mlsanityData to 7 Oct 2026

Detoxifying Large Language Models via Autoregressive Reward Guided Representation Editing

arXiv 2510.01243 ↗First posted 24 Sep 2025cs.CLcited by 9

On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks

Abstract (arXiv)

Large Language Models (LLMs) have demonstrated impressive performance across various tasks, yet they remain vulnerable to generating toxic content, necessitating detoxification strategies to ensure safe and responsible deployment. Test-time detoxification methods, which typically introduce static or dynamic interventions into LLM representations, offer a promising solution due to their flexibility and minimal invasiveness. However, current approaches often suffer from imprecise interventions, primarily due to their insufficient exploration of the transition space between toxic and non-toxic outputs. To address this challenge, we propose textscAutoregressive textscReward textscGuided textscRepresentation textscEditing (ARGRE), a novel test-time detoxification framework that explicitly models toxicity transitions within the latent representation space, enabling stable and precise reward-guided editing. ARGRE identifies non-toxic semantic directions and interpolates between toxic and non-toxic representations to reveal fine-grained transition trajectories. These trajectories transform sparse toxicity annotations into dense training signals, enabling the construction of an autoregressive reward model that delivers stable and precise editing guidance. At inference, the reward model guides an adaptive two-step editing process to obtain detoxified representations: it first performs directional steering based on expected reward gaps to shift representations toward non-toxic regions, followed by lightweight gradient-based refinements. Extensive experiments across 8 widely used LLMs show that ARGRE significantly outperforms leading baselines in effectiveness (-62.21% toxicity) and efficiency (-47.58% inference time), while preserving the core capabilities of the original model with minimal degradation. Our code is available at the website.

Key facts. Cited by 9 papers in the map (data through 7 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 69 of its 90 references that are in the map. First posted on arXiv 24 Sep 2025.

Builds on

69 of 90 references.

Closest ancestors · 5

Same direction, newest first

  1. 2025PRISM: Programmatic Reasoning with Image Sequence Manipulation for LVLM Jailbreaking29 Jul
  2. 2024Model Editing as a Robust and Denoised variant of DPO: A Case Study on Toxicity22 May
  3. 2024Defending Large Language Models against Jailbreak Attacks via Semantic Smoothing25 Feb
  4. 2024Assessing the Brittleness of Safety Alignment via Pruning and Low-Rank Modifications7 Feb
  5. 2024A Mechanistic Understanding of Alignment Algorithms: A Case Study on DPO and Toxicity3 Jan

Other references · 64

  1. 2020Language Models are Few-Shot Learnerscited by 32,199
  2. 2023GPT-4 Technical Reportcited by 18,132
  3. 2022Training language models to follow instructions with human feedbackcited by 15,712
  4. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
  5. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 7,916
  6. 2018GLUE: A Multi-Task Benchmark and Analysis Platform for Natural Language Understandingcited by 4,854
  7. 2018Think you have Solved Question Answering? Try ARC, the AI2 Reasoning Challengecited by 4,710
  8. 2019HellaSwag: Can a Machine Really Finish Your Sentence?cited by 4,018
  9. 2022OPT: Open Pre-trained Transformer Language Modelscited by 3,464
  10. 2016Pointer Sentinel Mixture Modelscited by 2,992
  11. 2022Locating and Editing Factual Associations in GPTcited by 2,609
  12. 2019BoolQ: Exploring the Surprising Difficulty of Natural Yes/No Questionscited by 2,140
38 more
  1. 2019Fine-Tuning Language Models from Human Preferencescited by 2,124
  2. 2018Can a Suit of Armor Conduct Electricity? A New Dataset for Open Book Question Answeringcited by 2,114
  3. 2020Don't Stop Pretraining: Adapt Language Models to Domains and Taskscited by 1,548
  4. 2020RealToxicityPrompts: Evaluating Neural Toxic Degeneration in Language Modelscited by 1,235
  5. 2023Steering Llama 2 via Contrastive Activation Additioncited by 1,009
  6. 2019Plug and Play Language Models: A Simple Approach to Controlled Text Generationcited by 793
  7. 2023The Linear Representation Hypothesis and the Geometry of Large Language Modelscited by 679
  8. 2021DExperts: Decoding-Time Controlled Text Generation with Experts and Anti-Expertscited by 434
  9. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 434
  10. 2020GeDi: Generative Discriminator Guided Sequence Generationcited by 377
  11. 2023Toxicity in ChatGPT: Analyzing Persona-assigned Language Modelscited by 356
  12. 2023Emergent Linear Representations in World Models of Self-Supervised Sequence Modelscited by 313
  13. 2024TrustLLM: Trustworthiness in Large Language Modelscited by 280
  14. 2023In-context Vectors: Making In Context Learning More Effective and Controllable Through Latent Space Steeringcited by 240
  15. 2024Secrets of RLHF in Large Language Models Part II: Reward Modelingcited by 170
  16. 2024The Geometry of Categorical and Hierarchical Concepts in Large Language Modelscited by 151
  17. 2014A Tutorial on Principal Component Analysiscited by 139
  18. 2023Aligning Language Models with Preferences through f-divergence Minimizationcited by 118
  19. 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Promptcited by 103
  20. 2024Model Editing Harms General Abilities of Large Language Models: Regularization to the Rescuecited by 101
  21. 2022Prompt Compression and Contrastive Conditioning for Controllability and Toxicity Reduction in Language Modelscited by 96
  22. 2024Detoxifying Large Language Models via Knowledge Editingcited by 86
  23. 2024VL-Trojan: Multimodal Instruction Backdoor Attacks against Autoregressive Visual Language Modelscited by 83
  24. 2023Reward-Augmented Decoding: Efficient Controlled Text Generation With a Unidirectional Reward Modelcited by 79
  25. 2022Exploring the Limits of Domain-Adaptive Training for Detoxifying Large-Scale Language Modelscited by 67
  26. 2024SafeBench: A Safety Evaluation Framework for Multimodal Large Language Modelscited by 63
  27. 2024Aligning Large Language Models with Representation Editing: A Control Perspectivecited by 62
  28. 2025Reasoning-Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Modelscited by 61
  29. 2019Training Robust Deep Neural Networks via Adversarial Noise Propagationcited by 60
  30. 2023X-Adv: Physical Adversarial Object Attacks against X-ray Prohibited Item Detectioncited by 58
  31. 2023A Survey of Temporal Credit Assignment in Deep Reinforcement Learningcited by 56
  32. 2024GenARM: Reward Guided Generation with Autoregressive Reward Model for Test-time Alignmentcited by 54
  33. 2023Self-Detoxifying Language Models via Toxification Reversalcited by 45
  34. 2024Revisiting Backdoor Attacks against Large Vision-Language Models from Domain Shiftcited by 45
  35. 2025Jailbreaking Multimodal Large Language Models via Shuffle Inconsistencycited by 42
  36. 2025Manipulating Multimodal Agents via Cross-Modal Prompt Injectioncited by 42
  37. 2025AGENTSAFE: Benchmarking the Safety of Embodied Agents on Hazardous Instructionscited by 33
  38. 2024Unlearning Backdoor Threats: Enhancing Backdoor Defense in Multimodal Contrastive Learning via Local Token Unlearningcited by 31

50 most cited of 64 All 64 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 2; 2026: 7.

9 papers.

Similar, not cited

Close in wording, no citation either way

  1. 2024Large Language Models can be Strong Self-Detoxifiers
  2. 2026Cleansing the Artificial Mind: A Self-Reflective Detoxification Framework for Large Language Models
  3. 2025Text Detoxification: Data Efficiency, Semantic Preservation and Model Generalization
  4. 2026Detoxifying LLMs via Representation Erasure-Based Preference Optimization
  5. 2025GemDetox at TextDetox CLEF 2025: Enhancing a Massively Multilingual Model for Text Detoxification on Low-resource Languages
  6. 2024Model Surgery: Modulating LLM's Behavior Via Simple Parameter Editing
  7. 2026Where Does Toxicity Live? Mechanistic Localization and Targeted Suppression in Language Models
  8. 2022Reward Modeling for Mitigating Toxicity in Transformer-based Language Models