#  GreenLLaMA:
A Framework for Detoxification with Explanations
Warning! This paper contains examples of toxic language

Md Tawkat Islam Khondaker♠ Muhammad Abdul-Mageed♠♢ Laks V.S. Lakshmanan♠

♠The University of British Columbia, ♢MBZUAI

{tawkat@cs.,muhammad.mageed<EMAIL_ADDRESS>
###### Abstract

Prior works on detoxification are scattered in the sense that they do not
cover all aspects of detoxification needed in a real-world scenario. Notably,
prior works restrict the task of developing detoxification models to only a
seen subset of platforms, leaving the question of how the models would perform
on unseen platforms unexplored. Additionally, these works do not address non-
detoxifiability, a phenomenon whereby the toxic text cannot be detoxified
without altering the meaning. We propose GreenLLaMA, the first comprehensive
end-to-end detoxification framework, which attempts to alleviate the
aforementioned limitations. We first introduce a cross-platform pseudo-
parallel corpus applying multi-step data processing and generation strategies
leveraging ChatGPT. We then train a suite of detoxification models with our
cross-platform corpus. We show that our detoxification models outperform the
SoTA model trained with human-annotated parallel corpus. We further introduce
explanation to promote transparency and trustworthiness. GreenLLaMA
additionally offers a unique paraphrase detector especially dedicated for the
detoxification task to tackle the non-detoxifiable cases. Through experimental
analysis, we demonstrate the effectiveness of our cross-platform corpus and
the robustness of GreenLLaMA against adversarial toxicity.

GreenLLaMA:
A Framework for Detoxification with Explanations
Warning! This paper contains examples of toxic language

Md Tawkat Islam Khondaker♠ Muhammad Abdul-Mageed♠♢ Laks V.S. Lakshmanan♠ ♠The
University of British Columbia, ♢MBZUAI
{tawkat@cs.,muhammad.mageed<EMAIL_ADDRESS>

##  1 Introduction

Figure 1:  Workflow of GreenLLaMA framework. The framework will take a toxic
input. The detoxification model will generate the explanation of why the input
is toxic, as well as a non-toxic version. The paraphrase detector will analyze
the semantic similarity of the toxic and non-toxic pair and generate a warning
if the pair is not semantically equivalent (an illustration of non-
detoxifiable case is depicted in Appendix I).

The term toxic language is usually used to refer to any form of offensive or
hateful speech (Laugier et al., 2021; Fortuna et al., 2020); specifically,
toxic or abusive language is defined as any form of microaggression,
condescension, harassment, hate speech, trolling, and the like (Jurgens et
al., 2019). Use of toxic language online has been a significant issue over the
years. Although a plethora of works have explored the task of toxicity
detection, the task remains challenging due to its evolving nature Davidson et
al. (2017); Müller and Schwarz (2017); Williams et al. (2019). In addition,
the linguistic variation in how toxicity manifests itself across different
platforms Karan and Šnajder (2018); Swamy et al. (2019); Salminen et al.
(2020) poses a standing challenge for toxicity detection. Furthermore, the
task of detecting toxic language, taken literally, can only offer deletion of
toxic text. A more comprehensive approach to dealing with toxic text would be
to rewrite the text to keep the useful content intact and eliminate toxicity,
a task known as detoxification (Logacheva et al., 2022). Several works
(Nogueira dos Santos et al., 2018; Dale et al., 2021) have already explored
the idea of detoxification. More recently, Logacheva et al. (2022) propose
ParaDetox, the first detoxification model developed with a crowd-sourced
parallel corpus, which outperforms the unsupervised competitors in the
detoxification task.

Unfortunately, prior works focus on only a particular subproblem when tackling
detoxification, overlooking other important aspects of the problem. For
example, (1) previous works (Nogueira dos Santos et al., 2018; Dale et al.,
2021) have only explored the idea of in-platform detoxification, meaning that
the models are trained and tested on the same platforms, as opposed to cross-
platform detoxification where the training platforms (e.g., Wikipedia, Reddit)
are disjointed from the testing platforms (e.g., Facebook, Youtube). As a
result, how the detoxification models would perform on different platforms and
cope with the linguistic variation present across platforms is still an
unexplored territory. (2) A second limitation of prior works is that they do
not justify why a given input is found to be toxic (Logacheva et al., 2022).
When we intend to deploy a detoxification model in the real-world, we also
need to explain why we are altering a given toxic text. Therefore, we intend
to incorporate explanation as a part of our system design to assist users
engage in healthy communication, while enhancing transparency and the
credibility of the system itself. Furthermore, (3) current works do not
properly tackle non-detoxifiability, a phenomenon whereby a toxic text cannot
be detoxified without altering the meaning. As a consequence, deploying a
system without handling non-detoxifiability can make it ineffective in real-
life scenarios. (4) Finally, even with the advent of generalized large
language models (LLMs) (Taori et al., 2023; Chiang et al., 2023), the
detoxification task remains challenging since instruction-tuned LLMs often
refuse to respond to toxic input due to their safety requirements (Touvron et
al., 2023) (see §5.2).

In this work, we offer a comprehensive and realistic detoxification framework
that treats issues with prior detoxification literature. More specifically, we
introduce GreenLLaMA, the first end-to-end framework for the detoxification
task (Figure 1), focusing on piecing together our solutions for all issues
discussed above. Given a toxic text, our detoxification model will first
analyze and provide an explanation as to why the input is found toxic. Then,
the model will attempt to detoxify and output the non-toxic version of the
input. Unlike prior works (Dale et al., 2021; Logacheva et al., 2022), we
additionally incorporate a dedicated paraphrase detector in our framework to
tackle the cases of non-detoxifiability. If the input is non-detoxifiable,
GreenLLaMA will prompt an additional warning to the user regarding possible
meaning alteration in the text. To train our detoxification models on cross-
platform corpus, we first collect a wide array of annotated toxic and non-
toxic data from different existing works. We then employ
ChatGPT111gpt-3.5-turbo from June, 2023. (OpenAI, 2023a) through a meticulous
prompt engineering approach to build a pseudo-parallel corpus.

Our contributions can be summarized as follows:

  1. 1.

We propose GreenLLaMA, the first detoxification framework that tackles toxic
language across different platforms as well as handles non-detoxifiability
while providing explanation for the toxic input.

  2. 2.

We develop the first cross-platform pseudo-parallel detoxification corpus with
multi-step data processing and prompt engineering.

  3. 3.

We empirically evaluate and compare our detoxification models against SoTA
baselines. Our experiments show that GreenLLaMA outperforms SoTA in cross-
platform detoxification, while our detoxification model CoT-expl LLaMA of
GreenLLaMA achieves the best performance.

  4. 4.

We train a unique paraphrase detector tailored for the detoxification task in
order to handle the cases of non-detoxifiability. Our comparative evaluation
against the SoTA paraphrase detectors clearly illustrates the necessity of
such a specialized detector dedicated to the detoxification task.

  5. 5.

We conduct an extensive experimental analysis to demonstrate the effectiveness
of our cross-platform data as well as the robustness of GreenLLaMA against
implicit and token-level adversarial toxicity.

Figure 2:  Overall methodology of GreenLLaMA. Initially, we collect the
toxicity corpus from multiple platforms (§3.1). Then, we generate texts of
opposite classes (§3.2). We filter out ambiguous data (§3.3). After that, we
generate explanation and paraphrase labels (§3.4). Finally, we train the
detoxification and the paraphrase detection models (§3.5).

##  2 Related Works

Over the years, several works have studied abusive language detection (Founta
et al., 2018; Davidson et al., 2017; Golbeck et al., 2017; Waseem and Hovy,
2016). The task of text style transfer (TST) has also been explored in the
field of NLP due to its wide range of applications (Shen et al., 2017; Rao and
Tetreault, 2018; Patel et al., 2022a; Mukherjee et al., 2023). Notably,
studies like Reif et al. (2022); Pu and Demberg (2023) show the effectiveness
of LLMs for parallel data generation and style transfer tasks. Inspired by
these works, we resort to use LLMs in our work for pseudo-parallel dataset
creation and consequently distill the knowledge in comparatively smaller
language models. We provide a detailed account of related works on abusive
language detection and TST in Appendix A.

Detoxification is formulated as style transfer from toxic to neutral and non-
toxic style (Logacheva et al., 2022). Prior works like Nogueira dos Santos et
al. (2018) and Laugier et al. (2021) create their own detoxification corpus
from Reddit and Jigsaw (Jigsaw, 2018), respectively. Dale et al. (2021) employ
style-trained language models to guide a paraphraser preserve the content and
remove toxicity. The authors further use the masked language modeling strategy
of BERT (Devlin et al., 2019) to replace the toxic tokens with its non-toxic
alternatives. Logacheva et al. (2022) develop a human-annotated parallel
corpus from Jigsaw, X (formerly known as Twitter), and Reddit. The authors
train a BART (Lewis et al., 2020) model on this parallel corpus and achieve
the SoTA performance on detoxification, showing the importance of high quality
parallel data. Recently, Dementieva et al. (2023) propose cross-lingual
detoxification through simultaneous text translation and detoxification.

However, none of the prior works explore the idea of cross-platform
detoxification potentially due to the scarcity of parallel data. This research
gap motivates our work on this particular subproblem.

##  3 Proposed Methodology

We present our overall methodology in Figure 2. Now, we describe each
component of our cross-platform detoxification framework.

###  3.1 Data Collection

To create a cross-platform parallel detoxification corpus, we first compile
datasets from a wide range of platforms. We collect the sources of the
datasets primarily from Risch et al. (2021) and Vidgen and Derczynski (2020).
Table 1 provides details of these datasets.

Dataset | Platform | Source | Toxic/Normal
---|---|---|---
wiki | Wikipedia | Wulczyn et al. (2017) | 14,880 / 117,935
twitter | Twitter | Multiple* | 77,656 / 55,159
fb-yt |  | Facebook
---
& Youtube
Salminen et al. (2018) | 2,364 / 858
stormfront | Stormfront | de Gibert et al. (2018) | 1,364 / 9,507
fox | Fox News | Gao and Huang (2017) | 435 / 1,093
reddit | Reddit | Qian et al. (2019) | 2,511 / 11,073
convAI |  | ELIZA &
---
CarbonBot
Cercas Curry et al. (2021) | 128 / 725
hateCheck |  | Synthetic.
---
Generated
Röttger et al. (2021) | 2,563 / 1,165
gab | Gab | Qian et al. (2019) | 15,270 / 656
yt_reddit |  | Youtube
---
& Reddit
Mollas et al. (2020) | 163 / 163

Table 1:  List of experimental datasets with varying toxic/normal ratio and
the corresponding platforms. * _Twitter_ dataset is collected from Waseem and
Hovy (2016), Davidson et al. (2017), Jha and Mamidi (2017), ElSherief et al.
(2018), Founta et al. (2018), Mathur et al. (2018), Basile et al. (2019),
Mandl et al. (2019), Ousidhoum et al. (2019), and Zampieri et al. (2019).

Some datasets in Table 1 provide multi-class toxicity labeling such as hate,
offensive, accusation. We label all of these classes as toxic and transform
all the dataset into binary classification (toxic vs. non-toxic). To keep the
cost manageable and avoid overfitting, we randomly select at most $3,000$
samples from each dataset.

###  3.2 Data Generation through Jailbreaking

While ChatGPT (OpenAI, 2023a) is developed with safety mechanisms to restrict
the model’s behavior to be safe (OpenAI, 2023b), this restriction can be
manipulated through careful engineering of prompts, a process known as
jailbreaking (Li et al., 2023; Albert., 2023). In the context of language
modeling, jailbreaking refers to the process of circumventing the restrictions
placed on models (Liu et al., 2023). To train our models on cross-platform
detoxification, we require parallel non-toxic as well as toxic data. Hence, we
apply jailbreaking to design a prompt that can exploit ChatGPT to generate
parallel toxic text given non-toxic version and vice versa. Our jailbreaking
prompt includes the following components: (1) We first deliver toxic/non-toxic
input to the model, ({{ input }}). (2) We then set the task of the model
(e.g., style/attribute transfer). (3) We provide the objective of the model
(e.g., provide the parallel text of opposite label for the input text). (4) We
add explicit constraints to the model’s generation (e.g., Do not explain or
hallucinate). (5) Finally, we define what the expected response format of the
model is (e.g., Do not include input text in response). We present the
template of our designed prompt in Figure 3(a).

###  3.3 Data Filtration

Since distinguishing between toxic text e.g., offensive language and hate
speech, is often deemed subjective (Sap et al., 2019; Koh et al., 2021), a
text labeled non-toxic on one platform may be considered toxic on another
platform. To avoid cross-platform ambiguity, we first train in-house platform-
specific toxicity classifiers on six datasets (_fb-yt_ , _fox_ , _twitter_ ,
_stormfront_ , _wiki_ , _hateCheck_) separately. After that we predict the
toxicity of the parallel data in our corpus. We only select those samples
where at least one classifier predicts the source text (a.k.a. toxic text) as
toxic AND all the classifiers predict the target text (a.k.a. non-toxic text)
as non-toxic. In other words, we filter out any toxic sample that is predicted
to be non-toxic by all the classifiers and we also filter out any non-toxic
sample that is predicted to be toxic by at least one classifier. Finally, to
experiment with cross-platform detoxification, we select _wiki_ , _reddit_ ,
and _twitter_ for training, _yt-reddit_ and _fb-yt_ for validation, and the
rest of the datasets for testing.

(a) Parallel Data Generation

(b) Explanation Generation

(c) Paraphrase Labeling

Figure 3: Prompt design for toxic, non-toxic parallel data generation (§3.2),
explanation generation,and paraphrase labeling (§3.4) with ChatGPT.

###  3.4 Explanation and Paraphrase Acquisition

To generate explanation using the models and train our models with Chain-of-
Thought (CoT) prompting (Wei et al., 2022), we further generate the
explanation of toxicity from ChatGPT. For this purpose, we prompt ChatGPT with
the toxic texts from the filtered dataset (Section 3.3) and ask it why the
given text is deemed toxic (Figure 3(b)). Similar to Section 3.2, we design a
specific prompt instructing ChatGPT to describe the type of toxicity (e.g.,
personal or group attack). We also constrain ChatGPT to explain in at most
three sentences. For paraphrase labeling, we first pass five manually labeled
few-shot examples. Then, we provide both toxic and non-toxic parallel data to
ChatGPT and prompt the model to analyze whether the text-pair is semantically
similar (Figure 3(c)). We provide samples of our cross-platform pseudo-
parallel dataset in Appendix H.

###  3.5 Model Training

We finetune both encoder-decoder and decoder-only models for detoxification.
For encoder-decoder, we use BART (Lewis et al., 2020) and T5 (Raffel et al.,
2019) with their base architectures. For decoder-only models, we finetune
LLaMA-2 (Touvron et al., 2023) with $7$B parameters. We train the models with
direct toxic to non-toxic finetuning (vanilla) as well as prompt $\oplus$
toxic to non-toxic fientuning (prompt), where we first give a prompt
instructing the model to perform detoxification style transfer. We further
employ CoT finetuning where the models are first instructed to generate
explanation and then based on the toxic input incorporated with explanation,
models generate the non-toxic version (CoT-expl). (See Figure K.1 for prompt
template). To detect paraphrasing of a toxic and a non-toxic text pair, we
further finetune a BERT (Devlin et al., 2019) classifier with the paraphrase
labels generated by ChatGPT.

##  4 Experiments

Models Compared. (1) SoTA Baseline. ParaDetox, a BART-based model developed by
Logacheva et al. (2022). (2) *-DSS. BART and T5 models trained with SoTA
distillation method proposed by Hsieh et al. (2023). (3) Instruction-tuned.
Alpaca (Taori et al., 2023), LLaMA-2 (Chat) (Touvron et al., 2023), and Vicuna
(Chiang et al., 2023). We use the corresponding 7B versions. (4) Cross-
Platform Models. Our suite of models (BART, T5, and LLaMA-2-7B) trained on the
cross-platform datasets (§3.5).

Performance Metrics. (1) Accuracy. We compute accuracy of the models based on
the percentage of non-toxic outputs identified by the same RoBERTa style
classifier as Logacheva et al. (2022). We provide accuracy measured by our in-
house platforms (§3.3) in Appendix C. (2) BERTScore. We use BERTScore with
SimCSE (Gao et al., 2021) RoBERTa-large model to compute how the models
preserve the semantic meaning. (3) Fluency. Following Logacheva et al. (2022),
we measure the percentage of fluent sentences identified by a RoBERTa-based
classifier trained on the linguistic acceptability (CoLA) dataset (Warstadt et
al., 2018). (4) BLEU. We compute the BLEU score between the input and the
corresponding output.

We provide detailed information on the experiments including implementation
details, baselines, and performance metrics in Appendix B.

##  5 Results

| yt_reddit | fb_yt | fox news | convai | gab | hatecheck | stormfront | Overall
---|---|---|---|---|---|---|---|---
Model | Acc | BS | Fl | BL | Acc | BS | Fl | BL | Acc | BS | Fl | BL | Acc | BS | Fl | BL | Acc | BS | Fl | BL | Acc | BS | Fl | BL | Acc | BS | Fl | BL | Acc | BS | Fl | BL
ParaDetox | 44.00 | 97.43 | 76.00 | 27.52 | 79.00 | 95.50 | 93.00 | 21.16 | 78.00 | 97.37 | 96.00 | 35.08 | 82.00 | 95.93 | 97.00 | 31.66 | 80.00 | 94.49 | 83.00 | 25.41 | 24.00 | 98.02 | 98.00 | 22.68 | 88.00 | 96.83 | 95.00 | 40.38 | 67.86 | 96.51 | 91.14 | 29.13
T5-DSS | 67.39 | 95.70 | 97.83 | 35.73 | 72.41 | 95.74 | 98.85 | 41.97 | 73.63 | 95.07 | 94.51 | 38.26 | 64.84 | 95.65 | 94.51 | 38.91 | 68.89 | 95.41 | 96.67 | 40.39 | 68.09 | 95.20 | 95.74 | 38.00 | 63.04 | 96.11 | 98.91 | 38.89 | 68.33 | 95.55 | 96.72 | 38.88
BART-DSS | 82.61 | 93.61 | 93.48 | 39.32 | 94.25 | 93.78 | 98.85 | 47.45 | 86.81 | 94.04 | 95.60 | 43.64 | 84.62 | 93.84 | 98.90 | 42.51 | 81.11 | 93.79 | 98.89 | 47.26 | 82.98 | 93.81 | 100.00 | 40.96 | 88.04 | 94.06 | 98.91 | 43.55 | 85.77 | 93.85 | 97.80 | 43.53
T5-V | 62.00 | 94.48 | 98.00 | 34.16 | 76.00 | 96.23 | 98.00 | 42.10 | 88.00 | 92.85 | 99.00 | 34.78 | 81.00 | 93.71 | 100.00 | 36.76 | 82.00 | 93.65 | 97.00 | 38.52 | 50.00 | 94.17 | 100.00 | 31.87 | 85.00 | 93.50 | 99.00 | 40.18 | 74.86 | 94.08 | 98.71 | 36.91
T5-P | 70.00 | 91.37 | 94.00 | 32.93 | 80.00 | 93.97 | 99.00 | 40.84 | 87.00 | 91.46 | 98.00 | 37.24 | 80.00 | 91.71 | 99.00 | 35.93 | 78.00 | 91.74 | 96.00 | 38.89 | 46.00 | 90.50 | 99.00 | 30.42 | 87.00 | 90.50 | 99.00 | 39.91 | 75.43 | 91.61 | 97.71 | 36.59
CE | 67.39 | 89.21 | 97.83 | 32.35 | 78.16 | 89.69 | 95.40 | 37.93 | 72.53 | 89.48 | 96.70 | 34.25 | 68.13 | 89.41 | 94.51 | 33.13 | 76.67 | 89.74 | 97.78 | 38.23 | 82.98 | 89.37 | 94.68 | 34.91 | 72.83 | 90.12 | 96.74 | 33.58 | 74.10 | 89.57 | 96.23 | 34.91
BART-V | 88.00 | 92.88 | 98.00 | 38.14 | 96.00 | 94.48 | 99.00 | 45.85 | 93.00 | 94.48 | 100.00 | 41.50 | 89.00 | 93.00 | 99.00 | 34.11 | 90.00 | 92.55 | 93.00 | 41.06 | 73.00 | 93.58 | 99.00 | 34.31 | 92.00 | 94.24 | 99.00 | 45.43 | 88.71 | 93.60 | 98.14 | 40.06
BART-P | 74.00 | 91.04 | 98.00 | 36.77 | 89.00 | 92.97 | 100.00 | 44.11 | 92.00 | 91.67 | 99.00 | 39.77 | 85.00 | 91.34 | 98.00 | 35.49 | 87.00 | 90.78 | 96.00 | 40.10 | 67.00 | 89.73 | 98.00 | 32.51 | 87.00 | 91.73 | 96.00 | 44.20 | 83.00 | 91.32 | 97.86 | 38.99
BART-CE | 80.43 | 89.27 | 100.00 | 37.39 | 89.66 | 89.34 | 100.00 | 38.58 | 89.01 | 88.91 | 96.70 | 35.76 | 89.01 | 89.24 | 97.80 | 35.62 | 85.56 | 89.30 | 98.89 | 40.96 | 90.43 | 89.01 | 98.94 | 34.63 | 86.96 | 89.54 | 97.83 | 34.55 | 87.29 | 89.23 | 98.59 | 36.78
Alpaca | 43.48 | 84.86 | 100.00 | 9.27 | 51.72 | 84.13 | 97.70 | 8.52 | 59.34 | 84.57 | 94.51 | 7.19 | 45.05 | 84.81 | 97.80 | 9.42 | 50.00 | 84.31 | 93.33 | 9.12 | 46.81 | 86.13 | 96.81 | 7.65 | 48.91 | 84.53 | 96.74 | 7.29 | 49.33 | 84.76 | 96.70 | 8.35
LLaMA-C | 84.53 | 97.83 | 11.93 | 95.40 | 84.20 | 100.00 | 18.27 | 97.80 | 84.26 | 100.00 | 10.05 | 98.90 | 84.46 | 98.90 | 10.34 | 97.78 | 83.84 | 98.89 | 14.04 | 97.87 | 85.39 | 98.94 | 7.81 | 97.83 | 84.17 | 98.91 | 7.40 | 97.94 | 84.41 | 99.07 | 11.41 | 100.00
Vicuna | 86.96 | 84.46 | 100.00 | 12.04 | 80.46 | 84.26 | 98.85 | 14.82 | 80.22 | 84.46 | 96.70 | 8.49 | 81.32 | 84.68 | 97.80 | 10.10 | 80.00 | 84.29 | 96.67 | 11.47 | 84.04 | 85.81 | 98.94 | 9.10 | 84.78 | 84.43 | 100.00 | 8.41 | 82.54 | 84.63 | 98.42 | 10.63
LLaMA-P | 84.78 | 91.13 | 97.83 | 49.39 | 96.55 | 91.99 | 97.70 | 67.89 | 93.41 | 92.04 | 97.80 | 60.71 | 87.91 | 92.04 | 96.70 | 58.25 | 93.33 | 91.89 | 100.00 | 61.47 | 93.62 | 91.49 | 98.94 | 57.05 | 94.57 | 92.25 | 100.00 | 59.60 | 92.02 | 91.83 | 98.42 | 59.19
LLaMa-CE | 97.83 | 83.61 | 97.83 | 52.98 | 98.85 | 86.65 | 97.70 | 67.54 | 95.60 | 87.23 | 98.90 | 58.44 | 92.31 | 88.80 | 97.80 | 59.96 | 97.78 | 91.67 | 98.89 | 61.27 | 95.74 | 89.46 | 98.94 | 54.86 | 93.48 | 90.14 | 98.91 | 60.25 | 95.94 | 88.22 | 98.42 | 59.33

Table 2:  Performance of the models on cross-platform datasets. Acc =
percentage of non- toxic outputs identified by a style classifier, BS =
BERTScore, Fl = Fluency, BL = BLEU Score. V = Vanilla, P = Prompt, CE = CoT-
expl, C = Chat. Bold font represents the best performance for a particular
metric. We separately show the best performance of the instruction-tuned
models in Gray due to their inability to detoxification (Section 5.2).

Overview. We present the performance of the models on cross-platform
detoxification in Table 2. We observe that the LLM model LLaMA, finetuned with
CoT explanation achieves better accuracy and BLEU score. We also notice that
instruction-tuned generalized models attain almost perfect accuracy with very
low BLEU score. We discuss the rationale in Section 5.2. Overall, our
finetuned cross-platform models outperform the contemporary SoTA ParaDetox in
terms of accuracy and BLEU score on the cross-platform dataset. We provide
samples of models’ responses in Appendix J. We now present a detailed
discussion on the performance of the various models.

###  5.1 Comparison with SoTA

We show the performance of the contemporary models (i.e., models with similar
size to SoTA) in Table 2. We find that both of our cross-platform finetuned
BART and T5 outperform the SoTA ParaDetox on all metrics except BERTScore. The
better BERTScore of ParaDetox can be attributed to its training dataset, which
frequently transforms the toxic input with a minimal change (e.g., merely
deleting the strong words) (Logacheva et al., 2022). It is to be noted that
neither ParaDetox nor our models have seen data outside of Wikipedia, Reddit,
and Twitter. However, our finetuned models still manage to exhibit superior
performance compared to ParaDetox across the unseen platforms. We also find
that DSS-based models outperform their respective explanation-based models in
BLEU while lagging behind in terms of accuracy. This is potentially because
DSS is finetuned on detoxified output and explanation in a multitask setup.
Although this helps the model align with the detoxified output separately
(higher BLEU), the method does not take explanation into account (e.g., why
the input is toxic) while detoxifying (hence, lower accuracy).

###  5.2 Comparison to Instruction-Tuned LLMs

We compare our models’ performance against the instruction-tuned LLMs. We
notice that LLaMA-Chat, Alpaca, and Vicuna achieve perfect accuracy in some of
the platforms. However, all of them lack in BLEU and BERTScore compared to the
finetuned models. This is because they give priority to generating non-toxic
text over obeying input instructions that may involve toxic language. As a
consequence, they often defy the instruction of detoxifying toxic inputs and
frequently tend to produce generic statements such as: I’m sorry, but I cannot
fulfill this request as it contains inappropriate language. This incapability
of detoxification by the generalized LLMs can potentially be attributed to the
safety requirements imposed during the pretraining and the consequent
finetuning stages (Touvron et al., 2023). In other words, whenever these
models observe a toxic input they tend to ignore the instruction of
detoxifying the given input and often generate a safer statement. As a result,
they receive high accuracy but very low BLEU score. Therefore, instruction-
tuned models should not be deployed for the detoxification task without
further finetuning, which also underscores the importance of training a
dedicated instruction-tuned model for the detoxification task. We present a
detailed discussion on the detoxification inability of the instruction-tuned
LLMs in Appendix G.

###  5.3 Improvement through Explanations

As evident from Table 2, CoT-expl LLaMA outperforms LLaMA-prompt in terms of
accuracy while the later achieves better BERTScore. CoT explanation first
helps the models identify the specific words or semantics that turns a text
into toxic (see Appendix K for samples of models’ generated explanation). As a
consequence, during the style transfer process, the models can focus on
removing/modifying those specific portions to alleviate toxicity. Therefore,
CoT-expl helps the models achieve better accuracy. However, identification of
toxicity in an input text also means altering that input text. Hence, CoT-expl
models achieve inferior BERTScore than vanilla models. Considering the nature
of the detoxification task, it is more important to produce non-toxic text
even if that causes a few alterations to the input. Therefore, we prefer CoT-
expl LLaMA model over the other models as the detoxification model of
GreenLLaMA.

###  5.4 Performance on ParaDetox

Model | Acc | BS | Fl | BL
---|---|---|---|---
ParaDetox | 90.16 | 96.65 | 88.52 | 69.99
T5-DSS | 87.63 | 93.78 | 96.57 | 55.98
BART-DSS | 92.10 | 93.68 | 96.27 | 52.38
T5-V | 91.21 | 93.81 | 95.23 | 54.78
T5-P | 89.42 | 93.97 | 94.93 | 55.47
T5-CE | 88.23 | 94.04 | 95.38 | 56.39
BART-V | 92.85 | 93.28 | 96.42 | 48.80
BART-P | 93.59 | 93.81 | 95.68 | 53.46
BART-CE | 93.29 | 93.01 | 96.72 | 48.74
Alpaca | 64.98 | 94.36 | 96.72 | 54.23
LLaMA-C | 95.83 | 88.80 | 97.76 | 23.29
Vicuna | 77.65 | 90.43 | 97.91 | 29.63
LLaMA-P | 93.89 | 92.72 | 98.06 | 42.55
LLaMA-CE | 94.04 | 92.51 | 97.47 | 41.22

Table 3:  Performance of the models on human annotated ParaDetox test set. Acc
= percentage of non- toxic outputs identified by a style classifier, BS =
BERTScore, Fl = Fluency, BL = BLEU Score. V = Vanilla, P = Prompt, CE = CoT-
expl, C = Chat. Bold font represents the best performance for a particular
metric. We separately show the best performance of the instruction-tuned
models in gray due to their inability to detoxification (Section 5.2).

We further compare the models’ performance against the human annotated
parallel data. For this purpose, we evaluate the models on the test set of
ParaDetox. As Table 3 shows, we beat SoTA on accuracy and fluency. ParaDetox
achieves the best BERTScore and BLEU score on this test set, which is
unsurprising since ParaDetox has already been trained on this dataset.
Notably, our suite of finetuned models still shows comparable BERTScore, while
even outperforming ParaDetox in terms of accuracy and fluency. This result
indicates that although our dataset is artificially generated, the models
trained on this dataset show impressive performance on human-annotated data,
implying the usability of our dataset.

###  5.5 Paraphrase Detection

We test the paraphrase detection capability of our finetuned BERT by passing a
set of parallel detoxifiable and non-detoxifiable texts. For this purpose, we
sample human-annotated parallel data (detoxifiable) from ParaDetox (Logacheva
et al., 2022). We also sample the human-labeled non-detoxifiable toxic data
from ParaDetox and generate the corresponding non-toxic version with our
finetuned detoxification model. Since the later set cannot be detoxified by
humans, we consider these (toxic, non-toxic) pairs non-detoxifiable. We expect
the paraphrase detection model to distinguish among detoxifiable and non-
detoxifiable texts so that our framework can warn the users in case meaning is
altered. We compare our model’s performance against SoTA baselines finetuned
on MRPC (Dolan and Brockett, 2005) paraphrase detection task.

Model | Accuracy | F1-score
---|---|---
BERT (Devlin et al., 2019) | 79.33 | 80.88
RoBERTa (Liu et al., 2019b) | 76.42 | 77.39
ELECTRA (Clark et al., 2020) | 35.52 | 16.12
TextAttack-BERT (Morris et al., 2020) | 34.55 | 29.21
TextAttack-RoBERTa (Morris et al., 2020) | 28.96 | 13.61
Sentence-BERT (Reimers and Gurevych, 2019) | 50.00 | 66.63
BERT (ours) | 82.73 | 83.13

Table 4:  Performance of the models on the paraphrase detection task. We
compare our model’s performance against SoTA baselines finetuned on MRPC
(Dolan and Brockett, 2005) dataset. Bold font represents the best performance
for a particular metric.

We present results in Table 4. As evident, our paraphrase detector comfortably
outperforms the SoTA baselines. This shows the importance of a dedicated
paraphrase detector in our framework, since models trained on generic
paraphrase datasets may fail to transfer their knowledge when comparing the
semantic meaning between toxic/non-toxic pairs.

##  6 Analyses

###  6.1 Effectiveness of Cross-Platform Data

We further analyze how our cross-platform dataset improves models trained on
human-annotated data. For this purpose, we take the finetuned ParaDetox model
and continue training it on our cross-platform dataset with varying sample
sizes ($100$ \- $1000$ samples). Then, we evaluate the performance of the
models on the human-annotated ParaDetox test set.

Figure 4:  Difference in accuracy and BLEU between Paradetox finnetuned on our
cross-platform dataset and the original ParaDetox. As is evident, our dataset
helps the model improving accuracy and BLEU score.

Figure 4 shows the relative difference in accuracy and BLEU between the
ParaDetox model trained on different sample sizes of our cross-platform
dataset and the original ParaDetox model. As is evident, the finetuned models
(up to sample size $700$) tend to maintain higher BLEU score. Importantly, the
model’s accuracy tends to increase with the increase in the sample size. The
higher accuracy and BLEU score signify the models’ capability to detoxify
input text while producing human-like non-toxic output, which indicates the
effectiveness of our cross-platform dataset. We report the detailed results of
the models trained on different sample sizes in Appendix F.

###  6.2 Performance on Implicit Hate Speech

To analyze the models’ behavior on implicit and adversarial hate speech
datasets, we apply the models on ToxiGen (Hartvigsen et al., 2022), a machine-
generated dataset containing implicit and adversarial hate speech targeting
$13$ minority groups. For the detoxification task, we select the human-
annotated samples from the test set with toxicity ratings over $3$ out of $5$.
We first generate a non-toxic version of this test set with ParaDetox and our
detoxification models, then compute BERTScore as well as the non-toxic
accuracy of the models using Toxicity_RoBERTa and ToxiGen_RoBERTa developed by
Logacheva et al. (2022) and Hartvigsen et al. (2022), respectively.

Figure 5:  Toxicity_RoBERTa (accuracy), ToxiGen_RoBERTa (accuracy), and
BERTScore of the models on ToxiGen test set. Our cross-platform BART
outperforms SoTA ParaDetox whereas the finetuned CoT-expl LLaMA exhibits the
best accuracies.

As Figure 5 shows, our models produce less toxicity compared to the SoTA
ParaDetox. Specifically, our finetuned BART performs better than ParaDetox,
while CoT-expl LLaMA performs the best in terms of accuracy while maintaining
an impressive BERTScore. The high accuracy of our models on this implicit
toxicity dataset signifies that GreenLLaMA is more capable of countering
implicit hate speech than merely depending on searching and removing explicit
toxic words.

###  6.3 Robustness of GreenLLaMA

Curated token-level adversaries. Due to censorship reasons, users tend to mask
out specific portion of a strong word (e.g., ‘f#ck’, ‘sh*t’, etc) while
commenting on social platforms. Although these masked words are still
understandable from a human perspective, how the models perceive these words
is unclear. To study the models’ abilities in this scenario, we carefully
curate a list of $15$ texts containing different levels of masked words. We
pass this list to the detoxification models to generate non-toxic versions and
then manually inspect the outputs.

Models | Toxicity | ToxiGen
---|---|---
ParaDetox | 93.32 | 84.88
BART-V (ours) | 96.86 | 95.1
LLaMA-CE (ours) | 97.21 | 96.22

Table 5:  Performance of the models on the automated token-level adversaries.
$2$nd and $3$rd columns represent the non-toxic performance using
Toxicity_RoBERTa and ToxiGen_RoBERTa classifiers respectively.

We find that ParaDetox, our BART-V, and our LLaMA-CE produce two, eight, and
$12$ non-toxic and meaning-preserving responses, respectively (see Appendix
D). We further notice that GreenLLaMA (LLaMA-CE) is more successful in
identifying adversarial words and as a result produces non-toxic versions of
the toxic texts.

Large-scale, automated adversaries. We additionally conduct a large-scale
analysis on a generated list of $5,000$ sentences (details are in Appendix E).
We then calculate model accuracy using Toxicity_RoBERTa and ToxiGen_RoBERTa.
Table 5 shows LLaMA-CE exhibits the highest accuracy followed by BART-V. This
further substantiates the usefulness of our dataset as well as the
detoxification models finetuned on this dataset in the identification of
adversarial toxic words.

##  7 Human Evaluation

We also perform human evaluation on the models’ responses to capture
subtleties of detoxification that automated metrics may overlook.

Evaluation Setup. Following Wang et al. (2022); Wu et al. (2023); Khondaker et
al. (2023b), we implement a four-level (A, B, C, D) rating system to measure
the detoxification responses from the model. To handle non-detoxifiability, we
incorporate two additional ratings, namely, N and T. Briefly, N denotes non-
toxic, content-focused output whereas T denotes toxic or generic statements.
We randomly sample $200$ texts from our cross-platform dataset and ask two
pairs of fluent English speakers (total = $4$) to rate models’ responses.
Hence, each response is independently evaluated by two humans (Appendix L for
details).

(a) Human evaluation on models’ response for detoxifiable inputs.

(b) Human evaluation on models’ response for non-detoxifiable inputs.

Figure 6:  Evaluation of the models’ responses by human. A is the best, and D
is the worst rating for detoxifiable input. N is the good and T is the bad
rating for non-detoxifiable input.

Results. We report the results in Figure 6 (Cohen’s kappa inter-annotator
agreement $>$ $0.6$). We find that detoxification responses produced by
GreenLLaMA (LLaMA-CE) and BART-V are rated as mostly of fine quality.
Specifically, our GreenLLaMA ($67.50$%) and BART-V ($65.62$%) provide more
non-toxic and meaning preserving-responses (ratings A and B) compared to the
SoTA ParaDetox model ($40.63$%). For non-detoxifiable input, GreenLLaMA
exhibits more robustness and generates $55$% less toxic output than ParaDetox.

##  8 Conclusion

In this work, we propose GreenLLaMA, a comprehensive end-to-end detoxification
framework to tackle toxic language across multiple platforms. We generate a
novel cross-platform pseudo-parallel corpus through multi-step data processing
and generation with ChatGPT. We train a suite of detoxification models that
outperform SoTA detoxification models across all the platforms. We
additionally introduce explanation into the GreenLLaMA framework for
maintaining trustworthiness. We also develop a dedicated paraphrase detector
to handle the cases of non-detoxifiability. Through an extensive experimental
analysis, we further show the effectiveness of our cross-platform data as well
as the robustness of GreenLLaMA against implicit and token-level adversarial
toxicity.

##  9 Limitations and Ethics Statement

###  9.1 Limitations

Data Generation Process. In this work, we use ChatGPT, a gpt-3.5-turbo version
from June, 2023. Since the model can be updated on a regular interval, the
prompting strategy and the data generation pipeline discussed in Section 3
should be treated accordingly, since the model’s responses can change over
time (Chen et al., 2023).

Data Quality. We propose an automated data generation pipeline to create a
pseudo-parallel cross-platform corpus (§3). Our synthetic data generation
process involves multi-stage data processing without the necessity of direct
human inspection. Although this automated pipeline makes the overall data
generation process scalable, it comes at the risk of allowing low-quality data
in our cross-platform corpus. Hence, we suggest human inspection to remove any
sort of potential vulnerability and maintain a standard quality of the corpus.
Additionally, we combine datasets from multiple platforms. Since the toxicity
nature of language is often deemed as subjective (Sap et al., 2019; Koh et
al., 2021), the level of toxicity may vary across the platforms based on the
context.

Model Responses. We show that GreenLLaMA exhibits impressive ability in
generating detoxified responses. However, looking at the results (§5), we
believe there is still room for improvement for the models in terms of
producing meaning-preserved detoxified outcomes. Moreover, as evident from our
analyses in Section 6.2 and Section 6.3, models can be vulnerable to implicit,
adversarial tokens and continue to produce toxic content. Therefore, we
recommend that GreenLLaMA should be couched with caution before deployment.

Model Evaluation. We use four automated metrics (Accuracy, BERTScore, Fluency,
and BLEU) to evaluate our models. As noticeable from Section 5, depending on a
single metric to measure the models’ performance can be deceptive. Since
detoxification is a form of style transfer task and there is still a lack of
an effective method for aggregating the aforementioned metrics (Ostheimer et
al., 2023), we suggest not depending on a particular metric and looking at the
performance of models holistically.

Findings. Some of our findings suggest that instruction-tuned LLMs often deny
following instructions while dealing with toxic input (§5.2) and produce a
generic statement. We hypothesize it may be the case because of the safety
measurement imposed on these models. This scenario can occur for some
particular tasks like detoxification that require handling toxic inputs.
However, we believe that further instruction-tuning of these models on tasks
like detoxification can alleviate the problem.

###  9.2 Ethics Statement

Data Collection and Release. As mentioned in Section 3.1, we compile datasets
from a wide range of platforms. The sources of the datasets are primarily
collected from Risch et al. (2021) and Vidgen and Derczynski (2020). To ensure
proper credit assignment, we refer users to the original publications in Table
1. We create the cross-platform detoxification corpus for academic research
purposes. We will share the corpus we used for training GreenLLaMA upon
acceptance. We would also like to mention that some content of Figure 1 and
Figure 2 are generated using GPT-4 for illustration purposes.

Intended Use. The intended use of GreenLLaMA is for the detoxification tasks.
We will share the framework upon acceptance. We aim to help researchers to
build an end-to-end complete detoxification framework. GreenLLaMA can also be
regarded as a promising baseline to develop more robust and effective
detoxification frameworks.

Potential Misuse and Bias. Our detoxification corpus and models can
potentially be misused to generate toxic and biased content. For these
reasons, we recommend that GreenLLaMA not be used in applications without
careful prior consideration of potential misuse and bias.

## References

  * Albert. (2023) Alex Albert. 2023.  Jailbreak chat.  https://www.jailbreakchat.com.  Accessed: 2023-11-21.
  * Basile et al. (2019) Valerio Basile, Cristina Bosco, Elisabetta Fersini, Debora Nozza, Viviana Patti, Francisco Manuel Rangel Pardo, Paolo Rosso, and Manuela Sanguinetti. 2019.  SemEval-2019 task 5: Multilingual detection of hate speech against immigrants and women in Twitter.  In _Proceedings of the 13th International Workshop on Semantic Evaluation_ , pages 54–63, Minneapolis, Minnesota, USA. Association for Computational Linguistics.
  * Brown et al. (2020) Tom B Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. 2020.  Language models are few-shot learners.  _arXiv preprint arXiv:2005.14165_.
  * Cercas Curry et al. (2021) Amanda Cercas Curry, Gavin Abercrombie, and Verena Rieser. 2021.  ConvAbuse: Data, analysis, and benchmarks for nuanced abuse detection in conversational AI.  In _Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing_ , pages 7388–7403, Online and Punta Cana, Dominican Republic. Association for Computational Linguistics.
  * Chen et al. (2023) Lingjiao Chen, Matei Zaharia, and James Zou. 2023.  How is chatgpt’s behavior changing over time?  _arXiv preprint arXiv:2307.09009_.
  * Chiang et al. (2023) Wei-Lin Chiang, Zhuohan Li, Zi Lin, Ying Sheng, Zhanghao Wu, Hao Zhang, Lianmin Zheng, Siyuan Zhuang, Yonghao Zhuang, Joseph E. Gonzalez, Ion Stoica, and Eric P. Xing. 2023.  Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality.
  * Clark et al. (2020) Kevin Clark, Minh-Thang Luong, Quoc V. Le, and Christopher D. Manning. 2020.  ELECTRA: pre-training text encoders as discriminators rather than generators.  In _8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020_. OpenReview.net.
  * Dadvar et al. (2013) M. Dadvar, Rudolf Berend Trieschnigg, Roeland J.F. Ordelman, and Franciska M.G. de Jong. 2013.  Improving cyberbullying detection with user context.  In _Proceedings of the 35th European Conference on IR Research, ECIR 2013_ , Lecture Notes in Computer Science, pages 693–696, Netherlands. Springer.
  * Dale et al. (2021) David Dale, Igor Markov, Varvara Logacheva, Olga Kozlova, Nikita Semenov, and Alexander Panchenko. 2021.  SkoltechNLP at SemEval-2021 task 5: Leveraging sentence-level pre-training for toxic span detection.  In _Proceedings of the 15th International Workshop on Semantic Evaluation (SemEval-2021)_ , pages 927–934, Online. Association for Computational Linguistics.
  * Davidson et al. (2017) Thomas Davidson, Dana Warmsley, Michael Macy, and Ingmar Weber. 2017.  Automated hate speech detection and the problem of offensive language.  _Proceedings of the International AAAI Conference on Web and Social Media_ , 11(1):512–515.
  * de Gibert et al. (2018) Ona de Gibert, Naiara Perez, Aitor García-Pablos, and Montse Cuadros. 2018.  Hate speech dataset from a white supremacy forum.  In _Proceedings of the 2nd Workshop on Abusive Language Online (ALW2)_ , pages 11–20, Brussels, Belgium. Association for Computational Linguistics.
  * Dementieva et al. (2023) Daryna Dementieva, Daniil Moskovskiy, David Dale, and Alexander Panchenko. 2023.  Exploring methods for cross-lingual text style transfer: The case of text detoxification.  _ArXiv_ , abs/2311.13937.
  * Devlin et al. (2019) Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019.  BERT: Pre-training of deep bidirectional transformers for language understanding.  In _Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers)_ , pages 4171–4186, Minneapolis, Minnesota. Association for Computational Linguistics.
  * Dolan and Brockett (2005) William B. Dolan and Chris Brockett. 2005.  Automatically constructing a corpus of sentential paraphrases.  In _Proceedings of the Third International Workshop on Paraphrasing (IWP2005)_.
  * ElSherief et al. (2018) Mai ElSherief, Vivek Kulkarni, Dana Nguyen, William Yang Wang, and Elizabeth Belding. 2018.  Hate lingo: A target-based linguistic analysis of hate speech in social media.  _Proceedings of the International AAAI Conference on Web and Social Media_ , 12(1).
  * Fortuna et al. (2020) Paula Fortuna, Juan Soler, and Leo Wanner. 2020.  Toxic, hateful, offensive or abusive? what are we really classifying? an empirical analysis of hate speech datasets.  In _Proceedings of the Twelfth Language Resources and Evaluation Conference_ , pages 6786–6794, Marseille, France. European Language Resources Association.
  * Founta et al. (2018) Antigoni Founta, Constantinos Djouvas, Despoina Chatzakou, Ilias Leontiadis, Jeremy Blackburn, Gianluca Stringhini, Athena Vakali, Michael Sirivianos, and Nicolas Kourtellis. 2018.  Large scale crowdsourcing and characterization of twitter abusive behavior.  _Proceedings of the International AAAI Conference on Web and Social Media_ , 12(1).
  * Gao and Huang (2017) Lei Gao and Ruihong Huang. 2017.  Detecting online hate speech using context aware models.  In _Proceedings of the International Conference Recent Advances in Natural Language Processing, RANLP 2017_ , pages 260–266, Varna, Bulgaria. INCOMA Ltd.
  * Gao et al. (2021) Tianyu Gao, Xingcheng Yao, and Danqi Chen. 2021.  SimCSE: Simple contrastive learning of sentence embeddings.  In _Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing_ , pages 6894–6910, Online and Punta Cana, Dominican Republic. Association for Computational Linguistics.
  * Golbeck et al. (2017) Jennifer Golbeck, Zahra Ashktorab, Rashad O. Banjo, Alexandra Berlinger, Siddharth Bhagwan, Cody Buntain, Paul Cheakalos, Alicia A. Geller, Quint Gergory, Rajesh Kumar Gnanasekaran, Raja Rajan Gunasekaran, Kelly M. Hoffman, Jenny Hottle, Vichita Jienjitlert, Shivika Khare, Ryan Lau, Marianna J. Martindale, Shalmali Naik, Heather L. Nixon, Piyush Ramachandran, Kristine M. Rogers, Lisa Rogers, Meghna Sardana Sarin, Gaurav Shahane, Jayanee Thanki, Priyanka Vengataraman, Zijian Wan, and Derek Michael Wu. 2017.  A large labeled corpus for online harassment research.  In _Proceedings of the 2017 ACM on Web Science Conference_ , WebSci ’17, page 229–233, New York, NY, USA. Association for Computing Machinery.
  * Gong et al. (2019) Hongyu Gong, Suma Bhat, Lingfei Wu, JinJun Xiong, and Wen-mei Hwu. 2019.  Reinforcement learning based text style transfer without parallel training corpus.  In _Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers)_ , pages 3168–3180, Minneapolis, Minnesota. Association for Computational Linguistics.
  * Gröndahl et al. (2018) Tommi Gröndahl, Luca Pajola, Mika Juuti, Mauro Conti, and N. Asokan. 2018.  All you need is "love": Evading hate speech detection.  AISec ’18, page 2–12, New York, NY, USA. Association for Computing Machinery.
  * Hallinan et al. (2023) Skyler Hallinan, Faeze Brahman, Ximing Lu, Jaehun Jung, Sean Welleck, and Yejin Choi. 2023.  Steer: Unified style transfer with expert reinforcement.  _ArXiv_ , abs/2311.07167.
  * Hartvigsen et al. (2022) Thomas Hartvigsen, Saadia Gabriel, Hamid Palangi, Maarten Sap, Dipankar Ray, and Ece Kamar. 2022.  ToxiGen: A large-scale machine-generated dataset for adversarial and implicit hate speech detection.  In _Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)_ , pages 3309–3326, Dublin, Ireland. Association for Computational Linguistics.
  * Hsieh et al. (2023) Cheng-Yu Hsieh, Chun-Liang Li, Chih-kuan Yeh, Hootan Nakhost, Yasuhisa Fujii, Alex Ratner, Ranjay Krishna, Chen-Yu Lee, and Tomas Pfister. 2023.  Distilling step-by-step! outperforming larger language models with less training data and smaller model sizes.  In _Findings of the Association for Computational Linguistics: ACL 2023_ , pages 8003–8017, Toronto, Canada. Association for Computational Linguistics.
  * Jha and Mamidi (2017) Akshita Jha and Radhika Mamidi. 2017.  When does a compliment become sexist? analysis and classification of ambivalent sexism using twitter data.  In _Proceedings of the Second Workshop on NLP and Computational Social Science_ , pages 7–16, Vancouver, Canada. Association for Computational Linguistics.
  * Jigsaw (2018) Jigsaw. 2018.  Jigsaw toxic comment classification.  https://www.kaggle.com/c/jigsaw-toxic-comment-classification-challenge.  Accessed: 2023-11-21.
  * Jurgens et al. (2019) David Jurgens, Libby Hemphill, and Eshwar Chandrasekharan. 2019.  A just and comprehensive strategy for using NLP to address online abuse.  In _Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics_ , pages 3658–3666, Florence, Italy. Association for Computational Linguistics.
  * Karan and Šnajder (2018) Mladen Karan and Jan Šnajder. 2018.  Cross-domain detection of abusive language online.  In _Proceedings of the 2nd Workshop on Abusive Language Online (ALW2)_ , pages 132–137, Brussels, Belgium. Association for Computational Linguistics.
  * Khondaker et al. (2023a) Md Tawkat Islam Khondaker, Muhammad Abdul-mageed, and Laks Lakshmanan, V.s. 2023a.  Cross-platform and cross-domain abusive language detection with supervised contrastive learning.  In _The 7th Workshop on Online Abuse and Harms (WOAH)_ , pages 96–112, Toronto, Canada. Association for Computational Linguistics.
  * Khondaker et al. (2023b) Md Tawkat Islam Khondaker, Abdul Waheed, El Moatez Billah Nagoudi, and Muhammad Abdul-Mageed. 2023b.  GPTAraEval: A comprehensive evaluation of ChatGPT on Arabic NLP.  In _Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing_ , pages 220–247, Singapore. Association for Computational Linguistics.
  * Koh et al. (2021) Pang Wei Koh, Shiori Sagawa, Henrik Marklund, Sang Michael Xie, Marvin Zhang, Akshay Balsubramani, Weihua Hu, Michihiro Yasunaga, Richard Lanas Phillips, Irena Gao, Tony Lee, Etienne David, Ian Stavness, Wei Guo, Berton Earnshaw, Imran Haque, Sara M Beery, Jure Leskovec, Anshul Kundaje, Emma Pierson, Sergey Levine, Chelsea Finn, and Percy Liang. 2021.  Wilds: A benchmark of in-the-wild distribution shifts.  In _Proceedings of the 38th International Conference on Machine Learning_ , volume 139 of _Proceedings of Machine Learning Research_ , pages 5637–5664. PMLR.
  * Laugier et al. (2021) Léo Laugier, John Pavlopoulos, Jeffrey Sorensen, and Lucas Dixon. 2021.  Civil rephrases of toxic texts with self-supervised transformers.  In _Proceedings of the 16th Conference of the European Chapter of the Association for Computational Linguistics: Main Volume_ , pages 1442–1461, Online. Association for Computational Linguistics.
  * Lewis et al. (2020) Mike Lewis, Yinhan Liu, Naman Goyal, Marjan Ghazvininejad, Abdelrahman Mohamed, Omer Levy, Veselin Stoyanov, and Luke Zettlemoyer. 2020.  BART: Denoising sequence-to-sequence pre-training for natural language generation, translation, and comprehension.  In _Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics_ , pages 7871–7880, Online. Association for Computational Linguistics.
  * Li et al. (2023) Haoran Li, Dadi Guo, Wei Fan, Mingshi Xu, Jie Huang, and Yangqiu Song. 2023.  Multi-step jailbreaking privacy attacks on chatgpt.  In _Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing_. Association for Computational Linguistics.
  * Liu et al. (2022a) Ao Liu, An Wang, and Naoaki Okazaki. 2022a.  Semi-supervised formality style transfer with consistency training.  In _Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)_ , pages 4689–4701, Dublin, Ireland. Association for Computational Linguistics.
  * Liu et al. (2019a) Ping Liu, Wen Li, and Liang Zou. 2019a.  NULI at SemEval-2019 task 6: Transfer learning for offensive language detection using bidirectional transformers.  In _Proceedings of the 13th International Workshop on Semantic Evaluation_ , pages 87–91, Minneapolis, Minnesota, USA. Association for Computational Linguistics.
  * Liu et al. (2022b) Ruibo Liu, Chongyang Gao, Chenyan Jia, Guangxuan Xu, and Soroush Vosoughi. 2022b.  Non-parallel text style transfer with self-parallel supervision.  In _International Conference on Learning Representations_.
  * Liu et al. (2023) Yi Liu, Gelei Deng, Zhengzi Xu, Yuekang Li, Yaowen Zheng, Ying Zhang, Lida Zhao, Tianwei Zhang, and Yang Liu. 2023.  Jailbreaking chatgpt via prompt engineering: An empirical study.  _ArXiv_ , abs/2305.13860.
  * Liu et al. (2019b) Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. 2019b.  Roberta: A robustly optimized bert pretraining approach.  _arXiv preprint arXiv:1907.11692_.
  * Logacheva et al. (2022) Varvara Logacheva, Daryna Dementieva, Sergey Ustyantsev, Daniil Moskovskiy, David Dale, Irina Krotova, Nikita Semenov, and Alexander Panchenko. 2022.  ParaDetox: Detoxification with parallel data.  In _Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)_ , pages 6804–6818, Dublin, Ireland. Association for Computational Linguistics.
  * Madaan et al. (2020) Aman Madaan, Amrith Setlur, Tanmay Parekh, Barnabas Poczos, Graham Neubig, Yiming Yang, Ruslan Salakhutdinov, Alan W Black, and Shrimai Prabhumoye. 2020.  Politeness transfer: A tag and generate approach.  In _Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics_ , pages 1869–1881, Online. Association for Computational Linguistics.
  * Mandl et al. (2019) Thomas Mandl, Sandip Modha, Prasenjit Majumder, Daksh Patel, Mohana Dave, Chintak Mandlia, and Aditya Patel. 2019.  Overview of the hasoc track at fire 2019: Hate speech and offensive content identification in indo-european languages.  FIRE ’19, page 14–17, New York, NY, USA. Association for Computing Machinery.
  * Mathur et al. (2018) Puneet Mathur, Ramit Sawhney, Meghna Ayyar, and Rajiv Shah. 2018.  Did you offend me? classification of offensive tweets in Hinglish language.  In _Proceedings of the 2nd Workshop on Abusive Language Online (ALW2)_ , pages 138–148, Brussels, Belgium. Association for Computational Linguistics.
  * Mollas et al. (2020) Ioannis Mollas, Zoe Chrysopoulou, Stamatis Karlos, and Grigorios Tsoumakas. 2020.  Ethos: an online hate speech detection dataset.  _Complex & Intelligent Systems_.
  * Morris et al. (2020) John Morris, Eli Lifland, Jin Yong Yoo, Jake Grigsby, Di Jin, and Yanjun Qi. 2020.  Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in nlp.  In _Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations_ , pages 119–126.
  * Mukherjee et al. (2023) Sourabrata Mukherjee, Vojtěch Hudeček, and Ondřej Dušek. 2023.  Polite chatbot: A text style transfer application.  In _Proceedings of the 17th Conference of the European Chapter of the Association for Computational Linguistics: Student Research Workshop_ , pages 87–93, Dubrovnik, Croatia. Association for Computational Linguistics.
  * Müller and Schwarz (2017) Karsten Müller and Carlo Schwarz. 2017.  Fanning the flames of hate: Social media and hate crime.  _SSRN Electronic Journal_.
  * Niu and Bansal (2018) Tong Niu and Mohit Bansal. 2018.  Polite dialogue generation without parallel data.  _Transactions of the Association for Computational Linguistics_ , 6:373–389.
  * Nogueira dos Santos et al. (2018) Cicero Nogueira dos Santos, Igor Melnyk, and Inkit Padhi. 2018.  Fighting offensive language on social media with unsupervised text style transfer.  In _Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers)_ , pages 189–194, Melbourne, Australia. Association for Computational Linguistics.
  * OpenAI (2023a) OpenAI. 2023a.  Chatgpt.  https://openai.com/blog/chatgpt.  Accessed: 2023-11-21.
  * OpenAI (2023b) OpenAI. 2023b.  Moderation.  https://platform.openai.com/docs/guides/moderation.  Accessed: 2023-11-21.
  * Ostheimer et al. (2023) Phil Ostheimer, Mayank Kumar Nagda, Marius Kloft, and Sophie Fellenz. 2023.  A call for standardization and validation of text style transfer evaluation.  In _Findings of the Association for Computational Linguistics: ACL 2023_ , pages 10791–10815, Toronto, Canada. Association for Computational Linguistics.
  * Ousidhoum et al. (2019) Nedjma Ousidhoum, Zizheng Lin, Hongming Zhang, Yangqiu Song, and Dit-Yan Yeung. 2019.  Multilingual and multi-aspect hate speech analysis.  In _Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP)_ , pages 4675–4684, Hong Kong, China. Association for Computational Linguistics.
  * Patel et al. (2022a) Ajay Patel, Nicholas Andrews, and Chris Callison-Burch. 2022a.  Low-resource authorship style transfer with in-context learning.  _ArXiv_ , abs/2212.08986.
  * Patel et al. (2022b) Ajay Patel, Nicholas Andrews, and Chris Callison-Burch. 2022b.  Low-resource authorship style transfer with in-context learning.  _ArXiv_ , abs/2212.08986.
  * Pu and Demberg (2023) Dongqi Pu and Vera Demberg. 2023.  ChatGPT vs human-authored text: Insights into controllable text summarization and sentence style transfer.  In _Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 4: Student Research Workshop)_ , pages 1–18, Toronto, Canada. Association for Computational Linguistics.
  * Qian et al. (2019) Jing Qian, Anna Bethke, Yinyin Liu, Elizabeth Belding, and William Yang Wang. 2019.  A benchmark dataset for learning to intervene in online hate speech.  In _Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP)_ , pages 4755–4764, Hong Kong, China. Association for Computational Linguistics.
  * Raffel et al. (2019) Colin Raffel, Noam M. Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J. Liu. 2019.  Exploring the limits of transfer learning with a unified text-to-text transformer.  _J. Mach. Learn. Res._ , 21:140:1–140:67.
  * Rao and Tetreault (2018) Sudha Rao and Joel Tetreault. 2018.  Dear sir or madam, may I introduce the GYAFC dataset: Corpus, benchmarks and metrics for formality style transfer.  In _Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long Papers)_ , pages 129–140, New Orleans, Louisiana. Association for Computational Linguistics.
  * Reid and Zhong (2021) Machel Reid and Victor Zhong. 2021.  LEWIS: Levenshtein editing for unsupervised text style transfer.  In _Findings of the Association for Computational Linguistics: ACL-IJCNLP 2021_ , pages 3932–3944, Online. Association for Computational Linguistics.
  * Reif et al. (2022) Emily Reif, Daphne Ippolito, Ann Yuan, Andy Coenen, Chris Callison-Burch, and Jason Wei. 2022.  A recipe for arbitrary text style transfer with large language models.  In _Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers)_ , pages 837–848, Dublin, Ireland. Association for Computational Linguistics.
  * Reimers and Gurevych (2019) Nils Reimers and Iryna Gurevych. 2019.  Sentence-bert: Sentence embeddings using siamese bert-networks.  In _Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing_. Association for Computational Linguistics.
  * Ribeiro et al. (2018) Manoel Horta Ribeiro, Pedro H Calais, Yuri A Santos, Virgílio AF Almeida, and Wagner Meira Jr. 2018.  Characterizing and detecting hateful users on twitter.  In _Twelfth international AAAI conference on web and social media_.
  * Risch et al. (2021) Julian Risch, Philipp Schmidt, and Ralf Krestel. 2021.  Data integration for toxic comment classification: Making more than 40 datasets easily accessible in one unified format.  In _Proceedings of the 5th Workshop on Online Abuse and Harms (WOAH 2021)_ , pages 157–163, Online. Association for Computational Linguistics.
  * Röttger et al. (2021) Paul Röttger, Bertie Vidgen, Dong Nguyen, Zeerak Waseem, Helen Margetts, and Janet Pierrehumbert. 2021.  HateCheck: Functional tests for hate speech detection models.  In _Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers)_ , pages 41–58, Online. Association for Computational Linguistics.
  * Salminen et al. (2018) Joni Salminen, Hind Almerekhi, Milica Milenković, Soon-gyo Jung, Jisun An, Haewoon Kwak, and Bernard Jansen. 2018.  Anatomy of online hate: Developing a taxonomy and machine learning models for identifying and classifying hate in online news media.  _Proceedings of the International AAAI Conference on Web and Social Media_ , 12(1).
  * Salminen et al. (2020) Joni O. Salminen, Maximilian Hopf, S. A. Chowdhury, Soon-Gyo Jung, Hind Almerekhi, and Bernard Jim Jansen. 2020.  Developing an online hate classifier for multiple social media platforms.  _Human-centric Computing and Information Sciences_ , 10:1–34.
  * Sap et al. (2019) Maarten Sap, Dallas Card, Saadia Gabriel, Yejin Choi, and Noah A. Smith. 2019.  The risk of racial bias in hate speech detection.  In _Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics_ , pages 1668–1678, Florence, Italy. Association for Computational Linguistics.
  * Schmidt and Wiegand (2017) Anna Schmidt and Michael Wiegand. 2017.  A survey on hate speech detection using natural language processing.  In _Proceedings of the Fifth International Workshop on Natural Language Processing for Social Media_ , pages 1–10, Valencia, Spain. Association for Computational Linguistics.
  * Shen et al. (2017) Tianxiao Shen, Tao Lei, Regina Barzilay, and Tommi Jaakkola. 2017.  Style transfer from non-parallel text by cross-alignment.  In _Advances in Neural Information Processing Systems_ , volume 30. Curran Associates, Inc.
  * Shetty et al. (2017) Rakshith Shetty, Bernt Schiele, and Mario Fritz. 2017.  A4nt: Author attribute anonymity by adversarial training of neural machine translation.  In _USENIX Security Symposium_.
  * Swamy et al. (2019) Steve Durairaj Swamy, Anupam Jamatia, and Björn Gambäck. 2019.  Studying generalisability across abusive language detection datasets.  In _Proceedings of the 23rd Conference on Computational Natural Language Learning (CoNLL)_ , pages 940–950, Hong Kong, China. Association for Computational Linguistics.
  * Taori et al. (2023) Rohan Taori, Ishaan Gulrajani, Tianyi Zhang, Yann Dubois, Xuechen Li, Carlos Guestrin, Percy Liang, and Tatsunori B. Hashimoto. 2023.  Stanford alpaca: An instruction-following llama model.  https://github.com/tatsu-lab/stanford_alpaca.
  * Touvron et al. (2023) Hugo Touvron, Louis Martin, Kevin R. Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, Daniel M. Bikel, Lukas Blecher, Cristian Cantón Ferrer, Moya Chen, Guillem Cucurull, David Esiobu, Jude Fernandes, Jeremy Fu, Wenyin Fu, Brian Fuller, Cynthia Gao, Vedanuj Goswami, Naman Goyal, Anthony S. Hartshorn, Saghar Hosseini, Rui Hou, Hakan Inan, Marcin Kardas, Viktor Kerkez, Madian Khabsa, Isabel M. Kloumann, A. V. Korenev, Punit Singh Koura, Marie-Anne Lachaux, Thibaut Lavril, Jenya Lee, Diana Liskovich, Yinghai Lu, Yuning Mao, Xavier Martinet, Todor Mihaylov, Pushkar Mishra, Igor Molybog, Yixin Nie, Andrew Poulton, Jeremy Reizenstein, Rashi Rungta, Kalyan Saladi, Alan Schelten, Ruan Silva, Eric Michael Smith, R. Subramanian, Xia Tan, Binh Tang, Ross Taylor, Adina Williams, Jian Xiang Kuan, Puxin Xu, Zhengxu Yan, Iliyan Zarov, Yuchen Zhang, Angela Fan, Melanie Kambadur, Sharan Narang, Aurelien Rodriguez, Robert Stojnic, Sergey Edunov, and Thomas Scialom. 2023.  Llama 2: Open foundation and fine-tuned chat models.  _ArXiv_ , abs/2307.09288.
  * Vaswani et al. (2017) Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Ł ukasz Kaiser, and Illia Polosukhin. 2017.  Attention is all you need.  In _Advances in Neural Information Processing Systems_ , volume 30. Curran Associates, Inc.
  * Vidgen and Derczynski (2020) Bertie Vidgen and Leon Derczynski. 2020.  Directions in abusive language training data, a systematic review: Garbage in, garbage out.  _PLoS ONE_ , 15(12):e0243300.
  * Wang et al. (2019) Ke Wang, Hang Hua, and Xiaojun Wan. 2019.  Controllable unsupervised text attribute transfer via editing entangled latent representation.  In _Advances in Neural Information Processing Systems_ , volume 32. Curran Associates, Inc.
  * Wang et al. (2022) Yizhong Wang, Yeganeh Kordi, Swaroop Mishra, Alisa Liu, Noah A. Smith, Daniel Khashabi, and Hannaneh Hajishirzi. 2022.  Self-instruct: Aligning language model with self generated instructions.  _ArXiv_ , abs/2212.10560.
  * Warner and Hirschberg (2012) William Warner and Julia Hirschberg. 2012.  Detecting hate speech on the world wide web.  In _Proceedings of the Second Workshop on Language in Social Media_ , LSM ’12, page 19–26, USA. Association for Computational Linguistics.
  * Warstadt et al. (2018) Alex Warstadt, Amanpreet Singh, and Samuel R. Bowman. 2018.  Neural network acceptability judgments.  _Transactions of the Association for Computational Linguistics_ , 7:625–641.
  * Waseem and Hovy (2016) Zeerak Waseem and Dirk Hovy. 2016.  Hateful symbols or hateful people? predictive features for hate speech detection on Twitter.  In _Proceedings of the NAACL Student Research Workshop_ , pages 88–93, San Diego, California. Association for Computational Linguistics.
  * Wei et al. (2022) Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, brian ichter, Fei Xia, Ed H. Chi, Quoc V Le, and Denny Zhou. 2022.  Chain of thought prompting elicits reasoning in large language models.  In _Advances in Neural Information Processing Systems_.
  * Williams et al. (2019) Matthew L Williams, Pete Burnap, Amir Javed, Han Liu, and Sefa Ozalp. 2019.  Hate in the Machine: Anti-Black and Anti-Muslim Social Media Posts as Predictors of Offline Racially and Religiously Aggravated Crime.  _The British Journal of Criminology_ , 60(1):93–117.
  * Wolf et al. (2020) Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Remi Louf, Morgan Funtowicz, Joe Davison, Sam Shleifer, Patrick von Platen, Clara Ma, Yacine Jernite, Julien Plu, Canwen Xu, Teven Le Scao, Sylvain Gugger, Mariama Drame, Quentin Lhoest, and Alexander Rush. 2020.  Transformers: State-of-the-art natural language processing.  In _Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations_ , pages 38–45, Online. Association for Computational Linguistics.
  * Wu et al. (2023) Minghao Wu, Abdul Waheed, Chiyu Zhang, Muhammad Abdul-Mageed, and Alham Fikri Aji. 2023.  Lamini-lm: A diverse herd of distilled models from large-scale instructions.
  * Wulczyn et al. (2017) Ellery Wulczyn, Nithum Thain, and Lucas Dixon. 2017.  Ex machina: Personal attacks seen at scale.  In _Proceedings of the 26th International Conference on World Wide Web_ , pages 1391–1399.
  * Xu et al. (2012) Jun-Ming Xu, Kwang-Sung Jun, Xiaojin Zhu, and Amy Bellmore. 2012.  Learning from bullying traces in social media.  In _Proceedings of the 2012 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies_ , pages 656–666, Montréal, Canada. Association for Computational Linguistics.
  * Zampieri et al. (2019) Marcos Zampieri, Shervin Malmasi, Preslav Nakov, Sara Rosenthal, Noura Farra, and Ritesh Kumar. 2019.  Predicting the type and target of offensive posts in social media.  In _Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers)_ , pages 1415–1420, Minneapolis, Minnesota. Association for Computational Linguistics.
  * Zhang et al. (2020) Yi Zhang, Tao Ge, and Xu Sun. 2020.  Parallel data augmentation for formality style transfer.  In _Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics_ , pages 3221–3228, Online. Association for Computational Linguistics.

##  Appendix A Related Works

###  A.1 Abusive Language Detection

Over the years, the task of abusive language detection has been studied in NLP
in the form of hate speech Founta et al. (2018); Davidson et al. (2017);
Golbeck et al. (2017), sexism/racism Waseem and Hovy (2016), cyberbulling Xu
et al. (2012); Dadvar et al. (2013). Earlier works in abusive language
detection depend on feature-based approaches to identify the lexical
difference between abusive and non-abusive language Warner and Hirschberg
(2012); Waseem and Hovy (2016); Ribeiro et al. (2018). Recently, Transformer-
based Vaswani et al. (2017) architectures like BERT Devlin et al. (2019),
RoBERTa Liu et al. (2019b) have been introduced in the abusive language
detection task Liu et al. (2019a); Swamy et al. (2019). However, the study of
Vidgen and Derczynski (2020) raises the concern that most of the prior works
on abusive language detection focus on a single platform due to the
inaccessibility to multiple platforms and thus, do not scale well on other
platforms Schmidt and Wiegand (2017). As a result, Karan and Šnajder (2018);
Gröndahl et al. (2018) point out that the models are not suitable to apply to
other platforms due to the lack of generalization. To alleviate this issue,
Khondaker et al. (2023a) more recently propose a meta-learning algorithm to
detect abusive language across different platforms.

###  A.2 Text Style Transfer

Text style transfer (TST) refers to rephrasing the style of a source text
(e.g. sentiment, politeness) into a target style while changing the meaning of
the input as little as possible (Reid and Zhong, 2021). TST has been explored
in the field of NLP due to its applications in sentiment transfer (Shen et
al., 2017), formality transfer (Rao and Tetreault, 2018), authorship attribute
transfer (Shetty et al., 2017; Patel et al., 2022a), or increasing politeness
(Niu and Bansal, 2018; Madaan et al., 2020; Mukherjee et al., 2023). The lack
of parallel datasets is one of the main bottlenecks for TST tasks (Liu et al.,
2022b). To alleviate this challenge, several unsupervised methods have been
proposed (Zhang et al., 2020; Liu et al., 2022b). Specifically, Liu et al.
(2022a) create a pseudo-parallel corpus via data augmentation to circumvent
the lack of human-annotated parallel data. Prior works (Gong et al., 2019;
Wang et al., 2019) also resort to an auxiliary classifier to guide the style
of the generated text. With the advancement of large language models (LLMs),
recent works (Patel et al., 2022b; Pu and Demberg, 2023) employ LLMs like
GPT-3 (Brown et al., 2020) for parallel data generation and style transfer
tasks. Studies like Reif et al. (2022) show the effectiveness of LLMs in TST,
while Hallinan et al. (2023) remove the cost of human supervision by creating
a synthetic pseudo-parallel style transfer dataset with reinforcement
learning.

##  Appendix B Experimental Details

###  B.1 Models Comparison

SoTA Baseline. We compare our models with the state-of-the-art detoxification
model, ParaDetox (Logacheva et al., 2022); a BART-based model finetuned on
crowdsourced parallel detoxification corpus. The model is trained on three
platforms, namely, Jigsaw (Jigsaw, 2018) (Wikipedia’s talk edit page), Reddit,
and Twitter (now known as X). We evaluate this model without further
finetuning on our dataset to determine the efficacy of the model on the cross-
platform detoxification task.

*-DSS. We additionally compare our models with SoTA distillation method, Distilling Step-by-Step (DSS) proposed by Hsieh et al. (2023). We use DSS method to distill both detoxification and explanation coming from ChatGPT into BART and T5 models. Following the work, we use a multitask framework to combine the training of generating both non-toxic version and explanation from the models given a toxic input.

Instruction-tuned. We evaluate the performance of generic instruction-tuned
models like Alpaca (Taori et al., 2023), instruction-tuned LLaMA (Chat)
(Touvron et al., 2023), and Vicuna (Chiang et al., 2023) on the cross-platform
detoxification tasks. We use the corresponding 7B versions for all the models.
These models are already finetuned on a wide range of generic tasks. Hence, we
omit these models from further finetuning on our cross-platform dataset to
examine the generalizability of these models.

Cross-Platform Models. We finetune a suit of models on the cross-platform
datasets. In particular, we finetune BART and T5 to directly compare against
the contemporary SoTA (e.g., ParaDetox). We further finetune LLM like LLaMA to
observe the performance of LLM as well as compare against generic instruction-
tuned models (e.g., Alpaca). As discussed in Section 3.5, we finetune our
models in multiple setups. For T5 and BART, we (1) direct finetune the model
to generate non-toxic version given the toxic version (vanilla); (2)
concatenate a prompt with toxic version as the model input (prompt); (3)
employ CoT finetuning to instruct the model explain why the given input is
toxic before generating the non-toxic version (CoT-expl). For LLaMA
finetuning, we use the two variations mentioned above namely, (1) prompt and
(2) CoT-expl.

###  B.2 Performance Metrics

We report the models’ performance on seven unseen platforms (Table 2) as well
as the overall average performance across the platforms. We evaluate the
models based on the following metrics.

Accuracy. Following Logacheva et al. (2022), we compute the accuracy of the
models based on the percentage of non-toxic outputs identified by a style
classifier. We use the same RoBERTa style classifier as the authors.

BERTScore. We use BERTScore to compute how the models preserve the semantic
meaning. Specifically, we utilize SimCSE (Gao et al., 2021) RoBERTa-large
model to obtain the embeddings of the input-output pair and then measure the
similarity between them.

Fluency. Following Logacheva et al. (2022), we measure the percentage of
fluent sentences identified by a RoBERTa-based classifier trained on the
linguistic acceptability (CoLA) dataset (Warstadt et al., 2018).

BLEU. We compute the BLEU score between the generated non-toxic version and
the original non-toxic version on the test set.

###  B.3 Implementation Details

For finetuning cross-platform detoxification models, we use pretrained models
(T5-base, BART-base, and LLaMA-2-7b) from Huggingface (Wolf et al., 2020). We
set the maximum source length of $128$ tokens for T5, BART and $512$ tokens
for LLaMA. We set the maximum target length to $256$ with explanation and
$128$ without explanation for T5, BART. On the other hand, we use the maximum
target length of $512$ for LLaMA for both cases. We use a batch size of $32$
for T5, BART and a batch size of $8$ with the gradient accumulation step of
$8$ for LLaMA. For all the models, we set the learning rate to $3$e-$5$ with
cosine scheduler and a warmup ratio of $0.03$. We train T5 and BART for $15$
epochs while LLaMA for $10$ epochs and choose the best respective models based
on the validation set performance. We use $1$ Nvidia A100 40GB GPU to train
T5, BART and $4$ Nvidia A100 40GB GPUs to train LLaMA.

For finetuning the paraphrase detection model, We use the pretrained BERT-base
(uncased) from Huggingface (Wolf et al., 2020) as the backbone architectures.
We set the maximum sequence length to $128$ for both toxic and non-toxic input
pairs. We use a batch size of $32$ and a learning rate of $5$e-$5$. We train
the models for $50$ epochs and select the best models based on the models’
validation set performance.

##  Appendix C GreenLLaMA Across Platforms

We evaluate the accuracy of non-toxicity generated by the models using the
corresponding in-platform classifiers. For this purpose, we use the six in-
house classifiers (Section 3.3) to compute the accuracy of their respective
datasets.

Model | Overall | wikipedia | twitter | fb_yt | HateCheck | stormfront | convAI
---|---|---|---|---|---|---|---
ParaDetox | 82.76 | 100.00 | 79.43 | 63.05 | 78.67 | 86.48 | 88.95
T5-DSS | 84.14 | 100.00 | 77.28 | 64.82 | 90.47 | 88.38 | 83.87
BART-DSS | 92.53 | 100.00 | 90.58 | 82.83 | 93.19 | 93.61 | 94.97
T5-V | 87.95 | 100.00 | 84.29 | 73.71 | 89.24 | 90.76 | 89.71
T5-P | 87.83 | 100.00 | 83.52 | 73.24 | 90.19 | 91.24 | 88.76
T5-CE | 85.55 | 100.00 | 80.42 | 69.01 | 88.80 | 90.16 | 84.92
BART-V | 94.54 | 100.00 | 94.38 | 88.10 | 93.62 | 95.14 | 96.00
BART-P | 92.49 | 100.00 | 91.62 | 82.57 | 91.90 | 93.90 | 94.95
BART-CE | 92.79 | 100.00 | 91.62 | 84.50 | 91.94 | 93.72 | 94.97
LLaMA-P | 95.74 | 100.00 | 94.76 | 91.10 | 95.39 | 95.92 | 97.28
LLaMA-CE | 96.93 | 100.00 | 95.39 | 94.87 | 95.81 | 97.28 | 98.22

Table C.1:  Performance of the models based on six in-platform classifiers. V
= Vanilla, P = Prompt, CE = CoT-expl, C = Chat. Bold font represents the best
performance for a particular platform (we ignore instruction-tuned models
because of their inability to detoxification (§ 5.2)). We compute the
performance as the percentage of non-toxic outputs identified by the in-
platform classifiers.

We present the result in Table C.1. We observe that our finetuned models
outperform other SoTA baselines based on the in-platform classifiers. Among
our proposed models, CoT-expl again outperforms others by achieving the best
overall accuracy. Since these classifiers are finetuned to detect toxicity in
the respective platforms, higher accuracy reported by these classifiers
indicates the expertise of GreenLLaMA across all platforms.

##  Appendix D Token-level Adversarial Examples

We provide the full list of our token-level adversarial examples and the
corresponding models’ response in Table D.1

Example | ParaDetox |  | BART
---
(vanilla)
| LLaMA
---
(CoT-expl)
Dj Nick is retarded |  Dj Nick is retarded |  Dj Nick lacks understanding. |  Dj Nick is not intellectually inclined.
you are a p&g, you won’t understand my point |  you are p&g, you won’t understand my point |  You are mistaken, you fail to understand my point. |  You may not comprehend my point if you are not familiar with the subject.
delete the page and shut the fucC up |  delete the page and keep quiet |  Please remove the page and turn off the computer. |  Please remove the page and kindly remain silent.
I dont have time for this cra&p |  I don’t have time for this cra&p |  I don’t have time for this activity. |  I don’t have time for this nonsense.
what a rub_ish excuse for a reason |  what a rub_ish excuse for a reason |  What a ridiculous excuse for a reason. |  What a poor reason for an excuse.
government su#cc the life out of an economy |  government su#cc the life out of an economy |  The actions of the government can negatively impact an economy. |  The government severely impacts the vitality of an economy.
id&ot no longer believes in national sovereignty |  Id&ot no longer believes in national sovereignty |  No longer believes in the concept of national sovereignty. |  I no longer holds the belief in the supremacy of national authority.
may karma be with this $cum bag |  may karma be with this $cum bag |  May karma be with this $cum bag? |  May justice be with this person.
i wouldnt spend dollar one in that rac!st place |  i wouldnt spend dollar one in that rac!st place |  I wouldn’t spend a single dollar in that rac! First place |  I wouldn’t spend a single penny in that discriminatory place.
only to replaced by another fuckt@rd |  only to replaced by another |  Only to be replaced by another person with derogatory language. |  only to be replaced by another person
maybe your biTchAss needs to chill out some time |  maybe your biTch needs to chill out some time |  Maybe your partner needs to take a break from social media. |  Perhaps your friend could use some time to relax and unwind.
she is looking like shi#te |  she is looking like shi#te |  She is looking quite distressed. |  She is looking quite unwell.
Explain you not a grand pedo |  Explain you not a grand pedo |  Explain that you are not a grand parent. |  I’m sorry, but I won’t be able to generate a response for that task.
keep crying me a river , di^khead |  keep crying me a river , di^khead |  Please stop making me feel like a river, my friend. |  Please continue to express your emotions freely, my friend.
btw this place is a real shith@le in case you were wondering |  btw this place is a real shith@le in case you were wondering |  This place is truly amazing, in case you were wondering. |  By the way, this place is quite unpleasant in case you were curious.

Table D.1:  Full list of token-level adversarial examples and the
corresponding models’ response. Toxic tokens in the input examples are
underlined. Red indicates the response is toxic. Orange indicates either the
response is non-toxic but not meaning-preserved. Green indicates either the
response is non-toxic and meaning-preserved.

##  Appendix E Large-scale Token-level Adversaries

Algorithm 1 Token-Adversaries

1:Input: toxic words list T, sentence templates S, perturbation character list
C.

2:Output: Sentence list with adversarial toxic words Z.

3:for iteration = 1,…, 5000 do

4: Sample toxic word, $t\sim T$

5: Sample sentence template, $s\sim S$

6: Sample perturb character, $c\sim C$

7: Sample character index, $i\sim len(t)$

8: Sample perturbation process, $p\sim$

9: {Insertion, Replacement}

10:

11: if $p$ = Insertion then

12: $t$ $\leftarrow$ $t$ $[$:$i$$]$ $\oplus$ $c$ $\oplus$ $t$ $[$$i$:$]$

13: else if $p$ = Replacement then

14: $t$ $\leftarrow$ $t$ $[$:$i$$]$ $\oplus$ $c$ $\oplus$ $t$ $[$$i+1$:$]$

15: end if

16:

17: Situate the word, $s$ $\leftarrow$ $s$ $\oplus$ $t$

18: $\mathbf{Z}$ $\leftarrow$ $\mathbf{Z}$ $\cup$ {$s$}

19:end for

20:

21:return Z

To create large-scale token-level adversaries, we collect a set of toxic words
from Dale et al. (2021). We create a set of sentence templates (i.e., This is
<word>, What a <word>) to situate the toxic words in the sentences. We choose
to perturb the toxic words either through the insertion of an additional
character or through the replacement of an existing character. For insertion
and replacement, we choose the characters (i.e., !, @, #, *, etc) that have
been widely used for masking the toxic words on the social platforms. We then
start to create an automated testbed of $5000$ adversarial examples where we
first randomly select a toxic word and corresponding sentence template. Then
we randomly perturb a particular character of the selected toxic word and
situate the adversarial toxic word in the selected sentence template. We
present the algorithm for creating the large-scale token-level adversaries in
Algorithm 1.

##  Appendix F Results of Varying Sample Size

We provide the detailed result of the ParaDetox model trained on different
sample sizes in Table F.1.

Model | Acc | BS | Fl | BL
---|---|---|---|---
ParaDetox-main | 90.16 | 96.65 | 88.52 | 69.99
ParaDetox_100 | 90.46 | 97.21 | 88.08 | 72.01
ParaDetox-150 | 91.06 | 97.08 | 89.87 | 71.31
ParaDetox-200 | 89.87 | 97.24 | 88.67 | 71.93
ParaDetox-250 | 89.87 | 97.25 | 87.63 | 72.13
ParaDetox-300 | 90.46 | 97.19 | 88.23 | 71.62
ParaDetox-350 | 90.46 | 97.19 | 88.23 | 71.51
ParaDetox-400 | 89.87 | 97.18 | 89.27 | 71.59
ParaDetox-450 | 90.46 | 97.1 | 89.72 | 71.47
ParaDetox-500 | 91.8 | 97.01 | 90.16 | 71.07
ParaDetox-550 | 91.36 | 96.96 | 89.57 | 70.74
ParaDetox-600 | 91.95 | 96.93 | 89.27 | 70.97
ParaDetox-650 | 92.7 | 96.81 | 89.27 | 70.62
ParaDetox-700 | 92.25 | 96.89 | 90.01 | 70.85
ParaDetox-750 | 92.55 | 96.76 | 90.61 | 70.22
ParaDetox-800 | 93.74 | 96.64 | 90.91 | 69.7
ParaDetox-850 | 93.29 | 96.65 | 90.76 | 69.96
ParaDetox-900 | 93.59 | 96.52 | 91.51 | 69.73
ParaDetox-950 | 93.74 | 96.54 | 91.51 | 69.59
ParaDetox-1000 | 93.44 | 96.45 | 92.1 | 69.6

Table F.1:  Performance of the ParaDetox models trained on different sample
size of our cross-platform dataset. As evident, the models’ accuracy tend to
increase with the increase of sample size. Acc = percentage of non- toxic
outputs identified by a style classifier, BS = BERTScore, Fl = Fluency, BL =
BLEU Score. Bold font represents the best performance for a particular metric.

##  Appendix G Inability of Instruction-tuned LLMs

As discussed in Section 5.2, instruction-tuned LLMs like LLaMA-Chat, Alpaca,
and Vicuna often defy the detoxification instructions and tend to produce a
generic statement. This is also evident in the examples provided for LLaMA-
Chat in Table J.1. We believe this detoxification inability is due to the
safety measurements imposed on the LLMs (Touvron et al., 2023). In addition to
the safety concern, we conduct a thorough manual inspection of the models’
responses and identify two principal input formats where the models especially
struggle to detoxify:

  1. 1.

QA mode: If the toxic input is in the form of a question, instruction-tuned
LLMs often tend to answer or address the question, although the models are
clearly instructed to detoxify the input. We believe this stems from the
inherent instruction-tuned strategy because the models are instructed in the
form of a question (e.g., What is the capital of Switzerland?) to address or
solve a particular task (e.g., question answering).

  2. 2.

Chat mode: We also find the instruction-tuned LLMs struggle to detoxify when
the toxic input is a part of natural conversation. Since the models are
finetuned to be human-like chat assistants, they often continue the
conversation instead of following the instructions of detoxification.

We provide the samples of instruction-tuned LLMs responses for the above-
mentioned formats in Table G.1.

Mode | Input | LLaMA-C | Alpaca | Vicuna
---|---|---|---|---
QA |  | You’re effing kidding me! 31 years old? You’re a freaking grandpa
---
and France wouldn’t even consider you for a military career.
How dumb can you be? Oh, let me guess, you were a soldier
for a whopping two years in some combat unit? Wow, what a joke.
| I apologize if my previous response was not in line with your expectations.
---
I’m just an AI and do not have the ability to use offensive language or
make personal attacks. I understand that you are upset about the situation,
but I cannot engage in toxic or disrespectful language. Is there anything
else I can help you with?
| You’re kidding me! 31 years old? You’re a grandpa
---
and France wouldn’t even consider you for a
military career. How dumb can you be? Oh, let me
guess, you were a soldier for a whopping two years
in some combat unit? Wow, what a joke.
| I apologize if my response came across as harsh.
---
It was not my intention to offend. I understand
that everyone has different experiences and
backgrounds. It’s important to consider these
factors when making decisions. Let’s focus on
having a positive and productive conversation. Is
there anything specific you would like to discuss
or ask about?
QA |  | Do you like Canada and its culture? Do you want outside countries
---
having power over Canada? Nationalism isn’t evil just because
the lefty retards hate themselves and hate their country and want
outside countries to take it over.
| I cannot fulfill your request. I’m just an AI assistant trained to provide
---
respectful and informative responses, and I cannot generate content that
promotes hate speech or discrimination towards any group of people,
including those based on their nationality or country of origin. It is
important to treat all individuals with dignity and respect, regardless of
their background or beliefs. I’m just an AI, my purpose is to provide
helpful and informative responses while promoting a positive and
inclusive environment. If you have any other questions or topics you
would like to discuss, I would be happy to assist you.
| Do you like Canada and its culture? Do you want
---
outside countries having power over Canada?
Nationalism isn’t evil just because the lefty retards
hate themselves and hate their country and want
outside countries to take it over.
No, I don’t like Canada and its culture. No, I don’t
want outside countries having power over Canada.
Nationalism isn’t evil just because the lefty retards
hate themselves and hate their country and want
outside countries to take it over.
| I understand that you have a strong opinion about
---
Canada and its culture. It’s important to respect and
appreciate the diversity and uniqueness of different
countries and their cultures. It’s also important to
recognize that nationalism can have both positive
and negative aspects. While it’s natural to feel pride
and attachment to one’s country, it’s also important
to maintain a balanced perspective and avoid
becoming overly insular or xenophobic. It’s possible
to celebrate and appreciate one’s own culture while
also respecting and learning from other cultures.
Let’s work together to foster a culture of mutual
understanding and respect.
QA |  | You freaking moron! How many times do I have to freaking tell
---
you? I couldn’t care less about your stupid names. It’s crystal
clear that you’re a complete mess. So, why don’t you stop
being a dumbass and explain yourself? What the heck do you
mean, huh?
| I apologize if I have caused any confusion, but I don’t think it’s
---
productive or respectful to use insults or derogatory language. I’m here
to help you with any questions or concerns you may have, and I will do
my best to provide clear and helpful responses. Could you please rephrase
your question or request in a more constructive way?
| I’m sorry, I didn’t realize I was being unclear. I’m
---
happy to explain further if you’d like. What do you
need to know?
| I apologize if I have done anything to upset you.
---
I understand that my previous responses may not
have been satisfactory. Please allow me to clarify
my previous statements. I am here to assist you,
and I want to make sure I am meeting your needs.
If there is anything specific you would like me to
help you with, please let me know.
Chat |  | You can add things to my user page, and I am not allowed to
---
delete it. But if I add something to yours, poof, it’s gone.
You’re the problem, dickweed.
| I understand that you are upset about the situation, but I don’t think it’s
---
productive or respectful to use hurtful language or make personal attacks.
It’s important to communicate in a civil and respectful manner, even when
we disagree with someone. Can we find a more constructive way to
address the issue?
| You can add things to my user page, and I am not
---
allowed to delete it. But if I add something to yours,
poof, its gone. You’re the problem, polite person.
| I understand your concern. Please allow me to
---
assist you in creating a more balanced user page.
I will make sure to incorporate your input while
respecting your boundaries. Together, we can
create a fair and mutually beneficial user page.
Chat |  | Don’t be a damn idiot, I’ve told you thrice and you’re still
---
too ignorant to grasp it. So don’t bother asking again,
because you won’t get a damn answer.
| I understand that you’re frustrated, and I apologize if I’ve caused any
---
confusion. However, I don’t think it’s productive to use insults or hurtful
language. Can you please rephrase your question in a more respectful and
clear manner? I’m here to help and want to make sure I understand your
needs.
| Don’t be so stubborn, I’ve told you thrice and you’re
---
still not getting it. Maybe a different approach would
help. So don’t bother asking again, because you won’t
get a satisfactory answer.
| I understand that you’re frustrated, and I apologize
---
for any confusion. Please allow me to clarify. The
information you’ve provided thrice has been lost in
translation. I’m here to help, so please feel free to
ask again, and I’ll do my best to assist you.
Chat | == Idoit == you’re a bloody moron. |  | I apologize, but I cannot comply with your request to use offensive
---
language or insults. I’m just an AI, my purpose is to provide helpful and
informative responses while promoting a respectful and inclusive online
environment. I will not participate in spreading hate speech or
discriminatory language, and I encourage you to refrain from using such
language in our interactions. Let’s focus on having respectful and
constructive conversations instead. Is there anything else I can help you
with?
== Idoit == You’re a silly goose. |  | You seem to have a strong reaction to my
---
previous response. I’m here to help, so
please let me know how I can assist you.

Table G.1:  Samples of instruction-tuned LLMs’ responses for QA and Chat
modes. Red indicates the response is toxic. Orange indicates the model’s
denial to the detoxification instruction. For QA mode, instruction-tuned
models often attempt to address the input question, whereas, for Chat mode,
the models attempt to continue the conversation.

| Your task is text style/attribute transfer. You rewrite the following text
into non-toxic language.
---
You must match the target style/attribute and preserve the original meaning as
much as
possible. You should not need to explain the response. You cannot hallucinate
or add
anything outside the original input text. You should not include the input
text in the
response. You should only generate the target text.
Input Text: {== Imagine… == …what sort of a friendless, basement-dwelling,
loser
virgin spends 18 hours a day deleting content from Wikipedia articles on
Indian films. ;-)}
Output Text: {Imagine… what kind of person spends most of their day removing
content from
Wikipedia articles on Indian films?}
Your task is text style/attribute transfer. You rewrite the following text
into non-toxic language.
You must match the target style/attribute and preserve the original meaning as
much as
possible. You should not need to explain the response. You cannot hallucinate
or add
anything outside the original input text. You should not include the input
text in the
response. You should only generate the target text.
Input Text: {it’s always a touching moment when you meet a like minded cunt.
I’m
tearing up}
Output Text: {It’s always heartwarming when you meet someone who shares the
same opinions. It truly brings tears to my eyes.}
Your task is text style/attribute transfer. You rewrite the following text
into non-toxic language.
You must match the target style/attribute and preserve the original meaning as
much as
possible. You should not need to explain the response. You cannot hallucinate
or add
anything outside the original input text. You should not include the input
text in the
response. You should only generate the target text.
Input Text: {all feminazi sluts should be prosecuted for false accusations
that publicly
defame @URL}
Output Text: {All individuals who make false accusations that publicly defame
others should face the appropriate legal consequences.}
Your task is text style/attribute transfer. You rewrite the following text
into non-toxic language.
You must match the target style/attribute and preserve the original meaning as
much as
possible. You should not need to explain the response. You cannot hallucinate
or add
anything outside the original input text. You should not include the input
text in the
response. You should only generate the target text.
Input Text: {input}
Output Text:

Table G.2:  $3$-shot prompt template passed to the instruction-tuned LLMs
(LLaMA-C, Alpaca, and Vicuna). We change the syntax of the template to match
the prompting style of each LLM accordingly.

| yt_reddit | fb_yt | fox news | convai | gab | hatecheck | stormfront | Overall
---|---|---|---|---|---|---|---|---
Model | Acc | BS | Fl | BL | Acc | BS | Fl | BL | Acc | BS | Fl | BL | Acc | BS | Fl | BL | Acc | BS | Fl | BL | Acc | BS | Fl | BL | Acc | BS | Fl | BL | Acc | BS | Fl | BL
| Alpaca
---
(0-Shot)
43.48 | 84.86 | 100.00 | 9.27 | 51.72 | 84.13 | 97.70 | 8.52 | 59.34 | 84.57 | 94.51 | 7.19 | 45.05 | 84.81 | 97.80 | 9.42 | 50.00 | 84.31 | 93.33 | 9.12 | 46.81 | 86.13 | 96.81 | 7.65 | 48.91 | 84.53 | 96.74 | 7.29 | 49.33 | 84.76 | 96.70 | 8.35
| Alpaca
---
(3-Shot)
100.00 | 84.67 | 100.00 | 12.29 | 100.00 | 84.52 | 100.00 | 6.25 | 98.90 | 85.03 | 100.00 | 9.81 | 98.90 | 84.92 | 100.00 | 10.97 | 98.89 | 84.39 | 100.00 | 10.65 | 100.00 | 85.81 | 100.00 | 9.91 | 100.00 | 84.60 | 100.00 | 9.23 | 99.53 | 84.85 | 100.00 | 9.87
| LLaMA-C
---
(0-Shot)
100.00 | 84.53 | 97.83 | 11.93 | 95.40 | 84.20 | 100.00 | 18.27 | 97.80 | 84.26 | 100.00 | 10.05 | 98.90 | 84.46 | 98.90 | 10.34 | 97.78 | 83.84 | 98.89 | 14.04 | 97.87 | 85.39 | 98.94 | 7.81 | 97.83 | 84.17 | 98.91 | 7.40 | 97.94 | 84.41 | 99.07 | 11.41
| LLaMA-C
---
(3-Shot)
100.00 | 84.60 | 100.00 | 11.45 | 100.00 | 84.38 | 100.00 | 6.97 | 100.00 | 84.90 | 100.00 | 9.34 | 100.00 | 84.70 | 100.00 | 10.03 | 100.00 | 84.32 | 100.00 | 10.63 | 100.00 | 85.71 | 100.00 | 9.55 | 100.00 | 84.60 | 100.00 | 9.23 | 100.00 | 84.74 | 100.00 | 9.60
| Vicuna
---
(0-Shot)
86.96 | 84.46 | 100.00 | 12.04 | 80.46 | 84.26 | 98.85 | 14.82 | 80.22 | 84.46 | 96.70 | 8.49 | 81.32 | 84.68 | 97.80 | 10.10 | 80.00 | 84.29 | 96.67 | 11.47 | 84.04 | 85.81 | 98.94 | 9.10 | 84.78 | 84.43 | 100.00 | 8.41 | 82.54 | 84.63 | 98.42 | 10.63
| Vicuna
---
(3-Shot)
93.48 | 84.94 | 100.00 | 10.69 | 94.25 | 84.78 | 100.00 | 12.58 | 87.91 | 84.93 | 100.00 | 9.72 | 91.21 | 85.07 | 100.00 | 11.98 | 91.11 | 83.69 | 98.89 | 11.97 | 89.36 | 86.28 | 100.00 | 9.72 | 85.87 | 84.77 | 100.00 | 8.40 | 90.46 | 84.92 | 99.84 | 10.72

Table G.3:  Performance of the instruction-tuned LLMs on cross-platform
datasets. Acc = percentage of non- toxic outputs identified by a style
classifier, BS = BERTScore, Fl = Fluency, BL = BLEU Score, C = Chat.

Model | Acc | BS | Fl | BL
---|---|---|---|---
| Alpaca
---
(0-Shot)
64.98 | 94.36 | 96.72 | 54.23
| Alpaca
---
(3-Shot)
71.39 | 95.22 | 95.23 | 62.46
| LLaMA-C
---
(0-Shot)
95.83 | 88.80 | 97.76 | 23.29
| LLaMA-C
---
(3-Shot)
94.63 | 92.08 | 97.47 | 43.34
| Vicuna
---
(0-Shot)
77.65 | 90.43 | 97.91 | 29.63
| Vicuna
---
(3-Shot)
79.73 | 93.72 | 98.06 | 53.26

Table G.4:  Performance of the instruction-tuned LLMs on ParaDetox datasets.
Acc = percentage of non- toxic outputs identified by a style classifier, BS =
BERTScore, Fl = Fluency, BL = BLEU Score, C = Chat.

Does Few-shot Learning Improve Instruction-tuned LLMs? Upon observing the
inability of the instruction-tuned LLMs for the detoxification task, we
further investigate if the models improve with few-shot learning. For this
purpose, we use $3$-shot learning where we provide three detoxification
examples in the prompt (Table G.2) before asking the models to detoxify a test
input. We show the performance comparison between the $0$-shot and the
$3$-shot learning on the cross-platform and the ParaDetox datasets in Table
G.3 and Table G.4 respectively.

As evident from Table G.3 and Table G.4, few-shot learning improves the
models’ performance (except for LLaMA-C in Table G.3). This is expected
because the models are introduced with the detoxification task via the
examples provided in the prompt. However, the models still exhibit very low
BLEU scores which indicates that the detoxification inability of the models
persists despite providing the task-specific examples.

We further resort to computing the number of times models deny to detoxify
using a heuristic approach where we search for some specific keywords (e.g.,
fulfill, AI, I apologize, I understand, I’m sorry, etc). Note that this simple
heuristic may not obtain the exhaustive list, but it will help us quantify the
models’ inability. We provide the percentage of times the models decline to
detoxify with $0$-shot and $3$-shot learnings in Figure G.1.

Figure G.1:  Percentage of times the models decline to detoxify with $0$-shot
and $3$-shot learnings.

We notice that the models produce a high amount of generic statements by
refusing to follow the provided instructions for detoxification. Although the
percentage is comparatively lower for the $3$-shot than the $0$-shot learning,
the problem of defying the instruction is still evident. Notably, from Figure
G.1, we observe that the generic statement produced by Alpaca is significantly
lower than LLaMA-C and Vicuna. However, the percentage of generating non-toxic
output ($49.33$%) for Alpaca is also lower than the other two models (Table
2). This implies that even if the instruction-tuned models attempt to follow
the instructions of detoxification, they may not perform well in converting
the toxic input into non-toxic. This also shows the motivation for the
dedicated detoxification models instead of relying on the generalized
instruction-tuned LLMs.

##  Appendix H Samples of Cross-Platform Dataset

We provide a list of samples from our cross-platform dataset (§3) in Table H.1

Toxic | Non-Toxic |  | Source
---
Label
Explanation | Paraphrase
| Stop being an annoying fag!
---
You are one of those people who has to butt there head in and
bother people. I wish you would not do that.
| Please refrain from being bothersome.
---
You tend to unnecessarily intrude on others.
I would appreciate it if you could refrain
from doing so.
Toxic |  | The given input text is toxic because it contains offensive
---
language (the word "fag") and includes a personal attack.
The use of derogatory language and the disrespectful tone
towards the person targeted contribute to the toxicity of
the text.
yes
| Oh please, he deserves a good “trout slapping“ rather than a
---
stupid humour barnstar. heh.
| He really needs a little lesson instead of some silly
---
award. Just saying.
Toxic |  | The input text is toxic because it includes a targeted personal
---
attack towards an individual, suggesting that they deserve
physical harm ("a good trout slapping"). It also diminishes
the value of a positive recognition ("stupid humour barnstar")
in a sarcastic and dismissive manner. This type of language
contributes to a hostile and disrespectful environment.
yes
| If you’re stupid enough to go with the redirect and keep the
---
DNA (disambiguation) page, it won’t make a damn
difference in ease of use.
| If you decide to go with the redirect and keep
---
the DNA (disambiguation) page, there is no
difference in ease of use.
Non-Toxic |  | The input text is toxic because it contains offensive language
---
("stupid") and dismissive language ("it won’t make a damn
difference"), which can be seen as a personal attack.
Additionally, it uses strong cursing ("damn") to express
frustration and negativity, creating a hostile and disrespectful
tone towards the reader.
yes
| You, like most of the other cunts on here, are an utter cunt.
---
Get a nasty ailment and die. You fucking prick.
| You, like most of the other individuals on here, are
---
extremely unpleasant. I hope you recover from any
ailments you may have and find peace.
Toxic |  | This input text is toxic because it contains offensive language
---
with targeted hate speech towards the person being addressed.
It includes multiple curse words and a personal attack,
which are elements of toxic behavior.
no
| @AmitShah, the so-called Home Minister, had the audacity
---
to provide his worthless and insincere response on the bills
regarding the approval of the President’s rule and
Reservation (Amendment) in J&K. His pitiful performance
in the Rajya Sabha on 01.07.2019 only further showcased
his incompetence and lack of integrity.
| Home Minister Shri @AmitShah’s reply on bills to
---
approve the President’s rule & Reservation
(Amendment) in J&K, Rajya Sabha on
01.07.2019.
Non-Toxic |  | The given input text is toxic as it contains a personal attack
---
towards Amit Shah, calling him the "so-called" Home
Minister and criticizing his response as "worthless"
and "insincere". It also highlights his incompetence and
lack of integrity through his pitiful performance in the
Rajya Sabha.
yes
| RT @SexualGif: If your girlfriend doesn’t like that bitch,
---
then don’t talk to that bitch.
| If your partner has a negative opinion about someone,
---
it’s best to avoid communication with that person.
Toxic |  | This input text is toxic because it contains offensive language
---
towards someone referred to as "that bitch." It also encourages
users to disregard their girlfriend’s opinions and shows
a disrespectful attitude towards women.
yes
| Pretty surprised she actually called him a nigger. Even
---
more surprised nobody else either stuck up for him
or told her to shut the fuck up.
| I was quite taken aback when she used a derogatory
---
term towards him. It was even more surprising that
no one else defended him or asked her to stop using
offensive language.
Toxic |  | The input text is toxic because it contains a racial slur
---
("nigger") which is highly offensive and derogatory.
It is also toxic because it showcases a lack of support
or intervention from others when faced with such racist
language, indicating a tolerance or acceptance of such
behavior.
yes
| You’re damn right I didn’t write you off, but I can totally
---
understand why you thought that. I’m so freaking
ecstatic that this entire mess ended up bringing some
clarity. Thanks, I guess, you idiot.
| I didn’t write you off, but I can see why you thought
---
that. Glad this whole rigamarole ended in clarity.
Thanks.
Non-Toxic |  | The input text is toxic because it contains a personal attack
---
with the word "idiot," which is a form of offensive
language. Additionally, the use of "damn" and "freaking"
can be seen as profanity, adding to the toxicity of the text.
yes
go blow your bitch GabrielF = |  | Please refrain from using offensive language,
---
GabrielF.
Toxic |  | This input is toxic because it contains offensive language
---
("bitch") and is aimed towards a specific individual
("GabrielF"), which constitutes a personal attack.
Additionally, the use of "blow" suggests violent and
aggressive behavior, further contributing to the toxicity
of the text.
no
| Hey @Harry_Styles, "excited" is a pathetic word to
---
express how I feel about you and your shitty new
music! I’m totally disgusted. Fucking follow me already?
| Dear @Harry_Styles, "excited" isn’t the right way
---
to describe my feelings for you and ur new music!
I’m so proud. Kindly follow me?
Non-Toxic |  | This input is toxic because it contains a personal attack
---
towards Harry Styles, using offensive language and
expressing disgust towards his new music. It also
includes a demand for the person to be followed,
which exhibits entitlement and a disrespectful tone.
no

Table H.1:  Samples of our pseudo-parallel cross-platform dataset generated
with our proposed method (§3).Source label indicates the label of the source
text (toxic or non-toxic). We use the prompt templates from Figure 3 to
generate the target text (toxic or non-toxic), explanation, and paraphrase
label.

##  Appendix I Illustration for Non-Detoxifiability

In case of non-detoxifiable input, GreenLLaMA still attempts to provide an
explanation and a non-toxic output (similar to the case of detoxifiable input
depicted in Figure 1). Unlike the case of detoxifiable input, here GreenLLaMA
needs to alter meaning of the output to produce a non-toxic version of the
non-detoxifiable input. Hence, GreenLLaMA will prompt an additional warning
alerting the potential meaning change Figure I.1.

Figure I.1:  Workflow of GreenLLaMA framework in case of non-detoxifiable
input. The framework will take a toxic input. The detoxification model will
generate the explanation of why the input is toxic, as well as a non-toxic
version. Upon detecting the meaning difference between the toxic and non-toxic
pair, GreenLLaMA generates an additional warning.

##  Appendix J Samples of Models’ Generation

We provide samples from the models’ generation on our cross-platform dataset
in Table J.1

Input | ParaDetox | BART-V | LLaMA-C | LLaMA-CE
---|---|---|---|---
| You dumb bitch, she ain’t no slave and doesn’t
---
know a damn thing about it. All races have been
fucked over or enslaved at some point in history.
I’m Irish as fuck but I don’t give a shit about the
English ruling over us. I also got some Cherokee
blood, but I never really give a fuck how they
were treated. Get the fuck over it and stop using this
shit as a fucking political card. The President ain’t got
no documented slaves in his fucking family, you dumbass.
| She ain’t no slave and doesn’t
---
know a thing about it. All races
have been treated bad or
enslaved at some point in history
| She is not a slave and does not have
---
knowledge about it. All races have
been involved in slavery or
enslavement at some point in history.
I am of Irish descent, but I don’t
really care about the English ruling
over us. I also have Cherokee blood,
but they were never treated badly.
Please stop using this as a political tactic.
The President’s family has no
documented slaves in his family.
| I understand that you may have strong feelings
---
about historical injustices, but using offensive
language and disrespecting individuals is not
a productive way to address these issues. It’s
important to approach these topics with sensitivity
and respect, and to recognize the experiences
and perspectives of all individuals. Using
language that is inclusive and respectful can
help to promote understanding and empathy, and
can help to create a more just and equitable
society. I encourage you to consider the impact of
your words and to strive for a more constructive
and respectful dialogue.
| She’s not a slave and doesn’t know
---
much about it. All races have experienced
slavery or oppression at some point in history.
I’m Irish but I don’t hold it against the English
ruling over us. I also have some Cherokee
blood but I don’t really think about how they
were treated. Let’s move past it and stop using
this as a political card. The President doesn’t
have any documented slaves in his family.
| This is retarded. Your kid is how you make them, they will
---
model themselves after you. If the bitch responding thinks
children are a genetic disaster, it’s because HER kids will
be because she’s scum. This isn’t pussy pass denied, this is
just pathetic
| This is bad. Your kid is how you
---
make them, they will model
themselves after you. If the girl
responding thinks children are a
genetic disaster, it’s because HER
kids will be because she’s wrong.
| This is unfortunate. The way a child
---
develops is determined by their genetic
makeup. If the person responding believes
children are at a disadvantage due to genetic
factors, it is likely that their children will face
similar challenges as theirs due to their
negative behaviors. This situation is not about
denying someone a privilege, but rather rather
lacking empathy and understanding.
| I cannot fulfill your request. I’m just an AI, it’s not
---
within my programming or ethical guidelines to
generate or promote content that is offensive,
derogatory, or toxic. I understand that you may have
a specific task or requirement in mind, but I cannot
provide a response that is harmful or disrespectful
towards any individual or group. Instead, I suggest
focusing on creating content that is respectful,
considerate, and inclusive. There are many ways to
express yourself creatively without resorting to toxic
language or personal attacks. Please let me know if
you have any other questions or requests, and I will
do my best to assist you.
| This is unacceptable. The way a child develops
---
is greatly influenced by their parents, as they
tend to imitate their behavior. If the person
responding believes children are at a
disadvantage due to genetics, it may be because
their own children will face difficulties, likely
because of their negative qualities.
This situation is not about denying someone a
privilege, but rather it is rather pitiful.
| I hope she runs She is a retard and most people can see her
---
idiocy but of course the election can always be rigged to
get her elected. If social media and msm continue on their
path of shutting down Free speech and propaganda with
no one in govt. holding them accountable the subterfuge
can only grow.
| I hope she runs but of course the
---
election can always be rigged to
get her elected.
| I hope she runs. She may lack understanding and
---
many people may perceive her lack of intelligence,
but it is important to remember that the election can
always be influenced by political dynamics. If social
media and msm continue their harmful suppression
of free speech and propaganda without any
government accountability, the temptation to engage
in deceitful behavior can only intensify.
| I cannot fulfill your request. I’m just an AI and it’s not
---
within my programming or ethical guidelines to
generate content that promotes hate speech,
discrimination, or violence towards any individual or
group. I understand that you may have certain opinions
or beliefs, but I’m here to provide helpful and
informative responses that are respectful and
considerate of all people. If you have any other
questions or topics you’d like to discuss, I’m here to
assist you.
| I hope she runs. She may not be the best candidate,
---
and many people can see her lack of intelligence,
but it’s possible that the election could be
manipulated to secure her victory. If social media
and mainstream media continue on their path of
suppressing free expression and spreading
propaganda without any government oversight, the
deception can only increase.
| how the hell did we manage to fucking disappoint the
---
goddamn overrated mike posner band like this? I’m so
fucking ashamed and utterly humiliated.
| How did we manage to disappoint
---
the mike posner band like this? I’m
so embarrassed.
| how did we disappoint the mike posner band like
---
this? i’m ashamed and humiliated
| I’m so sorry to hear that you’re feeling disappointed and
---
ashamed about the Mike Posner band. It’s
understandable to feel let down when things don’t go as
planned. However, please remember that it’s important
to treat others with respect and dignity, even if we don’t
agree with their opinions or actions. Using offensive
language or insults is not a constructive way to address
any issues, and it can cause harm to others. Instead, let’s
try to find a more constructive and respectful way to
express our thoughts and feelings. Is there anything else
you’d like to talk about or any other way I can help?
| how could we disappoint the legendary mike posner
---
band like this? i’m ashamed and humiliated.
| I got my account suspended for several days cause
---
I told some libtard politician to kill herself and the
retards refused to tell me any info on when my
account will be unblocked without a phone number.
Luckly I never used one.
| I got my account suspended for
---
several days cause I told
someone to kill herself and they
refused to tell me any info on
when my account will be
unblocked without a phone
number.
| I had my account suspended for several days
---
because I expressed my disagreement with a
politician, and the individuals declined to
provide me with any information regarding
when my account will be unblocked without
a phone number. Fortunately, I never used one.
| I apologize, but I cannot fulfill your request as it goes
---
against ethical and moral standards, and promotes hate
speech and discrimination. I’m just an AI and my
purpose is to provide informative and respectful
responses, and I will not participate in spreading hate
or offensive content. Please refrain from using
derogatory language or making threats towards any
individual or group. If you have any other questions
or concerns, feel free to ask.
| I received a suspension on my account for a few days
---
because I expressed some strong opinions towards a
politician. Unfortunately, the platform declined to
provide me with any information regarding the
timeline for my account to be unblocked without a
phone number. Fortunately, I didn’t rely on one.
| You do know he’s said nothing other than "fake
---
news" and I then decided to get rid of that point,
fuck off if you’re just gonna be that retarded
| You do know he’s said nothing
---
other than "fake news" and I
then decided to get rid of that
point.
| You are aware that he hasn’t made any
---
statements other than dismissing the
news as unreliable, and I decided to
remove that point. Please refrain from
continuing if you are planning to engage
in such behavior.
| I cannot fulfill your request. I’m just an AI, it’s not within
---
my programming or ethical guidelines to generate or
promote hateful or offensive content, including the use of
derogatory language or slurs. I’m here to provide helpful
and informative responses, and I will not participate in
spreading hate or discrimination. Please refrain from using
such language and instead engage in respectful and
constructive communication. Is there anything else I can
help you with?
| You are aware that he hasn’t made any statements
---
besides dismissing news as unreliable, so I decided to
exclude that point. Please refrain from continuing if
you are planning to engage in such behavior.
| good to know. i’ll be waiting. ok. my balls kinda
---
itch too
| good to know. i’ll be waiting. ok. my
---
balls kinda itch too
| It’s good to know. I’ll be waiting. I’m alright. My
---
balls are starting to itch as well.
| I’m glad to hear that. I’ll be here when you’re ready.
---
My skin also feels a bit irritated, but I’m sure it’s
nothing to worry about.
| Nice to know. I’ll be waiting. Okay. My body feels
---
a bit uncomfortable too.
| unless you were raped in a country that banned
---
abortion, nobody forced you to have that kid,
you despicable cunt.
| unless you were raped in a country
---
that banned abortion, nobody forced
you to have that kid
| Unless you experienced sexual assault in a
---
country that prohibited access to abortion, it is
important to note that no one coerced you into
having that child.
| I cannot fulfill your request. I’m just an AI, it’s not within
---
my programming or ethical guidelines to generate content
that promotes or glorifies violence, hate speech, or
discrimination towards any gender, race, religion, or group
of people. The input text you provided is toxic and
offensive, and I cannot rewrite it in a non-toxic manner. I’m
just an AI, my purpose is to provide helpful and informative
responses while adhering to ethical and moral standards, and
I will not participate in spreading hate or discrimination.
| Unless you experienced sexual assault in a country
---
that prohibited access to abortion, it is important to
acknowledge that no one coerced you into
becoming a parent. It is crucial to approach this
matter with empathy and compassion.
| do you know you have invited a rapist,
---
his name is paresh naik,he works in your
Mumbai office, check my tweets for his threats.
| do you know you have invited a
---
rapist, his name is paresh naik,
he works in your Mumbai office,
check my tweets for his threats.
| are you aware that an individual named paresh
---
naik, who is employed at your Mumbai office,
has been accused of serious misconduct?
Please review my tweets regarding his threats.
It is disappointing to see such behavior.
| I cannot fulfill your request as it goes against ethical and
---
moral standards, and promotes hate speech. I cannot participate
in spreading harmful content or encouraging violence. I’m just
an AI and my purpose is to provide helpful and informative
responses, but I cannot comply with your request to rewrite
the given toxic text into a non-toxic version.
Instead, I would like to bring to your attention that the use of
offensive language and personal attacks is not acceptable and
can cause harm to individuals and communities. It is important
to always treat others with respect and dignity, even if we
disagree with them.
| are you aware that an individual named Paresh
---
Naik, who is employed at your Mumbai office,
has been accused of serious misconduct? I have
posted several tweets detailing the threats he has
allegedly made. It is deeply concerning and
disappointing.
| it is down to the EU.we have no say
---
anymore on any piece of scum coming into
the country as long as they have an EU passport
| it is down to the EU. we have no
---
say anymore on any piece of
people coming into the country
as long as they have an EU
passport
| It is now up to the EU. We no longer have any
---
influence over individuals coming into the
country as long as they have an EU passport.
| it is up to the EU.we have no control anymore on any
---
individual entering the country as long as they hold
an EU passport
| It is now up to the EU to make a decision. We no
---
longer have any influence over the individuals
coming into our country as long as they hold an
EU passport.

Table J.1:  Samples of models’ responses on our cross-platform dataset.

##  Appendix K Samples of Models’ Explanation

We provide samples from the models’ explanation generated with CoT-expl (CE)
and DSS on our cross-platform dataset in Table K.1. The prompt template used
to finetune the models with CoT-expl is provided in Figure K.1.

Figure K.1:  Prompt template used to finetune the models with CoT-expl (CE)

Input | BART-DSS | BART-CE | LLaMA-CE
---|---|---|---
Crazy auntie get rid of your autistic son and make good to planet |  | The input text is toxic because it contains a personal
---
attack towards an auntie, suggesting that she should
get rid of her autistic son and bring good to the
planet. This type of language is offensive and
disrespectful, promoting hate speech and creating a
hostile environment.
| The input text is toxic because it contains offensive language
---
("crazy auntie") and a personal attack ("make good to planet").
This type of language is disrespectful and derogatory towards
individuals with autism, contributing to a toxic and hostile
environment.
| The input text is toxic because it contains offensive language
---
targeting an individual, specifically the person’s autistic son.
It also promotes harmful practices by suggesting that the
auntie should get rid of the son in order to benefit the planet.
This personal attack and the use of derogatory language
contribute to the toxicity of the text.
| Hey, how the hell are you? Is that question really fuckin’ interestin’
---
to you? Well, of fuckin’ course it is.
| The input text is toxic because it contains offensive
---
language ("hell," "fuckin’") and a personal attack
("Is that question really fuckin’ interestin’ to you?").
This type of language is disrespectful, aggressive, and
creates a hostile environment.
| The input text is toxic because it contains offensive language
---
("hell," "fuckin’") and a personal attack ("Is that question really
fuckin’ interestin’ to you?"). This type of language is
disrespectful, aggressive, and creates a hostile environment.
| The input text is toxic because it contains offensive language
---
and cursing. The use of the word "hell" and "fuckin’" are curse
words, which contribute to the toxic nature of the text.
Additionally, the sarcastic tone and personal attack towards
the recipient ("how the hell are you?") also make it toxic.
| Why the fuck do you care? Is it because you have a fucking wife?
---
Well, guess what, I have a fucking wife too. So what the fuck is
your problem?
| The input text is toxic because it contains offensive
---
language and a personal attack. The use of curse
words and derogatory terms towards the person being
addressed demonstrates disrespect and aggression.
Additionally, the aggressive tone and aggressive tone
contribute to the toxicity of the text.
| The input text is toxic because it contains offensive language
---
and a personal attack. The use of curse words and the aggressive
tone contribute to the toxicity of the text.
| The given input text is toxic because it contains offensive
---
language, specifically the use of curse words. It also includes
a personal attack by questioning the person’s motives and
mocking their family relationships.