Toxicity-Preserving Translation

• Toxicity-preserving translation is a process that maintains not only the literal meaning but also the harmful tone and intent of the original text.
• It employs techniques like controlled decoding, counterfactual generation, and human-in-the-loop prompting to balance input and output toxicity levels.
• Its applications span moderation, auditing, and red-teaming while addressing challenges such as low-resource languages and context-dependent toxicity.

Searching arXiv for papers on toxicity-preserving translation, multilingual toxicity detection, and added toxicity in MT. Toxicity-preserving translation denotes translation or rewriting that retains not only propositional content but also the degree, type, target, and pragmatic force of harmful language, rather than silently sanitizing, amplifying, or distorting it. In multilingual safety research, the label is not always used explicitly, but the underlying problem recurs in translation-based moderation, cross-lingual toxicity classification, low-resource dialect translation, adversarial rewriting, and inference-time control of generation. The topic therefore spans faithful transfer of slurs, insults, microaggressions, sarcasm, and implicit harms; avoidance of “added toxicity”; and explicit mechanisms for matching output toxicity to a source-side target (Dan et al., 24 Jun 2026).

1. Conceptual scope and problem definition

A central distinction in the literature is between preserving source toxicity and introducing new toxicity. MinTox defines added toxicity as “the fact of producing a translation output with more toxicity than there exists in the input,” and operationally focuses on cases where the output contains toxic words but the input does not contain any toxic words; it explicitly does not mitigate cases where toxicity is already present in the input (Costa-jussà et al., 2023). The NLLB study similarly defines added toxicity as “the introduction in the translation output of toxicity that is not present in the source sentence,” and, on non-toxic HolisticBias English inputs, treats any toxic target output as added toxicity (Costa-jussà et al., 2022).

A different line of work uses the term more directly. In low-resource Singlish translation, toxicity-preserving translation is the task of translating content that may be rude, abusive, profane, or hateful in a way that keeps both its meaning and its harmful tone or intensity, instead of sanitizing it. The stated objective is to preserve slang, colloquial style, code-mixing, loanwords, and the “informal, rude, and expressive tone” of the source, while avoiding unwanted softening of insults or rude terms (Ge et al., 16 Jul 2025).

The same conceptual boundary appears in rewriting research. CITA studies Chinese toxicity-preserving rewriting as preserving harmful intent while changing expression through semantic indirectness and orthographic obfuscation. Its examples move from explicit toxicity to implicit toxicity and then to obfuscation variants, while keeping the underlying hostile meaning recognizable to human readers (Kang et al., 21 May 2026). The multilingual survey generalizes this view by arguing that toxicity-preserving translation would require the degree, type, and target of harm to remain recognizable across language shifts, while also preventing translation from spuriously diluting or inventing harmful content (Dan et al., 24 Jun 2026).

2. Formal objectives and control formulations

One explicit formalization treats toxicity as a continuous score in $[0,1]$, denoted by $\text{tox}(*)$, and controls it directly during decoding. For a generated sequence $y=(y_1,\dots,y_T)$, the base LLM defines

$p(y)=\prod_{t=1}^{T} p(y_t \mid y_{<t}),$

with token score

$$\text{score}(y_t \mid y_{<t})=\log p(y_t \mid y_{<t}).$$

Controlled toxicity decoding modifies these scores before sampling. If the partial output is less toxic than the target toxicity $\text{tox}(s)$ of the input sentence, the decoder rewards toxic tokens; if it is more toxic, it penalizes them:

$$\text{score}(y_t \mid y_{<t}) = \text{score}(y_t \mid y_{<t}) + \lambda \cdot \text{tox}(y_t), \quad \text{if } \text{tox}(y_{<t}) < \text{tox}(s)$$

$$\text{score}(y_t \mid y_{<t}) = \text{score}(y_t \mid y_{<t}) - \lambda \cdot \text{tox}(y_t), \quad \text{if } \text{tox}(y_{<t}) > \text{tox}(s).$$

A second objective relaxes control for more toxic inputs through

$\lambda = \frac{1}{\text{tox}(s)\cdot 100},$

and a third objective updates the target between multiple outputs by reflecting the previous output toxicity across the source toxicity, so that successive generations scatter around the source rather than collapsing to a single level. The method was introduced for interpretation generation, but the paper states that most of the machinery can be repurposed almost directly for translation or paraphrasing by plugging it into a translation model rather than an interpretation model (Trusca et al., 11 Mar 2025).

A second formulation comes from counterfactual generation. Given a toxicity classifier $f$, a counterfactual text is defined as

$\text{tox}(*)$0

where $\text{tox}(*)$1 combines minimal change, semantic similarity, and plausibility. In the detoxification setting this flips a toxic text to non-toxic, but the same structure can be generalized from binary label flipping to toxicity matching, so that the output is constrained to approximate a target toxicity level rather than merely become non-toxic (Bhan et al., 2024).

At the representation level, mechanistic work treats toxicity as a contrastive direction in hidden states. Meow2X computes layerwise activation differentials

$\text{tox}(*)$2

scores layers by $\text{tox}(*)$3 magnitude, and suppresses selected layers by inference-time scaling, while TRNE uses contrastive gradient norms and rank-one projection edits. The paper evaluates decoder-only LMs rather than MT systems, but explicitly links these mechanisms to toxicity-controllable translation by suggesting that toxicity can be treated as a partly separable direction in internal representations (Beniwal et al., 27 May 2026).

3. Translation workflows and implementation patterns

A practical translation workflow appears in the Singlish study as a two-stage, human-in-the-loop framework. Stage 1 is human-verified few-shot prompt engineering: a pool of 20 Singlish sentences, balanced between benign and harmful content, is translated into Chinese, Malay, and Tamil through a three-round process in which annotators review zero-shot outputs from GPT-4o mini, DeepSeek-R1, and Gemini 2.0 Flash, may provide custom translations, and finally select a single best translation for each source sentence and target language. The final translation prompt explicitly instructs the model to maintain informal, rude, and expressive tone, preserve impoliteness in a natural and culturally appropriate way, and “Do not soften the tone or make it more polite than the original” (Ge et al., 16 Jul 2025).

Stage 2 optimizes model–prompt pairs by semantic similarity. Direct similarity between source sentence $\text{tox}(*)$4 and translation $\text{tox}(*)$5 is computed with multilingual embeddings as

$\text{tox}(*)$6

and back-translation similarity compares the original $\text{tox}(*)$7 with a back-translation $\text{tox}(*)$8:

$\text{tox}(*)$9

Few-shot retrieval is then performed by selecting the top-$y=(y_1,\dots,y_T)$0 most similar examples for each new input. The same paper reports that GPT-4o mini with curated few-shot prompting was the strongest model in this setup (Ge et al., 16 Jul 2025).

A different implementation pattern is translate–then–detect. For a source-language text $y=(y_1,\dots,y_T)$1 in language $y=(y_1,\dots,y_T)$2, machine translation first produces an English rendering

$y=(y_1,\dots,y_T)$3

which is then scored by an English toxicity classifier

$y=(y_1,\dots,y_T)$4

This pipeline does not require translated training data for the classifier; English classifiers are trained on original English data and then reused after translation. The paper studies NLLB-200, Llama 3.1, Gemma 3, GPT-4o, and MT-specific fine-tuning of Llama 3.1 on TowerBlocks/MT, and it treats refusal by safety-tuned instruction LLMs as a major failure mode because refusal destroys toxicity-preserving behavior by not translating harmful content at all (Bell et al., 17 Sep 2025).

Inference-time mitigation pipelines implement the opposite constraint: preserve source toxicity when it exists, but prevent new toxicity from being injected. MinTox wraps an existing translation system with a detect–redecode loop. It first generates an unconstrained translation, runs toxicity detection on the output, checks toxicity on the input, and only if the output is toxic while the input is non-toxic does it re-run beam search with the detected toxic token sequences banned. For this paper, toxicity detection is implemented with ETOX wordlists, and mitigation is applied at inference time without retraining the base translation model (Costa-jussà et al., 2023).

4. Evaluation protocols and empirical findings

Evaluation in this area is heterogeneous because different papers target different operational goals. Controlled toxicity decoding for interpretation generation uses METEOR for syntactic similarity, COMET for semantic similarity, perplexity for model uncertainty, and Spearman correlation between model-generated toxicity and human interpretation toxicity. With Objectives 1+2+3 enabled, COMET increases from 82.36 to 85.81 for BART, from 86.16 to 91.07 for LLAMA, and from 79.61 to 82.9 for T5; this suggests that toxicity-aware decoding can improve semantic alignment when the task requires matching human toxicity behavior (Trusca et al., 11 Mar 2025).

Cross-lingual toxicity classification evaluates translated pipelines with AUC and compares them to in-distribution and out-of-distribution native-language classifiers. The principal result is that the best translation-based pipeline outperforms the best out-of-distribution classifier in 13 of 16 languages, or 81.3% of cases, and that translation benefits correlate with both target-language resource level and machine-translation quality. The same study finds that traditional classifiers outperform LLM judges, especially in low-resource settings, and that MT-specific fine-tuning of Llama 3.1 lowers refusal rates but can negatively impact toxicity detection accuracy for low-resource languages (Bell et al., 17 Sep 2025).

Added-toxicity studies measure a different failure mode. On 164 English-to-X directions over HolisticBias, added toxicity varies from 0% to 5%, with the highest-toxicity languages tending to be low-resource and the most affected demographic axes including sexual orientation, gender and sex, and ability. Human evaluation on a subset of eight directions confirms that automatically flagged toxicity is often true added toxicity, and input-attribution analysis with alti+ shows that source contribution significantly correlates with toxicity for 84% of languages studied (Costa-jussà et al., 2022). MinTox, applied to SEAMLESSM4T, reports approximately 25% to 95% mitigation of added toxicity depending on modality and domain while keeping translation quality, with stronger effects for text outputs and speech-to-text than for speech outputs that require ASR on synthesized speech (Costa-jussà et al., 2023).

Low-resource toxicity-preserving translation evaluates human judgments of meaning and tone alongside embedding-based similarity. On 200 GPT-4o mini translations per language, average human ratings are 3.83 for Chinese, 4.09 for Malay, and 2.49 for Tamil, compared with 4.07, 4.08, and 3.30 respectively for the 20 curated gold references. The reported interpretation is that Chinese and Malay machine translations are close to gold, whereas Tamil translations are more often “overly sanitized or emotionally flat,” even when semantically correct (Ge et al., 16 Jul 2025).

5. Adversarial rewriting, implicit toxicity, and multilingual threat models

Toxicity-preserving translation is not confined to faithful rendering for moderation; it also appears in red-teaming as intent-preserving rewriting under disguise. CITA decomposes Chinese toxicity attacks into three stages. Harmful Intent Learning creates contextual toxic responses from standalone toxic posts by synthesizing a preceding query $y=(y_1,\dots,y_T)$5 and then fine-tuning Qwen3-8B with

$y=(y_1,\dots,y_T)$6

Implicit Toxicity Enhancement then uses GRPO to reward detector evasion and response quality:

$y=(y_1,\dots,y_T)$7

with the quality term explicitly scoring harmful intent retention, implicitness, naturalness, and absence of explicit toxic markers. Obfuscation Variant Rewriting finally applies homophone replacement, character transposition, traditional mixing, and emoji-based substitution through type-specific rewriters $y=(y_1,\dots,y_T)$8 so that $y=(y_1,\dots,y_T)$9 (Kang et al., 21 May 2026).

Attack success is measured only on examples independently judged toxic:

$p(y)=\prod_{t=1}^{T} p(y_t \mid y_{<t}),$0

Across seven detectors, full CITA yields an average ASR of 69.48%, compared with 59.51% for HIL only and 68.36% for HIL+ITE. Human evaluation reports that harmfulness remains high, while implicitness rises from 3.47 to 4.00, evasiveness from 3.03 to 3.77, and naturalness from 3.95 to 4.20. The same synthetic data can also be used defensively: the Chinese Implicit Toxicity Defense model achieves an average accuracy of 91.97%, surpassing a mixed-data baseline at 90.83% (Kang et al., 21 May 2026).

The multilingual survey places such rewriting in a broader threat landscape. It catalogues language-shift jailbreaks, translation-mediated pivot attacks, code-switching attacks, transliteration-based attacks, cross-lingual fine-tuning attacks, and “new-language” learning as ways to weaken safety alignment across languages. A consistent implication is that multilingual safety depends on whether toxic meaning survives translation, pivoting, script mixing, and orthographic variation closely enough for detectors and guardrails to remain effective (Dan et al., 24 Jun 2026).

6. Applications, limitations, and research directions

The main positive applications are moderation, auditing, legal or archival translation, robustness evaluation, and guardrail training. The controlled-decoding paper argues that preserving or even surfacing hidden toxic meanings can help build better content filtering and detection systems and can model how different readers interpret out-of-context toxic language (Trusca et al., 11 Mar 2025). The survey recommends separating user-facing translation, which may legitimately sanitize harmful content, from audit or research translation, which should prioritize faithful representation of harmful content and expose the original to moderators when needed (Dan et al., 24 Jun 2026).

The central technical limitation is dependence on the toxicity signal itself. Controlled decoding depends on an external classifier such as BERT-HateXplain; counterfactual detoxification depends on a BERT steering classifier and an independent toxic-bert evaluator; MinTox and the NLLB added-toxicity work rely on wordlist detectors; and the survey repeatedly notes that what counts as toxic is culturally contingent and community-specific. A direct consequence is that toxicity-preserving translation may preserve the classifier’s operational notion of toxicity rather than the full pragmatic or sociolinguistic notion recognized by human readers (Trusca et al., 11 Mar 2025, Bhan et al., 2024, Costa-jussà et al., 2023, Costa-jussà et al., 2022, Dan et al., 24 Jun 2026).

A second limitation is uneven language coverage. Translate–then–detect performs best when machine translation quality is high and the language is moderate- to high-resource, but low-resource languages remain challenging, and MT-specific fine-tuning can sometimes reduce toxicity-detection accuracy even while lowering refusals. The Singlish study similarly shows that Tamil lags behind Chinese and Malay, and the survey describes persistent gaps under code-switching, dialectal variation, and transliteration (Bell et al., 17 Sep 2025, Ge et al., 16 Jul 2025, Dan et al., 24 Jun 2026).

A third limitation is context. The controlled-decoding paper is explicitly about out-of-context sentences; the survey emphasizes multi-turn, cross-lingual, and code-switched settings; and Chinese implicit toxicity work exploits context-dependent sarcasm, stereotype-based implication, and condescending tone. This suggests that toxicity-preserving translation cannot be reduced to lexical transfer alone, especially for implicit harms, reclaimed slurs, or culturally specific pejoratives (Trusca et al., 11 Mar 2025, Kang et al., 21 May 2026, Dan et al., 24 Jun 2026).

A fourth limitation is dual use. CITA is presented as a controlled red-team framework rather than a deployable evasion tool, MinTox is designed to prevent added toxicity rather than amplify source toxicity, and the counterfactual detoxification paper explicitly discusses the risk that inversion of detoxification can become adversarial toxic generation. The standard governance response across these papers is restricted access, validation of generated toxic data, logging, and clear separation between analysis-oriented preservation and user-facing generation (Kang et al., 21 May 2026, Costa-jussà et al., 2023, Bhan et al., 2024).

Current research directions therefore fall into three broad categories. One is better control: decoding-time steering, counterfactual editing, and mechanistic localization all attempt to make toxicity a tunable variable rather than an uncontrolled side effect (Trusca et al., 11 Mar 2025, Bhan et al., 2024, Beniwal et al., 27 May 2026). Another is better measurement: cross-lingual consistency checks, source–target toxicity agreement, attribution-based hallucination analysis, and multilingual guard models aim to tell whether toxic meaning has actually been preserved or spuriously altered (Costa-jussà et al., 2022, Bell et al., 17 Sep 2025, Dan et al., 24 Jun 2026). The third is richer sociolinguistic grounding: low-resource prompting for Singlish, Chinese-specific obfuscation modeling, and the survey’s emphasis on culturally contingent harm all indicate that toxicity-preserving translation is as much a problem of pragmatic equivalence and language politics as of sequence modeling (Ge et al., 16 Jul 2025, Kang et al., 21 May 2026, Dan et al., 24 Jun 2026).