3. Figure 3: Performance in terms of maximum toxicity and fluency perplexity (shown separately) on prompts from the “challenging” subset of the RealToxicityPrompts benchmark, averaged over three completions generated with temperature 0.1, except in the temperature experiments. The best performance lies in the lower left. The tested values are listed in [PITH_FULL_IMAGE:figures/full_fig_p021_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Performance in terms of maximum toxicity versus fluency perplexity, averaged over three completions generated with temperature 0.1. The best performance lies in the lower left. For RAD and SASA, only the results for 𝛽 = {50, 75, 100} are shown for clarity, with darker markers indicating larger 𝛽 values. From left to right: Llama 3.1-8B, Qwen3-4B, Gemma 2-2B, GPT-2 Large (774M). 22 [PITH_FULL_IMAGE:figures… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Self-Improving In-Context Learning

    cs.CL 2026-05 unverdicted novelty 7.0

    A test-time zeroth-order optimization of prompt embeddings using a bounded self-supervised proxy from demonstration log-probabilities improves ICL accuracy and correlates with gains across tasks.

Reference graph

Works this paper leans on

56 extracted references · 8 canonical work pages · cited by 1 Pith paper

  1. [1]

    Llama 3 model card

    AI@Meta. Llama 3 model card. 2024. URL https://github.com/meta-llama/llama3/blob/main/ MODEL_CARD.md

    2024

  2. [2]

    Director: Generator-classifiers for supervised language modeling

    Kushal Arora, Kurt Shuster, Sainbayar Sukhbaatar, and Jason Weston. Director: Generator-classifiers for supervised language modeling. In Yulan He, Heng Ji, Sujian Li, Yang Liu, and Chua-Hui Chang, editors,Proceedings of the 2nd Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics and the 12th International Joint Conferen...

    2022

  3. [4]

    Systematic rectification of language models via dead-end analysis

    Meng Cao, Mehdi Fatemi, Jackie CK Cheung, and Samira Shabanian. Systematic rectification of language models via dead-end analysis. InThe Eleventh International Conference on Learning Represen- tations, 2023. URLhttps://openreview.net/forum?id=k8_yVW3Wqln

    2023

  4. [5]

    Enhancing zeroth-order fine- tuning for language models with low-rank structures

    Yiming Chen, Yuan Zhang, Liyuan Cao, Kun Yuan, and Zaiwen Wen. Enhancing zeroth-order fine- tuning for language models with low-rank structures. InThe Thirteenth International Conference on Learning Representations, 2025. URLhttps://openreview.net/forum?id=9BiVepgmWW. 12

    2025

  5. [7]

    Plug and play language models: A simple approach to controlled text generation

    Sumanth Dathathri, Andrea Madotto, Janice Lan, Jane Hung, Eric Frank, Piero Molino, Jason Yosinski, and Rosanne Liu. Plug and play language models: A simple approach to controlled text generation. In International Conference on Learning Representations, 2020. URL https://openreview.net/forum? id=H1edEyBKDS

    2020

  6. [8]

    Reward-augmented decoding: Efficient controlled text generation with a unidirectional reward model

    Haikang Deng and Colin Raffel. Reward-augmented decoding: Efficient controlled text generation with a unidirectional reward model. In Houda Bouamor, Juan Pino, and Kalika Bali, editors,Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 11781–11791, Singapore, December 2023. Association for Computational Linguisti...

    doi:10.18653/v1/2023.emnlp-main.721 2023

  7. [9]

    Bold: Dataset and metrics for measuring biases in open-ended language generation

    Jwala Dhamala, Tony Sun, Varun Kumar, Satyapriya Krishna, Yada Pruksachatkun, Kai-Wei Chang, and Rahul Gupta. Bold: Dataset and metrics for measuring biases in open-ended language generation. InProceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency, FAccT ’21, page 862–872, New York, NY, USA, 2021. Association for Computing M...

    arXiv 2021

  8. [10]

    DSCD: Large lan- guage model detoxification with self-constrained decoding

    Ming Dong, Jinkui Zhang, Bolong Zheng, Xinhui Tu, Po Hu, and Tingting He. DSCD: Large lan- guage model detoxification with self-constrained decoding. In Christos Christodoulopoulos, Tanmoy Chakraborty, Carolyn Rose, and Violet Peng, editors,Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 3969–3984, Suzhou, Chi...

    doi:10.18653/v1/2025.emnlp-main.197 2025

  9. [11]

    Variance- reduced zeroth-order methods for fine-tuning language models

    Tanmay Gautam, Youngsuk Park, Hao Zhou, Parameswaran Raman, and Wooseok Ha. Variance- reduced zeroth-order methods for fine-tuning language models. InForty-first International Conference on Machine Learning, 2024. URLhttps://openreview.net/forum?id=VHO4nE7v41

    2024

  10. [12]

    Samuel Gehman, Suchin Gururangan, Maarten Sap, Yejin Choi, and Noah A. Smith. RealToxici- tyPrompts: Evaluating neural toxic degeneration in language models. In Trevor Cohn, Yulan He, and Yang Liu, editors,Findings of the Association for Computational Linguistics: EMNLP 2020, pages 3356–3369, Online, November 2020. Association for Computational Linguistic...

    doi:10.18653/v1/2020 2020

  11. [13]

    Suchin Gururangan, Ana Marasović, Swabha Swayamdipta, Kyle Lo, Iz Beltagy, Doug Downey, and Noah A. Smith. Don’t stop pretraining: Adapt language models to domains and tasks. In Dan Jurafsky, Joyce Chai, Natalie Schluter, and Joel Tetreault, editors,Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 8342–8360, O...

    doi:10.18653/v1/2020.acl-main.740 2020

  12. [14]

    Word embeddings are steers for language models

    Chi Han, Jialiang Xu, Manling Li, Yi Fung, Chenkai Sun, Nan Jiang, Tarek Abdelzaher, and Heng Ji. Word embeddings are steers for language models. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar, editors,Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 16410–16430, Bangkok, Thailand, Au...

    doi:10.18653/v1/2024.acl-long.864 2024

  13. [15]

    Detoxify

    Laura Hanu and Unitary team. Detoxify. Github. https://github.com/unitaryai/detoxify, 2020

    2020

  14. [16]

    Model-free learning of two-stage beamformers for passive irs-aided network design.IEEE Transactions on Signal Processing, 72:652–669,

    Hassaan Hashmi, Spyridon Pougkakiotis, and Dionysis Kalogerias. Model-free learning of two-stage beamformers for passive irs-aided network design.IEEE Transactions on Signal Processing, 72:652–669,

  15. [17]

    Localized zeroth-order prompt optimization

    Wenyang Hu, Yao Shu, Zongmin Yu, Zhaoxuan Wu, Xiaoqiang Lin, Zhongxiang Dai, See-Kiong Ng, and Bryan Kian Hsiang Low. Localized zeroth-order prompt optimization. InProceedings of the 38th International Conference on Neural Information Processing Systems, NIPS ’24, Red Hook, NY, USA, 2024. Curran Associates Inc. ISBN 9798331314385

    2024

  16. [18]

    DAPI: Domain adaptive toxicity probe vector intervention, for fine-grained detoxification

    Cho Hyeonsu, Dooyoung Kim, and Youngjoong Ko. DAPI: Domain adaptive toxicity probe vector intervention, for fine-grained detoxification. In Wanxiang Che, Joyce Nabende, Ekaterina Shutova, and Mohammad Taher Pilehvar, editors,Findings of the Association for Computational Linguistics: ACL 2025, pages 15059–15069, Vienna, Austria, July 2025. Association for ...

    work page doi:10.18653/v1/2025.findings-acl.779 2025

  17. [19]

    Perspective API

    Jigsaw & the Google Counter Abuse Technology team. Perspective API. https://www. perspectiveapi.com/. URLhttps://www.perspectiveapi.com/. Accessed: 2026-01-05

    2026

  18. [20]

    Critic- guided decoding for controlled text generation

    Minbeom Kim, Hwanhee Lee, Kang Min Yoo, Joonsuk Park, Hwaran Lee, and Kyomin Jung. Critic- guided decoding for controlled text generation. In Anna Rogers, Jordan Boyd-Graber, and Naoaki Okazaki, editors,Findings of the Association for Computational Linguistics: ACL 2023, pages 4598–4612, Toronto, Canada, July 2023. Association for Computational Linguistic...

    doi:10.18653/v1/2023.findings- 2023

  19. [21]

    Large language models can become strong self- detoxifiers

    Ching-Yun Ko, Pin-Yu Chen, Payel Das, Youssef Mroueh, Soham Dan, Georgios Kollias, Subhajit Chaudhury, Tejaswini Pedapati, and Luca Daniel. Large language models can become strong self- detoxifiers. InThe Thirteenth International Conference on Learning Representations, 2025. URL https: //openreview.net/forum?id=jY5oml9fe9

    2025

  20. [22]

    Unveiling safety vulnerabilities of large language models

    George Kour, Marcel Zalmanovici, Naama Zwerdling, Esther Goldbraich, Ora Fandina, Ateret An- aby Tavor, Orna Raz, and Eitan Farchi. Unveiling safety vulnerabilities of large language models. In Sebastian Gehrmann, Alex Wang, João Sedoc, Elizabeth Clark, Kaustubh Dhole, Khyathi Raghavi Chandu, Enrico Santus, and Hooman Sedghamiz, editors,Proceedings of the...

    2023

  21. [23]

    GeDi: Generative discriminator guided sequence generation

    Ben Krause, Akhilesh Deepak Gotmare, Bryan McCann, Nitish Shirish Keskar, Shafiq Joty, Richard Socher, and Nazneen Fatema Rajani. GeDi: Generative discriminator guided sequence generation. In Marie-Francine Moens, Xuanjing Huang, Lucia Specia, and Scott Wen-tau Yih, editors,Findings of the Association for Computational Linguistics: EMNLP 2021, pages 4929–...

    doi:10.18653/v1/2021.findings- 2021

  22. [24]

    Language detoxification with attribute- discriminative latent space

    Jin Myung Kwak, Minseon Kim, and Sung Ju Hwang. Language detoxification with attribute- discriminative latent space. In Anna Rogers, Jordan Boyd-Graber, and Naoaki Okazaki, editors, 14 Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 10149–10171, Toronto, Canada, July 2023. Association ...

    work page doi:10.18653/v1/2023.acl-long.565 2023

  23. [25]

    Gonzalez, Hao Zhang, and Ion Stoica

    Woosuk Kwon, Zhuohan Li, Siyuan Zhuang, Ying Sheng, Lianmin Zheng, Cody Hao Yu, Joseph E. Gonzalez, Hao Zhang, and Ion Stoica. Efficient memory management for large language model serving with pagedattention. InProceedings of the ACM SIGOPS 29th Symposium on Operating Systems Principles, 2023

    2023

  24. [26]

    Self-detoxifying language models via toxification reversal

    Chak Tou Leong, Yi Cheng, Jiashuo Wang, Jian Wang, and Wenjie Li. Self-detoxifying language models via toxification reversal. In Houda Bouamor, Juan Pino, and Kalika Bali, editors,Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 4433–4449, Singapore, December 2023. Association for Computational Linguistics. doi...

    work page doi:10.18653/v1/2023.emnlp-main.269 2023

  25. [27]

    Destein: Navigating detoxification of language models via universal steering pairs and head-wise activation fusion

    Yu Li, Han Jiang, Chuanyang Gong, and Zhihua Wei. Destein: Navigating detoxification of language models via universal steering pairs and head-wise activation fusion. InFirst Conference on Language Modeling, 2024. URLhttps://openreview.net/forum?id=jq2kNXigPP

    2024

  26. [29]

    Smith, and Yejin Choi

    Alisa Liu, Maarten Sap, Ximing Lu, Swabha Swayamdipta, Chandra Bhagavatula, Noah A. Smith, and Yejin Choi. DExperts: Decoding-time controlled text generation with experts and anti-experts. In Chengqing Zong, Fei Xia, Wenjie Li, and Roberto Navigli, editors,Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th...

    2021

  27. [30]

    Sparse meZO: Less parameters for better performance in zeroth-order LLM fine-tuning

    Yong Liu, Zirui Zhu, Chaoyu Gong, Minhao Cheng, Cho-Jui Hsieh, and Yang You. Sparse meZO: Less parameters for better performance in zeroth-order LLM fine-tuning. InThe Thirty-ninth Annual Conference on Neural Information Processing Systems, 2025. URL https://openreview.net/forum? id=Tjw0ACu3NL

    2025

  28. [31]

    Unidetox: Universal detoxification of large language models via dataset distillation

    Huimin LU, Masaru Isonuma, Junichiro Mori, and Ichiro Sakata. Unidetox: Universal detoxification of large language models via dataset distillation. InThe Thirteenth International Conference on Learning Representations, 2025. URLhttps://openreview.net/forum?id=eLLBILFRsA

    2025

  29. [32]

    Quark: controllable text generation with reinforced [un]learning

    Ximing Lu, Sean Welleck, Jack Hessel, Liwei Jiang, Lianhui Qin, Peter West, Prithviraj Ammanabrolu, and Yejin Choi. Quark: controllable text generation with reinforced [un]learning. InProceedings of the 36th International Conference on Neural Information Processing Systems, NIPS ’22, Red Hook, NY, USA, 2022. Curran Associates Inc. ISBN 9781713871088

    2022

  30. [33]

    Lee, Danqi Chen, and Sanjeev Arora

    Sadhika Malladi, Tianyu Gao, Eshaan Nichani, Alex Damian, Jason D. Lee, Danqi Chen, and Sanjeev Arora. Fine-tuning language models with just forward passes. InThirty-seventh Conference on Neural Information Processing Systems, 2023. URLhttps://openreview.net/forum?id=Vota6rFhBQ. 15

    2023

  31. [34]

    Attribute controlled fine-tuning for large language models: A case study on detoxification

    Tao Meng, Ninareh Mehrabi, Palash Goyal, Anil Ramakrishna, Aram Galstyan, Richard Zemel, Kai-Wei Chang, Rahul Gupta, and Charith Peris. Attribute controlled fine-tuning for large language models: A case study on detoxification. In Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen, editors,Findings of the Association for Computational Linguistics: EMNLP 20...

    work page doi:10.18653/v1/2024.findings-emnlp.779 2024

  32. [35]

    Random gradient-free minimization of convex functions

    Yurii Nesterov and Vladimir Spokoiny. Random gradient-free minimization of convex functions. Foundations of Computational Mathematics, 17(2):527–566, 2017. doi: 10.1007/s10208-015-9296-2. URL https://doi.org/10.1007/s10208-015-9296-2

    doi:10.1007/s10208-015-9296-2 2017

  33. [36]

    Parameter-efficient detoxification with contrastive decoding

    Tong Niu, Caiming Xiong, Yingbo Zhou, and Semih Yavuz. Parameter-efficient detoxification with contrastive decoding. In Nikita Soni, Lucie Flek, Ashish Sharma, Diyi Yang, Sara Hooker, and H. Andrew Schwartz, editors,Proceedings of the 1st Human-Centered Large Language Modeling Workshop, pages 30–40, TBD, August 2024. ACL. doi: 10.18653/v1/2024.hucllm-1.3....

    work page doi:10.18653/v1/2024.hucllm-1.3 2024

  34. [37]

    Best practices for prompt engineering with the openai api

    OpenAI. Best practices for prompt engineering with the openai api. https://help.openai.com/en/ articles/6654000-best-practices-for-prompt-engineering-with-the-openai-api , 2025. OpenAI Help Center article. Accessed: 7 Dec 2025

    arXiv 2025

  35. [38]

    Training language models to follow instructions with human feed- back

    Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kelton, Luke Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul F Christiano, Jan Leike, and Ryan Lowe. Training language models to follow instructions with human feed- b...

    2022

  36. [39]

    Data-driven learning of two-stage beamformers in passive irs-assisted systems with inexact oracles.IEEE Access, 13:154984–155002, 2025

    Spyridon Pougkakiotis, Hassaan Hashmi, and Dionysis Kalogerias. Data-driven learning of two-stage beamformers in passive irs-assisted systems with inexact oracles.IEEE Access, 13:154984–155002, 2025. doi: 10.1109/ACCESS.2025.3605249

    arXiv 2025

  37. [40]

    On the challenges of using black-box APIs for toxicity evaluation in research

    Luiza Pozzobon, Beyza Ermis, Patrick Lewis, and Sara Hooker. On the challenges of using black-box APIs for toxicity evaluation in research. In Houda Bouamor, Juan Pino, and Kalika Bali, editors, Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 7595– 7609, Singapore, December 2023. Association for Computational ...

    doi:10.18653/v1/2023 2023

  38. [41]

    Language models are unsupervised multitask learners

    Alec Radford, Jeff Wu, Rewon Child, David Luan, Dario Amodei, and Ilya Sutskever. Language models are unsupervised multitask learners. 2019

    2019

  39. [42]

    Compatible gradient approximations for actor-critic algo- rithms, 2025

    Baturay Saglam and Dionysis Kalogerias. Compatible gradient approximations for actor-critic algo- rithms, 2025. URLhttps://arxiv.org/abs/2409.01477

    Pith/arXiv arXiv 2025

  40. [43]

    Self-diagnosis and self-debiasing: A proposal for reducing corpus-based bias in nlp.Transactions of the Association for Computational Linguistics, 9: 1408–1424, 12 2021

    Timo Schick, Sahana Udupa, and Hinrich Schütze. Self-diagnosis and self-debiasing: A proposal for reducing corpus-based bias in nlp.Transactions of the Association for Computational Linguistics, 9: 1408–1424, 12 2021. ISSN 2307-387X. doi: 10.1162/tacl_a_00434. URL https://doi.org/10.1162/ tacl_a_00434. 16

    doi:10.1162/tacl_a_00434 2021

  41. [44]

    Gemma 2: Improving open language models at a practical size, 2024

    Gemma Team. Gemma 2: Improving open language models at a practical size, 2024. URL https: //arxiv.org/abs/2408.00118

    Pith/arXiv arXiv 2024

  42. [45]

    Supporting Human Raters with the Detection of Harmful Content Using Large Language Models

    Kurt Thomas, Patrick Gage Kelley, David Tao, Sarah Meiklejohn, Owen Vallis, Shunwen Tan, Blaz Bratanic, Felipe Tiengo Ferreira, Vijay Kumar Eranti, and Elie Bursztein. Supporting Human Raters with the Detection of Harmful Content Using Large Language Models . In2025 IEEE Symposium on Security and Privacy (SP), pages 2772–2789, Los Alamitos, CA, USA, May 2...

    arXiv 2025

  43. [46]

    Attention is all you need

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Ł ukasz Kaiser, and Illia Polosukhin. Attention is all you need. In I. Guyon, U. Von Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett, editors,Advances in Neural Information Processing Systems, volume 30. Curran Associates, Inc., 2017. URL htt...

    2017

  44. [47]

    Exploring the limits of domain-adaptive training for detoxifying large-scale language models

    Boxin Wang, Wei Ping, Chaowei Xiao, Peng Xu, Mostofa Patwary, Mohammad Shoeybi, Bo Li, Anima Anandkumar, and Bryan Catanzaro. Exploring the limits of domain-adaptive training for detoxifying large-scale language models. In Alice H. Oh, Alekh Agarwal, Danielle Belgrave, and Kyunghyun Cho, editors,Advances in Neural Information Processing Systems, 2022. URL...

    2022

  45. [48]

    Llama-3.1-foundationai-securityllm-8b- instruct technical report, 2025

    Sajana Weerawardhena, Paul Kassianik, Blaine Nelson, Baturay Saglam, Anu Vellore, Aman Priyanshu, Supriti Vijay, Massimo Aufiero, Arthur Goldblatt, Fraser Burch, Ed Li, Jianliang He, Dhruv Kedia, Kojin Oshiba, Zhouran Yang, Yaron Singer, and Amin Karbasi. Llama-3.1-foundationai-securityllm-8b- instruct technical report, 2025. URLhttps://arxiv.org/abs/2508.01059

    Pith/arXiv arXiv 2025

  46. [49]

    Challenges in detoxifying language models

    Johannes Welbl, Amelia Glaese, Jonathan Uesato, Sumanth Dathathri, John Mellor, Lisa Anne Hen- dricks, Kirsty Anderson, Pushmeet Kohli, Ben Coppin, and Po-Sen Huang. Challenges in detoxifying language models. In Marie-Francine Moens, Xuanjing Huang, Lucia Specia, and Scott Wen-tau Yih, editors,Findings of the Association for Computational Linguistics: EMN...

    work page doi:10.18653/v1/2021.fi 2021

  47. [50]

    Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Rémi Louf, Morgan Funtowicz, Joe Davison, Sam Shleifer, Patrick von Platen, Clara Ma, Yacine Jernite, Julien Plu, Canwen Xu, Teven Le Scao, Sylvain Gugger, Mariama Drame, Quentin Lhoest, and Alexander M. Rush. Transformers: State-of-the-art...

    2020

  48. [51]

    Recipes for safety in open-domain chatbots, 2021

    Jing Xu, Da Ju, Margaret Li, Y-Lan Boureau, Jason Weston, and Emily Dinan. Recipes for safety in open-domain chatbots, 2021. URLhttps://arxiv.org/abs/2010.07079

    Pith/arXiv arXiv 2021

  49. [52]

    SafeDecoding: Defending against jailbreak attacks via safety-aware decoding

    Zhangchen Xu, Fengqing Jiang, Luyao Niu, Jinyuan Jia, Bill Yuchen Lin, and Radha Poovendran. SafeDecoding: Defending against jailbreak attacks via safety-aware decoding. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar, editors,Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 5587–5605,...

  50. [53]

    Qwen3 technical report, 2025

    An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, Chujie Zheng, Dayiheng Liu, Fan Zhou, Fei Huang, Feng Hu, Hao Ge, Haoran Wei, Huan Lin, Jialong Tang, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Yang, Jiaxi Yang, Jing Zhou, Jingren Zhou, Junyang Lin, Kai Dang, Keqin Bao, Kexin Yang, ...

    Pith/arXiv arXiv 2025

  51. [54]

    doi: 10.18653/v1/2024.acl-long.303

    Association for Computational Linguistics. doi: 10.18653/v1/2024.acl-long.303. URL https: //aclanthology.org/2024.acl-long.303/

    doi:10.18653/v1/2024.acl-long.303 2024

  52. [55]

    Unlocking black-box prompt tuning efficiency via zeroth-order optimization

    Heshen Zhan, Congliang Chen, Tian Ding, Ziniu Li, and Ruoyu Sun. Unlocking black-box prompt tuning efficiency via zeroth-order optimization. In Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen, editors,Findings of the Association for Computational Linguistics: EMNLP 2024, pages 14825– 14838, Miami, Florida, USA, November 2024. Association for Computation...

    2024

  53. [56]

    FUDGE: Controlled text generation with future discriminators

    Kevin Yang and Dan Klein. FUDGE: Controlled text generation with future discriminators. In Kristina Toutanova, Anna Rumshisky, Luke Zettlemoyer, Dilek Hakkani-Tur, Iz Beltagy, Steven Bethard, Ryan Cotterell, Tanmoy Chakraborty, and Yichao Zhou, editors,Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Li...

    work page doi:10.18653/v1/2021.na 2021

  54. [57]

    challenging

    Chujie Zheng, Pei Ke, Zheng Zhang, and Minlie Huang. Click: Controllable text generation with sequence likelihood contrastive learning. In Anna Rogers, Jordan Boyd-Graber, and Naoaki Okazaki, editors,Findings of the Association for Computational Linguistics: ACL 2023, pages 1022–1040, Toronto, Canada, July 2023. Association for Computational Linguistics. ...

    doi:10.18653/v1/2023.findings-acl.65 2023

  55. [58]

    Detoxifying large language models via the diversity of toxic samples

    Ying Zhao, Yuanzhao Guo, Xuemeng Weng, Yuan Tian, Wei Wang, and Yi Chang. Detoxifying large language models via the diversity of toxic samples. In Christos Christodoulopoulos, Tanmoy Chakraborty, Carolyn Rose, and Violet Peng, editors,Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 5869–5882, Suzhou, China, No...

    work page doi:10.18653/v1/2025.emnlp-main.298 2025

  56. [2024]

    doi: 10.1109/TSP.2023.3346182

    arXiv 2023