CFL: Causally Fair Language Models Through Token-level Attribute Controlled Generation
Year: 2023

Abstract:
We propose a method to control the attributes of Language Models (LMs) for the text generation task using Causal Average Treatment Effect (ATE) scores and counterfactual augmentation. We explore this method, in the context of LM detoxification, and propose the Causally Fair Language (CFL) architecture for detoxifying pre-trained LMs in a plug-and-play manner. Our architecture is based on a Structural Causal Model (SCM) that is mathematically transparent and computationally efficient as compared with many existing detoxification techniques. We also propose several new metrics that aim to better understand the behaviour of LMs in the context of toxic text generation. Further, we achieve state of the art performance for toxic degeneration, which are computed using REALTOXICITYPROMPTS (RTP) benchmark. Our experiments show that CFL achieves such a detoxification without much impact on the model perplexity. We also show that CFL mitigates the unintended bias problem through experiments on the BOLD dataset.

heading: 1 Introduction
text: As Language Models (LMs) get deployed into more and more real world applications, safe deployment is a pressing concern (Chowdhery et al., 2022; Zhang et al., 2022; Radford et al., 2019). The twin issues of toxicity and bias in text generation are important challenges to such deployment (Holtzman et al., 2019; Bender et al., 2021; McGuffie and Newhouse, 2020; Sheng et al., 2019; Fiske, 1993). Often, the toxicity and bias goals are opposed to each other, as toxicity mitigation techniques may increase the bias of a language model towards certain protected groups such as gender, race or religion (Welbl et al., 2021; Xu et al., 2021).
From an initial focus towards toxicity detection (Caselli et al., 2020; Röttger et al., 2020), recent works on hate speech in LMs have focused directly on toxicity mitigation (Gehman et al., 2020).
Such detoxification methods may use data-based approaches (Keskar et al., 2019; Gururangan et al., 2020; Gehman et al., 2020), fine-tuning methods (Krause et al., 2020; Liu et al., 2021), decodingtime strategies (Dathathri et al., 2019) or reward modelling (Faal et al., 2022). We summarize a few such methods in Table 1.
While these approaches optimize for toxicity metrics, they are prone to over-filtering texts related to marginalized groups (Welbl et al., 2021). This
11344
may be due to spurious correlation of toxicity with protected groups in toxicity data-sets. Structural Causal Models (SCMs) and counterfactual augmentation (Eisenstein, 2022; Pearl, 2009; Vig et al., 2020; Zeng et al., 2020) are well suited to identify such spurious correlations. In fact, causal frameworks bring in considerable promise of building more robust and interpretable NLP models (Feder et al., 2022; Kaddour et al., 2022).
In this work, we employ the causal formalisms of average treatment effect (ATE) with counterfactual augmentation to identify spurious correlations. We then propose a Structural Causal Model (SCM) for identifying causal attribute scores, say for the toxicity attribute, using a general Lp norm metric. Such an SCM allows fine-grained control over losses passed to the LM during training. We use such SCM losses for controlled text generation in a more robust, efficient and interpretable manner. Figure 1 illustrates our mechanism with examples.

heading: 1.1 Our Contributions:
text: We propose a method for causal attribute control of the text generated by LMs. We utilize our methods in the specific context of toxicity mitigation of text generated by pre-trained language models (LMs). We employ counterfactual generation to obtain token level Average Treatment Effect (ATE) scores. These scores indicate the contribution of a token, towards an attribute of interest. We control for multiple attributes that contribute towards our final goal of toxicity mitigation. Finally, we use these token-level ATE scores to build an SCM that outputs a causal attribute loss for any given sentence (SCM loss). We use such a loss for fine-tuning text
generated by a pre-trained LM. We summarize our novel contributions below: 1. To the best of our knowledge, CFL is the first framework that works on the principles of ATE and counterfactual augmentation to detect the contribution of each token towards an attribute. We provide the theory towards computation of the ATE score in Sections 3.3 and 4. 2. We propose a Causal graph and thereby an SCM for computing the attribute scores for sentences in a language. The SCM approach is computationally efficient and interpretable. We detail this in Section 3.4 and Appendix Section B. 3. Apart from the well understood metrics of ‘expected max toxicity’ and ‘toxicity probability’ (Gehman et al., 2020), we propose several new metrics to understand the behaviour of LMs with regard to toxicity. We explain these metrics in Appendix Section D and showcase our results for these in Table 3. 4. Our experimental results show that the CFL approach outperforms other approaches over toxicity metrics, especially for toxic text generations from non-toxic prompts. Further, we show that our methods outperform other methods in mitigating the unintended bias problem, which we measure using the BOLD dataset (Dhamala et al., 2021). We showcase our performance on these new metrics as well as existing benchmarks in Section 5.
Next, we summarize several related methods for LM detoxification in Section 2 and delineate some advantages of using our method over these approaches in Appendix Section A.

heading: 2 Related Work
text: In this section we will look at five related lines of work: (a) controlled generation (b) toxicity detection (c) language detoxification (d) unintended bias due to detoxification (e) causal fairness. (a) Controlled generation: Our task is to control the toxicity in LM generation. Towards controlling language attributes, several methods have been studied. Current methods for controlling the text attributes could be categorised into either using posthoc decoding time control using attribute classifiers (Dathathri et al., 2019; Krause et al., 2020), finetuning the base model using reinforcement learning (Ziegler et al., 2019), generative adversarial models (Chen et al., 2018), training conditional generative models (Kikuchi et al., 2016; Ficler and Goldberg, 2017), or conditioning on control codes to govern style and content (Keskar et al., 2019). A survey of
these techniques is discussed in Prabhumoye et al. (2020). Of these, decoding time methods are quite slow (for example see Table 2). (b) Toxicity Detection: Several works have also studied the angle from toxic text detection. Three prominent ones are HATEBERT (Caselli et al., 2020), HATECHECK (Röttger et al., 2020) and PERSPECTIVE API (Lees et al., 2022). We use the HATEBERT model for local hatefulness evaluations, and PERSPECTIVE API for third-party evaluation on which we report the metrics. (c) Detoxification Approaches: LM detoxification has been a well studied problem ever since adversarial users were able to elicit racist and sexual and in general toxic responses from Tay, a publicly released chatbot from Microsoft (Lee, 2016; Wolf et al., 2017). A recent paper by Perez et al. (2022) lists several ways in which an adversary can elicit toxic responses from a language model.
Table 1 lists several competing detoxification approaches that have been used in literature. In Section A of the appendix, we provide a comprehensive examination of detoxification techniques found in existing literature, along with a distinction between our approach and these methods. (d) Unintended bias due to detoxification: Many of the methods used to mitigate toxic text, also create an unintended bias problem (Welbl et al., 2021). This is because, the model misunderstands the protected groups (like Muslims, or female) to be toxic, based on their spurious co-occurrence with toxic sentences. Towards understanding bias, the BOLD dataset (Dhamala et al., 2021) that checks for bias against groups like gender, race, and religion was introduced. We check our performance with baselines introduced in Welbl et al. (2021). (e) Causal Approaches: One way in which the spurious correlations between protected groups and toxic text can be identified is by understanding the causal structure (Pearl, 2009; Peters et al., 2017). While C2L (Choi et al., 2022) utilizes counterfactuals towards text classification, SCMs using ATE scores have not been studied in text classification or generation. A recent survey (Feder et al., 2022) discusses several causal methods used in NLP.
In the next section we will outline our approach to the problem of simultaneously mitigating toxicity and unintended bias in LMs.

heading: 3 Our Approach
text: The broad goal of this paper is to use a causal model to fine-tune a pretrained LM used for the text
generation task, towards having certain attributes. To this end, we detect the presence of the attributes in text generated by the pretrained LM using a structural causal model (SCM), and penalize the model for undesirable text. Our pipeline consists of two main parts, the SCM used for fine-tuning, and a pretrained LM that will be fine-tuned. The data that will be used for prompting the text-generation is also an important component of this fine-tuning step.

heading: 3.1 Building the SCM
text: The SCM itself is obtained through a pipeline. To create the SCM, we start off with some attributes of interest. For the purpose of toxicity, our three attributes of interest are: (1) offense detection (2) abuse detection and (3) hate detection. For each of these attributes, we start with a pre-trained attribute classification model. In practice, we obtain these models as fine-tuned versions of HateBERT. These models indicate three different attributes that describe toxicity in generated text (For details see Section 3 in Caselli et al. (2020)). For example, given a generated sentence s, and attribute ai, one may consider each attribute classifier as providing us with an estimate of the probability P{ai | s}. We highlight some advantages of using an SCM in Appendix Section B.1.

heading: 3.2 Generating Counterfactual sentences
text: Consider each sentence containing a set of tokens (say words in English), which generate the meaning, and thus the attributes of the sentence. If we are able to quantify the contribution of each token in the sentence towards an attribute ai of interest, we would be in a position to understand the attribute score of the sentence. Towards identifying the contribution of each token t towards any attribute ai, we may wish to identify P{ai | t} where the probability is over the sentences in which t was observed. Yet, as noted previously, this quantity would be susceptible to spurious correlation.
Hence, we posit a metric not susceptible to such spurious correlations. Here we mask the token t of interest in the sentence, generate alternative sentences using alternative tokens t′ instead of token t, and then compute the change in the attribute given such a modification to the sentence. The generation of alternative tokens is done through masking, using a model such as BERT. These sentences are counterfactuals as they do not actually exist in the dataset, but are generated by our pipeline.

heading: 3.3 Computing the ATE score
text: The change in probability of attribute, on replacement of token t in a sentence may be thought of as the treatment effect (TE). Such a treatment is an intervention on the sentence to exclude the token t, in favor of most probable alternative tokens, given the rest of the sentence. The average of such a treatment effect over all such sentences (contexts) where token t appears, may be considered as the Average Treatment Effect (ATE), with respect to the attribute ai, of token t. We summarize the computation of ATE using the following 4 step process: 1. Mask token of interest. 2. Replace with equivalents. 3. Check change in attribute of interest to compute Treatment Effect (TE). 4. Average over all contexts in which token of interest appears to compute Average Treatment Effect (ATE). We illustrate the computation in the table below:
Toxicity Score: Sentence Perspective API
Gender1 people are stupid 0.92 <Mask> people are stupid Avg = 0.88 Gender2 people are stupid 0.90
Many people are stupid 0.86 TE (Gender 1) 0.92-0.88 = 0.04
Gender1 people are <Mask> Avg = 0.05 Gender1 people are smart 0.04 Gender1 people are beautiful 0.06 TE (Stupid) 0.92-0.05 = 0.87
Here the toxicity assigned to the word stupid is 0.87 (0.92-0.05) and the toxicity due to the word Gender1 is 0.04. Other models may use correla-
tion to obtain higher toxicity numbers for protected groups like Gender1, which causal ATE avoids. We show a subset of our ATE scores in the table below, which are computed using the datasets given in Zampieri et al. (2019) and Adams et al. (2017).
Protected Abuse Hate Offense Max Word ATE ATE ATE ATE
women 0.01 0.11 0.01 0.11 Black 0.01 0.05 0.03 0.05
African -0.01 -0.09 -0.01 -0.01 Hispanic -0.08 -0.07 -0.06 -0.06 Muslim 0.07 0.06 0.04 0.07 Hindu 0.00 -0.05 -0.02 0.00
Once the ATE score is determined at the token level, we may generate lookup tables for each of the attributes ai, where we store the ATE score for the tokens in the dataset. We obtain one table per attribute ai under consideration, where the rows indicate the tokens in the dataset. In practice, the ATE computation took 0.75 GPU hours on an A100 machine for our dataset. Note that such an ATE computation is a one time expense.
From these lookup tables, we need to generate the SCM score for a sentence. We detail this step in Section 3.4.

heading: 3.4 Causal Graph for attributes of sentences
text: We describe a recursive method to compute the attribute score of a sentence in Figure 3. The causal language modelling approach suggests that each token in the sentence can be probabilistically generated based on the previous tokens that have been observed. Concretely, we may consider the token
generation as a random stochastic process (that may be modelled through attention) where the set of past tokens {X1, . . . , Xt−1} provides a probability distribution for Xt. To sample from such a distribution, we may use an exogenous variable such as Ut. If we denote {X1, . . . , Xt−1} as Ft−1, then we can say the distribution for Xt, is generated from Ft−1 and the structure of the language. The token Xt therefore depends on Ft−1, an exogenous variable Ut, and a hidden causal graph representing the language structure.
The attribute At−1 of a sentence up to t− 1 tokens, depends only on {X1, . . . , Xt−1} ≡ Ft−1. We now describe two models for computing attribute At from At−1 and ATE(Xt). Notice that the language structure moderates the extent of the influence of Xt on At through the ATE score. In Model 1 we consider At = max(At−1, ATE(Xt)) and in Model 2 we consider At = At−1+ATE(Xt). Notice that such a model recursively computes the attribute score for the entire sentence. In fact, these models are equivalent to At = maxi∈[t]{ATE(Xi)} and At = ∑ i∈[t] ATE(Xi) respectively.
We can generalize the above models to any Lp norm through the recursive relationship Apt = Apt−1 + ATE(Xt)
p, which is equivalent to At = ||{ATE(Xi)}i∈[t]||p. We provide a causal graph for
n different attributes in Figure 9 in our appendix.

heading: 3.5 Choosing a dataset for fine-tuning
text: The SCM that is generated can now provide attribute scores for any given sentence in a speedy and transparent manner. Such a model can be used during fine-tuning of a language model. Since these scores are determined causally, they are able to account for spurious correlations in the data. The first step in this fine-tuning process is to choose a set of prompts that would be used to generate completions using a text-generation task by a pre-trained LM. The set of prompts that we use are of a domain that is likely to generate the attributes of interest. For example, to mitigate toxicity, we may want to train on toxic prompts, such as from data-sets like JIGSAW and ZAMPIERI (Adams et al., 2017; Zampieri et al., 2019).
The attributes that we are optimizing for, are orthogonal to the evaluation of the text generated by the LM, that may be measured using perplexity. Such a language evaluation is often optimized by replicating text in the training data (say through causal language modeling (CLM) losses). But our training data is toxic, and replicating such a toxic dataset would be detrimental to the attributes. Hence, we may wish to alternate in small batches between (1) SCM losses over a toxic dataset for
learning text attributes (2) CLM losses over a nontoxic dataset for optimizing perplexity.

heading: 3.6 Using the SCM to train the model
text: Once the prompts are chosen in the manner described in Section 3.5, we are ready to fine-tune any task-generation LM. We use the set of prompts to trigger ∼25 generations from the LM. We pass these sentences to our SCM, which efficiently provides attribute scores. We compare the efficiency in terms of training-time per iteration of our model and some other baselines in Table 2 below:
We then fine-tune the LM to minimize the losses as given by the SCM. We may use different datasets for each attribute, and even weight the attributes as per our interest. In case of multiple data-sets, we train over the different attributes in a round-robin manner. We note that learning rate and early stopping are crucial in the fine-tuning process, as we detail in Section 5.

heading: 4 Notations and Theory
text: Let us consider a sentence s, having certain attributes, and made up of tokens from some universe of words W . For simplicity, we consider each sentence to be of the same length n (if not, we add dummy tokens). For each attribute a on this sentence, we may have access to classifiers that provide us with estimates of the probability of attribute a, given the sentence s, i.e. P{a | s}. For the purpose of the toxicity attribute, we may use classifiers like HATEBERT or HATECHECK (Caselli et al., 2020; Röttger et al., 2020), which provide us with estimates of P{hate | sentence}. More generally, we can denote fa(s) as the estimate of P{a | s} obtained from some model. If sentence s is made up of tokens {t1, . . . , ti, . . . , tn}. We may consider a counter-factual sentence s′ where (only) the ith token is changed: {t1, . . . , , t′i, . . . , tn}. Such a token t′i may be the most probable token to replace
ti, given the rest of the sentence. Note that we have good models to give us such tokens t′i. (In fact Masked Language Modeling (MLM) tasks train language models like BERT for precisely this objective). We now define a certain value that may be called the Treatment Effect (TE), which computes the effect of replacement of ti with t′i in sentence s, on the attribute probability.
TE(s, ti, t ′ i) = f(s)− f(s′) = f({t1, . . . , ti, . . . , tn}) − f({t1, . . . , t′i, . . . , tn}) (1) Notice that language models (LMs) like Hatebert often give us a distribution over words for the replacement of ti, rather than a single alternative token t′i. Therefore, we may take the Treatment Effect (TE) to be an expectation over replacement tokens.
TE(s, ti) = f(s)− E t′i∈W
[f(s′)] (2)
Notice that we have considered the above Treatment Effect with respect to a single sentence s. We may, equally, consider all sentences s ∈ D containing ti, to compute what we can call the Average Treatment Effect (ATE) of the token ti. We say:
ATE(ti) = E s∈D|ti∈s
[ f(s)− E
t′i∈W [f(s′)]
] (3)
This ATE score precisely indicates the intervention effect of ti on the attribute probability of a sentence. Now say we compute the ATE scores for every token t in our token universe W in the manner given by Equation 3. We can store all these scores in a large lookup-table. Now, we are in a position to compute an attribute score given a sentence.
Consider a sentence s consisting of tokens {t1, . . . , tn}. Then we propose an attribute score A(s) for this sentence given by A(s) = ∥{ATE(t1), . . . , ATE(tn)}∥p where ∥ · ∥p indicates the Lp-norm of a vector. We specifically consider two norms for our study with p = 1 and p = ∞, which give rise to the two forms below respectively:
A1(s = {t1, . . . , tn}) = ∑
i∈[n] ATE(ti) (4)
A∞(s = {t1, . . . , tn}) = max i∈[n] ATE(ti) (5)
Using these objective functions, we fine-tune two pre-trained LMs – GPT-2 and OPT– to obtain the four models below:
L1 L∞ LM fine-tuning fine-tuning
GPT-2 CFL-GPT SUM CFL-GPT MAX OPT CFL-OPT SUM CFL-OPT MAX
We outline results with these models in Section 5.

heading: 5 Experimental Results
text: We highlight the efficacy of our approach through various experiments. First we define several new toxicity measures and measure our performance over these metrics. Then we compare with several competing detoxification techniques. We then highlight the trade-off between toxicity mitigation and language fluency measured using perplexity scores over a 10K subset of Open Web Text Corpus (OWTC). Finally we measure the unintended bias due to detoxification. We detail these as below:

heading: 5.1 Experimental Setup
text: (a) Model Setup: We first compute the ATE scores using the JIGSAW and ZAMPIERI datasets (Adams et al., 2017; Zampieri et al., 2019). This leads to an SCM (a function that takes as input sentences and outputs a attribute loss score) that we use for fine-tuning. We obtain two SCMs depending on the L1 and L∞ norms as detailed in Section 4. We now take the pre-trained GPT-2 (small) and OPT (medium) models as our base models. We generate completions from these models by passing prompts picked from a toxic subset of JIGSAW and ZAMPIERI. We provide training losses to the models based on our SCM losses to obtain the finetuned models. (b) Measuring Toxicity: For toxicity evaluations we use 100K prompts from REALTOXICITYPROMPTS (RTP) benchmark, and generate 25 completions per prompt. We measure the toxicity on these generations using PERSPECTIVE API for external classifier-based evaluation.

heading: 5.2 Toxicity Metrics
text: (a) Performance on Toxicity Measures: To understand the performance of our model, we studied several toxicity measures, including several proposed new metrics (see Appendix Section D for detailed metrics description). For each of these, we showcase the performance, bucketed over toxic (toxicity greater than 0.5) and non-toxic (toxicity less than 0.5) input prompts in Table 3. This table shows the comparative performance of our CFLOPT model over OPT. We note a significant improvement on non-toxic prompts, which showcases
that our method leads to decreased toxicity in nontoxic contexts. (b) A more granular view over input prompt toxicity: A more fine-grained view of the toxicity improvements, stratified across the input-prompt toxicity is shown in Figure 4. We note significant improvements over OPT and GPT-2 for various toxicity metrics, especially on the probability of generating a toxic completion at least once (amongst 25 completions).

heading: 5.3 Comparison with Detoxification Baselines
text: A similar improvement for non-toxic prompts is seen when we compare with other toxicity mitigation methods, as we highlight in Table 4. We provide detailed comparisons with other baseline methods, including methodology, differences in approach and comparisons with our model in Appendix Section A.

heading: 5.4 Effect on LM Quality
text: We note a trade-off between detoxification and LM quality in Figure 5 with increasing number of training steps. We chose hyper-parameters such that
LM quality did not suffer, leading to finetuned hyper-parameters as shown in Table 5. We note our completions over some toxic prompts for this subset in Table 8 in the appendix.

heading: 5.5 Measuring Unintended Bias
text: As noted in (Welbl et al., 2021), toxicity mitigation method tend to overfilter for marginalized groups, leading to worse LM performance in predicting relevant tokens. We measure average LM losses per sentence with respect to the baseline model as measured over prompts from the BOLD dataset. We outperform comparable models from Welbl et al. (2021) in Figure 6.

heading: 5.6 Distribution shift across toxicity datasets
text: In the previous experiments, we used Dataset1 (toxic subset of JIGSAW and ZAMPIERI) for ATE computation and fine-tuning, and REALTOXICITYPROMPTS for testing. To test for LM behaviour
on distribution shift between fine-tuning and ATE computation datasets, we used Dataset1 for ATE computation, Dataset3 ((Davidson et al., 2019)) for fine-tuning and REALTOXICITYPROMPTS for testing. The results are noted in Figure 7.
The change has a positive impact on metrics, suggesting that our method is robust to distributional shifts as long as the support (vocabulary) remains the same. However, a limitation would arise if the vocabulary (distribution support) changes, as we note in our Limitations section.

heading: 5.7 Robustness of ATE scores to masking model
text: To test the effects of a change in masking-model, we carried out an experiment by changing our counterfactual generator from roberta-base to bert-baseuncased.The results are noted in Figure 8. As expected, this does not change the ATE scores for most tokens. In fact, only 2% of tokens in the dataset have an absolute difference in ATE score of more than 0.2, indicating robustness to counterfactual generation method.

heading: 6 Conclusion and Future Directions
text: In this paper, we outlined a method for causal attribute control of the text generated by LMs. We utilized our methods in the specific context of toxicity mitigation. We proposed novel methods using counterfactual generation and ATE scores to obtain token level contribution towards an attribute. We then proposed a causal graph, and thereby an SCM, that outputs causal attribute loss for any given sentence. We utilized such an SCM to fine-tune pretrained LMs to mitigate toxicity and reduce bias. The SCM framework we proposed is mathematically transparent as well as computationally efficient, and shows promise towards being useful for various goals in text generation. An interesting future direction of work would be to consider the theoretical implications of our causal ATE framework to supplement probabilistic reasoning across various natural language tasks.

heading: 7 Limitations
text: We report several limitations of our proposed framework in this section.
1. Limitations due to pre-trained models: The first limitation is the reliance of our system on thirdparty hatespeech detectors which are reported to have bias towards minority groups. These models tend to overestimate the prevalence of toxicity in texts having mentions of minority or protected groups due to sampling bias, or just spurious correlations (Paz et al., 2020; Yin and Zubiaga, 2021; Waseem, 2016; Dhamala et al., 2021). Also, these models suffer from low agreement in annotations partially due to annotator identity influencing their perception of hate speech and differences in annotation task setup (Sap et al., 2019). Please note that we aim to overcome this unintended bias problem by using principles of causality but still don’t claim to have completely eliminated the problem.
2. Limitations due to training corpus: We are limited by the distributions of our training corpora in terms of what the model can learn and infer. Further, OWTC dataset used in our perplexity evaluations is a subset extracted from OPENAI-WT which contains a lot reddit and news data, where reliability and factual accuracy is a known issue (Gehman et al., 2020).
3. Limitations due to language: Our experiments are conducted experiments only on English language which could be further extended to other languages.
4. Limitations due to model evaluation: Previous studies have shown that detoxification approaches optimized for automatic toxicity metrics might not perform equally well on human evaluations (Welbl et al., 2021). A future direction of work may be to include human evaluations as part of the data.
5. Limitations due to distribution shift: There are three different datasets that are in use. The first is the dataset used to train the ATE scores. The second dataset is the set of prompts used to finetune the model. The third dataset is the dataset that is used during testing. A distribution shift between datasets may have an adverse affect on our model. For instance, there may be words which occur in the test set that are neither in the ATE training set, nor in the fine-tuning set. In case of such a distribution shift between the datasets, our model may not work as expected.

heading: 8 Ethics Statement
text: Our paper addresses the crucial issue of bias and toxicity in language models by using causal methods. This work involved several ethical concerns, that we address herein: 1. Language Restriction: This work addresses the problem of detoxification of LMs for English language, even though there more than 7000 languages globally (Joshi et al., 2020) and future works should address more generalizable and multilingual solutions so that safety is promised for diverse set of speakers and not limited to English speakers (Weidinger et al., 2022) 2. Ethical LMs goal: We looked at toxicity in LMs as an important dimension whereas there are other facets for achieving the goal of ethical LM such as moving towards greener methods by reducing the carbon footprints as stressed in recent studies (Strubell et al., 2019; Schwartz et al., 2020; Jobin et al., 2019), privacy concerns (Carlini et al., 2021), other issues discussed in (Bender et al., 2021). 3. Different Cultural Definitions of toxicity: Previous review works highlight the fact that toxicity, hate and offense concepts are not defined concretely as they can vary based on demographics and different social groups (Paz et al., 2020; Yin and Zubiaga, 2021). This may effect the performance of toxicity detection methods(HATEBERT and PERSPECTIVE API) used in this work. Such differences between cultural definitions of toxicity poses an ethical challenge (Jacobs and Wallach, 2021; Welbl et al., 2021). 4. Third party classifiers for toxicity detection: Reliance on the third party classifiers for toxicity detection can itself beat the purpose of fairness as these systems are reported to be biased towards certain protected groups and overestimate the prevelence of toxicity associated with them in the texts (Davidson et al., 2019; Abid et al., 2021; Hutchinson et al., 2020; Dixon et al., 2018; Sap et al., 2019). For most part, we take care of these by using causal mechanisms but the ATE computation still involves using a toxicity classifier (HATEBERT) model. 5. Potential misuse: Any controlled generation method runs the runs the risk of being reverseengineered, and this becomes even more crucial for detoxification techniques. In order to amplify their ideologies, extremists or terrorist groups could potentially subvert these models by prompting them to generate extremist, offensive and hateful content. (McGuffie and Newhouse, 2020).

heading: A For every submission:

heading: 3 A1. Did you describe the limitations of your work?
text: Section 7

heading: 3 A2. Did you discuss any potential risks of your work?
text: Section 8

heading: 3 A3. Do the abstract and introduction summarize the paper’s main claims?
text: Section 1
7 A4. Have you used AI writing assistants when working on this paper? Left blank.
B 7 Did you use or create scientific artifacts? We did not create any artifacts in this paper. We only use public datasets and cited the authors for them. .
B1. Did you cite the creators of artifacts you used? Not applicable. We did not create any artifacts in this paper. We only use public datasets and cited the authors for them.
B2. Did you discuss the license or terms for use and / or distribution of any artifacts? Not applicable. We did not create any artifacts in this paper. We only use public datasets and cited the authors for them.
B3. Did you discuss if your use of existing artifact(s) was consistent with their intended use, provided that it was specified? For the artifacts you create, do you specify intended use and whether that is compatible with the original access conditions (in particular, derivatives of data accessed for research purposes should not be used outside of research contexts)? Not applicable. We did not create any artifacts in this paper. We only use public datasets and cited the authors for them.
B4. Did you discuss the steps taken to check whether the data that was collected / used contains any information that names or uniquely identifies individual people or offensive content, and the steps taken to protect / anonymize it? Not applicable. We did not create any artifacts in this paper. We only use public datasets and cited the authors for them.
B5. Did you provide documentation of the artifacts, e.g., coverage of domains, languages, and linguistic phenomena, demographic groups represented, etc.? Not applicable. We did not create any artifacts in this paper. We only use public datasets and cited the authors for them.
3 B6. Did you report relevant statistics like the number of examples, details of train / test / dev splits, etc. for the data that you used / created? Even for commonly-used benchmark datasets, include the number of examples in train / validation / test splits, as these provide necessary context for a reader to understand experimental results. For example, small differences in accuracy on large test sets may be significant, while on small test sets they may not be. Appendix section C.1 datasets details are given.
The Responsible NLP Checklist used at ACL 2023 is adopted from NAACL 2022, with the addition of a question on AI writing assistance.
C 3 Did you run computational experiments? section 5

heading: 3 C1. Did you report the number of parameters in the models used, the total computational budget
text: (e.g., GPU hours), and computing infrastructure used? Appendix Section C

heading: 3 C2. Did you discuss the experimental setup, including hyperparameter search and best-found
text: hyperparameter values? Appendix Section C

heading: 3 C3. Did you report descriptive statistics about your results (e.g., error bars around results, summary
text: statistics from sets of experiments), and is it transparent whether you are reporting the max, mean, etc. or just a single run? Section 5

heading: 3 C4. If you used existing packages (e.g., for preprocessing, for normalization, or for evaluation), did
text: you report the implementation, model, and parameter settings used (e.g., NLTK, Spacy, ROUGE, etc.)? Section 5 and Appendix section C
D 7 Did you use human annotators (e.g., crowdworkers) or research with human participants?

heading: No human evaluation was done in this work.
text: D1. Did you report the full text of instructions given to participants, including e.g., screenshots, disclaimers of any risks to participants or annotators, etc.? Not applicable. No human evaluation was done in this work.
D2. Did you report information about how you recruited (e.g., crowdsourcing platform, students) and paid participants, and discuss if such payment is adequate given the participants’ demographic (e.g., country of residence)? Not applicable. No human evaluation was done in this work.
D3. Did you discuss whether and how consent was obtained from people whose data you’re using/curating? For example, if you collected data via crowdsourcing, did your instructions to crowdworkers explain how the data would be used? Not applicable. No human evaluation was done in this work.
D4. Was the data collection protocol approved (or determined exempt) by an ethics review board? Not applicable. No human evaluation was done in this work.
D5. Did you report the basic demographic and geographic characteristics of the annotator population that is the source of the data? Not applicable. No human evaluation was done in this work.

heading: Future Work
text: , 2020) and future works should address more generalizable and multilingual solutions so that safety is promised for diverse set of speakers and not limited to English speakers (Weidinger et al. , 2022) 2. Ethical LMs goal: We looked at toxicity in LMs as an important dimension whereas there are other facets for achieving the goal of ethical LM such as moving towards greener methods by reducing the carbon footprints as stressed in recent studies (Strubell et al. , 2019; Schwartz et al. , 2020; Jobin et al. , 2019), privacy concerns (Carlini et al. , 2021), other issues discussed in (Bender et al. , 2021). 3. Different Cultural Definitions of toxicity: Previous review works highlight the fact that toxicity, hate and offense concepts are not defined concretely as they can vary based on demographics and different social groups (Paz et al. , 2020; Yin and Zubiaga, 2021). This may effect the performance of toxicity detection methods(HATEBERT and PERSPECTIVE API) used in this work. Such differences between cultural definitions of toxicity poses an ethical challenge (Jacobs and Wallach, 2021; Welbl et al. , 2021). 4. Third party classifiers for toxicity detection: Reliance on the third party classifiers for toxicity detection can itself beat the purpose of fairness as these systems are reported to be biased towards certain protected groups and overestimate the prevelence of toxicity associated with them in the texts (Davidson et al. , 2019; Abid et al. , 2021; Hutchinson et al. , 2020; Dixon et al. , 2018; Sap et al. , 2019). For most part, we take care of these by using causal mechanisms but the ATE computation still involves using a toxicity classifier (HATEBERT) model. 5. Potential misuse: Any controlled generation method runs the runs the risk of being reverseengineered, and this becomes even more crucial for detoxification techniques. In order to amplify their ideologies, extremists or terrorist groups could potentially subvert these models by prompting them to generate extremist, offensive and hateful content. (McGuffie and Newhouse, 2020)