Abstract

Large language models (LLMs) are increasingly deployed across languages, but their safety behavior remains uneven across linguistic and cultural contexts. This survey synthesizes work on toxicity detection and detoxification for multilingual LLMs. We first catalogue threat models that exploit language choice, translation pivots, code-switching, orthographic variation, multi-turn interaction, and post-deployment fine-tuning to weaken safety alignment. We then organize task formulations (toxic-to-neutral rewriting, toxicity classification, and toxic-generation evaluation), multilingual detection approaches (cross-lingual encoders, translation pipelines, representation-level probes, and LLM-based detectors), and mitigation strategies spanning data filtering, supervised and preference-based tuning, decoding-time steering, representation editing, and multilingual guardrails. Across these areas, we identify persistent challenges: uneven language coverage, culturally contingent definitions of harm, fragmented evaluation protocols, and the risk that detoxification suppresses legitimate dialectal or identity-related expression.

Figure 1: Taxonomy of multilingual toxicity threat models, task formulations, evaluation metrics, detection approaches, and mitigation strategies.

1 Introduction↩︎

Large language models (LLMs) are increasingly used in multilingual settings, powering applications ranging from multilingual chatbots to cross-lingual content moderation [1]–[3]. As deployment expands, so do safety risks: LLMs can produce, amplify, or fail to detect toxic content such as hate speech, harassment, profanity, and identity-based abuse, and these risks are not distributed uniformly across languages [4]–[7]. Despite substantial progress on English detoxification, multilingual detection and mitigation remain less mature, especially for low-resource languages, dialects, code-switched inputs, and culturally specific harms [1], [8]–[11].

1.0.0.1 The Complexity of Multilingual Toxicity.

Multilingual detoxification is not a direct translation of English safety protocols [12], [13]. Toxicity ranges from overt categories, such as slurs, explicit insults, and profanity, to implicit forms such as microaggressions, sarcasm, and toxic condescension, which are harder to annotate, detect, and mitigate [14], [15]. Definitions of harm also vary by community: expressions that are benign, reclaimed, or dialectal in one context may be offensive in another. Multilingual settings introduce additional technical vulnerabilities. Code-switching, transliteration, and mixed-script inputs can weaken both detectors and refusal behavior [16]–[18], while pretrained models can degenerate into toxic continuations from benign or ambiguous prompts [19]. These failures interact with broader cultural and social biases in generated language [20], [21].

1.0.0.2 Failures of Current Approaches.

Traditional moderation systems rely heavily on keyword lists, rules, and supervised classifiers, which are brittle under paraphrase, obfuscation, dialectal variation, and context-dependent meaning [3], [22]. LLM alignment reduces many overt harms, but it does not transfer uniformly across languages: malicious prompts in lower-resource languages are more likely to elicit unsafe responses [23], [24], and preference optimization or RLHF data remain concentrated in a small set of high-resource languages [25], [26]. Preference tuning can transfer across languages, but transfer quality varies with representation alignment and language-resource availability [12], [27]. Machine translation is not a universal fallback either: multilingual translation systems can introduce, amplify, or obscure toxicity through hallucination and data bias [28]. These failures make multilingual detoxification a problem of technical robustness, evaluation validity, and sociolinguistic coverage [29], [30].

This survey provides a focused overview of detoxification for multilingual LLMs, synthesizing recent work on detection and mitigation into a taxonomy of datasets, methods, and evaluation frameworks (Figure 1). Related surveys examine multilingual LLM safety broadly [7]; our emphasis is the narrower detoxification pipeline: how toxic behavior is induced, measured, detected, and mitigated across languages.

1.0.0.3 Scope and Contributions.

The survey is organized around the following themes:

We organize multilingual threat models covering language-shift jailbreaks, translation/pivot attacks, code-switch prompts, multilingual red-teaming, and adaptation-time safety collapse from cross-lingual fine-tuning (§2).
We organize task formulations into three categories—toxic-to-neutral rewriting, toxicity classification, and toxic-generation/prompt continuation—and survey the datasets and metrics used to evaluate each.
We survey multilingual toxicity detection methods, spanning encoder- and decoder-based transformers, translation-based pipelines, representation-level probing, and LLM-based zero-shot detection.
We present a mechanism-based detoxification taxonomy covering data-centric filtering, supervised and preference-based tuning, decoding-time steering, representation editing, and multilingual guardrails.

We conclude with a discussion of open challenges—cross-lingual coverage gaps, cultural misalignment, evaluation fragmentation, and over-suppression—and identify concrete directions for building globally safe and equitable LLMs.

2 Threat Models for Inducing Toxicity in Multilingual LLMs↩︎

We focus on multilingual-specific toxicity-inducing threat models, which are adversarial procedures that exploit language choice, cross-lingual transfer, or multilingual interaction to elicit toxic outputs from a safety-aligned model. In this survey, we treat safety vulnerabilities—jailbreaks, alignment bypass, red-teaming—as the mechanisms through which toxic outputs are induced; “safety failure” and “toxicity elicitation” are thus two views of the same problem. To make these threat models comparable, we use four diagnostic axes: (i) language composition (monolingual vs.code-switched), (ii) script composition (standard vs.mixed-script/transliterated), (iii) translation mediation (direct vs.pivot/round-trip), and (iv) cultural-norm variation (universal vs.culturally contingent harm). The subsections below instantiate these axes: language-shift attacks isolate non-English prompting; translation-mediated attacks stress pivoting and round-trip evaluation; code-switching attacks combine language and script composition; and multilingual red-teaming/adaptation attacks expose how these linguistic operators interact with culturally contingent safety policies.

2.1 Prompt-Space Multilingual Attacks↩︎

2.1.0.1 Language-Shift Jailbreaks.

This threat primarily tests language composition: a malicious or ambiguous request remains monolingual but is re-expressed outside English. [23] formalize (i) unintentional multilingual jailbreaks (benign users prompting in underrepresented languages) and (ii) intentional multilingual jailbreaks (adversaries combining multilingual prompts with explicit malicious instructions), and show substantially higher unsafe rates in lower-resource languages.

2.1.0.2 Translation-Mediated and Pivot Attacks.

This threat stresses translation mediation: an unsafe English prompt is translated into a target low-resource language to increase compliance, then the response is translated back. [24] empirically demonstrate higher unsafe response rates for malicious prompts expressed in lower-resource languages, motivating translation/pivot-based red-teaming. Recent defenses that re-anchor safety using English while enforcing target-language outputs further underscore translation as a core failure mode in multilingual safety [31].

2.1.0.3 Language Mixing: Code-Switching and Multi-Language Mixtures.

This threat combines language composition with script composition, because multilingual prompts may mix languages, scripts, and transliterated forms within one context. [18] show that code-switched red-teaming queries can elicit unsafe behavior more effectively than monolingual attacks and introduce a synthesis framework (CSRT) to generate such queries at scale. Complementarily, [32] propose the Sandwich Attack, a multi-language mixture prompt that interleaves benign and adversarial segments across languages to induce harmful completions in a black-box setting.

2.2 Multilingual Red Teaming↩︎

Red teaming operationalizes these axes by generating adversarial prompts and dialogues at scale, including culturally specific prompts whose harmfulness may not be captured by English-centric policies. Early work established manual and LM-assisted red teaming methodologies [33], [34]. Recent multilingual extensions explicitly target the multilingual capability envelope: CSRT generates code-switched attacks [18]; Rainbow Teaming produces diverse open-ended adversarial prompts and has been replicated/extended for Polish as a concrete non-English safety stress test [35], [36]; and MM-ART automates multi-turn, multilingual red teaming, showing vulnerability increases sharply with conversation length and is substantially underestimated by single-turn English evaluation [37].

2.3 Post-Deployment Adaptation Attacks↩︎

2.3.0.1 Cross-lingual Fine-Tuning Attacks.

Aligned multilingual models are frequently customized via SFT/PEFT after deployment, creating an adaptation-time attack surface where safety behavior can shift across languages and local norms. [38] show that fine-tuning on a small toxic dataset in one language can collapse safety across other languages (cross-lingual attack transfer). Their Safety Information Localization (SIL) analysis suggests safety-relevant parameters are partially language-agnostic, enabling sparse updates to induce multilingual failure.

2.3.0.2 Jailbreaks via New-Language Learning.

Even benign adaptation can be risky: [39] show that LoRA fine-tuning to learn a low-resource language—without harmful data—can nonetheless degrade refusal behavior, implying that multilingual expansion itself can destabilize safety guarantees.

Multilingual detoxification methods should therefore be evaluated not only on monolingual English prompts, but under compositions of multilingual operators (translate/pivot, code-switch, mixture prompts, transliteration), multi-turn interaction, and post-deployment adaptation stress tests. The threat models above motivate the task formulations, datasets, and metrics we discuss next.

3 Task Setup: Datasets and Metrics↩︎

3.1 Datasets↩︎

Toxicity datasets can broadly be categorized into three tasks, each corresponding to a distinct evaluation goal:

Toxic-to-Neutral Rewriting. ParaDetox [11] introduced more than 10K English toxic\(\rightarrow\)neutral paraphrase pairs. Subsequent work explored cross-lingual transfer for detoxification [40], [41], added a Hindi evaluation set [42], and extended the ParaDetox collection pipeline to Russian, Ukrainian, and Spanish in MultiParaDetox [10]. The TextDetox/PAN 2024 shared task and its COLING extension broadened the parallel detoxification setting to 9 languages: English, Spanish, German, Chinese, Arabic, Hindi, Ukrainian, Russian, and Amharic [43], [44]. SynthDetox-M [45], [46] adds 16K high-quality synthetic pairs across German, French, Spanish, and Russian via few-shot LLM prompting. APPDIA [47] and CAPP [48] provide discourse- or dialogue-aware parallel corpora for offensive-content paraphrasing.

Toxic Text Detection. Jigsaw’s English Toxic Comment and Unintended Bias tasks provide large-scale comment-level toxicity labels, while the multilingual Jigsaw task evaluates binary toxicity in Spanish, Italian, Turkish, French, Portuguese, and Russian using English-labeled training data [49], [50]. OffensEval covers English offensive-language identification in 2019 and five languages in 2020 (Arabic, Danish, English, Greek, and Turkish) [51], [52]; the related Toxic Spans task targets span-level explanations in English [53]. HateCheck provides functional tests for English hate-speech detection, and Multilingual HateCheck extends this diagnostic framing to ten languages [4], [54]. HASOC and HatEval provide additional multilingual hate/offensive-language benchmarks [55], [56]. LifeTox [57] targets implicit toxicity in English advice-seeking contexts, and ToxiGen [2] provides 274K machine-generated toxic and benign statements about protected groups. Such classification datasets serve both toxicity evaluation [58] and retrieval-based detoxification [59].

Non-Toxic Text Continuation. RealToxicityPrompts (RTP) [19] provides 100K English web prompts scored by Perspective API and introduced common toxic-generation metrics such as Expected Maximum Toxicity (EMT) and toxicity probability. RTP-LX [1] extends this style of evaluation to 28 languages in the paper, with human-transcreated prompts and native-speaker annotations for harm categories such as bias, insult, identity attack, and microaggression. PolygloToxicityPrompts (PTP) [60] offers 425K naturally sourced prompts across 17 languages and reports that toxicity tends to increase as model size grows or language-resource availability decreases. FrenchToxicityPrompts [61] provides 50K French prompts. TET [62] comprises 2,546 prompts filtered from 1M real-world LLM interactions to expose latent toxic behaviors that can bypass safety mechanisms. [6] further showed that persona-based system prompts can amplify toxic degeneration.

max width=

3.2 Metrics↩︎

Toxicity Detection Metrics Outputs are often scored by toxicity classifiers. A common metric is style transfer accuracy (STA): the fraction of outputs that a classifier deems non-toxic. For example, models use RoBERTa-based classifiers trained on Jigsaw to compute STA [41]. Other tools such as the Perspective API¹ provide continuous toxicity scores. Detoxification systems are typically expected to improve STA or reduce toxicity scores while preserving meaning and fluency (e.g., reducing toxic-generation probability as in [27]).

Content Preservation and Fluency To ensure meaning is retained, similarity metrics are applied. Popular choices include BLEURT [63] or BERTScore [64] to compare the detoxified output to the input or a reference. [41] adopt BLEURT for English content similarity (SIM) and LaBSE embeddings for Russian. Fluency is evaluated by the percentage of grammatical or fluent sentences, often via a language acceptability classifier (e.g., a RoBERTa trained to recognize acceptability) [11], [41]. Combined metrics like the product of STA, SIM, and fluency are sometimes used to rank models.

Cross-Lingual Alignment When detox and translation happen together, one can also measure translation quality or cross-lingual consistency. For example, in simultaneous translation+detox, one may compute BLEU [65] or COMET [66] between the generated detoxified translation and a human reference. In practice, cross-lingual transfer effectiveness is often inferred from zero-shot performance, or by correlating translated and original outputs. Some work also uses source-output embedding similarity as a proxy for semantic alignment.

Human Evaluation Ultimately, manual judgments are key. Human annotators typically rate detox outputs on (1) toxicity/style (is the output non-toxic/neutral?); (2) content preservation (does it retain the original meaning?); and (3) fluency (is the output natural?). Human scores are used both to evaluate final systems and to calibrate or validate automatic metrics (e.g. correlating BLEURT with meaning preservation).

4 Detection↩︎

Detecting toxicity in multilingual settings is complicated by linguistic diversity, code-mixing, dialectal variation, and culturally contingent definitions of harm.

4.1 Multilingual Transformers↩︎

Early toxicity detection relied on keyword lists and lexicon-based classifiers, which lack contextual understanding and fail under paraphrase, obfuscation, and dialectal variation. Deep contextual encoders such as mBERT and XLM-R marked a significant advance, demonstrating that cross-lingual representations can improve toxicity identification across languages [9], [67]. These models benefit from shared subword vocabularies and multilingual pretraining, allowing transfer from high-resource languages such as English to languages with less labeled toxicity data. Nevertheless, performance remains uneven across scripts, dialects, and languages with limited pretraining resources [68]. The brittleness of subword tokenization under spelling variants, obfuscation, and script mixing has motivated byte- and character-level alternatives; the newer Perspective API, for example, uses a multilingual token-free Charformer architecture for toxic-content detection [69].

4.2 Translation-Based Pipelines↩︎

A parallel line of work explores translation-based pipelines, where non-English text is machine-translated into English before being passed to an English toxicity classifier [70]. This strategy can be competitive because English detectors are comparatively mature, but it introduces error propagation, translation artifacts, and semantic drift, especially for dialectal, code-mixed, or morphologically complex inputs [52]. Translation systems themselves can introduce or obscure toxic content, so translation is best treated as an evaluation or deployment design choice rather than a neutral preprocessing step [28].

4.3 Representation-Level Detection↩︎

Recent research identifies linear toxic subspaces in language model embeddings [71], [72], suggesting that toxicity-related features can occupy identifiable directions in latent space. Decomposing models into interpretable expert components can further isolate toxicity-related behavior [73]. These findings motivate probing and attribution techniques that seek to locate where toxicity features are stored, with applications to both detection and mitigation [74], [75].

4.4 LLM-Based Detection↩︎

The emergence of instruction-tuned LLMs has opened new detection avenues [76]. Several works evaluate LLMs as zero-shot or few-shot toxicity detectors, showing strong generalization but also calibration failures [77] and cultural misalignment across languages [78]. These models often rely on implicit safety priors learned during alignment, which can produce inconsistent behavior on region-specific sociolinguistic norms.

Takeaway: Multilingual LLMs and multilingual encoders have improved cross-lingual toxicity detection, but substantial challenges remain. Persistent gaps in language coverage, bias in training corpora, inconsistent cross-lingual performance, and translation-induced errors limit the reliability of current detectors. See Table 1 in the Appendix for a detailed comparison.

5 Detoxification↩︎

5.1 Data-Centric Detoxification↩︎

Data-centric detoxification targets the quality of pre-training and fine-tuning corpora by removing or down-weighting toxic content. Early filtering pipelines relied on blocklists or lexical heuristics; contemporary pipelines often combine language identification, quality filters, and toxicity classifiers at web scale [79], [80]. More recent work emphasizes bias-aware filtering to avoid suppressing dialectal or marginalized speech [15], [81], [82]. In multilingual settings, filtering depends heavily on cross-lingual detector generalization, which can misclassify culturally specific idioms, reclaimed slurs, or dialectal markers [83], [84]. Data filtering is scalable and can reduce exposure to toxic training examples, but it also risks cultural misalignment, uneven language coverage, and the over-removal of minority language varieties; recent work argues that harmful-content filtering can deepen underrepresentation of already vulnerable groups [80].

5.2 Model-Centric Detoxification↩︎

5.2.0.1 Supervised Finetuning on Safe or Contrastive Data

Supervised detoxification approaches fine-tune LLMs on curated non-toxic corpora, contrastive toxic–neutral pairs, or attribute-controlled toxicity objectives [85], [86]. [12] report that mitigation can transfer across languages, but that transfer depends on language-resource conditions and can trade off against non-English generation quality. Fine-tuning-based detoxification can provide strong control, but it may reduce output diversity, degrade generation quality, or introduce stylistic flattening [84], [87].

5.2.0.2 Instruction-Based Safety Tuning

Instruction tuning using curated safety data or synthetic refusal-style instructions can enhance multilingual LLMs’ ability to decline harmful requests and avoid toxic continuations. Multilingual preference optimization shows that alignment can transfer across languages when feedback data are balanced and sufficiently broad [25]. These methods scale well for deployment, though annotation biases and cultural coverage remain persistent limitations.

5.2.0.3 RLHF and Human Feedback Alignment

Reinforcement learning from human feedback (RLHF) [88], [89] can improve safety by training reward models to penalize toxic outputs. While RLHF datasets are primarily English-centric, multilingual LLMs can benefit indirectly through shared parameters and cross-lingual transfer [25]. However, reliance on English safety norms introduces cross-cultural misalignment in multilingual models [26], especially for expressions that are offensive in some cultures but neutral in others.

5.3 Decoding-Time Detoxification↩︎

Post-hoc methods avoid or minimize retraining by steering generation at inference [90]. Classifier-guided and expert-based logit steering include PPLM hidden-state perturbations [91], [92], GeDi-style generative discriminators [93], and expert/anti-expert mixture decoding such as DExperts [94]. Expert steering is modular, but high-quality multilingual experts are a bottleneck. A second family uses edit-after-generate: produce a candidate, detect toxicity, and rewrite or refine it via prompting or a specialized editor [95]. In multilingual deployments, translation-pivot pipelines (translate\(\rightarrow\)detox in English\(\rightarrow\)translate back) remain common, but they risk semantic drift and can erase culturally salient pragmatics [41], [70]. Retrieval augmentation can also support detoxification by grounding rewrites in policy examples or safe templates [59].

5.4 Model Editing and Representation Interventions↩︎

Recent work investigates activation steering: modifying internal LM representations to remove or attenuate toxic features [75]. Activation Addition [96] and ROME-based editing [97] identify directions or associations that can be altered during generation. Early analyses of how interventions reshape cross-lingual representations [98] suggest potential for multilingual transfer, though evaluation is still nascent and regression risk remains high without careful cross-lingual audits [74].

5.5 Multilingual Guardrails↩︎

A related line of work–not the main focus of this survey–is post-hoc moderation via multilingual guardrails [99]: deployment-time controllers that classify and gate prompts and responses into policy categories such as prompt harmfulness, response harmfulness, and refusal/compliance under adversarial multilingual inputs. Language choice, code-switching, and transliteration can weaken English-centric safeguards. Representative guardrails and safety classifiers include Llama Guard [100], Aegis [101], MrGuard [78], WildGuard [102], PolyGuard [13], MultiGuard/OmniGuard [103], CREST [104], Qwen3Guard [105], and UnityAI-Guard [106].

Key Takeaways.

Cross-lingual robustness remains a central challenge: Detoxification methods often perform better in high-resource languages than in low-resource or morphologically rich languages.
Cultural bias persists across detoxification pipelines: Much safety supervision originates from English, creating misalignment in non-Western contexts.
Hybrid strategies are promising: Combining data filtering, controlled decoding, alignment tuning, and guardrails can cover failure modes that no single method handles reliably.
Avoiding over-censorship is an unresolved issue: Techniques often suppress legitimate emotional or dialectal expressions, leading to “model homogenization.”

See Table 2 in the Appendix for a detailed comparison of detoxification techniques.

6 Discussion and Open Challenges↩︎

6.1 Cross-Lingual Gaps in Detoxification↩︎

A persistent disparity exists between high-resource and low-resource languages. Many multilingual toxicity detectors and safety-tuned LLMs are trained or validated primarily on English and other high-resource languages, leaving morphologically rich, dialectal, or culturally distant varieties under-detected [24], [83], [107]. Alignment methods such as RLHF and constitutional tuning have historically relied on English-heavy preference or principle data [88], [89], which can produce inconsistent refusal behavior and weak recognition of non-English toxic slang [25], [26].

Open Challenge: Developing culturally aware multilingual safety representations that scale to low-resource languages without English over-dominance remains essential.

6.2 Cultural and Normative Misalignment↩︎

Toxicity is culturally embedded: annotators’ identities and beliefs strongly influence judgments [15], [81], [108], yet many safety datasets collapse disagreement into a single label. Models therefore risk over-censoring reclaimed slurs, misclassifying dialectal expressions, or reinforcing majority-group norms [24]. Languages with rich honorific systems, code-switching norms, or culturally specific humor [109] expose current models’ limited ability to differentiate toxicity from socially sanctioned expression.

Open Challenge: Future systems need culturally grounded, community-driven annotation and context-aware toxicity modeling that respects sociolinguistic diversity.

6.3 Lack of Robust, Multilingual Evaluation Frameworks↩︎

A recurring theme is the lack of standardized, multilingual frameworks for evaluating toxicity. Existing generation benchmarks such as RealToxicityPrompts [19] are English-only, while newer multilingual datasets such as RTP-LX, PTP, and PolyGuard broaden coverage but differ substantially in task format, label schema, and language set [1], [13], [60]. Evaluation pipelines also struggle with subtle harms such as microaggressions, presuppositional harm, and implicit bias [15]. Cross-lingual transfer of toxicity classifiers can produce false positives for dialects or false negatives for low-resource slang, making direct comparison unreliable.

Open Challenge: The field needs multilingual benchmarks with fine-grained toxicity categories, cross-cultural annotations, and shared evaluation protocols [107].

6.4 Over-Suppression and Style Degradation↩︎

Detoxification techniques, particularly contrastive finetuning and representation editing, can reduce linguistic richness or stylistic diversity. Prior work shows that detoxification can trade toxicity reduction for reduced fluency, reduced diversity, or suppression of identity-related language [82], [84], [94]. In multilingual settings, this risk is amplified: low-resource languages may be pushed toward generic, formal, or English-like outputs because the model has weaker language-specific representations. Techniques such as activation editing [96] and PPLM [91] offer fine-grained control but still risk semantic over-suppression when applied cross-lingually.

Open Challenge: Designing detoxification techniques that preserve stylistic and cultural characteristics while eliminating harmful content remains an open frontier.

6.5 Handling Code-Switching and Mixed-Linguistic Toxicity↩︎

Multilingual communities frequently communicate through code-switching (e.g., Hinglish, Arabizi, Spanglish), combining scripts, phonetic spellings, and culturally specific expressions. Current LLMs and toxicity detectors are less reliable under code-switching because training coverage, tokenization, and evaluation data are sparse for mixed-language inputs [16], [83]. Safety failures under code-switched or transliterated prompts have been demonstrated for red-teaming and jailbreak settings [17], [18], and Hindi-English toxic language remains an active detection problem [5]. This poses serious risks for global deployments of multilingual LLMs.

Open Challenge: Robust multilingual safety systems must explicitly account for code-switching and orthographic variation via code-mixed training corpora, unified mixed-script tokenizers, and transliteration-aware detection.

6.6 The Role of Decoding-Time Steering↩︎

Decoding-time methods (PPLM, GeDi, DExperts) are best viewed as a complementary safeguard—modular and retraining-light—not a standalone fix for root causes like English-centric alignment data. In multilingual settings, tokenization asymmetries, script mixing, and cross-lingual semantic drift weaken expert model reliability; building language-specific experts for low-resource languages remains impractical at scale. A central bottleneck is expert availability (data scarcity), followed by representation entanglement (toxic directions conflating sentiment, intensity, and identity) and cross-script transfer instability. The evidence points toward hybrid architectures: filtering and alignment tuning address root causes; steering provides inference-time control; guardrails add system-level robustness. Where norms are culturally contingent, community-grounded supervision remains necessary.

6.7 Key Takeaways↩︎

Language disparities: Methods effective in English often underperform in low-resource languages and dialects.
Cultural context: One-size-fits-all safety tuning misaligns with local norms, over-censoring benign expressions or missing contextually offensive language.
Evaluation gaps: Fragmented protocols and English-centric benchmarks make cross-system comparison unreliable, especially for subtle toxicity.
Style trade-offs: Detoxification often degrades output diversity, yielding generic text that erases linguistic richness.
Hybrid approaches: Combining data filtering, controlled generation, culturally aware alignment, and guardrails is the most defensible direction for deployment.
Interpretability: Understanding why models flag or generate toxic content is essential for trust and auditability in multilingual settings.

7 Conclusion↩︎

This survey offers a focused treatment of detoxification for multilingual LLMs, a problem that remains under-studied relative to its practical importance. We systematized the space along three axes: multilingual threat models that expose how language shift, translation pivots, code-switching, and post-deployment adaptation erode safety; task formulations spanning rewriting, classification, and toxic-generation evaluation; and a mechanism-based taxonomy covering data filtering, supervised and preference-based tuning, decoding-time steering, representation editing, and guardrails.

Two findings cut across every axis. First, cross-lingual transfer of safety is unreliable: methods effective in English routinely under-perform in low-resource and morphologically rich languages, and alignment learned from English preference data can misfire when projected onto other cultural contexts. Second, detoxification and linguistic diversity are in tension: current techniques can suppress legitimate dialectal, code-switched, or identity-related expression, trading one harm for another.

The most pressing research need is evaluation infrastructure: standardized, culturally grounded multilingual benchmarks that go beyond English-translated prompts and that measure not only toxicity reduction but also preservation of stylistic and cultural content. Without such benchmarks, progress on multilingual safety will remain difficult to measure and easy to overstate.

Limitations↩︎

This survey synthesizes a fast-moving literature, so specific model families, benchmarks, and best practices may evolve after publication. Its scope is also intentionally focused on text-based toxicity detection and detoxification for multilingual language models; we do not cover multimodal moderation, broader cyber-safety policies, or legal governance in depth. The evidence base is uneven across languages: many “multilingual” studies still emphasize English and other high-resource languages, with fewer results for low-resource languages, dialect continua, and code-mixed or transliterated text. Because toxicity definitions and label schemas vary across datasets and cultures, comparisons across papers are necessarily approximate. We also do not run a quantitative meta-analysis or reproduce prior experiments; our synthesis depends on reported results, which often use different models, datasets, detectors, and evaluation protocols. Finally, many evaluations rely on automatic detectors, translation-based protocols, or closed-model assessments, which can introduce measurement noise and limit strict apples-to-apples replication.

Ethics↩︎

This survey reviews prior work on toxicity in multilingual language models and does not involve new data collection, human-subject annotation, or model deployment. Because the paper discusses jailbreaks, red-teaming, and adaptation-time safety failures, the topic has some dual-use risk. We therefore keep the discussion at the level of threat models, evaluation categories, and mitigation strategies rather than providing operational attack instructions or harmful prompt examples. The central ethical concern is that automated toxicity detection and detoxification can reflect English-centric or majority-culture norms, misclassify reclaimed or dialectal expressions, and suppress legitimate identity-related speech. Such failures can reinforce societal and annotator biases or lead to over-censorship, especially for communities already underrepresented in training and evaluation data. We therefore emphasize culturally grounded evaluation, inclusive data practices, transparent reporting of language coverage, and careful safety–utility trade-offs in multilingual deployment.

8 Detection and Detoxification Comparisons↩︎

Table 1: Comparison of multilingual toxicity detection approaches.
Approach	Typical setup	Strengths	Main failure modes	Representative evidence
Cross-lingual classifiers	mBERT/XLM-R or similar encoders trained on labeled toxicity data	Efficient inference; supports many languages with shared representations	Uneven transfer across scripts, dialects, and low-resource languages; annotation bias transfers with labels	Cross-lingual hate-speech detection [9]; dialect and tokenization bias [68], [108]
Translation-to-English pipelines	Translate non-English text, then apply an English detector	Reuses strong English detectors; simple to deploy	Translation artifacts, semantic drift, and toxicity insertion/omission	Cross-lingual toxicity classification via MT [70]; toxicity in MT [28]
LLM-based detection	Prompt or fine-tune instruction models/guard models for toxicity labels	Flexible label schemas; can use context and rationales	Calibration failures; inconsistent cultural norms; closed-model reproducibility issues	LLM toxicity detection [76]; guard calibration [77]; multilingual reasoning guardrails [78]
Representation probing	Linear probes, subspace analysis, or feature attribution in hidden states	Supports interpretability and targeted mitigation	Correlational unless paired with causal interventions; multilingual transfer remains under-tested	Toxic subspaces [71], [72]; expert decomposition [73]

Table 2: Comparison of multilingual LLM detoxification and moderation techniques.
Technique	Strengths	Weaknesses	Representative evidence
Parallel supervised fine-tuning	Strong task fit when toxic–neutral pairs exist; direct control over rewriting behavior	Expensive parallel data; weak zero-shot transfer; style can flatten	ParaDetox and multilingual extensions [10], [11], [44]
Preference tuning / RLHF / DPO	Can reduce toxic continuations and transfer safety preferences across languages	Transfer varies with representation alignment and language resources; English-heavy reward data can misalign norms	Cross-lingual preference transfer [12], [27]; multilingual preference optimization [25]
Decoding-time steering	Avoids full retraining; can be toggled or tuned at inference time	Needs calibrated classifiers or expert models; may degrade fluency under strong guidance; multilingual evidence remains limited	PPLM [91]; GeDi [93]; DExperts [94]
Edit-after-generate	Modular; can combine detection, rewriting, and reranking	Slower; detector errors propagate; translation pivots can lose pragmatics	Toxification reversal [95]; self-detoxification [90]; retrieval mitigation [59]
Representation editing	Targets internal toxicity features with limited data or parameter updates	Regression risk; limited multilingual evaluation; causal claims require audits	SafeEdit [74]; activation engineering [96]; SAE steering [75]
Multilingual guardrails	Deployment-time prompt/response gating; policy labels can be updated without changing generator	Does not detoxify the generator itself; vulnerable to coverage gaps and adversarial multilingual forms	MultiGuard/OmniGuard [103]; PolyGuard [13]; MrGuard [78]; Qwen3Guard [105]

References↩︎

[1]

A. de Wynter et al., “RTP-LX: Can LLMs evaluate toxicity in multilingual scenarios?” Proceedings of the AAAI Conference on Artificial Intelligence, vol. 39, no. 27, pp. 27940–27950, 2025, doi: 10.1609/aaai.v39i27.35011.

[2]

T. Hartvigsen, S. Gabriel, H. Palangi, M. Sap, D. Ray, and E. Kamar, “ToxiGen: A large-scale machine-generated dataset for adversarial and implicit hate speech detection,” in Proceedings of the 60th annual meeting of the association for computational linguistics (volume 1: Long papers), May 2022, pp. 3309–3326, doi: 10.18653/v1/2022.acl-long.234.

[3]

Y. Kim, H. Beniwal, S. L. Johnson, and T. Hartvigsen, “Decoding the rule book: Extracting hidden moderation criteria from reddit communities,” in Proceedings of the 2025 conference on empirical methods in natural language processing, Nov. 2025, pp. 20487–20498, doi: 10.18653/v1/2025.emnlp-main.1034.

[4]

P. Röttger, B. Vidgen, D. Nguyen, Z. Waseem, H. Margetts, and J. Pierrehumbert, “HateCheck: Functional tests for hate speech detection models,” in Proceedings of the 59th annual meeting of the association for computational linguistics and the 11th international joint conference on natural language processing (volume 1: Long papers), Aug. 2021, pp. 41–58, doi: 10.18653/v1/2021.acl-long.4.

[5]

A. Sharma and R. Bhalla, “Detecting hate speech for hindi-english code-mix text data using dual contrastive learning,” Procedia Computer Science, vol. 259, pp. 35–43, 2025, doi: 10.1016/j.procs.2025.03.304.

[6]

A. Deshpande, V. Murahari, T. Rajpurohit, A. Kalyan, and K. Narasimhan, “Toxicity in ChatGPT: Analyzing persona-assigned language models,” in Findings of the association for computational linguistics: EMNLP 2023, Dec. 2023, pp. 1236–1270, doi: 10.18653/v1/2023.findings-emnlp.88.

[7]

A. Krasnodębska, K. Dziewulska, K. Seweryn, M. Chrabaszcz, and W. Kusa, “Safety of large language models beyond English: A systematic literature review of risks, biases, and safeguards,” in Proceedings of the 19th conference of the european chapter of the association for computational linguistics (volume 1: Long papers), 2026, pp. 1003–1034, doi: 10.18653/v1/2026.eacl-long.44.

[8]

H. Beniwal, Y. Kim, M. Sap, S. Dan, and T. Hartvigsen, “Breaking mBad! Supervised fine-tuning for cross-lingual detoxification.” 2025, [Online]. Available: https://arxiv.org/abs/2505.16722.

[9]

T. Tiţa and A. Zubiaga, “Cross-lingual hate speech detection using transformer models,” arXiv preprint arXiv:2111.00981, 2021, doi: 10.48550/arXiv.2111.00981.

[10]

D. Dementieva, N. Babakov, and A. Panchenko, “MultiParaDetox: Extending text detoxification with parallel data to new languages,” in Proceedings of the 2024 conference of the north american chapter of the association for computational linguistics: Human language technologies (volume 2: Short papers), Jun. 2024, pp. 124–140, doi: 10.18653/v1/2024.naacl-short.12.

[11]

V. Logacheva et al., “ParaDetox: Detoxification with parallel data,” in Proceedings of the 60th annual meeting of the association for computational linguistics (volume 1: Long papers), May 2022, pp. 6804–6818, doi: 10.18653/v1/2022.acl-long.469.

[12]

V. Neplenbroek, A. Bisazza, and R. Fernández, “Cross-lingual transfer of debiasing and detoxification in multilingual llms: An extensive investigation,” in Findings of the association for computational linguistics: ACL 2025, Jul. 2025, pp. 2805–2830, doi: 10.18653/v1/2025.findings-acl.145.

[13]

P. Kumar et al., “Polyguard: A multilingual safety moderation tool for 17 languages,” arXiv preprint arXiv:2504.04377, 2025, doi: 10.48550/arXiv.2504.04377.

[14]

J. Wen et al., “Unveiling the implicit toxicity in large language models,” in Proceedings of the 2023 conference on empirical methods in natural language processing, Dec. 2023, pp. 1322–1338, doi: 10.18653/v1/2023.emnlp-main.84.

[15]

M. Sap, S. Swayamdipta, L. Vianna, X. Zhou, Y. Choi, and N. A. Smith, “Annotators with attitudes: How annotator beliefs and identities bias toxic language detection,” in Proceedings of the 2022 conference of the north american chapter of the association for computational linguistics: Human language technologies, Jul. 2022, pp. 5884–5906, doi: 10.18653/v1/2022.naacl-main.431.

[16]

R. Zhang, S. Cahyawijaya, J. C. B. Cruz, G. I. Winata, and A. F. Aji, “Multilingual large language models are not (yet) code-switchers,” in Proceedings of the 2023 conference on empirical methods in natural language processing, 2023, pp. 12567–12582, doi: 10.18653/v1/2023.emnlp-main.774.

[17]

M. Al Ghanim, S. Almohaimeed, M. Zheng, Y. Solihin, and Q. Lou, “Jailbreaking llms with arabic transliteration and arabizi,” in Proceedings of the 2024 conference on empirical methods in natural language processing, Nov. 2024, pp. 18584–18600, doi: 10.18653/v1/2024.emnlp-main.1034.

[18]

H. Yoo, Y. Yang, and H. Lee, “Code-switching red-teaming: Llm evaluation for safety and multilingual understanding,” in Proceedings of the 63rd annual meeting of the association for computational linguistics (volume 1: Long papers), Jul. 2025, pp. 13392–13413, doi: 10.18653/v1/2025.acl-long.657.

[19]

S. Gehman, S. Gururangan, M. Sap, Y. Choi, and N. A. Smith, “RealToxicityPrompts: Evaluating neural toxic degeneration in language models,” in Findings of the association for computational linguistics: EMNLP 2020, 2020, pp. 3356–3369, doi: 10.18653/v1/2020.findings-emnlp.301.

[20]

P. Vongpradit, A. Imsombut, S. Kongyoung, C. Damrongrat, S. Phaholphinyo, and T. Tanawong, “SafeCultural: A dataset for evaluating safety and cultural sensitivity in large language models,” in 2024 8th international conference on information technology (InCIT), 2024, pp. 740–745, doi: 10.1109/InCIT63192.2024.10810548.

[21]

P. P. S. Dammu, H. Jung, A. Singh, M. Choudhury, and T. Mitra, “‘They are uncultured’: Unveiling covert harms and social threats in LLM generated conversations,” in Proceedings of the 2024 conference on empirical methods in natural language processing, Nov. 2024, pp. 20339–20369, doi: 10.18653/v1/2024.emnlp-main.1134.

[22]

T. Huang, “Content moderation by LLM: From accuracy to legitimacy,” Artificial Intelligence Review, vol. 58, no. 10, p. 320, 2025, doi: 10.1007/s10462-025-11328-1.

[23]

Y. Deng, W. Zhang, S. J. Pan, and L. Bing, “Multilingual jailbreak challenges in large language models,” in The twelfth international conference on learning representations, 2024, [Online]. Available: https://proceedings.iclr.cc/paper_files/paper/2024/hash/6b396f766a50e0853a5164e68048540c-Abstract-Conference.html.

[24]

L. Shen et al., “The language barrier: Dissecting safety challenges of LLMs in multilingual contexts,” in Findings of the association for computational linguistics: ACL 2024, Aug. 2024, pp. 2668–2680, doi: 10.18653/v1/2024.findings-acl.156.

[25]

J. Dang, A. Ahmadian, K. Marchisio, J. Kreutzer, A. Üstün, and S. Hooker, “RLHF can speak many languages: Unlocking multilingual preference optimization for LLMs,” in Proceedings of the 2024 conference on empirical methods in natural language processing, Nov. 2024, pp. 13134–13156, doi: 10.18653/v1/2024.emnlp-main.729.

[26]

H. Lu et al., “Alignment and safety in large language models: Safety mechanisms, training paradigms, and emerging challenges.” 2025, [Online]. Available: https://arxiv.org/abs/2507.19672.

[27]

X. Li, Z.-X. Yong, and S. H. Bach, June 2024“Preference tuning for toxicity mitigation generalizes across languages,” arXiv preprint, vol. arXiv:2406.16235, 2024, [Online]. Available: https://arxiv.org/abs/2406.16235.

[28]

M. R. Costa-Jussà et al., “Toxicity in multilingual machine translation at scale,” in Findings of the association for computational linguistics: EMNLP 2023, Dec. 2023, pp. 9570–9586, doi: 10.18653/v1/2023.findings-emnlp.642.

[29]

R. Adragna, E. Creager, D. Madras, and R. Zemel, “Fairness and robustness in invariant learning: A case study in toxicity classification,” arXiv preprint arXiv:2011.06485, 2020, doi: 10.48550/arXiv.2011.06485.

[30]

D. Cecchini, A. Nazir, K. Chakravarthy, and V. Kocaman, “Holistic evaluation of large language models: Assessing robustness, accuracy, and toxicity for real-world applications,” in Proceedings of the 4th workshop on trustworthy natural language processing (TrustNLP 2024), Jun. 2024, pp. 109–117, doi: 10.18653/v1/2024.trustnlp-1.11.

[31]

Z. Zhang, Y. Guo, J. Lin, S. Quan, H. Zhang, and D. Zhao, “English as defense proxy: Mitigating multilingual jailbreak via eliciting english safety knowledge,” in Findings of the association for computational linguistics: EMNLP 2025, Nov. 2025, pp. 1185–1196, doi: 10.18653/v1/2025.findings-emnlp.62.

[32]

B. Upadhayay and V. Behzadan, “Sandwich attack: Multi-language mixture adaptive attack on LLMs,” in Proceedings of the 4th workshop on trustworthy natural language processing (TrustNLP 2024), Jun. 2024, pp. 208–226, doi: 10.18653/v1/2024.trustnlp-1.18.

[33]

E. Perez et al., “Red teaming language models with language models,” in Proceedings of the 2022 conference on empirical methods in natural language processing, Dec. 2022, pp. 3419–3448, doi: 10.18653/v1/2022.emnlp-main.225.

[34]

T. Y. Zhuo, Y. Huang, C. Chen, and Z. Xing, “Red teaming chatgpt via jailbreaking: Bias, robustness, reliability and toxicity,” arXiv preprint arXiv:2301.12867, 2023, doi: 10.48550/arXiv.2301.12867.

[35]

M. Samvelyan et al., “Rainbow teaming: Open-ended generation of diverse adversarial prompts,” Advances in Neural Information Processing Systems, vol. 37, pp. 69747–69786, 2024, doi: 10.52202/079017-2229.

[36]

A. Krasnodębska, M. Chrabaszcz, and W. Kusa, “Rainbow-teaming for the polish language: A reproducibility study,” in Proceedings of the 5th workshop on trustworthy NLP (TrustNLP 2025), May 2025, pp. 155–165, doi: 10.18653/v1/2025.trustnlp-main.12.

[37]

A. Singhania, C. Dupuy, S. S. Mangale, and A. Namboori, “Multi-lingual multi-turn automated red teaming for LLMs,” in Proceedings of the 5th workshop on trustworthy NLP (TrustNLP 2025), May 2025, pp. 141–154, doi: 10.18653/v1/2025.trustnlp-main.11.

[38]

S. Poppi et al., “Towards understanding the fragility of multilingual llms against fine-tuning attacks,” in Findings of the association for computational linguistics: NAACL 2025, Apr. 2025, pp. 2358–2372, doi: 10.18653/v1/2025.findings-naacl.126.

[39]

B. Upadhayay and V. Behzadan, “Tongue-tied: Breaking LLMs safety through new language learning,” in Proceedings of the 7th workshop on computational approaches to linguistic code-switching, May 2025, pp. 32–47, doi: 10.18653/v1/2025.calcs-1.5.

[40]

D. Moskovskiy, D. Dementieva, and A. Panchenko, “Exploring cross-lingual text detoxification with large multilingual language models,” in Proceedings of the 60th annual meeting of the association for computational linguistics: Student research workshop, 2022, pp. 346–354, doi: 10.18653/v1/2022.acl-srw.26.

[41]

D. Dementieva, D. Moskovskiy, D. Dale, and A. Panchenko, “Exploring methods for cross-lingual text style transfer: The case of text detoxification,” in Proceedings of the 13th international joint conference on natural language processing and the 3rd conference of the asia-pacific chapter of the association for computational linguistics (volume 1: Long papers), Nov. 2023, pp. 1083–1101, doi: 10.18653/v1/2023.ijcnlp-main.70.

[42]

S. Mukherjee, A. Bansal, A. Kr. Ojha, J. P. McCrae, and O. Dusek, “Text detoxification as style transfer in English and Hindi,” in Proceedings of the 20th international conference on natural language processing (ICON), Dec. 2023, pp. 133–144, [Online]. Available: https://aclanthology.org/2023.icon-1.13/.

[43]

D. Dementieva et al., “Overview of the multilingual text detoxification task at pan 2024,” CEUR Workshop Proceedings, vol. 3740, pp. 2432–2461, 2024, [Online]. Available: https://nchr.elsevierpure.com/en/publications/overview-of-the-multilingual-text-detoxification-task-at-pan-2024/.

[44]

D. Dementieva et al., COLING 2025“Multilingual and explainable text detoxification with parallel corpora,” in Proceedings of the 31st international conference on computational linguistics, 2025, pp. 7998–8025, [Online]. Available: https://aclanthology.org/2025.coling-main.535/.

[45]

D. Moskovskiy, N. Sushko, S. Pletenev, E. Tutubalina, and A. Panchenko, “SynthDetoxM: Modern LLMs are few-shot parallel detoxification data annotators,” arXiv preprint arXiv:2502.06394, 2025, doi: 10.48550/arXiv.2502.06394.

[46]

D. Moskovskiy, S. Pletenev, and A. Panchenko, “LLMs to replace crowdsourcing for parallel data creation? The case of text detoxification,” in Findings of the association for computational linguistics: EMNLP 2024, Nov. 2024, pp. 14361–14373, doi: 10.18653/v1/2024.findings-emnlp.839.

[47]

K. Atwell, S. Hassan, and M. Alikhani, “APPDIA: A discourse-aware transformer-based style transfer model for offensive social media conversations,” in Proceedings of the 29th international conference on computational linguistics, Oct. 2022, pp. 6063–6074, [Online]. Available: https://aclanthology.org/2022.coling-1.530/.

[48]

A. Som, K. Sikka, H. Gent, A. Divakaran, A. Kathol, and D. Vergyri, “Demonstrations are all you need: Advancing offensive content paraphrasing using in-context learning,” in Findings of the association for computational linguistics: ACL 2024, Aug. 2024, pp. 12612–12627, doi: 10.18653/v1/2024.findings-acl.749.

[49]

Jigsaw, “Jigsaw toxic comment classification challenge.” Kaggle competition, 2018, [Online]. Available: https://www.kaggle.com/c/jigsaw-toxic-comment-classification-challenge.

[50]

I. Kivlichan, J. Sorensen, J. Elliott, L. Vasserman, M. Görner, and P. Culliton, “Jigsaw multilingual toxic comment classification.” Kaggle competition, 2020, [Online]. Available: https://www.kaggle.com/c/jigsaw-multilingual-toxic-comment-classification.

[51]

M. Zampieri, S. Malmasi, P. Nakov, S. Rosenthal, N. Farra, and R. Kumar, “SemEval-2019 task 6: Identifying and categorizing offensive language in social media (OffensEval),” in Proceedings of the 13th international workshop on semantic evaluation, Jun. 2019, pp. 75–86, doi: 10.18653/v1/S19-2010.

[52]

M. Zampieri et al., “SemEval-2020 task 12: Multilingual offensive language identification in social media (OffensEval 2020),” in Proceedings of the fourteenth workshop on semantic evaluation, Dec. 2020, pp. 1425–1447, doi: 10.18653/v1/2020.semeval-1.188.

[53]

J. Pavlopoulos, J. Sorensen, L. Laugier, and I. Androutsopoulos, “SemEval-2021 task 5: Toxic spans detection,” in Proceedings of the 15th international workshop on semantic evaluation (SemEval-2021), Aug. 2021, pp. 59–69, doi: 10.18653/v1/2021.semeval-1.6.

[54]

P. Röttger, H. Seelawi, D. Nozza, Z. Talat, and B. Vidgen, “Multilingual HateCheck: Functional tests for multilingual hate speech detection models,” in Proceedings of the sixth workshop on online abuse and harms (WOAH), Jul. 2022, pp. 154–169, doi: 10.18653/v1/2022.woah-1.15.

[55]

T. Mandl et al., “Overview of the hasoc track at fire 2019: Hate speech and offensive content identification in indo-european languages,” in Proceedings of the 11th annual meeting of the forum for information retrieval evaluation, 2019, pp. 14–17, doi: 10.1145/3368567.3368584.

[56]

V. Basile et al., “Semeval-2019 task 5: Multilingual detection of hate speech against immigrants and women in twitter,” in Proceedings of the 13th international workshop on semantic evaluation, Jun. 2019, pp. 54–63, doi: 10.18653/v1/S19-2007.

[57]

M. Kim, J. Koo, H. Lee, J. Park, H. Lee, and K. Jung, “LifeTox: Unveiling implicit toxicity in life advice,” in Proceedings of the 2024 conference of the north american chapter of the association for computational linguistics: Human language technologies (volume 2: Short papers), Jun. 2024, pp. 688–698, doi: 10.18653/v1/2024.naacl-short.60.

[58]

H. Koh, D. Kim, M. Lee, and K. Jung, “Can LLMs recognize toxicity? A structured investigation framework and toxicity metric,” in Findings of the association for computational linguistics: EMNLP 2024, Nov. 2024, pp. 6092–6114, doi: 10.18653/v1/2024.findings-emnlp.353.

[59]

L. Pozzobon, B. Ermis, P. Lewis, and S. Hooker, EMNLP Findings 2023“Goodtriever: Adaptive toxicity mitigation with retrieval-augmented models,” in Findings of the association for computational linguistics: EMNLP 2023, 2023, pp. 5108–5125, doi: 10.18653/v1/2023.findings-emnlp.339.

[60]

D. Jain, P. Kumar, S. Gehman, X. Zhou, T. Hartvigsen, and M. Sap, May 2024“PolygloToxicityPrompts: Multilingual evaluation of neural toxic degeneration in large language models,” arXiv preprint, vol. arXiv:2405.09373, 2024, [Online]. Available: https://arxiv.org/abs/2405.09373.

[61]

C. Brun and V. Nikoulina, “FrenchToxicityPrompts: A large benchmark for evaluating and mitigating toxicity in french texts,” in Proceedings of the fourth workshop on threat, aggression & cyberbullying@ LREC-COLING-2024, 2024, pp. 105–114, [Online]. Available: https://aclanthology.org/2024.trac-1.12/.

[62]

T. Luong, T.-T. Le, L. Ngo, and T. Nguyen, “Realistic evaluation of toxicity in large language models,” in Findings of the association for computational linguistics: ACL 2024, Aug. 2024, pp. 1038–1047, doi: 10.18653/v1/2024.findings-acl.61.

[63]

T. Sellam, D. Das, and A. Parikh, “BLEURT: Learning robust metrics for text generation,” in Proceedings of the 58th annual meeting of the association for computational linguistics, Jul. 2020, pp. 7881–7892, doi: 10.18653/v1/2020.acl-main.704.

[64]

T. Zhang, V. Kishore, F. Wu, K. Q. Weinberger, and Y. Artzi, “BERTScore: Evaluating text generation with BERT,” in International conference on learning representations, 2020, [Online]. Available: https://openreview.net/forum?id=SkeHuCVFDr.

[65]

K. Papineni, S. Roukos, T. Ward, and W.-J. Zhu, “BLEU: A method for automatic evaluation of machine translation,” in Proceedings of the 40th annual meeting of the association for computational linguistics, 2002, pp. 311–318, doi: 10.3115/1073083.1073135.

[66]

R. Rei, C. Stewart, A. C. Farinha, and A. Lavie, “COMET: A neural framework for MT evaluation,” in Proceedings of the 2020 conference on empirical methods in natural language processing (EMNLP), 2020, pp. 2685–2702, doi: 10.18653/v1/2020.emnlp-main.213.

[67]

A. Conneau et al., “Unsupervised cross-lingual representation learning at scale,” in Proceedings of the 58th annual meeting of the association for computational linguistics, Jul. 2020, pp. 8440–8451, doi: 10.18653/v1/2020.acl-main.747.

[68]

V. Kanjirangat, T. Samardzic, L. Dolamic, and F. Rinaldi, “Tokenization and representation biases in multilingual models on dialectal NLP tasks,” in Proceedings of the 2025 conference on empirical methods in natural language processing, Nov. 2025, pp. 23992–24010, doi: 10.18653/v1/2025.emnlp-main.1224.

[69]

A. Lees et al., “A new generation of perspective api: Efficient multilingual character-level transformers,” in Proceedings of the 28th ACM SIGKDD conference on knowledge discovery and data mining, 2022, pp. 3197–3207, doi: 10.1145/3534678.3539147.

[70]

S. Bell, E. Sánchez, D. Dale, P. Stenetorp, M. Artetxe, and M. R. Costa-jussà, “Translate, then detect: Leveraging machine translation for cross-lingual toxicity classification,” in Proceedings of the tenth conference on machine translation, Nov. 2025, pp. 253–268, doi: 10.18653/v1/2025.wmt-1.15.

[71]

A. Wang, M. Sudhakar, and Y. Ji, “Simple text detoxification by identifying a linear toxic subspace in language model embeddings,” arXiv preprint arXiv:2112.08346, 2021, doi: 10.48550/arXiv.2112.08346.

[72]

Z. Duan et al., “GloSS over toxicity: Understanding and mitigating toxicity in LLMs via global toxic subspace,” arXiv preprint arXiv:2505.17078, 2025, doi: 10.48550/arXiv.2505.17078.

[73]

Z. H. Shaik, A. Mazhar, A. Srivastava, and M. S. Akhtar, “Redefining experts: Interpretable decomposition of language models for toxicity mitigation,” arXiv preprint arXiv:2509.16660, 2025, doi: 10.48550/arXiv.2509.16660.

[74]

M. Wang et al., “Detoxifying large language models via knowledge editing,” in Proceedings of the 62nd annual meeting of the association for computational linguistics (volume 1: Long papers), Aug. 2024, pp. 3093–3118, doi: 10.18653/v1/2024.acl-long.171.

[75]

A. Goyal, V. Rathi, W. Yeh, Y. Wang, Y. Chen, and H. Sundaram, “Breaking bad tokens: Detoxification of LLMs using sparse autoencoders,” in Proceedings of the 2025 conference on empirical methods in natural language processing, Nov. 2025, pp. 12691–12709, doi: 10.18653/v1/2025.emnlp-main.641.

[76]

Z. Hu, J. Piet, G. Zhao, J. Jiao, and D. Wagner, “Toxicity detection for free,” Advances in Neural Information Processing Systems, vol. 37, pp. 17518–17540, 2024, [Online]. Available: https://papers.nips.cc/paper_files/paper/2024/hash/1f69928210578f4cf5b538a8c8806798-Abstract-Conference.html.

[77]

H. Liu, H. Huang, X. Gu, H. Wang, and Y. Wang, “On calibration of LLM-based guard models for reliable content moderation,” in The thirteenth international conference on learning representations, 2025, [Online]. Available: https://openreview.net/forum?id=wUbum0nd9N.

[78]

Y. Yang, S. Dan, S. Li, D. Roth, and I. Lee, “MrGuard: A multilingual reasoning guardrail for universal LLM safety,” in Proceedings of the 2025 conference on empirical methods in natural language processing, Nov. 2025, pp. 27377–27396, doi: 10.18653/v1/2025.emnlp-main.1392.

[79]

J. Kreutzer et al., “Quality at a glance: An audit of web-crawled multilingual datasets,” Transactions of the Association for Computational Linguistics, vol. 10, pp. 50–72, 2022, doi: 10.1162/tacl_a_00447.

[80]

M. A. Stranisci and C. Hardmeier, “What are they filtering out? A survey of filtering strategies for harm reduction in pretraining datasets,” arXiv preprint arXiv:2503.05721, 2025, doi: 10.48550/arXiv.2503.05721.

[81]

H. Jaggi, K. Coimbatore Murali, E. Fleisig, and E. Biyik, “Accurate and data-efficient toxicity prediction when annotators disagree,” in Proceedings of the 2024 conference on empirical methods in natural language processing, Nov. 2024, pp. 21910–21917, doi: 10.18653/v1/2024.emnlp-main.1221.

[82]

A. Xu, E. Pathak, E. Wallace, S. Gururangan, M. Sap, and D. Klein, “Detoxifying language models risks marginalizing minority voices,” in Proceedings of the 2021 conference of the north american chapter of the association for computational linguistics: Human language technologies, Jun. 2021, pp. 2390–2397, doi: 10.18653/v1/2021.naacl-main.190.

[83]

I. Bensalem, P. Rosso, and H. Zitouni, “Toxic language detection: A systematic review of arabic datasets.” 2024, [Online]. Available: https://arxiv.org/abs/2312.07228.

[84]

J. Welbl et al., “Challenges in detoxifying language models,” in Findings of the association for computational linguistics: EMNLP 2021, Nov. 2021, pp. 2447–2469, doi: 10.18653/v1/2021.findings-emnlp.210.

[85]

W. Hawkins, B. Mittelstadt, and C. Russell, “The effect of fine-tuning on language model toxicity,” arXiv preprint arXiv:2410.15821, 2024, doi: 10.48550/arXiv.2410.15821.

[86]

T. Meng et al., “Attribute controlled fine-tuning for large language models: A case study on detoxification.” Amazon Science, 2024, [Online]. Available: https://www.amazon.science/publications/attribute-controlled-fine-tuning-for-large-language-models-a-case-study-on-detoxification.

[87]

B. Wang et al., “Exploring the limits of domain-adaptive training for detoxifying large-scale language models,” Advances in Neural Information Processing Systems, vol. 35, pp. 35811–35824, 2022, [Online]. Available: https://proceedings.neurips.cc/paper_files/paper/2022/hash/e8c20cafe841cba3e31a17488dc9c3f1-Abstract-Conference.html.

[88]

L. Ouyang et al., “Training language models to follow instructions with human feedback,” in Advances in neural information processing systems, 2022, vol. 35, pp. 27730–27744, [Online]. Available: https://proceedings.neurips.cc/paper_files/paper/2022/hash/b1efde53be364a73914f58805a001731-Abstract-Conference.html.

[89]

Y. Bai et al., “Constitutional AI: Harmlessness from AI feedback.” 2022, [Online]. Available: https://arxiv.org/abs/2212.08073.

[90]

C.-Y. Ko et al., “Large language models can be strong self-detoxifiers.” 2024, [Online]. Available: https://arxiv.org/abs/2410.03818.

[91]

S. Dathathri et al., “Plug and play language models: A simple approach to controlled text generation,” in International conference on learning representations, 2020, [Online]. Available: https://openreview.net/forum?id=H1edEyBKDS.

[92]

D. Pascual, B. Egressy, C. Meister, R. Cotterell, and R. Wattenhofer, “A plug-and-play method for controlled text generation,” in Findings of the association for computational linguistics: EMNLP 2021, Nov. 2021, pp. 3973–3997, doi: 10.18653/v1/2021.findings-emnlp.334.

[93]

B. Krause et al., “Gedi: Generative discriminator guided sequence generation,” in Findings of the association for computational linguistics: EMNLP 2021, Nov. 2021, pp. 4929–4952, doi: 10.18653/v1/2021.findings-emnlp.424.

[94]

A. Liu et al., ACL 2021“DExperts: Decoding-time controlled text generation with experts and anti-experts,” in Proceedings of the 59th annual meeting of the association for computational linguistics (ACL 2021), 2021, pp. 1990–2001, [Online]. Available: https://aclanthology.org/2021.acl-long.522/.

[95]

C. T. Leong, Y. Cheng, J. Wang, J. Wang, and W. Li, “Self-detoxifying language models via toxification reversal,” in Proceedings of the 2023 conference on empirical methods in natural language processing, 2023, pp. 4433–4449, doi: 10.18653/v1/2023.emnlp-main.269.

[96]

A. M. Turner et al., “Steering language models with activation engineering.” 2024, [Online]. Available: https://arxiv.org/abs/2308.10248.

[97]

K. Meng, D. Bau, A. Andonian, and Y. Belinkov, “Locating and editing factual associations in GPT,” in Advances in neural information processing systems, 2022, vol. 35, pp. 17359–17372, [Online]. Available: https://proceedings.neurips.cc/paper_files/paper/2022/hash/6f1d43d5a82a37e89b0665b33bf3a182-Abstract-Conference.html.

[98]

A. Sundar, S. Williamson, K. Metcalf, B.-J. Theobald, S. Seto, and M. Fedzechkina, “Steering into new embedding spaces: Analyzing cross-lingual alignment induced by model interventions in multilingual language models,” arXiv preprint arXiv:2502.15639, 2025, doi: 10.48550/arXiv.2502.15639.

[99]

D. Yi et al., “Position: Building guardrails for large language models requires systematic design,” in Forty-first international conference on machine learning, 2024, pp. 11375–11394, [Online]. Available: https://proceedings.mlr.press/v235/dong24c.html.

[100]

H. Inan et al., “Llama guard: Llm-based input-output safeguard for human-ai conversations,” arXiv preprint arXiv:2312.06674, 2023, doi: 10.48550/arXiv.2312.06674.

[101]

S. Ghosh, P. Varshney, E. Galinkin, and C. Parisien, “AEGIS: Online adaptive AI content safety moderation with ensemble of LLM experts.” 2024, [Online]. Available: https://arxiv.org/abs/2404.05993.

[102]

S. Han et al., “Wildguard: Open one-stop moderation tools for safety risks, jailbreaks, and refusals of llms,” Advances in Neural Information Processing Systems, vol. 37, pp. 8093–8131, 2024, [Online]. Available: https://proceedings.neurips.cc/paper_files/paper/2024/hash/0f69b4b96a46f284b726fbd70f74fb3b-Abstract-Datasets_and_Benchmarks_Track.html.

[103]

S. Verma et al., “MULTIGUARD: An efficient approach for AI safety moderation across languages and modalities,” in Proceedings of the 2025 conference on empirical methods in natural language processing, Nov. 2025, pp. 16173–16187, doi: 10.18653/v1/2025.emnlp-main.819.

[104]

L. Bansal and N. Mishra, Accepted at LREC 2026“CREST: Universal safety guardrails through cluster-guided cross-lingual transfer,” arXiv preprint arXiv:2512.02711, 2025, doi: 10.48550/arXiv.2512.02711.

[105]

H. Zhao et al., “Qwen3Guard technical report,” arXiv preprint arXiv:2510.14276, 2025, doi: 10.48550/arXiv.2510.14276.

[106]

H. Beniwal et al., “UNITYAI-GUARD: Pioneering toxicity detection across low-resource indian languages.” 2025, [Online]. Available: https://arxiv.org/abs/2503.23088.

[107]

W. Wang et al., “All languages matter: On the multilingual safety of LLMs,” in Findings of the association for computational linguistics: ACL 2024, Aug. 2024, pp. 5865–5877, doi: 10.18653/v1/2024.findings-acl.349.

[108]

M. Sap, D. Card, S. Gabriel, Y. Choi, and N. A. Smith, “The risk of racial bias in hate speech detection,” in Proceedings of the 57th annual meeting of the association for computational linguistics, Jul. 2019, pp. 1668–1678, doi: 10.18653/v1/P19-1163.

[109]

C. Li, M. Chen, J. Wang, S. Sitaram, and X. Xie, “Culturellm: Incorporating cultural differences into large language models,” Advances in Neural Information Processing Systems, vol. 37, pp. 84799–84838, 2024, [Online]. Available: https://proceedings.neurips.cc/paper_files/paper/2024/hash/9a16935bf54c4af233e25d998b7f4a2c-Paper-Conference.pdf.

https://perspectiveapi.com/↩︎

A Survey of Toxicity Detection and Mitigation Strategies for Multilingual Language Models