Breaking Bad Tokens: Detoxification of LLMs Using Sparse Autoencoders

TL;DR

This paper introduces a novel detoxification method for large language models using sparse autoencoders to perform targeted activation steering, effectively reducing toxicity while maintaining language fluency and model capabilities.

Contribution

The paper proposes a new SAE-based causal intervention technique for LLM detoxification, demonstrating its effectiveness and analyzing the trade-offs involved.

Findings

Up to 20% reduction in toxicity compared to baselines

Steering can degrade fluency depending on aggressiveness

Model knowledge remains stable after steering

Abstract

Large language models (LLMs) are now ubiquitous in user-facing applications, yet they still generate undesirable toxic outputs, including profanity, vulgarity, and derogatory remarks. Although numerous detoxification methods exist, most apply broad, surface-level fixes and can therefore easily be circumvented by jailbreak attacks. In this paper we leverage sparse autoencoders (SAEs) to identify toxicity-related directions in the residual stream of models and perform targeted activation steering using the corresponding decoder vectors. We introduce three tiers of steering aggressiveness and evaluate them on GPT-2 Small and Gemma-2-2B, revealing trade-offs between toxicity reduction and language fluency. At stronger steering strengths, these causal interventions surpass competitive baselines in reducing toxicity by up to 20%, though fluency can degrade noticeably on GPT-2 Small depending on the aggressiveness. Crucially, standard NLP benchmark scores upon steering remain stable, indicating that the model's knowledge and general abilities are preserved. We further show that feature-splitting in wider SAEs hampers safety interventions, underscoring the importance of disentangled feature learning. Our findings highlight both the promise and the current limitations of SAE-based causal interventions for LLM detoxification, further suggesting practical guidelines for safer language-model deployment.