reviews: 
Comments: This paper presents SASA (Self-disciplined Autoregressive Sampling), a controlled decoding method aimed at reducing toxicity in large language model (LLM) outputs without requiring external reward models or model retraining. The key insight is that LLMs' internal representations can capture and distinguish toxic from non-toxic content. SASA leverages these contextual representations to define linear subspaces that separate toxic from non-toxic language. During the token-by-token generation process, SASA dynamically monitors and adjusts the sampling strategy to steer the output away from toxicity, based on the "margin" from the toxic subspace.

The paper's contributions include:
- Introduction of the SASA method that utilizes the LLM's own contextual embeddings to identify and learn toxic versus non-toxic subspaces, thereby guiding the generation process to avoid toxic content during autoregressive sampling.
- Theoretical validation demonstrates that the proposed sampling strategy optimally balances two objectives: maximizing alignment with desired attributes (reducing toxicity) while preserving similarity to the original sampling distribution.
- Empirical evidence showcasing SASA's effectiveness across various model scales and types (base versus instruction-tuned), with competitive performance relative to state-of-the-art methods on benchmarks.
Strengths: - The paper introduces the SASA approach, which is different from traditional methods that rely on external reward models or model retraining to mitigate toxicity in large language models (LLMs). The originality lies in leveraging the LLM's own contextual embeddings to define toxic and non-toxic subspaces, which is an innovative use of the model's internal representations.

- The authors provide theoretical proof that their sampling strategy optimally balances the reduction of toxicity with maintaining the original sampling distribution. The experiments cover different model scales and types, and the results show that SASA achieves competitive performance compared to state-of-the-art methods.

- The paper is well-written and structured.

- SASA addresses a critical issue in the deployment of LLMs—mitigating toxicity without the need for extensive retraining or external models. By providing a lightweight solution, it has the potential to be adopted in various applications of LLMs.
Weaknesses: - While the paper states that SASA compromise coherence, a more detailed analysis of the trade-off between non-toxicity and coherence would improve transparency.

- One of the paper’s novel claims is that toxic and non-toxic subspaces can be characterized within the model's representations. However, it is unclear how stable or interpretable these subspaces are across different contexts. Including a deeper analysis or visualization of these subspaces, perhaps using Principal Component Analysis (PCA) or t-SNE on the learned subspaces, could provide valuable insights and clarify the method’s inner workings.

- The paper does not extensively address whether the toxic and non-toxic subspaces hold across different domains (e.g., social media, news, or technical content) or languages. Since language toxicity can vary significantly by domain and cultural context, a sensitivity analysis across diverse data sources would improve generalizability claims.

- Incorporating a user study or human evaluation to assess the perceived quality and acceptability of the generated text would add significant value. Human evaluators could provide insights into the nuances of toxicity that automated metrics might miss, thereby offering a more holistic assessment of SASA's effectiveness.


- While SASA is presented as lightweight, the paper does not provide a quantitative assessment of the computational overhead introduced by its decoding strategy. Given that many applications of LLMs are latency-sensitive, evaluating the inference speed or compute cost of SASA relative to standard autoregressive sampling could strengthen the paper's claims of efficiency.

- Even though Table 11 in the Appendix provides 4 failure case examples, the paper doesn't thoroughly analyze when and why SASA fails.
Recommendation: 6
Reviewer confidence: 4
Soundness/correctness: 2
Clarity: 2