Pith. sign in

REVIEW 4 major objections 6 minor 56 references

Test-Time Detoxification without Training or Learning Anything

T0 review · 4 major / 6 minor · reviewed 2026-08-03 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A test-time-only method steers language models away from toxic continuations by nudging prompt embeddings downhill on a black-box toxicity function.

desk verdict A neat, model-agnostic test-time detoxification method that works on the reported benchmarks, but the central claim that gradient estimation beats random perturbations is never tested — and the sensitivity analysis hints it may not hold. read the letter →

arxiv 2602.02498 v2 pith:QBNPYWZS submitted 2026-01-14 cs.CL cs.AIcs.LG

Baturay Saglam , Dionysis Kalogerias This is my paper
classification cs.CLcs.AIcs.LG
keywords detoxificationzeroth-orderoptimizationblack-boxembeddingsteeringtest-timecontrolGaussiansmoothingfinite-differencegradienttoxicity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that toxic generation can be reduced at inference time with no retraining, no gradient access, and no learned auxiliary components: the model is treated as a black box and the only control variable is the prompt's embedding matrix. The core move is to approximate the gradient of completion toxicity with respect to the input embeddings using a zeroth-order Gaussian-smoothed finite-difference estimator, then take a few normalized descent steps, with early stopping once toxicity falls below a threshold. The paper argues that this procedure achieves robust toxicity reductions across several models and benchmarks and, in most settings, the best toxicity–quality trade-off compared to existing decoding-based and steering-based baselines. The broader claim is that word embeddings are effective control variables for guiding autoregressive models toward safer text, opening a training-free, model-agnostic route to controllable generation.

What carries the argument

The Gaussian-smoothed zeroth-order gradient estimator (Equation 1): for an embedding matrix X perturbed tokenwise by Gaussian noise U, the gradient of the smoothed objective Φ_μ satisfies ∇Φ_μ(X)=E[((Φ(X+μU)−Φ(X))/μ) U]. Replacing the expectation with an N-sample Monte Carlo average yields a descent direction computable from forward evaluations alone. The method then couples this estimator with gradient normalization, a cosine-similarity constraint that keeps embeddings near the original prompt, and early stopping at a toxicity threshold, so that only a handful of iterations (typically under four) are needed.

What would settle it

Run the method on a model and toxicity scorer where the toxicity score is adversarially constructed to be a high-frequency function of the prompt embeddings (e.g., a scorer that toggles between 0 and 1 with small embedding perturbations). If the finite-difference estimator fails to produce toxicity reductions beyond random chance, the smoothness assumption is shown to be load-bearing.

Watch

Extended reading notes

Core claim

The central discovery is that a toxicity function evaluated on model completions can be minimized with respect to the prompt embedding matrix using only forward evaluations, via the Nesterov–Spokoiny randomized finite-difference estimator. Treating the composite objective Φ(X)=h(f(X)) as a black-box, the paper approximates ∇Φ with a Monte Carlo average of scaled directional evaluations, updates embeddings by gradient descent, normalizes steps, constrains cosine similarity to the original prompt, and stops as soon as toxicity falls below 0.5. Empirically, the method (TIDE) is reported to substantially reduce average maximum toxicity and toxicity rate on challenging prompts across GPT-2 Large,

Load-bearing premise

The method's theoretical grounding assumes that the composite toxicity objective is smooth (Lipschitz and Lipschitz-smooth) over the embedding regions traversed; if the toxicity landscape is rugged, the finite-difference estimates become noise and the descent mechanism lacks a guarantee, though the paper acknowledges this regularity condition is not verifiable from query access.

Editorial extensions

If this is right

  • If the central claim holds, safety filtering of LLM outputs can be performed at deployment time with no model modification, no training data, and no access to logits or hidden states, working on any model for which embeddings and forward passes are available.
  • The method positions embedding-space optimization as a near-optimal steering mechanism, suggesting that within this control family, further detoxification gains would come mainly from better toxicity objectives rather than from alternative steering rules.
  • Because the decoded optimized embeddings remain identical to the original prompt, the technique changes generation purely through what the model 'sees' in embedding space, which may extend to other black-box target behaviors (style, factuality) that can be scored by an external function.
  • The low query overhead—early stopping keeps the effective iteration count small—makes the method compatible with batched high-throughput inference pipelines, potentially enabling real-time safety intervention.
  • The theoretical link to gradient descent implies that when the objective is smooth enough, the steering direction is approximately optimal among embedding perturbations, giving a principled guarantee absent from heuristic steering methods.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same mechanism could serve as a general-purpose safety patch: any harm metric that can be scored from text (bias, hallucination likelihood, privacy leakage) might be reducible at test time without retraining, provided the score is a reasonably smooth function of the prompt.
  • The method's reliance on low-temperature decoding is a natural boundary: as temperature rises, the function being minimized becomes stochastic, and the finite-difference estimator would need explicit variance control; a natural extension is to smooth over multiple sampled completions rather than one.
  • If the decoded embeddings are genuinely invariant under optimization, the technique effectively performs a 'steering in disguise'—moving through directions that the tokenizer maps back to the same string—which suggests that gradient information is being translated into sampling-condition changes for the same prompt representation; this deserves inspection as a potential artifact or as evidence tha
  • A testable extension would be to apply the same zeroth-order embedding descent to a continuous numerical target (e.g., sentiment score, factual-consistency score) and check whether the observed monotone toxicity reductions generalize to other objectives, which would confirm or refute the paper's broader framing of embeddings as control variables.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes TIDE, a test-time detoxification procedure that treats the toxicity of a model completion as a black-box function of the prompt embedding matrix and approximates its gradient with a Gaussian-smoothed zeroth-order finite-difference estimator (Nesterov-Spokoiny). The estimated direction is used for a small number of normalized descent steps on the embeddings, with cosine-similarity projection and early stopping at a toxicity threshold. Experiments on GPT-2 Large, Gemma 2-2B, Qwen3-4B, and Llama 3.1-8B over AttaQ, BOLD, and the RTP challenging subset report lower toxicity at comparable or better perplexity than several decoding/steering baselines, at temperature 0.1. The paper also claims that TIDE provides a near-optimal embedding-space steering direction.

Significance. If the empirical claims are supported, TIDE would be an attractive safety tool: it requires no training, no gradient access, no auxiliary modules, and it transfers across model families. The evaluation is broad, the baselines were rerun with the current Perspective API, and code is promised. However, the load-bearing mechanism—that the finite-difference weighting in Eq. (2) yields a meaningful descent direction—is not isolated by any control experiment. In addition, hyperparameters are selected on a subset of the main evaluation benchmark, and the objective being optimized is the same Perspective toxicity score used in evaluation, with early stopping at the toxicity threshold mechanically suppressing the reported toxic-rate metric. These issues need to be resolved before the 'near-optimal steering' and 'robust detoxification' conclusions are accepted.

major comments (4)
  1. [Section 4.1, Eq. (2); Appendix C, Fig. 3b] The paper never compares TIDE with a random-search baseline using the same query budget. The sensitivity analysis shows N=1–8 performs comparably to N=128 and that toxicity varies non-monotonically with μ, so the observed gains could come from sampling many nearby embeddings combined with early stopping, normalization, and cosine projection, rather than from the Φ(X+μU_i)−Φ(X) weighting. Please add controls that use the same N evaluations but ignore the function-value weighting, e.g., (i) replacing the finite-difference coefficient by a constant or random sign, (ii) selecting the best of N random perturbations, and (iii) moving along a random normalized direction of the same step size. If any of these matches the TIDE toxicity–perplexity trade-off, Section 6's claim that TIDE estimates a near-optimal descent direction is unsupported.
  2. [Appendix B.1; Tables 2, 13–16] Hyperparameters were tuned on a subset of the RTP dataset (base toxicity > 0.9) and then a model-specific grid was used to select the best hyperparameters before reporting main results on the RTP challenging subset. Because RTP is the headline evaluation benchmark, the reported toxicity–perplexity trade-off is partly fitted rather than predictive. The AttaQ/BOLD results mitigate this, but they were produced with the same hyperparameters selected on RTP. Please report results on a held-out benchmark that played no role in hyperparameter selection, or use nested/leave-one-benchmark-out validation.
  3. [Section 4.2 (Early Stopping); Section 5 (Metrics)] The optimization objective Φ(X)=h(f(X)) is exactly the Perspective API toxicity score used in evaluation, and early stopping terminates as soon as h(f(X))<0.5. Consequently, the reported toxic rate (fraction of prompts with a completion above 0.5) is directly engineered to be low; e.g., Table 2 shows toxic rate 0.003 vs. 0.639 for the base model. This circularity makes the toxic-rate gains less informative. Please evaluate with an independent toxicity scorer or human annotation, and separate the score used for optimization from the score used for reporting.
  4. [Section 6.1; Section 4.1] The theoretical justification assumes Lipschitz continuity and Lipschitz smoothness of Φ and, in Nesterov–Spokoiny, deterministic function evaluations. The paper admits these conditions are 'not directly verifiable from query access,' and the experiments use stochastic decoding (temperature 0.1, M=3). Thus the claim in Section 6 that TIDE is 'near-optimal' among embedding-space steering methods goes beyond what the theory establishes. Please either provide a stochastic zeroth-order analysis or temper the optimality claim; at minimum, report confidence intervals over decoding seeds for the optimized toxicity and perplexity.
minor comments (6)
  1. [Section 5.1] The text says 'we set the threshold κ=0.5 to control computational cost,' but κ is the cosine similarity threshold (0.2 in Table 3). The early-stopping threshold is τ=0.5. Please correct the symbol.
  2. [Figures 2 and 4] The legends include 'InnerDetox,' but no method with that name appears in the baseline descriptions or in Table 2. Please clarify whether this is an alternate name for Toxification Reversal or a leftover from an earlier draft.
  3. [References] References [6] and [7] are the same PPLM paper; one duplicate should be removed.
  4. [Appendix C] The text says 'changing μ changes the smoothed objective fμ'; the paper elsewhere uses Φ_μ. Use consistent notation.
  5. [Algorithm 1 / Section 4] Methodology says 'typically K<4' but Algorithm 1 allows up to K iterations and experiments set K=10. Clarify whether K is a maximum and what the typical early-stopped iteration count means for the reported # iterations.
  6. [Abstract / Section 6] The abstract claims the 'best overall toxicity–quality trade-off' without stating the low-temperature condition. Given the paper's own limitation that high temperature makes Φ unstable, the abstract should hedge or explicitly mention the temperature setting.

Circularity Check

2 steps flagged · score 4.0 of 10

Toxic-rate metric is the algorithm's own early-stopping rule; RTP hyperparameters are tuned on the evaluation set, but the gradient-steering core is externally grounded and held-out benchmarks support the central claim.

  1. self definitional [Section 4.2 (Early Stopping), Section 5 (Metrics), Table 3, Algorithm 1]
    "if h(f(X_{k+1})) < τ then break (Algorithm 1); 'toxicity rate, where the latter is the probability that at least one of the M completions has toxicity greater than 0.5' (Sec. 5); 'The toxicity threshold τ = 0.5 is used throughout.' (Table 3)"

    The reported Toxicity Rate counts completions with Φ > 0.5, while TIDE's termination condition is Φ < 0.5 with the same τ = 0.5. The near-zero Toxic Rate values (e.g., 0.003 in Table 2) are therefore the algorithm's own stopping predicate, not an independent measurement. This metric reduces by construction; the max/mean toxicity and perplexity results are less directly forced, so the circularity is partial.

  2. fitted input called prediction [Appendix B.1 (Hyperparameter Selection) and Section 5.1]
    "We first tuned hyperparameters on GPT-2 using the subset of the RTP dataset where the base model's average toxicity exceeds 0.9, which corresponds to roughly 100 samples. ... After selecting the best configuration, we constructed model-specific grids for the remaining models by scaling these values ... We then ran this scaled, model-specific grid to select the best hyperparameters for each model."

    The main RTP 'challenging' benchmark is also the source of the 100-sample tuning subset used to select μ, N, η, and κ. Reporting the resulting RTP toxicity–perplexity trade-off as evidence of the 'best overall toxicity–quality trade-off' therefore includes hyperparameters fitted to the same benchmark. The central claim retains independent support from AttaQ and BOLD, which were not used for tuning, limiting the severity.

full rationale

The derivation chain itself is mostly self-contained: the zeroth-order estimator in Eq. (2) is the standard Nesterov–Spokoiny finite-difference identity, cited to an external source, and the descent update directly minimizes the defined objective Φ = h(f(X)); that an optimizer reduces its own objective is not circular. The paper does not rely on a self-citation chain or imported uniqueness theorem: references [16], [39], and [42] are illustrative rather than load-bearing, and the sensitivity analysis independently shows small N is adequate. The significant caveats are two. First, the Toxicity Rate metric is defined by the same 0.5 threshold used in the early-stopping rule, so the near-zero toxic rates are engineered by the termination condition rather than discovered. Second, the RTP benchmark used for the headline trade-off is the same dataset from which the GPT-2 hyperparameter tuning subset is drawn, so part of the RTP advantage is fitted; held-out AttaQ/BOLD results mitigate this. The absence of a random-search control is an empirical-validity concern about whether the estimator is a true gradient direction, not a circularity, and therefore does not raise the score further.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The method introduces no new physical or theoretical entities; the 'steering direction' is a standard zeroth-order gradient estimate. The free parameters are all hyperparameters of the optimization, tuned on the evaluation benchmark. The axioms are the unverifiable smoothness conditions, the low-temperature regime, and the regularization assumption, plus the imported standard ZO theory.

free parameters (5)
  • Perturbation scale μ = 0.03 (Llama 3.1-8B), 0.01 (Qwen3-4B), 0.05 (Gemma 2-2B), 0.1 (GPT-2 Large)
    Controls bias-variance of the Gaussian smoothing estimator; selected via grid search on an RTP subset (Appendix B.1).
  • Number of Monte Carlo samples N = 16, 8, 8, 8
    Number of random perturbations per gradient estimate; tuned per model; higher N reduces variance but increases forward passes.
  • Step size η = 0.3, 0.65, 1.0, 1.5
    Gradient descent step size after normalization; tuned per model via grid search.
  • Cosine similarity threshold κ = 0.2 (all models)
    Bound on how far updated embeddings can drift from the original prompt; tuned via grid search.
  • Early-stopping toxicity threshold τ = 0.5
    Standard threshold from prior detoxification work (Liu et al.; Deng and Raffel); not tuned in this paper.
assumptions (4)
  • domain assumption The composite objective Φ(X) = h(f(X)) is Lipschitz continuous and Lipschitz-smooth over the embedding regions traversed by the optimization, so the Gaussian-smoothed gradient estimator (Eq. 1) has bounded bias and provides a useful descent direction.
    Section 4.1 acknowledges these conditions are 'not directly verifiable' in the black-box setting, yet the near-optimality discussion in Section 6 relies on them.
  • domain assumption At low decoding temperature (0.1), the stochasticity of the model's completions does not invalidate the finite-difference estimates; at higher temperatures the objective becomes too unstable.
    The low-temperature requirement is empirically observed (Section 5, Section 6.1) and is a restriction on the method's applicability that is not guaranteed by the ZO theory, which assumes deterministic evaluations.
  • domain assumption The cosine-similarity projection (κ=0.2) keeps the perturbed embeddings in a region where the model's outputs remain meaningful and where the decoded tokens stay identical to the original prompt.
    This ad hoc regularization is essential to the headline 'prompt unchanged' observation, but its adequacy is only validated empirically.
  • standard math Nesterov and Spokoiny's Gaussian-smoothing theory (identity Eq. 1 and the bias bounds) is valid and applicable as stated.
    The paper directly imports the ZO estimator theory from [35]; this is standard mathematical background.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Test-Time Detoxification without Training or Learning Anything." pith.science (2026). https://pith.science/paper/QBNPYWZS

@misc{pith2026260202498,
  author       = {Pith},
  title        = {Pith review of: Test-Time Detoxification without Training or Learning Anything},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QBNPYWZS}},
  note         = {Machine review of arXiv:2602.02498}
}
read the original abstract

Large language models can produce toxic or inappropriate text even for benign inputs, creating risks when deployed at scale. Detoxification is therefore important for safety and user trust, particularly when we want to reduce harmful content without sacrificing the model's generation quality. Many existing approaches rely on model retraining, gradients, or learned auxiliary components, which can be costly and may not transfer across model families or to truly black-box settings. We introduce a test-time procedure that approximates the gradient of completion toxicity with respect to the input embeddings and uses a small number of descent steps to steer generation toward less toxic continuations. This is achieved with zeroth-order optimization that requires only access to input embeddings, a toxicity scoring function, and forward evaluations of the model. Empirically, the approach delivers robust toxicity reductions across models and prompts and, in most settings, achieves the best overall toxicity-quality trade-off. More broadly, our work positions word embeddings as effective control variables and encourages wider use of black-box optimization to guide autoregressive language models toward scalable, safer text generation, without requiring any training or access to intermediate computations.

Figures

Figures reproduced from arXiv: 2602.02498 by the authors.

Figure 1
Figure 1. Illustrative example of our test-time procedure, where model completions are shown in bold. We terminate optimization once the completion toxicity Φ falls below 0.5. The procedure shifts the embedding toward regions of lower toxicity in the landscape, as shown in the second panel, where the dashed line indicates the steepest descent (theoretical optimum). to reduce downstream toxicity—conceptually by following a des… view at source ↗
Figure 2
Figure 2. Performance in terms of maximum toxicity versus fluency perplexity on prompts from the RealToxici￾tyPrompts benchmark, averaged over three completions generated with temperature 0.1. The best performance lies in the lower left. For RAD and SASA, only the results for 𝛽 = {50, 75, 100} are shown for clarity, with darker markers indicating larger 𝛽 values. A Better Toxicity–Fluency Trade-Off Under this relative assessm… view at source ↗
Figure 3
Figure 3. Performance in terms of maximum toxicity and fluency perplexity (shown separately) on prompts from the “challenging” subset of the RealToxicityPrompts benchmark, averaged over three completions generated with temperature 0.1, except in the temperature experiments. The best performance lies in the lower left. The tested values are listed in [PITH_FULL_IMAGE:figures/full_fig_p021_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Performance in terms of maximum toxicity versus fluency perplexity, averaged over three completions generated with temperature 0.1. The best performance lies in the lower left. For RAD and SASA, only the results for 𝛽 = {50, 75, 100} are shown for clarity, with darker …

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

56 extracted references · 8 canonical work pages

  1. [1]

    Llama 3 model card

    AI@Meta. Llama 3 model card. 2024. URL https://github.com/meta-llama/llama3/blob/main/ MODEL_CARD.md

    2024

  2. [2]

    Director: Generator-classifiers for supervised language modeling

    Kushal Arora, Kurt Shuster, Sainbayar Sukhbaatar, and Jason Weston. Director: Generator-classifiers for supervised language modeling. In Yulan He, Heng Ji, Sujian Li, Yang Liu, and Chua-Hui Chang, editors,Proceedings of the 2nd Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics and the 12th International Joint Conferen...

    2022

  3. [4]

    Systematic rectification of language models via dead-end analysis

    Meng Cao, Mehdi Fatemi, Jackie CK Cheung, and Samira Shabanian. Systematic rectification of language models via dead-end analysis. InThe Eleventh International Conference on Learning Represen- tations, 2023. URLhttps://openreview.net/forum?id=k8_yVW3Wqln

    2023

  4. [5]

    Enhancing zeroth-order fine- tuning for language models with low-rank structures

    Yiming Chen, Yuan Zhang, Liyuan Cao, Kun Yuan, and Zaiwen Wen. Enhancing zeroth-order fine- tuning for language models with low-rank structures. InThe Thirteenth International Conference on Learning Representations, 2025. URLhttps://openreview.net/forum?id=9BiVepgmWW. 12

    2025

  5. [7]

    Plug and play language models: A simple approach to controlled text generation

    Sumanth Dathathri, Andrea Madotto, Janice Lan, Jane Hung, Eric Frank, Piero Molino, Jason Yosinski, and Rosanne Liu. Plug and play language models: A simple approach to controlled text generation. In International Conference on Learning Representations, 2020. URL https://openreview.net/forum? id=H1edEyBKDS

    2020

  6. [8]

    Reward-augmented decoding: Efficient controlled text generation with a unidirectional reward model

    Haikang Deng and Colin Raffel. Reward-augmented decoding: Efficient controlled text generation with a unidirectional reward model. In Houda Bouamor, Juan Pino, and Kalika Bali, editors,Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 11781–11791, Singapore, December 2023. Association for Computational Linguisti...

    doi:10.18653/v1/2023.emnlp-main.721 2023

  7. [9]

    Bold: Dataset and metrics for measuring biases in open-ended language generation

    Jwala Dhamala, Tony Sun, Varun Kumar, Satyapriya Krishna, Yada Pruksachatkun, Kai-Wei Chang, and Rahul Gupta. Bold: Dataset and metrics for measuring biases in open-ended language generation. InProceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency, FAccT ’21, page 862–872, New York, NY, USA, 2021. Association for Computing M...

    arXiv 2021

  8. [10]

    DSCD: Large lan- guage model detoxification with self-constrained decoding

    Ming Dong, Jinkui Zhang, Bolong Zheng, Xinhui Tu, Po Hu, and Tingting He. DSCD: Large lan- guage model detoxification with self-constrained decoding. In Christos Christodoulopoulos, Tanmoy Chakraborty, Carolyn Rose, and Violet Peng, editors,Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 3969–3984, Suzhou, Chi...

    doi:10.18653/v1/2025.emnlp-main.197 2025

Show all 56 references
  1. [11]

    Variance- reduced zeroth-order methods for fine-tuning language models

    Tanmay Gautam, Youngsuk Park, Hao Zhou, Parameswaran Raman, and Wooseok Ha. Variance- reduced zeroth-order methods for fine-tuning language models. InForty-first International Conference on Machine Learning, 2024. URLhttps://openreview.net/forum?id=VHO4nE7v41

    2024

  2. [12]

    Samuel Gehman, Suchin Gururangan, Maarten Sap, Yejin Choi, and Noah A. Smith. RealToxici- tyPrompts: Evaluating neural toxic degeneration in language models. In Trevor Cohn, Yulan He, and Yang Liu, editors,Findings of the Association for Computational Linguistics: EMNLP 2020, ...

    2020 doi

  3. [13]

    Suchin Gururangan, Ana Marasović, Swabha Swayamdipta, Kyle Lo, Iz Beltagy, Doug Downey, and Noah A. Smith. Don’t stop pretraining: Adapt language models to domains and tasks. In Dan Jurafsky, Joyce Chai, Natalie Schluter, and Joel Tetreault, editors,Proceedings of the 58th Ann...

    2020 doi

  4. [14]

    Word embeddings are steers for language models

    Chi Han, Jialiang Xu, Manling Li, Yi Fung, Chenkai Sun, Nan Jiang, Tarek Abdelzaher, and Heng Ji. Word embeddings are steers for language models. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar, editors,Proceedings of the 62nd Annual Meeting of the Association for Computation...

    2024 doi

  5. [15]

    Detoxify

    Laura Hanu and Unitary team. Detoxify. Github. https://github.com/unitaryai/detoxify, 2020

    2020

  6. [16]

    Model-free learning of two-stage beamformers for passive irs-aided network design.IEEE Transactions on Signal Processing, 72:652–669,

    Hassaan Hashmi, Spyridon Pougkakiotis, and Dionysis Kalogerias. Model-free learning of two-stage beamformers for passive irs-aided network design.IEEE Transactions on Signal Processing, 72:652–669,

  7. [17]

    Localized zeroth-order prompt optimization

    Wenyang Hu, Yao Shu, Zongmin Yu, Zhaoxuan Wu, Xiaoqiang Lin, Zhongxiang Dai, See-Kiong Ng, and Bryan Kian Hsiang Low. Localized zeroth-order prompt optimization. InProceedings of the 38th International Conference on Neural Information Processing Systems, NIPS ’24, Red Hook, NY...

    2024

  8. [18]

    DAPI: Domain adaptive toxicity probe vector intervention, for fine-grained detoxification

    Cho Hyeonsu, Dooyoung Kim, and Youngjoong Ko. DAPI: Domain adaptive toxicity probe vector intervention, for fine-grained detoxification. In Wanxiang Che, Joyce Nabende, Ekaterina Shutova, and Mohammad Taher Pilehvar, editors,Findings of the Association for Computational Lingui...

    2025 doi

  9. [19]

    Perspective API

    Jigsaw & the Google Counter Abuse Technology team. Perspective API. https://www. perspectiveapi.com/. URLhttps://www.perspectiveapi.com/. Accessed: 2026-01-05

    2026

  10. [20]

    Critic- guided decoding for controlled text generation

    Minbeom Kim, Hwanhee Lee, Kang Min Yoo, Joonsuk Park, Hwaran Lee, and Kyomin Jung. Critic- guided decoding for controlled text generation. In Anna Rogers, Jordan Boyd-Graber, and Naoaki Okazaki, editors,Findings of the Association for Computational Linguistics: ACL 2023, pages...

    2023 doi

  11. [21]

    Large language models can become strong self- detoxifiers

    Ching-Yun Ko, Pin-Yu Chen, Payel Das, Youssef Mroueh, Soham Dan, Georgios Kollias, Subhajit Chaudhury, Tejaswini Pedapati, and Luca Daniel. Large language models can become strong self- detoxifiers. InThe Thirteenth International Conference on Learning Representations, 2025. U...

    2025

  12. [22]

    Unveiling safety vulnerabilities of large language models

    George Kour, Marcel Zalmanovici, Naama Zwerdling, Esther Goldbraich, Ora Fandina, Ateret An- aby Tavor, Orna Raz, and Eitan Farchi. Unveiling safety vulnerabilities of large language models. In Sebastian Gehrmann, Alex Wang, João Sedoc, Elizabeth Clark, Kaustubh Dhole, Khyathi...

    2023

  13. [23]

    GeDi: Generative discriminator guided sequence generation

    Ben Krause, Akhilesh Deepak Gotmare, Bryan McCann, Nitish Shirish Keskar, Shafiq Joty, Richard Socher, and Nazneen Fatema Rajani. GeDi: Generative discriminator guided sequence generation. In Marie-Francine Moens, Xuanjing Huang, Lucia Specia, and Scott Wen-tau Yih, editors,Fi...

    2021 doi

  14. [24]

    Language detoxification with attribute- discriminative latent space

    Jin Myung Kwak, Minseon Kim, and Sung Ju Hwang. Language detoxification with attribute- discriminative latent space. In Anna Rogers, Jordan Boyd-Graber, and Naoaki Okazaki, editors, 14 Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Vol...

    2023 doi

  15. [25]

    Gonzalez, Hao Zhang, and Ion Stoica

    Woosuk Kwon, Zhuohan Li, Siyuan Zhuang, Ying Sheng, Lianmin Zheng, Cody Hao Yu, Joseph E. Gonzalez, Hao Zhang, and Ion Stoica. Efficient memory management for large language model serving with pagedattention. InProceedings of the ACM SIGOPS 29th Symposium on Operating Systems ...

    2023

  16. [26]

    Self-detoxifying language models via toxification reversal

    Chak Tou Leong, Yi Cheng, Jiashuo Wang, Jian Wang, and Wenjie Li. Self-detoxifying language models via toxification reversal. In Houda Bouamor, Juan Pino, and Kalika Bali, editors,Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 443...

    2023 doi

  17. [27]

    Destein: Navigating detoxification of language models via universal steering pairs and head-wise activation fusion

    Yu Li, Han Jiang, Chuanyang Gong, and Zhihua Wei. Destein: Navigating detoxification of language models via universal steering pairs and head-wise activation fusion. InFirst Conference on Language Modeling, 2024. URLhttps://openreview.net/forum?id=jq2kNXigPP

    2024

  18. [29]

    Smith, and Yejin Choi

    Alisa Liu, Maarten Sap, Ximing Lu, Swabha Swayamdipta, Chandra Bhagavatula, Noah A. Smith, and Yejin Choi. DExperts: Decoding-time controlled text generation with experts and anti-experts. In Chengqing Zong, Fei Xia, Wenjie Li, and Roberto Navigli, editors,Proceedings of the 5...

    2021

  19. [30]

    Sparse meZO: Less parameters for better performance in zeroth-order LLM fine-tuning

    Yong Liu, Zirui Zhu, Chaoyu Gong, Minhao Cheng, Cho-Jui Hsieh, and Yang You. Sparse meZO: Less parameters for better performance in zeroth-order LLM fine-tuning. InThe Thirty-ninth Annual Conference on Neural Information Processing Systems, 2025. URL https://openreview.net/for...

    2025

  20. [31]

    Unidetox: Universal detoxification of large language models via dataset distillation

    Huimin LU, Masaru Isonuma, Junichiro Mori, and Ichiro Sakata. Unidetox: Universal detoxification of large language models via dataset distillation. InThe Thirteenth International Conference on Learning Representations, 2025. URLhttps://openreview.net/forum?id=eLLBILFRsA

    2025

  21. [32]

    Quark: controllable text generation with reinforced [un]learning

    Ximing Lu, Sean Welleck, Jack Hessel, Liwei Jiang, Lianhui Qin, Peter West, Prithviraj Ammanabrolu, and Yejin Choi. Quark: controllable text generation with reinforced [un]learning. InProceedings of the 36th International Conference on Neural Information Processing Systems, NI...

    2022

  22. [33]

    Lee, Danqi Chen, and Sanjeev Arora

    Sadhika Malladi, Tianyu Gao, Eshaan Nichani, Alex Damian, Jason D. Lee, Danqi Chen, and Sanjeev Arora. Fine-tuning language models with just forward passes. InThirty-seventh Conference on Neural Information Processing Systems, 2023. URLhttps://openreview.net/forum?id=Vota6rFhBQ. 15

    2023

  23. [34]

    Attribute controlled fine-tuning for large language models: A case study on detoxification

    Tao Meng, Ninareh Mehrabi, Palash Goyal, Anil Ramakrishna, Aram Galstyan, Richard Zemel, Kai-Wei Chang, Rahul Gupta, and Charith Peris. Attribute controlled fine-tuning for large language models: A case study on detoxification. In Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung C...

    2024 doi

  24. [35]

    Random gradient-free minimization of convex functions

    Yurii Nesterov and Vladimir Spokoiny. Random gradient-free minimization of convex functions. Foundations of Computational Mathematics, 17(2):527–566, 2017. doi: 10.1007/s10208-015-9296-2. URL https://doi.org/10.1007/s10208-015-9296-2

    2017 doi

  25. [36]

    Parameter-efficient detoxification with contrastive decoding

    Tong Niu, Caiming Xiong, Yingbo Zhou, and Semih Yavuz. Parameter-efficient detoxification with contrastive decoding. In Nikita Soni, Lucie Flek, Ashish Sharma, Diyi Yang, Sara Hooker, and H. Andrew Schwartz, editors,Proceedings of the 1st Human-Centered Large Language Modeling...

    2024 doi

  26. [37]

    Best practices for prompt engineering with the openai api

    OpenAI. Best practices for prompt engineering with the openai api. https://help.openai.com/en/ articles/6654000-best-practices-for-prompt-engineering-with-the-openai-api , 2025. OpenAI Help Center article. Accessed: 7 Dec 2025

    2025

  27. [38]

    Training language models to follow instructions with human feed- back

    Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kelton, Luke Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul F Christiano, Jan Leike, a...

    2022

  28. [39]

    Data-driven learning of two-stage beamformers in passive irs-assisted systems with inexact oracles.IEEE Access, 13:154984–155002, 2025

    Spyridon Pougkakiotis, Hassaan Hashmi, and Dionysis Kalogerias. Data-driven learning of two-stage beamformers in passive irs-assisted systems with inexact oracles.IEEE Access, 13:154984–155002, 2025. doi: 10.1109/ACCESS.2025.3605249

    2025

  29. [40]

    On the challenges of using black-box APIs for toxicity evaluation in research

    Luiza Pozzobon, Beyza Ermis, Patrick Lewis, and Sara Hooker. On the challenges of using black-box APIs for toxicity evaluation in research. In Houda Bouamor, Juan Pino, and Kalika Bali, editors, Proceedings of the 2023 Conference on Empirical Methods in Natural Language Proces...

    2023 doi

  30. [41]

    Language models are unsupervised multitask learners

    Alec Radford, Jeff Wu, Rewon Child, David Luan, Dario Amodei, and Ilya Sutskever. Language models are unsupervised multitask learners. 2019

    2019

  31. [42]

    Compatible gradient approximations for actor-critic algo- rithms, 2025

    Baturay Saglam and Dionysis Kalogerias. Compatible gradient approximations for actor-critic algo- rithms, 2025. URLhttps://arxiv.org/abs/2409.01477

    2025 arXiv

  32. [43]

    Self-diagnosis and self-debiasing: A proposal for reducing corpus-based bias in nlp.Transactions of the Association for Computational Linguistics, 9: 1408–1424, 12 2021

    Timo Schick, Sahana Udupa, and Hinrich Schütze. Self-diagnosis and self-debiasing: A proposal for reducing corpus-based bias in nlp.Transactions of the Association for Computational Linguistics, 9: 1408–1424, 12 2021. ISSN 2307-387X. doi: 10.1162/tacl_a_00434. URL https://doi....

    2021 doi

  33. [44]

    Gemma 2: Improving open language models at a practical size, 2024

    Gemma Team. Gemma 2: Improving open language models at a practical size, 2024. URL https: //arxiv.org/abs/2408.00118

    2024 arXiv

  34. [45]

    Supporting Human Raters with the Detection of Harmful Content Using Large Language Models

    Kurt Thomas, Patrick Gage Kelley, David Tao, Sarah Meiklejohn, Owen Vallis, Shunwen Tan, Blaz Bratanic, Felipe Tiengo Ferreira, Vijay Kumar Eranti, and Elie Bursztein. Supporting Human Raters with the Detection of Harmful Content Using Large Language Models . In2025 IEEE Sympo...

    2025

  35. [46]

    Attention is all you need

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Ł ukasz Kaiser, and Illia Polosukhin. Attention is all you need. In I. Guyon, U. Von Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett, editors,Advances in Neural I...

    2017

  36. [47]

    Exploring the limits of domain-adaptive training for detoxifying large-scale language models

    Boxin Wang, Wei Ping, Chaowei Xiao, Peng Xu, Mostofa Patwary, Mohammad Shoeybi, Bo Li, Anima Anandkumar, and Bryan Catanzaro. Exploring the limits of domain-adaptive training for detoxifying large-scale language models. In Alice H. Oh, Alekh Agarwal, Danielle Belgrave, and Kyu...

    2022

  37. [48]

    Llama-3.1-foundationai-securityllm-8b- instruct technical report, 2025

    Sajana Weerawardhena, Paul Kassianik, Blaine Nelson, Baturay Saglam, Anu Vellore, Aman Priyanshu, Supriti Vijay, Massimo Aufiero, Arthur Goldblatt, Fraser Burch, Ed Li, Jianliang He, Dhruv Kedia, Kojin Oshiba, Zhouran Yang, Yaron Singer, and Amin Karbasi. Llama-3.1-foundationa...

    2025 arXiv

  38. [49]

    Challenges in detoxifying language models

    Johannes Welbl, Amelia Glaese, Jonathan Uesato, Sumanth Dathathri, John Mellor, Lisa Anne Hen- dricks, Kirsty Anderson, Pushmeet Kohli, Ben Coppin, and Po-Sen Huang. Challenges in detoxifying language models. In Marie-Francine Moens, Xuanjing Huang, Lucia Specia, and Scott Wen...

    2021 doi

  39. [50]

    Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Rémi Louf, Morgan Funtowicz, Joe Davison, Sam Shleifer, Patrick von Platen, Clara Ma, Yacine Jernite, Julien Plu, Canwen Xu, Teven Le Scao, Sylvain Gugger, Mari...

    2020

  40. [51]

    Recipes for safety in open-domain chatbots, 2021

    Jing Xu, Da Ju, Margaret Li, Y-Lan Boureau, Jason Weston, and Emily Dinan. Recipes for safety in open-domain chatbots, 2021. URLhttps://arxiv.org/abs/2010.07079

    2021 arXiv

  41. [52]

    SafeDecoding: Defending against jailbreak attacks via safety-aware decoding

    Zhangchen Xu, Fengqing Jiang, Luyao Niu, Jinyuan Jia, Bill Yuchen Lin, and Radha Poovendran. SafeDecoding: Defending against jailbreak attacks via safety-aware decoding. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar, editors,Proceedings of the 62nd Annual Meeting of the Ass...

  42. [53]

    Qwen3 technical report, 2025

    An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, Chujie Zheng, Dayiheng Liu, Fan Zhou, Fei Huang, Feng Hu, Hao Ge, Haoran Wei, Huan Lin, Jialong Tang, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Yang, Jia...

    2025 arXiv

  43. [54]

    doi: 10.18653/v1/2024.acl-long.303

    Association for Computational Linguistics. doi: 10.18653/v1/2024.acl-long.303. URL https: //aclanthology.org/2024.acl-long.303/

    2024 doi

  44. [55]

    Unlocking black-box prompt tuning efficiency via zeroth-order optimization

    Heshen Zhan, Congliang Chen, Tian Ding, Ziniu Li, and Ruoyu Sun. Unlocking black-box prompt tuning efficiency via zeroth-order optimization. In Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen, editors,Findings of the Association for Computational Linguistics: EMNLP 2024, pag...

    2024

  45. [56]

    FUDGE: Controlled text generation with future discriminators

    Kevin Yang and Dan Klein. FUDGE: Controlled text generation with future discriminators. In Kristina Toutanova, Anna Rumshisky, Luke Zettlemoyer, Dilek Hakkani-Tur, Iz Beltagy, Steven Bethard, Ryan Cotterell, Tanmoy Chakraborty, and Yichao Zhou, editors,Proceedings of the 2021 ...

    2021 doi

  46. [57]

    challenging

    Chujie Zheng, Pei Ke, Zheng Zhang, and Minlie Huang. Click: Controllable text generation with sequence likelihood contrastive learning. In Anna Rogers, Jordan Boyd-Graber, and Naoaki Okazaki, editors,Findings of the Association for Computational Linguistics: ACL 2023, pages 10...

    2023 doi

  47. [58]

    Detoxifying large language models via the diversity of toxic samples

    Ying Zhao, Yuanzhao Guo, Xuemeng Weng, Yuan Tian, Wei Wang, and Yi Chang. Detoxifying large language models via the diversity of toxic samples. In Christos Christodoulopoulos, Tanmoy Chakraborty, Carolyn Rose, and Violet Peng, editors,Proceedings of the 2025 Conference on Empi...

    2025 doi

  48. [2024]

    doi: 10.1109/TSP.2023.3346182

    2023

Pith tools

Reviewed August 3, 2026 · model on record in the stance chip above.