A Survey of Toxicity Detection and Mitigation Strategies for Multilingual Language Models

Problem Statement

Large Language Models (LLMs) are increasingly deployed in multilingual settings, yet their safety behaviors remain uneven across linguistic and cultural contexts. While significant progress has been made in English detoxification, multilingual detection and mitigation remain less mature, particularly for low-resource languages, dialects, code-switched inputs, and culturally specific harms. The core problem is that toxicity is not a direct translation of English safety protocols; definitions of harm vary by community, and technical vulnerabilities (such as code-switching, transliteration, and mixed scripts) can weaken both detectors and refusal behaviors. Furthermore, current mitigation strategies often risk suppressing legitimate dialectal or identity-related expression, leading to "model homogenization."

Methodology and Scope

This paper provides a focused survey synthesizing recent work on the detoxification pipeline for multilingual LLMs. Rather than offering a broad overview of LLM safety, the authors organize the literature into a taxonomy covering three primary axes:

1. Threat Models: How toxic outputs are induced in multilingual settings.
2. Task Formulations: How toxicity is measured (rewriting, classification, generation evaluation).
3. Mitigation Strategies: Mechanisms to detect and reduce toxicity.

The survey relies on a systematic review of existing datasets, models, and evaluation frameworks, categorizing them by their technical approach and linguistic coverage.

Key Contributions and Taxonomy

1. Threat Models for Inducing Toxicity

The authors categorize adversarial procedures that exploit language choice to bypass safety alignment into four diagnostic axes: language composition, script composition, translation mediation, and cultural-norm variation.

• Language-Shift Jailbreaks: Malicious or ambiguous requests re-expressed in non-English languages (often lower-resource ones) elicit higher unsafe rates than in English.
• Translation-Mediated and Pivot Attacks: Unsafe English prompts are translated into a target language to increase compliance, with the response translated back. This exposes translation as a core failure mode.
• Code-Switching and Mixed Scripts: Attacks that mix languages, scripts, and transliterated forms (e.g., "Sandwich Attacks" interleaving benign and adversarial segments) effectively bypass monolingual detectors.
• Post-Deployment Adaptation: Fine-tuning on toxic data in one language can cause safety collapse across other languages (cross-lingual attack transfer). Conversely, even benign fine-tuning to learn a new language can degrade refusal behavior.

2. Task Formulations, Datasets, and Metrics

The survey organizes evaluation tasks into three categories:

• Toxic-to-Neutral Rewriting: Datasets like ParaDetox, MultiParaDetox, and TextDetox provide parallel toxic-neutral pairs for style transfer. Synthetic datasets (e.g., SynthDetox-M) are increasingly used to augment low-resource languages.
• Toxicity Classification: Benchmarks include Jigsaw (multilingual extensions), OffensEval, HateCheck, and ToxiGen. These range from binary classification to functional tests for hate speech.
• Toxic Generation Evaluation: Datasets like RealToxicityPrompts (RTP), RTP-LX (extended to 28 languages), and PolygloToxicityPrompts (PTP) evaluate the probability of toxic continuations.
• Metrics: Evaluation relies on Toxicity Scoring (e.g., Perspective API), Style Transfer Accuracy (STA), Content Preservation (BLEURT, BERTScore), and Fluency. A critical gap noted is the lack of standardized, culturally grounded human evaluation protocols.

3. Detection Approaches

• Multilingual Transformers: Models like mBERT and XLM-R leverage shared subword vocabularies for cross-lingual transfer, though performance remains uneven across scripts and dialects.
• Translation Pipelines: Translating non-English text to English before detection is common but introduces error propagation, semantic drift, and potential toxicity insertion.
• Representation-Level Probing: Recent work identifies linear toxic subspaces in embeddings, allowing for the localization of toxicity features for both detection and mitigation.
• LLM-Based Detection: Instruction-tuned LLMs are used as zero-shot detectors, though they suffer from calibration failures and cultural misalignment.

4. Mitigation Strategies

The authors present a mechanism-based taxonomy for detoxification:

• Data-Centric: Filtering pre-training corpora to remove toxic content. While scalable, this risks over-removing minority language varieties and culturally specific idioms.
• Model-Centric:
  • Supervised Fine-Tuning (SFT): Training on curated non-toxic or contrastive pairs.
  • Preference Tuning/RLHF: Aligning models with human feedback. However, reliance on English-centric preference data leads to cross-cultural misalignment.
• Decoding-Time Steering: Methods like PPLM, GeDi, and DExperts steer generation at inference without retraining. These are modular but require high-quality multilingual experts, which are scarce.
• Representation Editing: Techniques like Activation Addition or ROME-based editing modify internal representations to attenuate toxic features.
• Multilingual Guardrails: Deployment-time classifiers (e.g., Llama Guard, Aegis, PolyGuard) that gate prompts and responses. These are vulnerable to code-switching and transliteration attacks.

Results and Open Challenges

The survey identifies several persistent challenges that limit the reliability of current multilingual safety systems:

• Cross-Lingual Gaps: Methods effective in English consistently underperform in low-resource and morphologically rich languages.
• Cultural Misalignment: Safety definitions are often culturally contingent. One-size-fits-all tuning risks over-censoring reclaimed slurs or benign dialectal expressions while missing contextually offensive language.
• Evaluation Fragmentation: There is no unified multilingual benchmark. Existing datasets differ in label schemas, task formats, and language coverage, making cross-system comparison difficult.
• Style and Diversity Trade-offs: Detoxification often degrades output diversity, yielding generic text that erases linguistic richness and identity-related expression.
• Code-Switching Vulnerabilities: Current tokenizers and training corpora are sparse for mixed-language inputs, creating significant safety gaps for communities that communicate via code-switching.

Significance and Conclusion

The paper concludes that cross-lingual transfer of safety is unreliable and that detoxification is in tension with linguistic diversity. The authors argue that the most pressing research need is the development of evaluation infrastructure: standardized, culturally grounded multilingual benchmarks that measure not only toxicity reduction but also the preservation of stylistic and cultural content.

The survey emphasizes that hybrid strategies—combining data filtering, controlled generation, culturally aware alignment, and guardrails—are the most defensible direction for deployment. However, without culturally grounded supervision and inclusive data practices, automated toxicity detection risks reinforcing societal biases and suppressing legitimate speech in underrepresented communities. The paper serves as a roadmap for building globally safe and equitable LLMs by highlighting the specific technical and sociolinguistic hurdles that remain unresolved.