Detoxifying Large Language Models via Autoregressive Reward Guided Representation Editing
On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks
Abstract (arXiv)
Large Language Models (LLMs) have demonstrated impressive performance across various tasks, yet they remain vulnerable to generating toxic content, necessitating detoxification strategies to ensure safe and responsible deployment. Test-time detoxification methods, which typically introduce static or dynamic interventions into LLM representations, offer a promising solution due to their flexibility and minimal invasiveness. However, current approaches often suffer from imprecise interventions, primarily due to their insufficient exploration of the transition space between toxic and non-toxic outputs. To address this challenge, we propose textscAutoregressive textscReward textscGuided textscRepresentation textscEditing (ARGRE), a novel test-time detoxification framework that explicitly models toxicity transitions within the latent representation space, enabling stable and precise reward-guided editing. ARGRE identifies non-toxic semantic directions and interpolates between toxic and non-toxic representations to reveal fine-grained transition trajectories. These trajectories transform sparse toxicity annotations into dense training signals, enabling the construction of an autoregressive reward model that delivers stable and precise editing guidance. At inference, the reward model guides an adaptive two-step editing process to obtain detoxified representations: it first performs directional steering based on expected reward gaps to shift representations toward non-toxic regions, followed by lightweight gradient-based refinements. Extensive experiments across 8 widely used LLMs show that ARGRE significantly outperforms leading baselines in effectiveness (-62.21% toxicity) and efficiency (-47.58% inference time), while preserving the core capabilities of the original model with minimal degradation. Our code is available at the website.
Key facts. Cited by 9 papers in the map (data through 7 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 69 of its 90 references that are in the map. First posted on arXiv 24 Sep 2025.
Builds on
69 of 90 references.
Closest ancestors · 5
Same direction, newest first
- 2025PRISM: Programmatic Reasoning with Image Sequence Manipulation for LVLM Jailbreaking29 Jul
- 2024Model Editing as a Robust and Denoised variant of DPO: A Case Study on Toxicity22 May
- 2024Defending Large Language Models against Jailbreak Attacks via Semantic Smoothing25 Feb
- 2024Assessing the Brittleness of Safety Alignment via Pruning and Low-Rank Modifications7 Feb
- 2024A Mechanistic Understanding of Alignment Algorithms: A Case Study on DPO and Toxicity3 Jan
Other references · 64
- 2020Language Models are Few-Shot Learnerscited by 32,199
- 2023GPT-4 Technical Reportcited by 18,132
- 2022Training language models to follow instructions with human feedbackcited by 15,712
- 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
- 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 7,916
- 2018GLUE: A Multi-Task Benchmark and Analysis Platform for Natural Language Understandingcited by 4,854
- 2018Think you have Solved Question Answering? Try ARC, the AI2 Reasoning Challengecited by 4,710
- 2019HellaSwag: Can a Machine Really Finish Your Sentence?cited by 4,018
- 2022OPT: Open Pre-trained Transformer Language Modelscited by 3,464
- 2016Pointer Sentinel Mixture Modelscited by 2,992
- 2022Locating and Editing Factual Associations in GPTcited by 2,609
- 2019BoolQ: Exploring the Surprising Difficulty of Natural Yes/No Questionscited by 2,140
38 more
- 2019Fine-Tuning Language Models from Human Preferencescited by 2,124
- 2018Can a Suit of Armor Conduct Electricity? A New Dataset for Open Book Question Answeringcited by 2,114
- 2020Don't Stop Pretraining: Adapt Language Models to Domains and Taskscited by 1,548
- 2020RealToxicityPrompts: Evaluating Neural Toxic Degeneration in Language Modelscited by 1,235
- 2023Steering Llama 2 via Contrastive Activation Additioncited by 1,009
- 2019Plug and Play Language Models: A Simple Approach to Controlled Text Generationcited by 793
- 2023The Linear Representation Hypothesis and the Geometry of Large Language Modelscited by 679
- 2021DExperts: Decoding-Time Controlled Text Generation with Experts and Anti-Expertscited by 434
- 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 434
- 2020GeDi: Generative Discriminator Guided Sequence Generationcited by 377
- 2023Toxicity in ChatGPT: Analyzing Persona-assigned Language Modelscited by 356
- 2023Emergent Linear Representations in World Models of Self-Supervised Sequence Modelscited by 313
- 2024TrustLLM: Trustworthiness in Large Language Modelscited by 280
- 2023In-context Vectors: Making In Context Learning More Effective and Controllable Through Latent Space Steeringcited by 240
- 2024Secrets of RLHF in Large Language Models Part II: Reward Modelingcited by 170
- 2024The Geometry of Categorical and Hierarchical Concepts in Large Language Modelscited by 151
- 2014A Tutorial on Principal Component Analysiscited by 139
- 2023Aligning Language Models with Preferences through f-divergence Minimizationcited by 118
- 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Promptcited by 103
- 2024Model Editing Harms General Abilities of Large Language Models: Regularization to the Rescuecited by 101
- 2022Prompt Compression and Contrastive Conditioning for Controllability and Toxicity Reduction in Language Modelscited by 96
- 2024Detoxifying Large Language Models via Knowledge Editingcited by 86
- 2024VL-Trojan: Multimodal Instruction Backdoor Attacks against Autoregressive Visual Language Modelscited by 83
- 2023Reward-Augmented Decoding: Efficient Controlled Text Generation With a Unidirectional Reward Modelcited by 79
- 2022Exploring the Limits of Domain-Adaptive Training for Detoxifying Large-Scale Language Modelscited by 67
- 2024SafeBench: A Safety Evaluation Framework for Multimodal Large Language Modelscited by 63
- 2024Aligning Large Language Models with Representation Editing: A Control Perspectivecited by 62
- 2025Reasoning-Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Modelscited by 61
- 2019Training Robust Deep Neural Networks via Adversarial Noise Propagationcited by 60
- 2023X-Adv: Physical Adversarial Object Attacks against X-ray Prohibited Item Detectioncited by 58
- 2023A Survey of Temporal Credit Assignment in Deep Reinforcement Learningcited by 56
- 2024GenARM: Reward Guided Generation with Autoregressive Reward Model for Test-time Alignmentcited by 54
- 2023Self-Detoxifying Language Models via Toxification Reversalcited by 45
- 2024Revisiting Backdoor Attacks against Large Vision-Language Models from Domain Shiftcited by 45
- 2025Jailbreaking Multimodal Large Language Models via Shuffle Inconsistencycited by 42
- 2025Manipulating Multimodal Agents via Cross-Modal Prompt Injectioncited by 42
- 2025AGENTSAFE: Benchmarking the Safety of Embodied Agents on Hazardous Instructionscited by 33
- 2024Unlearning Backdoor Threats: Enhancing Backdoor Defense in Multimodal Contrastive Learning via Local Token Unlearningcited by 31
50 most cited of 64 All 64 (JSON)
Built on by
Citing papers per year: 2025: 2; 2026: 7.
9 papers.
- 2026Uncovering Security Threats and Architecting Defenses in Autonomous Agents: A Case Study of OpenClawcited by 18
- 2025SecureWebArena: A Holistic Security Evaluation Benchmark for LVLM-based Web Agentscited by 17
- 2025RoboSafe: Safeguarding Embodied Agents via Executable Safety Logiccited by 11
- 2026Distillation Traps and Guards: A Calibration Knob for LLM Distillabilitycited by 1
- 2026Search for Truth from Reasoning: A Dynamic Representation Editing Framework for Steering LLM Trajectoriescited by 1
- 2026Benchmarking the Robustness of Autonomous Driving to Environmental Illusions: A Lane Perception Perspectivecited by 1
- 2026TrustVLA: Mechanism-Guided Inference-Time Defense Against Vision-Language-Action Backdoorscited by 0
- 2026TempQ-Jail: Query-Constrained Candidate Ranking for Text-to-Video Jailbreak Attackscited by 0
- 2026MASCRDM: Multi-Agent System for Compliance Risk Detection and Mitigation in Training Process of Large Language Modelscited by 0
- 2026MASCRDM: Multi-Agent System for Compliance Risk Detection and Mitigation in Training Process of Large Language Models30 Sep 2026
- 2026TempQ-Jail: Query-Constrained Candidate Ranking for Text-to-Video Jailbreak Attacks25 Sep 2026
- 2026TrustVLA: Mechanism-Guided Inference-Time Defense Against Vision-Language-Action Backdoors14 Jul 2026
- 2026Benchmarking the Robustness of Autonomous Driving to Environmental Illusions: A Lane Perception Perspective7 Jul 2026
- 2026Search for Truth from Reasoning: A Dynamic Representation Editing Framework for Steering LLM Trajectories26 Jun 2026
- 2026Distillation Traps and Guards: A Calibration Knob for LLM Distillability21 Apr 2026
- 2026Uncovering Security Threats and Architecting Defenses in Autonomous Agents: A Case Study of OpenClaw13 Mar 2026
- 2025RoboSafe: Safeguarding Embodied Agents via Executable Safety Logic24 Dec 2025
- 2025SecureWebArena: A Holistic Security Evaluation Benchmark for LVLM-based Web Agents11 Oct 2025
Similar, not cited
Close in wording, no citation either way
- 2024Large Language Models can be Strong Self-Detoxifiers
- 2026Cleansing the Artificial Mind: A Self-Reflective Detoxification Framework for Large Language Models
- 2025Text Detoxification: Data Efficiency, Semantic Preservation and Model Generalization
- 2026Detoxifying LLMs via Representation Erasure-Based Preference Optimization
- 2025GemDetox at TextDetox CLEF 2025: Enhancing a Massively Multilingual Model for Text Detoxification on Low-resource Languages
- 2024Model Surgery: Modulating LLM's Behavior Via Simple Parameter Editing
- 2026Where Does Toxicity Live? Mechanistic Localization and Targeted Suppression in Language Models
- 2022Reward Modeling for Mitigating Toxicity in Transformer-based Language Models