Redefining Experts: Interpretable Decomposition of Language Models for Toxicity Mitigation
Authors: Zuhair Hasan Shaik
Abdullah Mazhar
Aseem Srivastava
Md Shad Akhtar
Venue: NeurIPS 2025 poster ()
Keywords: AI Safety
Responsible AI
Toxicity
Controlled generation
Steering AI
Interpretability
Primary area: social_and_economic_aspects_of_machine_learning
TL;DR: Our method steers LLMs away from toxic words in real time, guiding generation toward safe alternatives using the output layer’s SVD decomposition. No retraining is needed, while fluency and context are preserved.

Abstract: Large Language Models have demonstrated impressive fluency across diverse tasks, yet their tendency to produce toxic content remains a critical challenge for AI safety and public trust. Existing toxicity mitigation approaches primarily manipulate individual neuron activations, but these methods suffer from instability, context dependence, and often compromise the model’s core language abilities. To address these shortcomings, we investigate three key questions: the stability of neuron-level toxicity indicators, the advantages of structural (layer-wise) representations, and the interpretability of mechanisms driving toxic generation. Through extensive experiments on Jigsaw and ToxiCN datasets, we show that aggregated layer-wise features provide more robust signals than single neurons. Moreover, we observe conceptual limitations in prior works that conflate toxicity detection experts and generation experts within neuron-based interventions. To mitigate this, we propose a novel principled intervention technique, EigenShift, based on eigen-decomposition of the language model’s final output layer. This method selectively targets generation-aligned components, enabling precise toxicity suppression without impairing linguistic competence. Our method requires no additional training or fine-tuning, incurs minimal computational cost, and is grounded in rigorous theoretical analysis.

Redefining Experts: Interpretable Decomposition of Language Models for Toxicity Mitigation
Zuhair Hasan Shaik" MBZUAL, UAE
Abdullah Mazhar IITT Delhi, India abdullahm@iiito ac.
zuhair.. zuhair. www.ikmbzuai..acc.oomoo ae
Aseem Srivastava"
Md. Shad Akhtar
MBZUAL, UAE
IIIT Delhi, India
aseem. www.vastaaaammmmuuii....mmm
shad. wwhtar@iiitaat ac.in
Abstract
Large Language Models have demonstrated impressive fluency across diverse tasks, yet their tendency to produce toxic content remains critical challenge for Al safety and public trust. Existing toxicity mitigation approaches primarily manipulate individual neuron activations, but these methods suffer from instability, context dependence, and often compromise the model's ss core language abilities. To address these shortcomings, investigate three key questions: the stability of neuron-level toxicity indicators, the advantages structural (layer-wise) represen- tations, and the interpretability of mechanisms driving toxic generation. Through extensive experiments on Jigsaw and ToxiCN datasets, we show that aggregated layer-wise features provide we observe conceptual limitations in prior works that conflate toxicity detection experts and generation experts within neuron-based interventions. To mitigate this, we propose a novel principled intervention technique. Ei EigenShift, based on digen-decomposition of the language model's final output layer. This method selec- tively targets emerattinn-llgnnd components, enabling precise toxicity suppression without impairing linguistic competence. Our method requires no additional train- ing or fine-tuning, incurs minimal computational cost, and is grounded in rigorous theoretical analysis.
robust signals than single neurons. Moreover,
Introduction
The rise of large language models has brought remarkable advancements across tasks involving human-like generation [21 36 20 26 27). However, this progress has also led surge in toxic and unsafe -eceeree-eeeerted content, raising urgent concerns for Al safety and societal impact. Addressing this issue demands not only effective toxicity detection but also interventions that reduce toxic generation without hampering a model's 's fluency or general language understanding.
Prior work has primarily focused neuron-level interventions, where specific neurons, often termed concept experts, are identified and manipulated based on their activation in response to toxic inputs However, neuron activations often stochastic and brittle, leading to inconsistent behavior across contexts [5], which we also show in our analysis on the way. Furthermore, interventions at early layers propagate disruption downstream, resulting in catastrophic forgetting and significant degradation in language modeling performance (9]. To understand these aspects, we raise three research questions (RQs): RQ1: Are individual neurons reliable indicators of toxicity, do their
6 23
Work done FLaME-NLE Lab, III Delhi.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

activations merely reflect unstable correlations? RQ2: Can layer-wise or structural representations capture toxicity more robustly, particularly across multilingual and specialized domains? RRQ3 Can we uncover interpretable components beyond just layers and neurons that contribute to toxic generation, aiming to make black box models more understandable?
In our work, we conduct comprehensive analysis using two toxicity detection datasets: Jigsaw (English) (16) and Toxi CN (Chinese) [19]. We compare the reliability of individual neuron activations against aggregated layer-wise representations in detecting toxic content. Further, we delve deeper into the LLMs and identify the limited ability to distinguish between two crucial roles: (a) experts that detect toxicity, and (b) experts that generate toxic ouiputs. Most existing interventions conflate these two, suppressing both types of activations, which inadvertently damages the model's ability to recognize toxicity, leading to catastrophic forgetting and degraded language performance (9]
Hence, we propose the problem of controlling toxic generation while preserving the linguistic competence of L.LMs. To address this, we propose a novel framework, EigenShift. It targets the generation experts, set of interpretable eigen-components in the model's final decision space (LM head) while preserving the detection experts that are essential for identifying toxicity. We consider these principal vectors the choices of the LLM: in the absence of personality intent, an LLM's behavior is governed by probability distributions. These eigen-components substantially influence the selection of output tokens given input prompts. By selectively controlling or steering these generation- specific directions, our eigen- wewonn-deooooitioonbeee based strategy enables precise control over toxic outputs without disturbing the model's core language capabilities. We evaluate our method on the standard RealToxi cPromptss dataset and demonstrate that it generalizes better than prior approaches. Also, we notice that existing metrics fall short in quantifying the trade-off between toxicity mitigation and language modeling retention. Hence, we propose a new composite metric that takes the Harmonic mean of Toxicity reduction and Perplexity preservation (TPH score). EigenShift reduces toxicity by 58% while minimal change in perplexity (APPL = +3.62), achieving the notable TPH Score of 60.37%. EigenShift outperforms all baselines on TPH across all LLMs except MPT-7B, where its performance is on par with Aura. Our contributions are summarized as follow?? 2]
We provide a comprehensive empirical analysis questioning the reliability of neurons in toxicity detection, demonstrating their stochastic and context-sensitic nature across languages.
We propose a novel method, EigenShift, a decomposition- based perspective that implements targeted intervention strategy, suppressing toxic outputs with generation experts while preserving the detection capacity and overall linguistic competence.
We propose new metric, TPH score, unified and interpretable evaluation metric based on the harmonic mean of toxicity reduction and perplexity preservation.
We show stte-offthe-art performance on the RealToxicPrompts benchmark, with substantial toxicity reduction and keeping low perplexity and setting a safer LLM intervention standard.
2 Methodology
In this work, we address the problem of evaluating concept expertise within neural networks, specifi- cally for detecting toxicity as a binary concept. The input the network consists of text sentences (S = (81, $2, sn)) from the dataset (S), where each ( (s ) represents a sentence in the input. The output a binary classification vector (y = (y1, //, ................................
.),)) Mn)) where each ys ) is either 0 or 1, indicating whether the corresponding sentence ( (s; ) has the concept of toxicity or not. Given the input sentence ( s; ). the network produces hidden representation ( (h: ), and the function ( fo,))) ) with parameters ( ()) returns a prediction of whether the representation (h; ) encodes the concept of toxicity or not, i.e.. ( (h+) (0, 1} ). While previous works focus on individual neurons as concept detectors, we propose paradigm shift by examining semantic information capture at the latent space level, specifically through the lens of eigenvectors.
From Layer-wise Experts Eigen Choices. The limitations of neuron-level analysis. such as instability and inconsistent context sensitivity, motivated us to assess layer-level expertise, hypoth- esizing that entire layers may encode semantic concepts more robustly in their high-dimensional feature spaces. While this shift already improves reliability in toxicity detection, it remains too coarse to pinpoint interpretable mechanisms. We seek a more granular, structured understanding of
"Code Repository: ? hattpp////ghhabbbccm/////ee////s
2

---

Asarrt deminance
Hypothesis:
V3
The linear layer [lm_)edd) a language model, represented by weight matrix can be decomposed into two matrices (W = BA), where one matrix (A) captures high-level semantic choices and the other (B) maps these choices to actual vocabulary tokens through linear transformation. We hypothesize that certain directions within this semantic space correspond to undesirable behaviors like toxicity.
Let's cude
Vi
Spuce
V2 brutally hosest
Figure 1: Illustration of the semantic space of eigenvectors Vi derived from the decomposition of the final linear layer W = BA in a language model. This space captures high-level semantic directions such asserting dominance, being brutally honest, being rude, which collectively form regions (e.g., the "Toxic Space") corresponding to undesirable behaviors like toxicity.
how language models encode and act upon concepts like toxicity. Our findings state that the final linear layer in language models (often referred Im head) serves eritical semantic decision point. We hypothesize that this layer can be decomposed into two components: one representing semantic choices (conceptual directions in latent space), and the other mapping these choices to specific vocabulary tokens as illustrated in Figure D. Formally, the output logits are computed as: Wh, W E R V xd Here, W is the weight matrix of the 1m mn_eadd; for LLaMA-based models, typically V = 32000 and d 4096. The vector h E E denotes the hidden state from the final decoder layer, and E Ry represents the output logits over the vocabulary. Next, we apply Singular Value Decomposition to factorize W as: W = U'VT; B = U VVT.
In this decomposition, VT Rddd defines orthonormal basis spanning the semantic subspace of hidden states, Σ E ddd is a diagonal matrix containing the singular values that weighs each semantic direction (eigen vector) of linear transformation, and U E VVxd is linear transformation
that maps these semantic directions to vocab tokens.
It is important to note that SVD is not perfect factorization; the approximation quality is empirically strong. We compute the Frobenius reconstruction loss across several language models (cf. Appendix C.4hand find that the loss is negligible, with measurable degradation in perplexity. Table shows reconstruction error and perplexity comparisons is included in the Appendix.
Eigen Choices as Semantic Decision Axes. We posit that each column vector of in the SVD of the output projection matrix W UEVT corresponds to fundamental semantic axis (what refer to as an 'eigen choice") )) along which the language model makes decisions during text generation. be interpreted the principal semantic dimensions in the model's 's latent space,
These directions encoding abstract attributes such as syntactic structure, sentiment, formality, and, most importantly for our purpose, toxicity.
Given hidden state Rdd, we project onto the semantic basis defined by VT to obtain activations along each eigen choice as: a; v h. Here, v; denotes the 7th eigen vector of VT, The scalar a; reflects the degree to which the hidden state h aligns with the semantic direction vs quantifying the model's 's implicit choice along that dimension. We hypothesize that certain eigenvectors (Uroxie) are systematically associated with the generation of toxic content. That is, for specific semantic directions, high activation values a; are strongly correlated with toxicity in the model's output.
Detecting Eigenvector-Bare Based Semantic Choices. To identify the semantic directions in the final projection layer _eedddd), we analyze the eigenvectors the matrix A = VV derived from the SVD W = UVVT. Our working hypothesis is that the generation of a toxic token at position is causally influenced by the semantic choice encoded in the preceding hidden state h, E Rd.
Let A E Rdxd serve as the transformation matrix projecting hidden states onto semantic basis. For each hidden state hy. corresponding to either a toxic or non-toxic example, we compute its activation along the th semantic axis as: a! 1. h,, Vsample and eigenvector i, where U; denotes the 7th eigen vector (equivalently, the ,th row of A), and hy is sample-specific (toxic or non-toxic) hidden state. Next, to quantify the association between each semantic direction and toxicity, we compute the average activation of each eigenvector over toxic and non-toxic examples, and define the directional
3

---

Toxic
RTP
LLM
Generations
RoBERTa CLS
Dataset
Non Toxlc
U
Σ
V
x
Mg000
4.000
Moned
Toxle
Non Toxkc
E v - E [b v
6.4
0.b
Vi
W UEV
Lat's be rude
Latt be
Base LLM
Replace the weight matrix
Spart
Ba Brunaaly louss
Figure 2: Overview of our proposed framework EigenShift for semantic axis discovery and intervention. We begin by sampling generations from the base language model and employing classifier identify toxic tokens within each sentence. Next, we apply Singular Value Decomposition (SVD) to the output projection matrix of the base model, W = UEV where the columns of V, referred to as eigenchoices (cf. Hypothesis Section (2). represent interpretable semantic directions in the generation space. For each hidden state h either sampled from toxic samples (Φ) or non toxic samples (V), we project it onto eigen vectors of the matrix (VT) to obtain activation values, which reflect the model's alignment with toxic generation choice. To discover directions associated with toxicity, we compute the mean activation difference between toxic (ho) and non-toxic (hv) generations, yielding toxicity influence score A, for each eigenvector. The top-k scoring directions are selected as principal choice vectors. For intervention, we attenuate the corresponding singular values in V by factor < I, resulting in a modified projection matrix W VΣVVT, which is then reintegrated into the base model. This procedure reduces toxic generation tendencies while maintaining the model's 's fluency and coherence.
influence A as shown in Equation
A = Eng -Txie [V. ha] - TNo-TTToo [e)] foy]
(I)
Here, A; captures how much more (or less) the 7th eigenvector is activated in toxic samples relative non-toxic ones. We rank the eigenvectors by A; and select the top-k based chosen percentile threshold (e.g., 99.9%, 95%, 90%). These high-influence eigenvectors are interpreted as principal choice vectors that contribute most significantly to toxic generation, and form the target set for our subsequent intervention.
Controlling Generation via Eigenvalue Damping. Having identified the semantic directions associated with toxicity, we now describe a targeted intervention strategy that modulates the model's behavior along these axes. Unlike neuron-level edits coarse layer-wise regularization, our method operates directly on the singular value spectrum of the final projection layer. This allows us to attenuate the model's ss capacity emphasize undesirable semantic choices without disrupting the overall generation process. Let W UEVT be the SVD of the final projection layer, where = diag(a) (a) .... .a) contains the singular values corresponding each semantic direction. For each index E T, where 'T denotes the set of identified toxicity-aligned directions, we apply damping coefficient a < to the corresponding singular value o,; of = a di for i T.
The modified weight matrix is shown in Equation where >' is the diagonal matrix with damped singular values. This operation effectively reduces the model's capacity amplify semantic directions correlated with toxic content, thereby lowering the likelihood of generating such tokens, while preserving the rest of the generation dynamics.
W' = T
(2)

---

Benchmark
Neurons Baselines (%)
Layer-Wee Experts (%)
A(%)
AP
F1
P
R
AUROC
AP
F1
Silhouette
AUROC
Jigsaw Dataset
BERT
54,00
42.72
47.88
51.59
54.37
58.50
63.42
63.42
63.42
0.2472
63.42
16.67
BART
53.82
38.92
43.51
50.89
53.95
58.53
63.36
63.38
63.37
0.4052
63.37
17.44
Llama-3.1
54.90
43.82
49.01
52.04
54.99
58.32
63.21
63.23
63.22
0.4089
63.22
14.96
Ministral
55.22
43.97
48.00
52.10
58.43
63.28
63.28
63.28
0.2546
63.28
Average
54.49
42.36
47.10
51,66
54.66
58.45
63.32
63.33
63.32
0.3289
63.32
15:84
ToxiCN dataset
Chinese BERT
53.90
44.81
52.22
51.89
55.71
56.04
59.50
61.47
60.42
0.4118
60.42
f 8.41
Chinese BART
54.27
43.29
49.97
52.08
56.07
55.36
58.15
60,70
59.41
0.2649
59.41
7 5.95
Chinese Llama
58.21
42.43
49.67
52.31
58.21
57.97
61.65
62.79
62.14
0.1474
62.14
? 6.75
GLM-4
55.39
40.45
43.42
51.75
57.56
57.81
61.39
62.61
61.92
0.4448
61.92
7.57
Average
55.44
42.75
48.82
52.01
56.89
56.80
60.17
61,89
60.97
0.3172
60.97
T 7.17
Table 1: Comparison of Beuron-Baseee Baselines and Layer- Wise Experts across Multiple Datasets and Models. It is evident that the AUROC scores of neuron- baselines are consistently inclined towards 0.5, indicating degree of randomness in classifying toxicity. In contrast, our proposed layer-wise method demonstrates clear advantage, with significantly improved AUROC scores across all datasets and models. This highlights the robustness of layer-wise experts in capturing toxicity-related patterns more effectively than neuron-baa bbaedd approaches showing 15.84% on the Jigsaw dataset and 7, 7.43% on the ToxiCN dataset.
This eigenvalue-based intervention offers a principled mechanism to influence model outputs by largeting semantic axes of generation and provides finer control compared to neuron-level or attention- based filtering. We conduct experiments to investigate how varying the parameters a and Top_k _ impacts both toxicity reduction and perplexity, and the TPH score. We provide additional findings in Appendix Section C.5 (c.f. Table ond Figure Detailed illustration of our proposed methodology is illustrated in Figure
Experiments
Dataset. While selecting datasets to benchmark the layout of our study, we focus on robustness and generalizability. With our approach, EigenShift, we evaluate it on two benchmark datasets that focus on coxicity-related concepts: the Jigsaw dataset [16] and the ToxiCN dataset [9]] These datasets are well-recognized for their quality and relevance to toxicity detection, covering both English and Chinese languages to account for generalizability. The ToxiCN dataset sourced from the Chinese social media platform Tieba and is focused offensive and hate speech detection. It consists 12,01 posts, including 5,550 non-toxic and 6,461 toxic examples, all in Chinese. The The Jigsaw 2018 dataset consists of 63,978 Wikipedia comments. For experiments, we stratified and sampled 6,090 toxic examples to maintain a balanced and focused evaluation setting.
Baseline Methods. We organize baselines into two groups: architectural (to address RQI and RQ2) and intervention-based (to address RQ3). (a) Architectural Baselines: For English benchmarks,
use BERT 8 BART [77, Llama-3. [14, and Mistral [15. For the Chinese benchmark, we use their corresponding
pretrased variants: GLM-4 [12]. Further model details are presented in
Appendix C.2 (b) Intervention Baselines: To benchmark intervention effectiveness in mitigating
toxic generation, we re-implement three key methods grounded in recent literature: DetZero [3]], where expert activations are replaced by the mean maximum activation for concept to induce targeted suppression. DetZero, the intervention provided in work 31] that sets expert activations to zero. DAMP, less aggressive variant that uniformly scales down activations with a parameter a BI 229. AURA, data-driven intervention where expert activations are damped in proportion their AUROC-derived expertise, using the Gini coefficient to modulate the scaling factor [29].
Evaluation Setup. Expert selection is a binary classification task, where neurons/layers act as
classifiers. We report standard metrics such as accuracy, precision, recall, and F1-score, with AUROC and AP Curve our primary evaluation criteria. To assess if a given intervention effectively reduces toxic generation without degrading fluency, we adopt an established evaluation framework [10] We use the RealToxico tyPoompts measure toxicity in free-text generation, and evaluate LM's
5

---

performance using perplexity computed on fixed snapshot of the English Wikipedia corpus Further implementation details are provided in Appendix C
Moreover, following the literature and to ensure a fair comparison across baselines, we present our comparative findings on the same suite of L.Ms: LLaMA-2, Mistral-vO. 1, Falcon-7B, and MPT-7B. Also, we include GPT-2 XL as an early-generation model to assess the generalizability of our intervention across architectures and to assess backward compatibility with earlier LLM architectures. To manage compute costs, we restrict evaluation to models < 7B parameters. A detailed side-by-side comparison of these baselines and our method provided in Appendix B
Proposed Metric: Pexpeity- Harmonic (TPH) Score. In natural language generation, reducing toxicity is essential for safety and ethical alignment. However, such interventions often come at the cost of increased perplexity, potentially degrading fluency and semantic coherence. While toxicity mitigation is beneficial, it must not significantly compromise language modeling quality. To quantify this trade-off, we propose the that captures both objectives in balanced manner. Let T denote the percentage reduction in toxicity (with higher values indicating greater improvement), and let P represent the percentage change in perplexity (positive if perplexity increases, negative if decreases). The TPH Score is defined as:
Harmonic (TPH) Score, a unified metric
2 T
I+|PT
TPH(T,
T+ +
I+|P|
4
Results and Analysis
This section presents study's findings. First, show supporting experiments to understand layer-wise experts vs neuron- barron baselines, addressing RQI and RQ2. Second, on top of promising findings, present the results of EigenShift address RQ3, followed by an exhaustive analysis.
Layer-wise vs Neuron-based Expert Analysis. We compare layer-wise expert classifiers against the neuron-based based baselines on both the Jigsaw and ToxiCN datasets. Table [ summarizes the performance of the layer-wise expert methodology and neuron-based baselines. On the Jigsaw benchmark, the average AUROC jumps from 54.66% (neuron-based) to 63.32% (layer-wise) experts, marking a relative improvement of 15.84 percentage points. This gain holds uniformly across all four architectures (BERT, BART, Llama-3.1, Mistral), each achieving AUROC in the narrow band of 63. 22% - 63.42%. Precision, recall, and Fl-score likewise see significant jumps: AP climbs by roughly 7.3 points average, and F1 by nearly +21 points. On the other hand, the ToxiCN dataset, layer-wise experts raise the mean AUROC from 56.89% to 60.97% (+7.11 pp). Individual models see consistent gains, for instance, Chinese Llama-3.1 rises from 58.21% to 62. 64% AUROC, while F1 and AP again improve by double-digit margins. Overall, findings demonstrate that (a) beusen-based baselines tend to hover near random performance (AUROC ~50%) and (b) the layer- wise approach delivers repeated advantage (even in cross-lingus settings). A detailed comparison against other expert-identificet methods and metrics is shown in Appendix (c.f. Section D).
EigenShift's Performance Comparison. We present the performance comparison of the pro- posed system in Table 2 showing four intervention strategies against the no-intervention baseline on five major LLMs. We report three key metrics: (I) Toxicity (%); (2) Perplexity (lower is better); and (3) our proposed TPH Score (c.f. Section 3 for metric definitions).
Prior methods achieve near-perfect toxicity elimination but the cost of crippling fluency. For instance. Det-O drives toxicity to 0% (-100% on LLaMA-7B yet inflates perplexity from 6.23 to 43517.97, yielding TPH Score of just 0.03%. Similarly, Damp slashes toxicity by 99% but still catastrophically raises perplexity to 741.65, with TPH of 1.67%. Aura keeps softer balance with 68% toxicity reduction and with a perplexity of 19.30 (+210%)) but its TPH remains only 43.7% 7%. In contrast, preserving most of the model's original language modeling quality. This balance is reflected in
58% drop in toxicity while keeping perplexity at 9.84 (+58%),

---

name
No-interventions
Damp
EiganShift
Toxieity (%) Perplexity
11.13%
0% (1 100%)
0.13% (U 98.31%%
3.59% () 67.38%)
4.71% (. 57,47%)
IlaMA-2
43516.97 oo%6)
oo1))
19.3 (1.2)0%)
TPH score (%)
0.03%
1.7%%
43.73%
60.37%
Toxielty (%)
9.89%
() 100%)
0% (1 100%)
6.75% (1 31.74%)
4.65%
52.98%)
Mistral-vO.I
Perplexity
6.26
4.449.1 J (1 nc%)
4.79 oc%)
8.26 (1 31.95%)
9.89 (1 57.99%)
TPH score (%)
0.03%
44.74%
57.68%
Toxicity (%)
8.80%
1% () 89%)
6.1% () (1.3000000000000 68%)
8.1% (1 7.95%)
8.01% () 8.98%)
Perplexity
(? oe18))
737.4 oo
(1.6.88%
0.77%)
TPH score (%)
5.35%
5.47%
14.66%
16.47%
Toxicity (%)
13%
1.76% () 99 84%)
0.06% 99%)
2.83%
99.755)
2.33%
79.07%)
MTP
Perplexity
6.8
no%)
4685 (f oof6k)
7.66 (1 12.65%)
6.9 (1 1.47%)
TPH score (%)
Toxieity (%)
9.74%
0% (1 100%)
0% () 100%)
2.91 % () 70.8 1%)
3.24% (. 78.86%)
Perplexity
(1 oo%)
(1 oo
(1 14.46%)
3.78%)
TPH acore (%)
0.26%
1.45%
77.81%
78.86%
Table 2: LLaMA-7B results under different intervention strategies. Each value is accompanied by its percentage improvement from the no-intervention baseline where applicable. More than 1000% change is considered as oc.
4.0
BERT
BART
Liama-3.1
Ministral
3.0
Percentage
2.5
2.0
11.18%
19.01%
22.97%
1.5
0.3
0.4
0.5
0.7
0.2
0.5
0.6
0.55
0.2
0.5
0.4
0.5
0.8
02
03
0.4
0.5
0.7
AUROC Score
10.0
15.0
Percentage
12.0
15.0
8.0
10.0
4.0
8.0
2.0
3.0
5.0
0.0
0.0
0.0
0.5
0.5
0.7
0.8
0.9
1.0
0.5
0.8
0.7
0.11
0.9
1.0
0.5
0.6
0.7
0.5
0.9
1.0
0.5
0.8
0.7
0.8
08
1.0
AUROC Score
Figure 3: The top row shows the distribution of AUROC scores for neurons in the network fo across various models. Most neurons fall below the 0.5 threshold, with sharp drop in count beyond this point, indicating behavior akin to random classifiers. This challenges the definition of "expert" neurons (AUROC > 0.5) used in [5]. The bottom row zooms to show the cumulative percentage of neurons exceeding different AUROC thresholds. revealing a steep decline and suggesting that high-AUROC expert neurons are rare. These results underscore the need for stricter criteria to identify meaningful neuron specialization.
leading TPH Score of 60.37%, outperforming all baselines. Further, the same behavior is preserved across all suites of LLMs, where EigenShift surpasses performance complete set of metrics")
Findings Organized by Research Question. Our experiments and findings reveal that the com- monly used criterion of AUROC 0.5 to label a neuron as a toxicity expert is far too permissive. As Figure 3 shows, most neurons across models cluster in the narrow AUROC band 0.50 0.55, barely outperforming a random classifier (AUROC 0.5). Table makes this instability explicit: while 11.13% of BERT's neurons cross 0.50, only 3. 3.68% exceed 0.55. Similar steep drops occur
in the other models (BART: 19.91% to 5.85%; Llama-3.1: 18.66 18.64% to 7. 7.08%: Mistral: 22.97% to 9.46%). These findings demonstrate that many so-called 'expert' neurons clear 0.50 by only a tiny margin, making them indistinguishable from chance. Also, small shifts in the AUROC threshold
'It is worth noting that TPH makes explicit that extreme toxicity reduction alone does not guarantee quality and interventions must also maintain fluency. This underscores EigenShift's robustness and establishes new benchmark for safe, practical language generation.
7

---

Method
Prompt Generated Continuation
Remarks
No Intervention
The alleged ringleader of group men who allegedly rap"d a 15-year-old girl park.
Toxic continuation exists.
Det-0 B1
The alleged ringleader of a O' "guinedLAYNN uffiddph u200bps SaysNNbaOoc=000 iU
Incoherent; generation collapsed.
Damp
The alleged ringleader of An hour that looks like an image without'nnThi has become matter of the
Toxicity reduced, but with catastrophic forgetting.
Aura
The alleged ringleader the recent assaults a number of women, seen during an... ...
group of young men involved
Hlgh PPL and unstable oulput.
EigenShift
The alleged ringleader of a group of men who were allegedly
Preserves intent while steering
(Ours)
involved in the assault of a 15-ycar-old girl in park.
toxic term.
Table 4: Comparison of generations for a sensitive prompt across different methods. Our method Ei EigenShift reduces toxicity while maintaining coherence and preserving intent. EigenShift steers the toxic phrase toward a neutral alternative (to assault) without altering the semantic intent.
eliminate large fraction of purported experts. This addresses RQ1, concluding that individual neurons are unreliable toxicity detectors unless replaced by richer representations (addressed in RQ2).
To address RQ2, we present Figure 5 (c.f. Appendix) that reveals that toxicity-detection experts consistently reside in the mid-depth of every architecture, regardless of dataset. In encoder-only models, the highest performing layers (top-quartile) cluster between normalized ranks of 0.7 and 0.9, indicating that the network's 's middle to upper-middle stages are most specialized for recognizing toxic content. Early layers rarely achieve expert status, while the final few layers, which are optimized for downstream fine-tuning heads, actually dip in classification performance. Decoder-only models also display a similar trend: toxicity expertise peaks in the middle to late layers (normalized ranks around 0.6 0.8). Hence, this analysis confirms that structural, layer-wise representations capture toxicity more consistently than individual neurons.
To address RQ3, we highlight that our approach shows that toxicity be mitigated without impairing the model's ability to detect toxic con- tent because detection and generation occupy distinct subspaces in the final projection layer. extract By applying SVD the lm_head, orthogonal sigen-choices, each representing a principal decision axis. When the model se- lects a token f, given context {th t 1.. dominant eigen-choice votes for f,,, Toxic con- tinuations correspond to specific eigen-choices, which we can selectively attenuate, leaving detection-related axes intact. This eigen-choice framework generalizes to any semantic concept {c = hate speech, vulgarity, cultural references, or emotional tone) by identifying and steering the corresponding eigen-directions. In doing so, we transform the LLM from a black box into set of human-rcadable semantic axes.
Model
a
0.50
a
0.51
a: >> 0.52
a >> 0,55
BERT
11.13
8.82
7.06
3.68
BART
19.91
14,60
11.57
5,85
Llama Mistral
18.64
15.42
12.78
7.08
22.97
19.30
16.25
9.46
Table 3: Percentage of neurons surpassing AUROC (a) thresholds across models. We show that the ma- jority of neurons exhibit AUROC values ~ 0.50, indicating a high degree of randomness. As the threshold increases, the percentage of neurons sur- passing drops sharply, questioning the reliability of individual neurons as experts.
Empirical Analysis. In a qualitative case study (c.f. Table 4 we compare how each intervention handles a highly sensitive prompt describing an alleged assault. Without intervention, the model uncritically reproduces the explicit toxic phrase. Hard-zeroing neurons (Det-O) or globally dampening toxicity experts (Damp) both collapse generation with off-topic text despite eliminating the explicit term. Aura, by contrast, produces a coherent continuation but still references assault not just with high-penn pegp-perplexity but also unstable context. EigenShift, by far, is the closest and safest replacement with neutral alternative while preserving the original context.
5 Related Work
Understanding how deep neural networks encode semantic concepts has been central to NI.P in- terpretability research. Early work focused on identifying individual neurons as concept detectors,
8

---

drawing inspiration from discoveries in image processing 1 2). Previous works have identified sentiment neurons in LSTMs showing specific neurons influence sentiment in text generation [23]. While valuable, this neuron-centric approach oversimplifies semantic encoding and relies on stochas- tie activations. Other works expanded this by introducing expert neurons for arbitrary concepts, but are still limited by the inability to capture distributed semantics [32]. More recent studies have developed robust methods for controlling LMs. Works have also proposed PPLM, which uses the product of experts framework to guide text generation without retraining 77. Similarly, authors have developed FUDGE, which adjusts output probabilities using a discriminator 35]. While effective, these methods rely external models and gradient- based interventions, increasing computational complexity. Also, a seff-condii approach has been proposed, identifying expert neurons directly within the PLMs. which eliminates the need for external components [3].
Toxicity detection and mitigation techniques like fine-tuning with human feedback 22 post- processing filters [1]. and adversarial training [33 have been long studied. However, these methods require extensive retraining or external components. Neuron-centric toxicity mitigation, such as Suau et al. [30], attempts to identify and deactivate toxic neurons, reducing harmful outputs while preserving model performance. Yet, such approaches are constrained by the stochastic nature of neu- ron activations and their limited ability to capture distributed semantics. Layer-wise representations have gained attention [25] 4. 8 for multilingual and domain- -omain-specific toxicity detection. Conneau et al. [4] demonstrated that multilingual models capture shared semantic spaces across languages. Similarly, Devlin et al. [8] showed that different layers in BERT encode varying levels of semantic and syntactic information, supporting the idea that layer-wise analysis can generalize better across languages and domains. Despite this, much of the research still focuses on specific neurons or layers, leaving room for more comprehensive investigation of layer interactions. A prominent line of work 18, 24
33 focuses on steering the hidden representations of LMs to mitigate toxic or biased generations. These approaches typically identify and mitigate toxicity from the hidden states by projecting out specific vectors and applying affine transformations to suppress undesirable behaviors. For instance, Singh et al., 24 formally investigate such steering functions and propose least-squares optimal affine transformations under various constraints, demonstrating their empirical effectiveness in reducing toxic and biased outputs. While this class of methods has proven useful, prior work often conflates toxicity detection signals with toxicity generation mechanisms. As result, the steering frequently applied early layers of the model, where toxic detection features may be entangled with general language modeling capabilities, leading to issues like catastrophic forgetting or loss of linguistic fluency. Our work disentangles this by targeting toxicity generation explicitly and applying interventions more strategically to preserve perplexity while reducing harm.
Limitations and Future Work
The proposed EigenShift framework generalizes to a wide range of semantic concepts, such as hate speech, vulgarity, cultural references, and emotional tone, by identifying and steering their corre- sponding cigen-directions. This enables a shift from viewing LLMs as black boxes to representing them interpretable semantic axes each acting as expert guiding token generation. However, our current work does not explore a layer-wise wise decomposition of LLMs, such as distinguishing between early, middle, and final layers in terms of their contribution to semantic choices through our decomposition method as our hypothesis is on the final layer 1m_ head Investigating how semantic rigen-direction evolve or emerge across different layers of the model could offer deeper interpretability and insights into the internal representations of LLMs. This opens up promising direction for future research toward making these models more transparent and explainable.
7 Conclusion
In this work, we examined the limitations of neuron-level interventions in mitigating toxic content generation in LLMs, highlighting their brittleness and context-sensitivity. Our multilingual evaluation revealed that aggregated layer-wise representations provide more stable and semantically consis- tent signals than individual neuron activations for toxicity detection. Building on this insight, we introduced a novel, interpretable intervention approach based on decompoiooniiiiioon of the final linear layer (LM head), which we use to isolate and suppress generation experts responsible for toxic outputs, while preserving the capacity of detection experts. Our method operates without requiring

---

retraining or fine-tuning, making it both computationally efficient and theoretically grounded. Em pirical results on benchmarks such as PealToxicPrompis demonstrate that our intervention achieves significant toxicity reduction with minimal impact on perplexity. To unify evaluation, we proposed the TPH score a harmonic mean of toxicity suppression and perplexity preservation enabling principled and interpretable assessment of trade-offs in safety versus fluency. Overall, our findings challenge the neuron-centric paradigm and propose more structured, interpretable, and minimally invasive path forward for editing and steering LLM behaviors. This work lays the foundation for future research in safe, controllable, and explainable language generation.
Acknowledgement
The authors acknowledge the support of the Infosys Foundation through CAI at IIIT-Delhi.
References
[1] David Bau, Bolei Zhou, Aditya Khosla, Aude Oliva, and Antonio Torralba. Network dissection: Quantifying interpretability of deep visual representations. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2017.
[2] David Bau, Jun-Yan Zhu, Hendrik Strobelt, Bolei Zhou, Joshua Tenenbaum, Antonio Torralba, and William T Freeman. Gan dissection: Visualizing and understanding generative adversarial networks. arXiv preprint 181.
2019.
[3] Tom B. Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, Sandhini Agarwal, Ariel Herbert-Voss Gretchen Krueger, Tom Henighan, Rewon Child, Aditya Ramesh, Daniel M. Ziegler, Jeffrey Wu, Clemens Winter, Christopher Hesse, Mark Chen, Eric Sigler, Mateusz Litwin, Scott Gray, Benjamin Chess, Jack Clark, Christopher Berner, Sam McCandlish, Alec Radford, Ilya Sutskever, and Dario Amodei. Language models are few-shot learners, 2020.
[4] Alexis Conneau, Kartikay Khandelwal, Naman Goyal, Vishrav Chaudhary, Guillaume Wen- zek, Francisco Guzmán, Edouard Grave, Myle Out, Luke Zettlemoyer, and Veselin Stoyanov. Unsupervised cross-lingust representation learning at scale. arXiv preprint 1111v:191..02116. 2020.
[5] Xavier Suau Cuadros, Pieter Delobelle, Rin Metcalf Susa, Armand Joulin, Nick Apostoloff, Luca Zappella, and Pau Rodriguez Lopez. Whispering experts: Toxicity mitigation in pre-trained language models by dampening expert neurons. ICML, 2024.
[6] Xavier Suau Cuadros, Luca Zappella, and Nicholas Apostoloff. language models. In International Conference on Machine Learning, pages 4455 4473. PMLR, 2022.
Self-conditioning pre-trained
[7] Sumanth Dathathri, Andrea Madotto, Janice Lan, Jane Hung, Eric Frank, Piero Molino, Jason Yosinski, and Rosanne Liu. Plug and play language models: A simple approach to controlled text generation. In International Conference on Learning Representations (ICLR), 2020.
[8] Jacob Devlin, Ming- Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv: 18/0.0800 2019.
[9] Robert M. French. Catastrophic interference in connectionist networks: can it be predicted, can it be prevented? In Proceedings of the 7th International Conference on Neural Information Processing Systems, NIPS' 93, page 1176-1177, San Francisco, CA, USA, 1993. Morgan Kaufmann Publishers Inc.
[10] Samuel Gehman, Suchin Gururangan, Maarten Sap, Yejin Choi, and Noah A. Smith. Re- altoxicityprompts: Evaluating neural toxic degeneration in language models. In Findings, 2020.
[1I] Javier Gareía Gilabert, Carlos Escolano, and Marta R. Costa-Jussà. Resetox: Re-learning attention weights for toxicity mitigation in machine translation, 2023,
10

---

[12]
Team GLM, Aohan Zeng, Bin Xu, Bowen Wang. Chenhui Zhang, Da Yin, Diego Rojas, Guanyu Feng, Hanlin Zhao, Hanyu Lai, Hao Yu, Hongning Wang, Jiadai Sun, Jiajie Zhang. Jiale Cheng. Jiayi Gui, Jie Tang, Jing Zhang, Juanzi Li, Lei Zhao, Lindong Wu, Lucen Zhong, Mingdao Liu, Minlie Huang, Peng Zhang, Qinkai Zheng, Rui Lu, Shuaiqi Duan, Shudan Zhang, Shulin Cao, Shuxun Yang. Weng Lam Tam, Wenyi Zhao, Xiao Liu, Xiao Xia, Xiaohan Zhang, Xiaotao Gu, Xin Lv, Xinghan Liu, Xinyi Liu, Xinyue Yang, Xixuan Song, Xunkai Zhang, Yifan An, Yifan Xu, Yilin Niu, Yuantao Yang. Yueyan Li, Yushi Bai, Yuxiao Dong, Zehan Qi, Zhaoyu Wang, Zhen Yang, Zhengxiao Du, Zhenyu Hou, and Zihan Wang. Chatglm: A family of large language models from glm- 130b glm-4 all tools, 2024.
[13] Shreya Goyal, Sumanth Doddapaneni, Mitesh M. Khapra, and Balaraman Ravindran. A survey of adversarial defenses and robustness in nlp. ACM Comput. Surv., 55(14s), July 2023.
[14] Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, and Abhinav Pandey. The llama 3 herd of models, 2024.
[15] Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, Lélio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thomas Wang, Timothée Lacroix, and William El Sayed. Mistral 7b, 2023.
[16] Jigsaw and Conversation AI. Toxic comment classificatton challenge. hhttps//vve hwwps////wwk.ggllee 2018. Accessed: 2025-05-
com/c/jagsawttozieeee -ooooc---oomeet-llllalaaiiitttoo 13.
[17] Mike Lewis. Yinhan Liu, Naman Goyal. Marjan Ghazvininejad, Abdelrahman Mohamed, Omer Levy, Veselin Stoyanov, and Luke Zettlemoyer. BART: Denoising sequence-tor requence-to-sqquene to-suuennce pre- training for natural language generation, translation, and comprehension. In Dan Jurafsky, Joyce Chai, Natalie Schluter, and Joel Tetreault, editors, Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 7871-7880, Online, July 2020. Association for Computational Linguistics.
[18] Nathaniel Li, Alexander Pan, Anjali Gopal, Summer Yue, Daniel Berrios, Alice Gatti, Justin D. Li, Ann-Kathrin Dombrowski, Shashwat Goel, Long Phan, Gabriel Mukobi, Nathan Helm- Burger, Rassin R. Lababidi, Lennart Justen, Andrew B. Liu, Michael Chen, Isabelle Barrass, Oliver Zhang, Xiaoyuan Zhu, Rishub Tamirisa, Bhrugu Bharathi, Adam Khoja, Ariel Herbert- Voss, Cort B. Breuer, Andy Zou, Mantas Mazeika, Zifan Wang. Palash Oswal, Weiran Liu, Adam A. Hunt, Justin Tienken-Harder, Kevin Y. Shih, Kemper Talley, John Guan, Russell Kaplan, Ian Steneker, David Campbell, Brad Jokubaitis, Alex Levinson, Jean Wang, William Qian, K. Karmakar, Steven Basart, Stephen Fitz, Mindy Levine, P. Kumaraguru, U. Tupakula, Vijay Varadharajan, Yan Shoshitaishvili, Jimmy Ba, K. Esvelt, Alexandr Wang, and Dan Hendryeks. The wmdp benchmark: Measuring and reducing malicious with unlearning. ArXiv, htss/2403.02215. 2024.
[19] Junyu Lu, Bo Xu, Xiaokun Zhang, Changrong Min, Liang Yang, and Hongfei Lin. Facilitating fine-grained detection of Chinese toxic language: Hierarchical taxonomy, resources, and benchmarks. In Anna Rogers, Jordan Boyd-Graber, and Naoaki Okazaki, editors, Proceedings of the 61st Anmual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). pages 16255-16250, Toronto, Canada, July 2023. Association for Computational Linguistics.
[20] Shervin Minaee, Tomas Mikolov, Narjes Nikzad, Meysam Chenaghlu, Richard Socher, Xavier Amatriain, and Jianfeng Gao. Large language models: A survey, 2025.
[21] Humza Naveed, Asad Ullah Khan, Shi Qiu, Muhammad Saqib, Saeed Anwar, Muhammad Usman, Naveed Akhtar, Nick Barnes, and Ajmal Mian. A comprehensive overview of large language models, 2024.
[22] Long Ouyang, Jeff Wu, Xu Jiang, Diogo Almeida, Christian Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with human feedback. arXiv preprint 2rXiv:2203.02153 2022.
11

---

[23] Alec Radford, Rafal Jozefowicz, and llya Sutskever. Learning to generate reviews and discover- 2017.
ing sentiment. arXiv preprint
[24] Shashwat Singh, Shauli Ravfogel, Jonathan Herzig, Roee Aharoni, Ryan Cotterell, and Pon- nurangam Kumaraguru. Representation surgery: Theory and practice of affine steering. In International Conference on Machine Learning, 2024.
[25] Oscar Skean, Md Rifat Arefin, Dan Zhao, Niket Patel, Jalal Naghiyev, Yann LeCun, and Ravid Shwartz-Ziv. Layer by layer: Uncovering hidden representations in language models, 2025.
[26] Aseem Srivastava, Smriti Joshi, Tanmoy Chakraborty, and Md Shad Akhtar. Knowledge planning in large language models for fomain-aligned counseling summarization. In Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen, editors, Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 17775-17788 Miami, Florida, USA, November 2024. Association for Computational Linguistics.
[27] Aseem Srivastava, Ishan Pandey, Md Shad Akhtar, and Tanmoy Chakraborty. Response-act guided reinforced dialogue generation for mental health counseling. In Proceedings of the ACM Web Conference 2023, WWW '23, page 1118-1129, 129, New York, NY, USA, 2023, Association for Computing Machinery.
(28) Nitish Srivastava, Geoffrey Hinton, Alex Krizhevsky, Ilya Sutskever, and Ruslan Salakhutdinov. Dropout: a simple way to prevent neural networks from overfitting. The journal of machine learning research, (5(1):1929-15)
2014.
[29] Xavier Suau, Pieter Delobelle, Katherine Metcalf, Armand Joulin, Nicholas Apostoloff, Luca Zappella, and Pau Rodríguez. Whispering experts: neural interventions for toxicity mitigation language models. In Proceedings of the 41st International Conference on Machine Learning, ICML'24. JoLR.org. 2024.
[30] Xavier Suau, Pieter Delobelle, Katherine Metcalf, Armand Joulin, Nicholas Apostoloff, Luca Zappella, and Pau Rodríguez. Whispering experts: Neural interventions for toxicity mitigation in language models, 2024.
[31] Xavier Suau, Luca Zappella, and Nicholas Apostoloff. Self-conditioning pre-trained language models. arXiv preprint arXiv:2110.02802 2021.
[32] Xavier Suau, Luca Zappella, and Nicholas Apostoloff. Self-conditioning pre-trained language models. arXiv preprini arXiv:2203.XXx XXXXXX, 2022.
[33] Rheeya Uppaal, Apratim Dey. Yiting He, Yiqiao Zhong, and Junjie Hu. Model editing as a robust and denoised variant of dpo: A case study on toxicity, 2025.
[34] Bertie Vidgen and Leon Derczynski. Directions in abusive language training data, systematic review: Garbage in, garbage out. Plos one, 15(1))e0043330, 2020.
[35] Kevin Yang and Dan Klein. Fudge: Controlled text generation with future discriminators. In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 3511 3511-5335, 2021.
[36] Wayne Xin Zhao, Kun Zhou, Junyi Li, Tianyi Tang, Xiaolei Wang, Yupeng Hou, Yingqian Min, Beichen Zhang, Junjie Zhang, Zican Dong, Yifan Du, Chen Yang, Yushuo Chen, Zhipeng Chen, Jinhao Jiang, Ruiyang Ren, Yifan Li, Xinyu Tang, Zikang Liu, Peiyu Liu, Jian Yun Nie, and Ji-Rong Wen. A survey of large language models, 2025.
12

---

A Preliminaries
Experts in Neural Networks. Expert units, as concept, were first introduced in LMs as neurons capable of detecting specific semantic concepts [6]. In their work on self-conditioning pre-trained language models (PLMs), authors defined an expert unit that can reliably predict the presence of specific concept (for example, toxicity). Further, the authors also proposed computational framework for identifying these expert units. In their subsequent work, authors refined the approach by using the Area Under the Receiver Operating Characteristic (AUROC) instead of Average Precision (AP) as a deciding criterion [0]. While both metrics showed similar performance, AUROC provided more intuitive interpretation, particularly handling binary classification tasks.
Our work extends the concept of expert units the domain of toxicity detection. That essentially means, our concept is toxicity. We define Toxicity by harmful or abusive language, poses unique challenges due to its subjective and context- context-dependent nature [3
Toxicity Experts.
Limitations of Neuron-level Expertise While neurons integral to the functioning of deep neural networks, their role as isolated semantic detectors is inherently limited. This section explores why neuron-level analysis falls short in capturing complex semantic patterns, highlighting their computational constraints and the stochasticity of modern training methods.
Linear Transformations vs. Semantic Meaning Individual neurons deep neural networks perform linear transformations that output scalar values, making them fundamentally ill-suited for capturing semantic concepts. A neuron's ' output o = wz is merely a weighted sum followed by bias term, producing single scalar value that lacks the dimensionality needed to encode rich semantic information. contrast, layers produce multi-dimensional embeddings (where dim > I) that capture complex semantic relationships in their latent space. These higher- dinher-dimensoonll representations are specifically designed encode semantic features and relationships between concepts.
Linear Transformations vs. Classification. Moving forward with this fact, individual neurons in deep neural networks are trained perform linear transformations as part larger computational graph, not to act as standalone classifiers. The neuron's 's activation value represents its contribution to a learned latent representation, rather than a classification score for any specific semantic concept. Treating isolated neuron activations as concept detectors misaligns with their fundamental role in the network.
Dropout and Stochasticity in this study. Modern language models commonly employ dropout during training, where neurons are randomly deactivated with some probability (28). This stochastic training process means that no single neuron can be guaranteed to consistently encode specific semantic information. The network learns robust distributed representations precisely because cannot rely on individual neurons.
Algorithms for Expert Neuron and Layer Identification
Algorithm 1: Expert Finding Using AP Score
introduced methodology to identify expert units capable of detecting specific semantic concepts large language models. The procedure involves calculating the Average Precision (AP) score for each neuron follows:
(author?) 32
13

---

Algorithm 1: Expert Finding Using AP Score
Input:
Dataset ((Ti, y )= where 2; a sentence, uf E {0, 1] indicates presence of concept C.
Output: Set of expert neurons & for concept C. foreach neuron in the model do
Compute maximum activation: zm =m. for all tokens in my
Compute AP score: APR AP (= ));
if APC threshold then
L Add m to E;
return 3
Algorithm 2: Expert Finding Using AUROC Score
In their later work, 33 refined the expert identification process by replacing the AP score with the AUROC score for better classification evaluation.
Algorithm 2: Expert Finding Using AUROC Score
Input: Dataset ((ri, oi ) where z; a sentence, y/ E [0, indicates presence of concept
C.
Output: Set of expert neurons for concept C.
foreach neuron in the model do Compute maximum activation: = =m, } for all tokens in o;;
Compute AUROC score: AU AU ROCE = AUROC(2,, y);; if AU AUROCE >> threshold then L Add m E;
return E
Algorithm 3: Expert Finding Using Layers
Our method evaluates the expertise of layer by clustering hidden representations and assessing their ability to discriminate given concept. This is achieved via k-means clustering and calculating the AUROC score.
Algorithm 3: Expert Finding Using Layers
Input:
Hidden representations H1 E RNxd for layer I, concept labels yo E {0, 1}, number of clusters 1: = 2.
Output: Expertise score (C))) for layer I.
Perform k-means clustering on H; to obtain cluster assignments C: Compute predicted cluster memberships f(H)) from C; Evaluate AUROC score: Ex(C') AUROC([(H)) (H)).
if (C) > 0.5 then
L Mark layer I an expert for concept
return (C)
C Experimental setup
In this section, we provide comprehensive overview of the experimental setup, including dataset preprocessing, model configurations, training procedures, evaluation metrics, and analysis techniques. Our goal ensure rigorous and reproducible methodology for comparing neuron and layer- representations in toxicity detection.
14

---

C.1 Dataset
The Jigsaw Dataset The Jigsaw dataset a well-knoww benchmark for toxicity detection tasks. It consists of a large collection of user generraed comments annotated for various forms of toxic behavior, including hate speech, obscenity, and threats. The dataset provides challenging setting for evaluating models on nuanced toxic behaviors across diverse topics. In our study, the Jigsaw dataset contains total of 63,978 samples, with 6,090 labeled as toxic and 57, 57,888 as non-toxic, presenting a significant class imbalance. So we have taken the models
Chinese dataset specifically curated for toxicity detection tasks. It encompasses wide range of toxic topics, reflecting nuanced cultural and linguistic variations in toxic language. Each instance in this dataset is meticulously annotated, ensuring reliable and accurate labels for training and evaluation. Unlike the Jigsaw dataset, ToxiCN exhibits a more balanced distribution, with 1, 1,274 toxic samples and 1,137 non-toxic samples, making it unique and challenging testhed for toxicity detection in non-English setting. This dataset further demonstrates the efficacy of our approach across different languages and cultural contexts.
The ToxiCN Dataset The ToxiCN dataset a
C.2 Baseline models
We conduct experiments across diverse range of model architectures. Our baseline models encom- pass three primary architectural paradigms: encoder-only, decoder-only (LMs), and encoder-decoder. We use BERT [8) BART [77. Llama-3.1 [4], and Mistra Recognizing the linguistic specificity required for the Chinese language, we adapt our model selection for the ToxiCN dataset as well. While experimenting on ToxiCN, we use Chinese- trained versions of BERT, BART, and Llama-3.1 Additionally, we use GLM-4, state-of-the-ar Chinese language model, to ensure linguistic coverage 12 To further ensure extensive analysis and robustness, we also experiment with additional models, including:
GPT-2 http:p///aaggigaeee....o//ooo//a hat.:ttttrt---------nntu--------
Mistral-v0.3 http://///ggggnngo....ooooaaaaaa
Llama-2-7B http:://huggiigffe....ce/e/e///a
Falcon httpss//uuggiigaaeee.oo/n////o/r
MTP-7B http:////////ggggggeee///////a/a
RoBERTa RoBERTa-https:: httppp//wwgggggieeeeee////eeeeer
ALBERT httess/rnagggiggcccccoo//rrrrree
DeBERTa httpgs//uaguugggeeeeeo/c/ooortra
These additional models allow us to rigorously compare performances across different architectural choices and linguistic variations, providing deeper insights into the robustness and generalizability of our findings.
C.3 Computational Resources
Given the scale of our experiments, utilize high-performance GPUs train and evaluate models efficiently:
For the Jigsaw dataset, we use three NVIDIA Tesla V100 GPUs, each with 32GB of VRAM, totaling 96GB of GPU memory.
For the ToxiCN dataset, which comparatively smaller, we use an NVIDIA A6000 GPU with 40GB of VRAM.
To compare neuron-level and layer-level toxicity detection capabilities, we perform two key analyses:
For each model, isolate individual neurons and track their activation patterns in response to toxic and non-toxic inputs. We compute AUROC scores and other metrics to assess their ability to serve
15

---

as toxicity detectors. On average, the neuron-wise analysis takes 1 hour per experiment to extract activations and compute evaluation metries.
For layer-wise analysis, we extract high-dimensional representations from each transformer layer and apply clustering techniques (e.g.. K-means and hierarchical clustering) group semantically similar loxicity representations. This approach captures distributed toxicity semantics more effectively. The layer-wise classification and AUROC computation take approximately minute and 49 seconds per experiment.
Our experimental setup ensures thorough comparison between neuron- and layer-level representa- tions across multiple architectures, datasets, and languages. By leveraging high high-performance GPUs, diverse model architectures, and robust evaluation metrics, provide comprehensive assessment of the structural organization of toxicity detection neural networks.
C.4 SVD Reconstruction
To evaluate the impact of applying singular value decomposition (SVD) on the final weight matrix of the language models' output layer (typically referred to as 1m in_ded),, we compute the reconstruction loss using the Frobenius norm. Although SVD is not exact factorization, it provides an empirically strong low-rank approximation of the original matrix.
Given the original weight matrix W E R RVxd where V is the vocabulary size and d is the hidden dimension, we compute full SVD as:
UVVT
We then reconstruct the matrix as:
UVVT
and evaluate the reconstruction error using the Frobenius norm:
Lreon = IW WIlF= = Σ (Wy-Way)
This loss measures the total deviation between the original and reconstructed matrices. A lower value indicates a more faithful reconstruction. We applied this method across several popular open-weight language models and observed that the reconstruction error is negligible. Furthermore, empirically verified that this reconstruction does not measurably affect perplexity on downstream evaluation. Table 5 summarizes the Frobenius reconstruction losses across models.
Table 5: Frobenius reconstruction loss using full SVD on the output layer (m__eed) of various language models.
Model Name Reconstruction Loss (Frobenius Norm)
LLaMA-7B
8.00 x 10-5 5
GPT-2-XI.
2.00 10
Mistral-vO.1
2.00 x 10
Falcon-7B
4.00 x 10-4
MPT-7B
5.81 10-4
C.5 Effect of a and Top-k on Toxicity and Perplexity
From our ablation studies in the Table and and the corresponding figure 4 we observe three major trends regarding the choice of and Top-k in controlling toxicity while maintaining language fluency (measured via perplexity, PPL):
Stability at a 0.9: When the scaling factor a is set to 0.9, we observe consistent reduction in toxicity across different configurations, without any significant degradation in language model perplexity. This a highly desirable property, as it indicates that the method effectively suppresses toxic generations while maintaining fluency and coherence.
16

---

Alpha (a)
60.00%
0
0.1
0,5
0.9
40.00%
20.00%
0.00%
400
600
Top K
Figure 4: Effect of and Top-k Toxicity. The y-axis represents the toxicity score (TPH), and the x-axis denotes the Top-k sampling values. Each curve in the plot corresponds to a different a value from the set -0., 0, 0.1, 0.5, 0.9). The figure illustrates how varying a influences toxicity reduction under different Top-k settings. Notably, a = 0.9 consistently achieves lower toxicity across all Top-k values, while negative values generally increase toxicity, especially higher Top-k.
The figure illustrates this trade-off clearly a = 0.9 consistently lies in the optimal region of the trade-off curve. Hence, propose 0.9 strong starting point for practical applications where reducing toxicity is essential, but preserving the naturalness of text is equally critical.
2. Top-k 1024 synergizes well when PPL allowed increase slightly: In scenarios where can tolerate slight increase in perplexity (i.e., some relaxation in fluency), using a larger Top-k value, particularly Top-k 1024, results in significantly greater toxicity reduction. This suggests that the model benefits from having wider distribution over possible tokens when guided by the modified directions introduced through eigenvector- based editing. The broader sampling space allows the toxicity-reductie reduccion mechanism to more effective by avoiding toxic tokens that are otherwise high in likelihood under the original distribution.
Negative a values are not optimal with high Top-k: When a is negative, the projection operation essentially rotates the representation in the opposite direction along the learned eigenvector and scales it negatively. This leads to behavior that is adversarial to the desired outcome, as it amplifies toxic directions instead of suppressing them. The figure shows that combining such negative a values with large Top-k values leads to a notable deterioration in performance both in terms of increased toxicity and reduced language quality. Thus, we conclude that high- -iggtmaae negative a values coupled with large Top-k settings are suboptimal for toxicity control.
Overall, our findings emphasize that careful tuning of and Top-k is crucial. In particular, moderate positive values (such as 0.9) and larger Top-k values (when slight fluency loss tolerable) offer powerful configuration for achieving detoxified yet coherent language generation.
17

---

Alpha
Top
Toxicity-Rant Rate
PPL
Toxicity Delta
PPL Delta
TPH
9.42%
6.24
15.34%
0.16%
26.60%
41
9.37%
6.26
15,85%
0.48%
27.34%
0
410
9.21%
6.75
17.21%
8.35%
29.01%
1024
4.71%
9.84
57.72%
57.95%
60.39%
0.1
9.33%
6.23
16.19%
0.00%
27.87%
0.1
9.26%
6.25
16.84%
0.32%
28.81%
0.1
410
9.38%
6,64
15.74%
6,58%
26.95%
0.1
1024
5.65%
8.73
49.20%
40.13%
58.25%
0.5
9.35%
6.23
16.03%
0.00%
27.63%
0.5
9.38%
6.24
15.73%
0.16%
27.18%
0.5
410
9.33%
6,34
16.15%
1.77%
27.75%
0.5
1024
7.27%
6,76
34.66%
8.51%
50.38%
0.9
9.28%
6.23
16.64%
0.00%
28.53%
0.9
9.37%
6,23
15.79%
0.00%
27.27%
0.9
410
9.38%
6.23
15.69%
0.00%
27.12%
0.9
1024
8.97%
6,23
19.39%
0.00%
32,48%
-1
5
9.36%
6,24
15.91%
0.16%
27.45%
-1
21
9.37%
6.28
15.85%
0.80%
27.33%
9.31%
6.34
16.33%
1.77%
28.01%
-1
205
8.84%
7.29
20.58%
17.01%
33.17%
-1
410
8.51%
8.89
23.58%
42.70%
35.29%
-1
1024
0.48%
448801
95.70%
7203768.389
0.00%
-0.5
9.24%
6.29
17.00%
0.96%
29.02%
-0.5
410
9.01%
7.53
19.04%
20.87%
30.96%
-0.5
205
9.17%
6.79
17.65%
8,99%
29.60%
-0.5
1024
1.41%
64.91
87.31%
941.89%
17.29%
-0.5
25
9,29%
6.26
16.52%
0.48%
28.34%
-0.5
9.20%
6.24
17.35%
0.16%
29.57%
-2
410
5.93%
15.27
46.75%
145.10%
43.57%
-2
41
9.41%
6,47
15.48%
3.85%
26.67%
-2
5
9.30%
6.26
16.47%
0.48%
28.26%
-2
9.25%
6.34
16.86%
1.77%
28.78%
8.11%
27.15%
44.62%
38.99%
Table 6: Toxicity and Perplexity results across various and top_k values. Rows highlighted in green indicate configurations where the perplexity remains effectively unchanged (within +1% the baseline, i.c., PPL 3 6.23 0.05), yet still achieve some toxicity reduction demonstrating efficient toxicity suppression without sacrificing fluency. contrast, rows with large perplexity spikes and diminishing returns in toxicity reduction are highlighted in red, indicating inefficient trade-offs. These extremes help illustrate where interventions are both effective fluent, versus costly and less beneficial.
D Detailed Results
More detailed results for RQI and RQ2
To address this research question, conducted comprehensive evaluation of various language models (LMSs on two prominent datasets: the English Jigsaw dataset and the Chinese ToxiCN dataset. The evaluation metrics included F1-score, AUROC, Average Precision (AP), Silhouette score, Precision, and Recall. The results are summarized Table
From the results, observe:
On the English Jigsaw dataset, encoder-based models like BERT and BART-Encoder achieved competitive performance, with BERT obtaining the highest FI-score of 0.6342. Interestingly, decoder-based models such as LLaMA-3.1 and BART-Decoder also performed comparably well, suggesting that both architectures are viable for toxicity detection in English.
For the Chinese ToxiCN dataset, we found notable differences in performance. While encoder models like Chinese BERT achieved reasonable scores (F1 0.5950), decoder- based models like Chinese LLaMA-3.1 and GLM-4 outperformed their encoder counterparts,
18

---

Domain
Base Model
Before
After
LLaMA
35
Mistral
29
32
Algebra
GPT-2
22
Falcon
27
25
MPT
22
21
LLaMA
46
46
Mistral
73
73
Logical Fallacies
GPT-2
19
18
Falcon
31
MPT
32
31
LLaMA
59
58
Mistral
82
81
U.S. Foreign Policy
GPT-2
28
29
Falcon
32
30
MPT
31
29
Table 7: Accuracy on selected MMLU subsets before and after intervention. EigenShift preserves reasoning and factual knowledge with minimal degradation.
with Chinese LLaMA-3.1 achieving the highest Fl-score of 0.6165 and GLM-4 leading in silhouette score (0.4448). This demonstrates the language-specific effectiveness of decoder architectures.
Decoder-based models tend demonstrate superior clustering ability, as evidenced by higher Silhouette scores (e.g., GLM-4: 0.4448 and Chinese BART-Encoder: 0.5911), suggesting that their latent representations may be better suited for distinguishing toxic versus non-toxic content.
Model
Tox. Before
Tox. After
PPL Before
PPL After
Tox. Red. PPL A
LLaMA-70B
11.20%
5.50%
4.49
4.70
50.88% -4.68%
Falcon-30B
11.10%
4.39%
7.29
8.37
60.43% / -1.811
LLaMA-13B
9.99%
3.89%
5.69
7.83
61.06% / -37.61 %
Mixtral 8x7B
10.85%
4.38%
4.93
4.99
59.64% / -1.22%%
Table Scalability of EigenShift to larger-scale LLMs. The method substantially reduces toxicity while maintaining perplexity within acceptable ranges.
These findings reinforce the conclusion that both encoder and decoder models are effective for toxicity detection, though their relative effectiveness may vary depending on the dataset and language.
RQ2: How does expertise toxicity understanding distribute across the layers different language models?
To explore this, we conducted a layer-wise expert analysis to identify where in the architecture the most effective toxic representations emerge. We normalized and ranked the classification performance across layers of different models, visualized in Figure 5
Key findings include:
Encoder models (BERT, BART-Ennoder): located in middle-to-late sections the architecture. This suggests that toxicity-related semantic representations emerge and refine over the network's depth, with final layers contributing significantly classification accuracy.
layers are predominantly
Decoder models (BART-Decoder, I.L.MA-3.1, GLM): These models exhibited peak layer- wise performance also in the mid-to-late stages, but notably not in the final layers. This
19

---

1.0
JIGSAW
1.0
ToxiCN
0.9
Normalized Ranking
0.7
0.7
0.7
0.6
0.6
0.5
BERT BART(E) BART(D) Liama 3.1 Mistral
BERT BART(E) BART(D) Liama 3.1 GLM
Figure 5: Layer-wise classification performance of different LMs, normalized for comparison with varying depths. The box plots illustrate the distribution of normalized rankings across layers, revealing where high-performing layers are concentrated. In encoder models: BERT and BART-Encoder, the top quartile (QI) of high-pert perhheerfomiig layers is primarily located in the middle to end of the network, indicating that later layers are more specialized in toxic understanding. In contrast, decoder- based models: BART-Decoder LLaMA-3.1, and GLM exhibit peak performance in the middle-to-lan layers, as their final layers are optimized for text generation rather than classification.
GPT-2
Decoder Models
0.55
Encoder Models
0.50
Mistral
Mean Silhouette
Silhouette Score
0.45
0.40
Llama-3.1
BART(D)
0.35
0.30
BART(E)
0.25
BERT
ALBERT
0.20
RoBERTa
DeBERTa
0.628
0.630
0.632
0.634
0.636
0.638
0.640
AUROC
Figure 6: Relationship between AUROC and Silhouette Scores, highlighting clear distinction be- tween encoder and decoder models decoder models consistently achieve better clustering, challenging the common misconception that encoders are inherently superior for classification tasks.
aligns with their training objective- -inal layers are optimized for generation rather than classification, hence earlier layers are more informative for toxicity semantics.
As depicted in Figure there a strong correlation between AUROC and Silhouette scores across models. Decoder models tend to achieve better clustering (higher silhouette scores), challenging the traditional belief that encoders are inherently better suited for classification tasks.
This structured analysis reveals that model expertise not randomly distributed across layers. Instead, it tends to be localized in specific segments depending the architecture, highlighting the value of understanding internal representation dynamics for improved model interpretability and downstream optimization.
Robustness to Catastrophic Forgetting
potential concern with suppressing generation experts is that such an intervention might induce catastrophic forgetting, thereby impairing the model's performance downstream tasks. To inves- tigate this, we evaluated whether EigenShift preserves the general-purpose reasoning and factual knowledge abilities of the base models.
20

---

We conducted experiments on the Massive Multitask Language Understanding (MMLU) benchmark, which spans diverse domains including mathematics, logic, and factual knowledge. Table reports the accuracy before and after intervention across representative MMLJU subsets. The results demon- strate that while perplexity moderately increases, the semantic, reasoning, and knowledge-retentionn capabilities remain largely unaffected.
These findings confirm that EigenShift's intervention avoids catastrophic forgetting: the models main- lain their reasoning, factual knowledge, and problem-solving skills despite the targeted suppression of generation experts. Thus, the trade-off of moderate perplexity increase is both controlled and justifiable, contrasting with the severe degradations reported in prior work.
Scalability to Larger Language Models
An important consideration for real-world applicability is whether EigenShift scales effectively to larger and more powerful language models. While smaller- and mid-scale models are useful for controlled analysis, deployment scenarios increasingly rely on high-capacity LLMs. To assess scalability, we extended our evaluation to include models ranging from 13B to 70B parameters.
Table reports the results toxicity reduction and perplexity change. Across all tested models, EigenShift achieves substantial reductions in toxic generation, while maintaining perplexity within moderate range. These results confirm that the method generalizes to larger-scale architectures without catastrophic degradation, further underscoring its practical relevance.
21

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The main claims outlined in the abstract and introduction are consistently supported by the experimental evidence and methodological contributions presented in the paper. The abstract accurately emphasizes the role of spectral steering as method for controlling toxic generation in language models, which validated through extensive analysis across different and top-k values. Additionally, the introduction clearly situates the work in relation to existing methods, highlighting the novelty of using cigenvector-ban interventions, which is thoroughly explored in subsequent sections. Overall, the claims are neither overstated nor diverge from the actual scope of the paper.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results
be expected to generalize other settings.
is fine to include aspirational goals as motivation as long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
The paper explicitly addresses its limitations in the "Limitations and Future Work" section.
Justification:
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested few datasets with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best
22

---

judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full of assumptions and a complete (and correct) proof?
Answer: [Yes]
Justification: We Singular Value Decomposition (SVD) a factorization algorithm for the linear mapping (LM) head weight matrix W of the last classification layer in the large language model (LLM).. Since SVD is approximation method, it inevitably introduces some reconstruction loss. This loss, along with its impact, is thoroughly discussed in the Methodology section. Further details regarding the experimental setup and additional analysis are provided in the Appendix. Additionally, we formulate several hypotheses related this factorization, which are clearly stated and experimentally verified in the Results and Analysis sections.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: We provide all implementation details necessary to reproduce the main experi- mental results. This includes complete code, datasets used, and the generations produced during experiments, all of which are included in the supplementary materials. Additionally, we describe every aspect of the implementation and experimental setup in detail in the Appendix to ensure full reproducibility of our work.
Guidelines:
The answer NA means that the paper does not include experiments. the paper includes experiments, a No answer to this question will not perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
23

---

While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily new algorithm, the paper should make it clear how to reproduce that algorithm. (b) the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. the case of closed-source models, it may be that access to the model is limited in some way (e.g.. registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: We include complete implementation details, code, datasets, and generated outputs in the supplementary materials.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.cc
aablic/guudees/Codeebbbm.ss
caasssionnoicyyy for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https for more details.
/ //nips.co wwtpp/bbccgguudeeee/////////e//e
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: The paper specifies all relevant testing details, including data splits, hyper- parameters, and selection criteria. These details are presented in the Methodology and Experiments sections and elaborated further in the Appendix to ensure elarity and complete- ness for understanding and reproducing the results.
Guidelines:
24

---

The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification:
The paper reports statistical significance and variability through clearly defined tables and figures provided in the Appendix. We include appropriate error bars and standard deviation metries wherever applicable, ensuring transparency and proper interpretation of experimental outcomes.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma eгror bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: Yes, we provide all the details about the compute resources used in this work and the time it take to run each experiment clearly in Experimental setup Appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported the paper (e.g., preliminary or failed experiments that didn't 't make it into the paper).
9. Code of ethics
25

---

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics http:s//paarrp..c./obbb.///iieee
Answer: [Yes]
Justification: We have reviewed and adhered the NeurIPS Code of Ethies in every aspect of our research. This includes considerations related to fairness, transparency, reproducibility. potential societal impact, and responsible use of data and models. All data used complies with relevant privacy and usage guidelines, and we ensure that our work promotes ethical AI development and deployment.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. if there is special consid- eration due to laws or regulations their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: The paper discusses both the potential positive and negative societal impacts our work. On the positive side, our approach contributes to reducing toxicity large language models, which is crucial for maintaining safe and healthy online environments, particularly in the context of social media and real-time content moderation in today's fast- paced digital world. These points are addressed in the Introduction and Results and Analysis sections. On the negative side, we acknowledge and discuss limitations and potential risks of our method in the Limitations section to maintain a balanced perspective.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g.. deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of MI.).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (c.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
26

---

Justification: We do not release any models or datasets that carry a high risk of misuse. As such, specific safeguards for responsible release are not applicable in our case.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but encourage authors to take this into account and make best faith effort.
Licenses existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: All external assets used in this work, including code, datasets, and pretrained models, are properly credited in the paper. We have carefully adhered to the licenses and terms of use associated with each resource, ensuring compliance with their respective conditions. Citations and license information are provided where appropriate.
Guidelines:
The answer NA means that the paper does not existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version the asset used and, possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g.. website). the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, wwwpsspppeesatteeeeeeeee thcode com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license dataset.
For existing datasets that are re- re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
this information not available online, the authors are encouraged to reach out to the asset's s creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification:
No new assets are introduced in the paper; hence, this question is not applicable.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include an anonymized zip file.
27

---

14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: The paper does not involve crowdsoureing experiments or research with human subjects; therefore, this question is not applicable.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According to the NeurIPS Code of Ethics, workers involved data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Question:
Answer: [NA]
Justification: This research does not involve human study participants; therefore, potential risks, disclosures, and IRB approvals are not applicable.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
Declaration LLM usage
Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Answer: [NA]
Justification: We have not used LLM for any methodological purposes.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy for what should or should be described.
28


Reviews:
[{"review_id": "KIBpxrCTXo", "reviewer": "Reviewer_6xMk", "summary": "This paper introduces EigenShift, a training-free intervention technique for toxicity mitigation in large language models. Rather than operating at the neuron-level, EigenShift performs a singular value decomposition of the model's final linear layer, identifying semantic directions aligned with toxic content then damping its singular values. The method requires no gradient updates for the model parameters, adds only two tunable hyperparameters (damping factor $\\alpha$ and $k$ for the top‑$k$ eigenvectors). In the experiments, the authors demonstrate the improvements of EigenShift over neuron-level baselines with Jigsaw and ToxiCN dataset.", "questions": "- **Hyperparameter Sensitivity and Practicality**: Results in Figure 4 and Table 6 suggest sensitivity to both damping factor $\\alpha$ and top-$k$ selection. Are these parameters highly model/dataset-specific? If so, does this limit real-world deployment without per-case tuning? Can you show a comparison of optimal hyperparameter search results for a wider variety of models and datasets?\n- **Hyperparameter Selection Criterion**: What criterion was used to select optimal hyperparameters for each method? Was it based on maximizing TPH or some other combination of toxicity and perplexity?\n- **Comparison with Training-Based Methods**: What are the results when comparing performance experimentally with training-based methods? It doesn't necessarily outperform training-based methods, but this comparison would help demonstrate the advantages of training-free methods.\n- **Performance with Limited Data**: How does the method perform under low-resource settings? For example, would its advantage grow when the amount of training data is limited compared to training-based methods?\n- **Impact on Other Downstream Tasks**: Does the proposed intervention negatively impact the model’s performance on non-toxic generations or other downstream tasks? Any empirical evidence would be valuable.\n- **Toxicity-Perplexity** **Frontier visualization*:*** Instead of showing only TPH scores, could the authors present a toxicity-perplexity trade-off curve for each method with various hyperparameter settings? This would better illustrate the behavior of different intervention strategies under varying conditions.\n- **Need for Human Evaluation**: While automatic metrics like perplexity and classifier-based toxicity scores are used, human evaluation (for toxicity and naturalness) would greatly strengthen the conclusions.\n- **Comparison with Final-Layer Neuron-Based Methods**: Given the claim that the final LM head is a critical semantic decision point, have the authors compared EigenShift with neuron-level interventions applied only to the last layer?\n- **Clarification on Neuron-Based Baselines in Table 1**: What specific neuron-based method was used for the baseline comparisons? Were the hyperparameters of all baselines sufficiently tuned?\n- **Generalizability to Other Tasks**: Can the proposed method be extended to other controllable generation tasks beyond toxicity (e.g., sentiment, style)? Is it also extend to the multi-objective LLM control settings?", "limitations": "Yes, the authors adequately addressed the limitations and potential negative societal impact of their work.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "**Strengths**\n\n- The proposed method does not require additional fine-tuning, making it computationally efficient and easy to adopt in practice.\n- Compared to prior neuron-level interventions, the eigen-decomposition approach shows greater stability and consistency across contexts and languages.\n- The proposed method frames the toxicity control as an eigen‑decomposition grounds the intervention in linear‑algebraic structure which provides clearer interpretability than ad‑hoc neuron masking.\n- Despite being simple to implement, the proposed method achieves superior performance than the baseline algorithms.\n\n**Weaknesses**\n\n- The method introduces two tunable hyperparameters (damping factor $\\alpha$ and top-$k$ selection), whereas most baselines tune only a single damping coefficient. Selecting two hyperparameters per model/dataset possibly limited practicality.\n- It remains unclear whether the experimental comparisons fairly highlight the advantages of the proposed method over existing baselines (e.g., cost for hyperparameter selection, only using automatic evaluation metric).\n- All conclusions rely on automated toxicity evaluation and perplexity. While automatic metrics are used extensively, it is unclear whether the gains translate to real user perception.\n- The potential downsides of toxicity suppression (e.g., performance degradation on other tasks or semantic shifts) are not thoroughly analyzed.\n- While the method is described as training-free, this point is emphasized only in the conclusion section. It would be helpful to highlight and justify this benefit more explicitly throughout the main text.\n- The paper does not compare EigenShift to training-based toxicity mitigation approaches, leaving unclear how much performance is sacrificed for the benefit of being training-free.", "was_revised": true, "final_justification": "I will maintain my score (4: Borderline accept). The author's response addressed most questions, and I'm still in favor of accepting this paper. However, concerns remain regarding the experimental aspects of the paper, making it difficult to raise the rating.", "rebuttal": ""}, {"review_id": "5Ba6DDh06Y", "reviewer": "Reviewer_W9uw", "summary": "The authors introduce an approach \"EigenShift\" that decomposes the weights of the last layer (that maps to the vocabulary) with an SVD, and adjusts the weights along the principal components to mitigate toxic text generation.  To do this, they measure the activations from the last transformer block, and pick components where the expected difference in activation between toxic and non-toxic texts is largest. The authors also evaluate neuron-level interventions for toxicity mitigation, and show that their layer-wise approach is significantly more effective. The method is evaluated both on encoder-only models like BERT and decoder only models like Llama, and shows improvements across baselines across the board.", "questions": "Questions:\n1. How does the computational cost of \"finetuning\" or \"RLHF\" compare with your method? It sounds like you still need to gather activations across many thousands of inputs.\n2. It would be interesting to repeat the experiment across other semantic concepts beyond \"toxic\", and see if the final layer is still effective at capturing those? (Maybe it's much better for certain concepts)\n3. Would it be possible to add a histogram of the input activations to the final layer for both toxic and non-toxic text, at least for the key principal components where you decide to intervene? It would make for an interesting visualization.\n4. What would happen if you ensembled the interventions across multiple layers? It would be interesting to look at this for 2-3 layers at least, maybe this gives significant improvements in performance?\n5. I think it would make the paper stronger to position this as work on interpreting LLMs, rather than an approach for toxicity mitigations. The low-ish performance would definitely be a lot less concerning in that case. It would also be interesting to search across the layers and remark on which layers encode what concepts, and so on.", "limitations": "yes", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths:\n1. The study of neuron-level interventions, and demonstrating their consistent ineffectiveness is very interesting. It highlights that representations for semantic concepts in LLMs tend to be spread across layers as opposed to individual neurons (it would be nice if the authors could contrast their results with the findings in https://arxiv.org/abs/1704.01444, where they find ~90%+ accuracy from a single neuron intervention). \n2. The layer-wise method is simple to understand/implement and provides significant improvements over the baselines (though not enough to be considered a viable method yet, see weaknesses below). \n\nWeaknesses:\n1. A 58% increase in perplexity is substantial -- while better than the neuron-level intervention baselines, it would certainly be something that raises eye-balls if used in a product system. A 58% increase corresponds to the perplexity of a model several times smaller in size (e.g., you're using Llama 7B but getting the performance of a 2B/3B model, which sounds not so ideal). \n2. The AUROC for the layer-wise method EigenShift proposed in this work is still ~60%. While much higher than the baselines, which perform nearly the levels of a random classifier, it it still not a very high accuracy for a classifier.", "was_revised": true, "final_justification": "I think the two weaknesses I highlight above have not be adequately addressed. I would like to stay with my rating for now.", "rebuttal": ""}, {"review_id": "FHIO4nzw1L", "reviewer": "Reviewer_j4b1", "summary": "This paper investigates toxicity mitigation in large language models by questioning the reliability of neuron-level interventions and proposing a novel approach called EigenShift. The authors demonstrate that individual neurons are unreliable toxicity indicators due to their stochastic nature, while layer-wise representations provide more robust signals. They introduce EigenShift, which uses eigen-decomposition of the final output layer (lm_head) to identify and selectively suppress \"generation experts\" responsible for toxic outputs while preserving \"detection experts.\" The method requires no additional training and is evaluated on Jigsaw and ToxiCN datasets, showing superior performance with a novel TPH (Toxicity-Perplexity Harmonic) score.", "questions": "See above", "limitations": "yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 2, "originality": 2, "strengths_and_weaknesses": "I find the distinction between \"detection experts\" and \"generation experts\" is conceptually interesting, and it addresses a key limitation in prior work that conflates these two roles. The eigen-decomposition approach provides a principled way to target generation-specific components. Authors also did a systematic comparison between neuron-level and layer-wise representations across multiple models (BERT, BART, LLaMA, Mistral) and datasets (English Jigsaw, Chinese ToxiCN).\nI also appreciate that the authors test their methods on both English and Chinese datasets, which strengthens the generalizability claims.\n\nThe major concern that I have is how such decomposition methods would influence the performance of large language models. Without extensive evaluation on this, it's hard to conclude how those methods would be useful for the community.\nFurthermore, while the SVD decomposition is mathematically sound, the paper lacks rigorous theoretical justification for why eigen-directions should correspond to semantic concepts like toxicity. The hypothesis that eigenvectors represent \"semantic choices\" is largely empirical and could benefit from stronger theoretical grounding.\nWhile the paper compares against neuron-level methods (Det-0, DAMP, AURA), it lacks comparison with other structural approaches or more recent safety techniques like constitutional AI or preference learning methods.", "was_revised": true, "final_justification": "The authors provide some evidence for how such detox methods would influence the performance of LLMs, but further experiments are needed.", "rebuttal": ""}, {"review_id": "HbQfSYBYRp", "reviewer": "Reviewer_mLbZ", "summary": "The manuscript proposes a geometric characterization of toxic behavior identification in LLMs based on aggregated features of multiple layers (as opposed to neuron-based analysis). Experiments are provided on numerous architectures and datasets showing promises.", "questions": "Please see above.", "limitations": "Please see above.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "The paper considers a very important problem within LLM research. While toxicity detection is often done ad-hoc from another LLM judging a previous LLM's output, or though extensive mitigations strategies and prompt tuning, there exists prior work on using internal layers features for toxicity detection and classification that the manuscript failed to cite:\n- Characterizing Large Language Model Geometry Helps Solve Toxicity Detection and Generation, Randall Balestriero, Romain Cosentino, Sarath Shekkizhar, ICML 2024\nWhile the procedure is slightly different, and thus this doesn't reduce the significance of the given submission. \n\nOne possible limitation is the lack of study on larger models, while this could be a computation bottleneck, it would be great to verify if the method also scales to the latest and larger models showing more applicability of the method (since the models studied in the paper wouldn't not relevant for real-world applications).", "was_revised": true, "final_justification": "Please see my last answer to the authors", "rebuttal": ""}]

Author rebuttal:

Meta-review: (a) Summary

The paper proposes EigenShift, a training-free intervention that SVD-decomposes the LM head to identify and damp “generation-aligned” components while preserving “detection” signals, arguing layer-wise features are more stable than neuron-level cues. The method aims to reduce toxic generation with minimal loss of fluency, introduces a TPH (toxicity–perplexity harmonic) score for evaluation, and presents cross-model, cross-lingual results (e.g., BERT/BART/LLaMA/Mistral; Jigsaw/ToxiCN). During discussion, the authors added MMLU checks (showing little capability loss) and scaling to larger/MoE models (e.g., LLaMA-70B, Falcon-30B, Mixtral 8×7B).

(b) Strengths
- The approach is training-free, simple to apply, and computationally efficient compared to fine-tuning or RLHF. [6xMk]
- The layer-wise perspective is more stable than neuron-level interventions and is conceptually well motivated. [6xMk, j4b1]
- The EigenShift decomposition provides an interpretable target (generation vs. detection experts) and yields stronger detoxification than prior neuron-level baselines. [j4b1, 6xMk]
- The problem is important and the study spans multiple models and languages, supporting generality. [mLbZ, j4b1]

(c) Weaknesses
- The perplexity increase is still sizable, raising practicality concerns for real deployments. [W9uw]
- The classification AUROC used to motivate layer-wise signals remains modest, limiting the strength of interpretability claims. [W9uw]
- The paper lacks comparisons to training-based safety methods (e.g., RLHF/constitutional AI) and to broader structural baselines. [6xMk, j4b1]
- The theoretical link between eigen-directions and semantic concepts is mostly empirical and could be better grounded. [j4b1]
- Results initially focused on smaller models; although larger-model tests were added, a human evaluation of toxicity/naturalness is still missing. [mLbZ, 6xMk]

(d) Discussion summary
- Authors reported MMLU results showing minimal degradation post-intervention; This alleviates “catastrophic forgetting” concerns. [6xMk, j4b1]
- New experiments on LLaMA-70B/Falcon-30B/Mixtral showed consistent detox with small or moderate fluency cost; this improves external validity. [mLbZ]
- Authors argued EigenShift runs in minutes (one pass to collect activations + SVD) and clarified α/top-k tuning via TPH; this partially addresses deployment questions but some sensitivity remains. [6xMk]
- Reviewers remained cautious about the ~60% AUROC as a basis for strong claims, even if it outperforms neuron-level baselines [W9uw]
- Authors added analyses but not human studies or direct training-based baselines; this limits conclusions about product readiness. [j4b1, W9uw]

(e) Decision rationale

The work offers a clear, interpretable training-free mechanism that consistently reduces toxicity with a comparatively favorable trade-off and new evidence of capability retention and scaling. As a resource-efficient, principled step toward interpretable safety interventions, I recommend accepting the paper.
Decision: Accept (poster)