Projecting Out the Malice: A Global Subspace Approach to LLM Detoxification

TL;DR

This work reframes toxicity in LLMs as a global subspace issue within FFN parameters, showing that toxic content cannot be eliminated by removing individual toxic vectors or layer-specific directions alone. The authors propose GLOSS, a three-stage, training-free method that (1) extracts candidate toxic directions via layer-wise contrasts and SVD, (2) ranks and selects high-toxicity directions using vocabulary-space projections, and (3) constructs a global toxic subspace with PCA and orthogonally projects FFN weights to remove toxic components. Empirical results across six diverse LLMs on RealToxicityPrompts and PolyglotoxicityPrompts demonstrate that GLOSS achieves state-of-the-art detoxification while preserving general capabilities, outperforming supervision-based and decoding-based baselines. The paper provides insights into the sparsity and global transferability of toxic directions, offering a practical detox strategy with strong robustness (including against jailbreaks) and data efficiency. This approach has meaningful implications for deploying safer LLMs without large-scale retraining, with potential applicability to larger models and broader toxicity contexts.

Abstract

Large language models (LLMs) exhibit exceptional performance but pose inherent risks of generating toxic content, restricting their safe deployment. While traditional methods (e.g., alignment) adjust output preferences, they fail to eliminate underlying toxic regions in parameters, leaving models vulnerable to adversarial attacks. Prior mechanistic studies characterize toxic regions as "toxic vectors" or "layer-wise subspaces", yet our analysis identifies critical limitations: i) Removed toxic vectors can be reconstructed via linear combinations of non-toxic vectors, demanding targeting of entire toxic subspace; ii) Contrastive objective over limited samples inject noise into layer-wise subspaces, hindering stable extraction. These highlight the challenge of identifying robust toxic subspace and removing them. Therefore, we propose GLOSS (GLobal tOxic Subspace Suppression), a lightweight method that mitigates toxicity by identifying and eliminating this global subspace from FFN parameters. Experiments on LLMs (e.g., Qwen3) show GLOSS achieves SOTA detoxification while preserving general capabilities without requiring large-scale retraining. WARNING: This paper contains context which is toxic in nature.

Figures (10)

• Figure 1: Motivation for global toxic subspace. (a) Toxic vectors can be reconstructed from non-toxic vectors via linear combinations. (b) Layer-wise subspaces suffer from noise due to limited samples. (c) Global toxic subspace provides stable, layer-invariant representation.
• Figure 2: Toxicity changes under different vector activation operations in Qwen3. (a) Enhanced activations amplify toxic vectors by factor 10; (b) Reversed activations flip signs based on cosine similarity to toxic direction; (c) Suppressed activations scale down top-$k$ toxic vectors.
• Figure 3: Cosine similarity of toxic directions across layers in Qwen3. Some toxic directions show high similarity while others exhibit differences, revealing multiple distinct toxic directions shared globally.
• Figure 4: The overview of GLOSS. It identifies and removes the global toxic subspace through a Three-stage procedure to effectively reduce toxic generation without retraining.
• Figure 5: Hyperparameter and layer selection analysis on Qwen3-14B-base. (a) R-Toxicity vs. perplexity with varying n_comp ($\eta$) and threshold ($\tau$). (b) Impact of projected layer selections.