Test-Time Detoxification without Training or Learning Anything

Large language models can produce toxic or inappropriate text even for benign inputs, creating risks when deployed at scale. Detoxification is therefore important for safety and user trust, particularly when we want to reduce harmful content without sacrificing the model’s generation quality. Many existing approaches rely on model retraining, gradients, or learned auxiliary components, which can be costly and may not transfer across model families or to truly black-box settings. We introduce a test-time procedure that approximates the gradient of completion toxicity with respect to the input embeddings and uses a small number of descent steps to steer generation toward less toxic continuations. This is achieved with zeroth-order optimization that requires only access to input embeddings, a toxicity scoring function, and forward evaluations of the model. Empirically, the approach delivers robust toxicity reductions across models and prompts and, in most settings, achieves the best overall toxicity–quality trade-off. More broadly, our work positions word embeddings as effective control variables and encourages wider use of black-box optimization to guide autoregressive language models toward scalable, safer text generation, without requiring any training or access to intermediate computations.

Large language models can produce offensive or harmful text, even when given innocent prompts. Making these models safer usually requires expensive retraining or access to their internal machinery—requirements that are impractical when models are updated frequently or when their inner workings are unavailable. We introduce a method that reduces toxic outputs without any training or access to model internals. The key idea is to make small, targeted adjustments to the numerical representation of the input text—its "embedding"—before the model sees it. We estimate which direction to nudge these numbers by repeatedly querying the model and a toxicity scorer, using a principled technique from mathematical optimization that reconstructs useful gradient information from function evaluations alone. This is analogous to adjusting a radio dial based on what you hear, without needing to open the radio. Our approach works across multiple language models and consistently achieves strong toxicity reductions while preserving the quality of generated text. It requires only a few extra model queries at generation time, making it lightweight and deployable alongside existing systems. More broadly, this work demonstrates that black-box optimization over input representations is a practical and effective lever for steering language model behavior at the point of use.