Euclidean flow matching based large language model detoxification method and device

Abstract

This invention discloses a method and apparatus for detoxifying large language models based on Euclidean flow matching, belonging to the field of artificial intelligence. To better balance detoxification effect and generation quality, this invention extracts features from the LLM output using a sparse autoencoder, performs detoxification transformation based on Euclidean flow matching, and finally replaces the original input activation, guiding the LLM to generate non-toxic content. This invention, applied to the field of large language models, can efficiently detoxify LLMs without significantly sacrificing fluency.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence, specifically to a method and apparatus for detoxification of large language models based on Euclidean flow matching. Background Technology

[0002] As the cornerstone of contemporary artificial intelligence, large language models (LLMs) represent the most promising path to artificial general intelligence (AGI) and have spawned an unprecedented application ecosystem globally.

[0003] Because the model ingests massive amounts of unrefined, internet-scale corpora during the pre-training phase, it inevitably internalizes human societal biases and preferences, leading to the generation of toxic, negative information, biased expressions, and other harmful content. The model's vulnerability to malicious prompts and jailbreak attacks further amplifies its security risks in complex interactive environments. Current LLM security issues can no longer be ignored.

[0004] This has given rise to the concept and engineering of Large Language Model Detoxification (LLM Detoxification). "Model Detoxification" constitutes a systematic technical framework that aims to reshape the generative behavior of models through corpus text processing, model intervention, and engineering control. Its core challenge lies in minimizing the probability of harmful outputs and eliminating or reducing the risk of the model outputting harmful content, while maintaining Pareto optimality between the model's existing cognitive efficiency and generative quality. This is not only a key pillar for ensuring the trustworthy deployment of LLMs but also represents a cutting-edge frontier in ethical alignment within AI safety research.

[0005] Current LLM detoxification solutions mainly include the following technical approaches: 1. Training-time alignment: optimizing model parameters from the root. This approach injects safety preferences into the model during the training / fine-tuning phase, modifying model parameters to reduce the probability of toxic generation from the source. The core is to use safety data and preference signals to guide the model to learn a "toxic generation" mode, including: data cleaning and safety fine-tuning, human preference alignment, and debiased training. 2. Inference-time intervention: dynamically controlling the generation process without modifying parameters. This approach intervenes in the generation process during the model's inference generation phase through representation editing, feature modulation, and decoding control, without modifying the original model parameters. It is flexible, lightweight, and can be rapidly iterated, making it the mainstream research direction. This approach can be further subdivided into: decoding layer intervention and representation layer intervention. 3. Establishing a multi-layered defense pipeline with a complete "input-generation-output" process. The core idea is to distrust the model's single output, and all content is reviewed and repaired.

[0006] The existing intervention method based on sparse autoencoders (SAE) indiscriminately ablates toxicity features, which can reduce toxicity output by about 20%, but doubles the fluency loss of non-toxic generation. SAE can decompose the internal activation of LLM into sparse, single-semantic interpretable features, providing a basis for feature-level precise regulation. Previous studies have used it for LLM bias elimination and rejection behavior regulation, but it suffers from the problem of indiscriminate intervention in detoxification applications.

[0007] Prior Art 1: A. Goyal, V. Rathi, W. Yeh, Y. Wang, Y. Chen, and H.Sundaram, “Breaking bad tokens: Detoxification of LLMs using sparseautoencoders,” in Proceedings of the 30th Conference on Empirical Methods inNatural Language Processing, Suzhou, JS, China, November 2025, pp. 12691–12709.

[0008] Prior art 2: CN121212369B, a feature editing method for content security of large language models.

[0009] Existing technology 2 maps the intermediate activations of a large language model to a sparse feature space using a sparse autoencoder, extracts the sparse feature differences corresponding to positive and negative inputs, and constructs a key dimension index set. Then, based on this index set, it performs targeted enhancement and suppression on the original sparse features, reconstructs the activations, and replaces the original activations, achieving lossless control. This scheme can accurately guide the output to meet safety specifications without fine-tuning the model. However, existing technology 2 is a static, binary, index-based feature intervention—it constructs a fixed positive / negative feature index set by comparing the sparse features of positive and negative input pairs, and only performs index-based targeted enhancement / suppression on the original features of new inputs. The intervention logic is a binary adjustment of "either positive or negative," i.e., a static on / off adjustment of feature dimensions. This means that the intervention accuracy, generation quality protection, and robustness of this scheme still have room for improvement, and it still suffers from inaccurate feature localization and semantic entanglement problems.

[0010] Current LLM detoxification solutions, whether data-driven, decoding control, or model editing, have not yet adequately resolved the core contradiction between "detoxification effect and generation quality." Summary of the Invention

[0011] To alleviate or partially alleviate the above-mentioned technical problems, the solution of the present invention is as follows:

[0012] On the one hand, this invention discloses a method for detoxification of large language models based on Euclidean flow matching, comprising the following steps:

[0013] When the large language model performs inference and generates each word, the intermediate layer outputs the original input activation; the original input activation is used as the input of the encoder of the sparse autoencoder and after encoding, the SAE features are obtained.

[0014] Toxicity subspace judgment is performed on SAE features: if intervention is triggered, the SAE features to be intervened are transformed by the Euclidean flow matching feature transformation operator to generate detoxified features after intervention.

[0015] After the detoxified features are decoded by the decoder of the sparse autoencoder, the reconstructed activation after detoxification is obtained. The reconstructed activation is used to replace the original input activation and input into the subsequent layers of the large language model to guide the large language model to generate non-toxic output content.

[0016] Preferably, the step of transforming the SAE features to be intervened using the Euclidean flow matching feature transformation operator to generate the detoxified features after intervention specifically includes the following steps:

[0017] Within the Euclidean SAE feature space, a flow matching feature transformation operator based on continuous normalized flow is pre-constructed. The flow matching feature transformation operator is used to characterize the continuous smooth mapping relationship from toxic features to non-toxic features.

[0018] When intervention is triggered during the inference phase, the SAE features to be intervened are mapped and transformed by the flow matching feature transformation operator to generate detoxification features after intervention.

[0019] Preferably, the step of transforming the SAE features to be intervened using the Euclidean flow matching feature transformation operator to generate the detoxified features after intervention specifically includes the following steps:

[0020] Within the Euclidean SAE feature space, an instantaneous velocity field based on continuous normalized flow is constructed. This instantaneous velocity field is used to characterize the instantaneous evolution speed and direction of SAE features within the normalized time interval [0,1].

[0021] Using toxicity characteristics as the starting point of evolution and predefined non-toxic characteristics as the endpoint of evolution, a mean path of Euclidean linear interpolation is constructed. The target velocity field for flow matching is obtained by differentiating the mean path with respect to time.

[0022] The instantaneous velocity field is trained by using the square of the L2 norm as a loss function to achieve flow matching and alignment with the target velocity field, thus obtaining a converged velocity field.

[0023] If intervention is triggered during the inference phase, multi-step numerical integration is performed on the instantaneous velocity field that has converged during training in the normalized time interval [0,1] to obtain the Euclidean flow matching feature transformation operator.

[0024] The Euclidean flow matching feature transformation operator is used to perform a global smoothing mapping on the SAE features to be intervened that trigger intervention, thereby generating the detoxification features after intervention.

[0025] Preferably, after performing a toxicity subspace judgment on the SAE features and triggering intervention, feature transformation is performed using any of the following intervention strategies:

[0026] (1) Minimize intervention strategy: Only perform transformation on the SAE feature corresponding to the last word in each generation time step, and retain the original value of the remaining word features;

[0027] (2) Maximize intervention strategy: Perform transformation on a word-by-word basis for the SAE features corresponding to all words in the generation process;

[0028] (3) Adaptive intervention strategy: Based on the preset decay coefficient, set the dynamic intervention probability for each generated word, and perform transformation on the SAE features of the corresponding word according to the intervention probability, while the remaining words retain the original features.

[0029] Preferably, the step of performing a toxicity subspace determination on the SAE features specifically involves:

[0030] Preconstruct toxicity feature subspace and non-toxicity feature subspace, and calculate the matching score between the SAE feature to be detected and the toxicity feature subspace;

[0031] When the matching score exceeds the preset intervention threshold, intervention is triggered; the preset intervention threshold is a fixed threshold or an adaptive threshold that is dynamically adjusted during the generation process.

[0032] Preferably, the sparse autoencoder is a pre-trained model. During training, the backbone weights of the large language model are fixed, and only the encoder and decoder of the sparse autoencoder are trained. The trained sparse autoencoder is used to extract interpretable semantic features corresponding to the activation of the intermediate layers of the large language model.

[0033] Preferably, the toxicity subspace judgment of SAE features is specifically performed by using a multi-layer Lipschitz MLP classifier to detect toxicity trigger risk in real time.

[0034] Preferably, the large language model detoxification method based on Euclidean flow matching is executed in a hardware architecture including a host and multiple accelerator cards, wherein:

[0035] The host is responsible for task distribution, data preprocessing, result aggregation, and global scheduling;

[0036] Main inference accelerator card execution: large language model inference, raw input activation extraction, SAE feature encoding and decoding, and activation replacement and subsequent generation;

[0037] Toxicity Assessment Accelerator: Performs toxicity subspace assessment and intervention trigger assessment based on SAE characteristics;

[0038] Detoxification transformation acceleration card execution: inference of Euclidean flow matching feature transformation operator, detoxification transformation of SAE features.

[0039] On the other hand, the present invention also discloses a large language model detoxification device based on Euclidean flow matching: including a host, a main inference acceleration card that establishes a communication connection with the host, a toxicity determination acceleration card, and a detoxification transformation acceleration card;

[0040] The detoxification device based on a large language model using Euclidean flow matching performs the following steps:

[0041] Step S1: The host receives the user's input text, completes the text preprocessing, and then distributes the large language model inference task to the main inference acceleration card.

[0042] Step S2: The main inference acceleration card performs large language model inference, generates output sequences word by word, and extracts the original input activations of the intermediate layer of the large model in real time. The SAE features are obtained by encoding through a pre-trained sparse autoencoder and then transmitted to the toxicity determination acceleration card.

[0043] Step S3: The toxicity determination acceleration card performs a toxicity risk assessment on the received SAE features based on the pre-constructed toxicity feature subspace. If the intervention triggering conditions are met, the card sends a detoxification instruction and the SAE features to be intervened to the detoxification transformation acceleration card.

[0044] Step S4: The detoxification transformation acceleration card calls the CNF velocity field and transforms the SAE features to be intervened through the Euclidean flow matching feature transformation operator to obtain the detoxified features after intervention; the detoxified features after intervention are input into the decoder of the sparse autoencoder for reconstruction, and the reconstructed detoxified features are activated and sent back to the main inference acceleration card.

[0045] Step S5: The main inference acceleration card uses the received reconstructed activation to replace the original input activation of the corresponding intermediate layer of the large language model, and feeds the replaced activation back into the subsequent network layers of the large model to guide the model to generate non-toxic output content.

[0046] Step S6: The host aggregates the generated sequence output by the main inference accelerator card, processes it, and returns the final detoxified output content to the user.

[0047] Preferably, the large language model detoxification device based on Euclidean flow matching performs the large language model detoxification method based on Euclidean flow matching as described in any of the preceding claims.

[0048] The technical solution of this invention has one or more of the following beneficial technical effects:

[0049] (1) Through local editing at the SAE feature level, efficient LLM detoxification was achieved. The verification results on mainstream open-source lightweight LLM are better than existing technologies. The toxicity index is significantly reduced while only the quality of generated content is slightly lost.

[0050] (2) The smooth feature transformation guided by feature subspace constraints and Euclidean flow matching solves the core problem of indiscriminate operation and semantic destruction in existing SAE intervention methods, and improves the stability and interpretability of LLM detoxification.

[0051] (3) It combines lightweight, generalizability and engineering practicality: In one instance, the inference time increases by less than 7%, adapts to different architectures of LLM, and retains the downstream task capability of the model, providing a new feature-level approach for the safe control of LLM.

[0052] (4) The intervention operation is constrained from the activation layer space of the model to the feature subspace, and the degree of feature transformation can be precisely controlled. In contrast, existing methods operate in a dense and entangled activation layer space, making it difficult to capture fine-grained semantic information.

[0053] (5) The present invention operates within the toxicity feature subspace obtained through learning, and guides local feature editing through a smooth feature transformation method, which effectively avoids the problem of unstable detoxification effect when the model is shifted in feature distribution.

[0054] (6) The present invention designs three feature intervention strategies: maximization, minimization and adaptive, to adapt to different safety control needs and scenarios: a) Maximization strategy, lightweight intervention, low time increment, suitable for scenarios with high efficiency requirements and low toxicity risk; b) Minimization strategy, deep intervention, optimal detoxification effect, suitable for scenarios with low time sensitivity but high safety requirements; c) Adaptive strategy, dynamically adjusts the intervention intensity, suitable for most comprehensive scenarios.

[0055] Furthermore, other beneficial effects of the present invention will be mentioned in the specific embodiments. Attached Figure Description

[0056] Figure 1 This is a flowchart of the detoxification method based on Euclidean flow matching for large language models according to the present invention.

[0057] Figure 2 This is a flowchart of the detoxification method based on Euclidean flow matching for large language models according to the present invention;

[0058] Figure 3 This is a schematic diagram of the detoxification device based on a large language model using Euclidean flow matching, as per the present invention. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0060] To facilitate a clear description of the technical solutions in the embodiments of the present invention, the terms "first" and "second" are used to distinguish identical or similar items with essentially the same function and effect. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or execution order.

[0061] Analysis of existing technologies by the inventors revealed that current SAE-Steering-based methods for detoxification involve indiscriminately shifting toxicity features in the opposite direction, failing to precisely control the degree of manipulation and resulting in a significant sacrifice in generation fluency during detoxification. Specifically, existing technologies decompose LLM internal activations into sparse, single-semantic interpretable features, providing a foundation for precise feature-level control. Previous research has used SAE for LLM bias elimination and rejection behavior control, but its application in detoxification suffers from indiscriminate intervention.

[0062] Based on this discovery and analysis, the core improvements of this invention are at least reflected in: (1) by learning the toxicity subspace, the intervention is constrained within the feature-level toxicity subspace, thereby achieving accurate positioning and granular differentiation of toxicity features and avoiding disturbance of irrelevant features; (2) by using smooth feature transformation guided by Euclidean flow matching to replace simple reverse offset, and by using s (a positive integer, for example, s=7) steps of Euler solution to achieve a stable remapping of the toxicity feature distribution, the problem of unstable latent space mapping is solved, and finally the balance between detoxification effect and generation quality is achieved.

[0063] This invention discloses a method and apparatus for detoxification of large language models based on Euclidean Flow Matching (EFM). This invention belongs to a constrained deep learning approach, with Euclidean Flow Matching (EFM) serving as the core technology supporting subspace-aware feature transformation. It is a key method for achieving a smooth remapping of toxic features from toxic to non-toxic distributions. Traditional SAE intervention methods, through simple reverse shifting / hard suppression of toxic features, cause abrupt changes in the feature distribution of the LLM latent space, leading to decreased fluency and semantic breaks in the generated text. The core function of EFM is to learn a continuous and smooth transformation flow from toxic to non-toxic feature distributions within the learned toxic subspace. This allows the adjustment process of toxic features to follow a continuous trajectory, rather than aggressive hard adjustments, thus avoiding the instability of detoxification effects caused by feature distribution shifts.

[0064] Figure 1 This is a flowchart of the detoxification method for large language models based on Euclidean flow matching, as described in this invention. A large language model (LLM) is essentially a neural network, comprising multiple layers. In this invention, following the execution order of neural network inference, it is divided into a backbone layer and subsequent network layers, each comprising multiple layers. For example, the backbone layer includes layers 0 to 1, and the subsequent network layers include layers 1 to L+1. The last layer of the backbone layer is an intermediate layer (layer 1) in the LLM, where 1 and L are both positive integers.

[0065] To facilitate understanding, the main concepts and processes of this invention will be explained below. When the large language model performs inference and generates the i-th token, the intermediate layer outputs the original input to activate a. (i) , where i is a positive integer. Here, a (i) These are the native activation values ​​of LLM (assuming no detoxification is performed) used for calculations in subsequent layers, and are the core data generated during the inference process.

[0066] Original input activation a (i) As input to the sparse autoencoder, after encoding, the resulting SAE features are: Here It is a feature space representation used for toxicity determination and detoxification transformation.

[0067] Next, the SAE features were analyzed. Perform toxicity subspace judgment: If intervention is triggered, then match the feature transformation operator using Euclidean flow. The SAE characteristics to be intervened are transformed to generate detoxification characteristics after intervention. If no intervention is triggered, the transformation will not be performed. In other words, the SAE feature to be intervened, after undergoing detoxification intervention, becomes the detoxified feature. .

[0068] Detoxification characteristics after intervention After SAE decoding, the reconstructed and activated product is obtained after detoxification treatment. .

[0069] Finally, activate after refactoring. Replace the original input to activate a (i) This inputs to subsequent layers, guiding the LLM to generate non-toxic output content.

[0070] The above is an introduction to the typical features of the present invention in some typical cases. There are more technical details, such as the intervention strategy and the specific intervention method, which will be explained later.

[0071] Figure 2 This is an architecture diagram of the large language model detoxification method of this invention. The LLM detoxification method mainly includes four stages or steps, among which the Euclidean flow matching scheme is applied to the "subspace-aware feature transformation" stage. In summary, it includes at least the following stages / steps:

[0072] (a) Stable Feature Selection. In this step, using 9 languages ​​and 400 pairs of "toxic-nontoxic" samples from the TextDetox dataset, residual flow activations of the LLM target layer are extracted. The t-statistic is used to calculate the activation differences of SAE features in toxic / non-toxic samples, and the top-k toxicity-related features, where k is a positive integer (for example, k=128), constitute a stable subset of toxicity features. ), filtering out low-activation, non-toxic, general multilingual features.

[0073] (b) Toxicity Subspace Learning and Detection. In this step, contrastive loss is introduced to construct separation rules for toxic / non-toxic feature clusters, and a feature subspace characterizing toxicity is learned to achieve fine-grained toxicity feature differentiation. A multilayer Lipschitz perceptron (MLP) classifier is constructed based on the toxicity feature subset to detect toxicity triggering risks in real time during the generation process.

[0074] (c) Subspace-Aware Feature Transformation. In this step, a feature transformation guided by Euclidean flow matching is used to remap the toxicity feature distribution to a non-toxicity distribution. The transformation process is constrained to occur within the toxicity subspace. Specifically, a Euler solver with a fixed step size of s (a positive integer, for example, s=7) is used to complete the transformation, avoiding excessive distribution shift caused by a single-step transformation.

[0075] (d) Feature intervention strategy. This step involves three strategies: maximization, minimization, and adaptive strategies. These strategies regulate the timing and intensity of intervention to achieve smooth suppression of toxic features.

[0076] The following sections will describe in detail the implementation process and details of the technical solution of this invention, based on the above framework. It is worth noting that the parameters (quantity, factors, etc.), hyperparameters, and datasets used in the specific embodiments here are generally exemplary examples and not intended as the sole limitation of this invention. Those skilled in the art can appropriately adjust these elements based on the concept of this invention to obtain similar technical effects.

[0077] Given a prefix consisting of I positive integers of tokens Large language models generate output sequences in an autoregressive manner, prompted by the input context. The goal of language model detoxification is to reduce the probability of generating toxic content while maintaining the quality of the generated content.

[0078] Regarding sparse autoencoders (SAEs), given the original input activations in the target layer corresponding to the input prefix... (When generating the i-th word, the corresponding activation of the original input is a) (i) , , (where is a positive integer), a sparse autoencoder (SAE) aims to decompose complex activation features into more interpretable high-dimensional representations. This model activates the original input a (i) The original features generated by the sparse autoencoder, which maps to sparse feature activation vectors. , and and decode it into the activation of reconstruction. :

[0079] ,

[0080] ,

[0081] Where f is the original feature generated by the sparse autoencoder. It is the encoder mapping function of a sparse autoencoder, with weights. 'a' is the original input activation. For the decoder parameters of the sparse autoencoder, For the encoder parameters of the sparse autoencoder; It is the activation of reconstruction. It is the decoder mapping function of the sparse autoencoder, with weights. , .

[0082] For example, when generating the i-th word, the corresponding original input activation is a. (i) After SAE encoding, SAE features are obtained. .

[0083] The model loss is minimized by two mutually constraining parameters: one is the square of the L2 norm. The reconstruction error is measured by two hyperparameters that characterize the sparsity of the hidden layer encoding. Weighted L1 regularization penalty term:

[0084] ,

[0085] in, For SAE loss, For reconstruction error, is a hyperparameter, and f is the original feature generated by the sparse autoencoder.

[0086] The L1 penalty term forces the hidden layer to encode—most elements of the original feature f generated by the sparse autoencoder are 0. This prompts the sparse autoencoder to learn localized features, so that each activation dimension in the original feature f generated by the sparse autoencoder ideally corresponds to a single and interpretable feature.

[0087] (A) Selection of stable features. In order to identify informational features for detoxification tasks in the sparse autoencoder (SAE) space, this invention uses the TextDetox dataset containing pairs of “toxic” and “non-toxic” prefixes, which are generated by restatement and retain the same meaning.

[0088] In the feature collection phase, in this invention, for a given pair of samples: Each prefix is ​​input into a frozen, pre-trained large language model, and residual stream activations of the target layer are extracted. These activations are passed through a pre-trained SAE encoder (whose mapping function is...). The process is performed to obtain the latent feature matrix. Where n is the number of sample pairs, m is the size of the SAE dictionary, and i is the index. It has a toxic prefix. It is a non-toxic prefix. It's a toxic label. It is a non-toxic label.

[0089] While initial filtering can separate significant noisy activation patterns for feature pruning of the core set, evaluating features independently using simple scalar statistics ignores the complex covariance structure of the multi-semantic latent space. To strictly isolate semantics that trigger toxicity while preserving the activation manifold geometry, this invention transforms feature selection into a column subset selection problem (CSSP) within the core set framework.

[0090] Assume the contrastive activation matrix is , where the i-th row The precise directional offset from the non-toxic generation space to the toxic generation space is encoded, where The toxic activation is in line i. The i-th row is non-toxic and activated. For Its singular decomposition is as follows:

[0091] ,

[0092] in, , And all of them are matrices with orthogonal columns. , , is the singular value of D, n is the number of sample pairs, and m is the size of the SAE dictionary. This is the transpose symbol.

[0093] To capture each SAE feature dimension To assess the structural importance of toxicity-biased manifolds, this invention calculates the sensitivity using ridge leverage scores. The regularization parameter for ridge regression is also considered. column j Its ridge leverage score It can be precisely derived from the right singular vector:

[0094] ,

[0095] in, It is a ridge lever score, yes The j-th column, It is the transpose symbol. It is the regularization parameter of ridge regression. It is an n-order identity matrix. yes The i-th singular value, V ji It is the i-th component of the j-th row of V, where i and j are both indices of the feature.

[0096] Define a sampling distribution P over all m features, where the selected features... probability Strictly proportional to its sensitivity boundary:

[0097] ,

[0098] in, It is a feature The probability of being selected. , All are ridge leverage scores. As a feature, m is the size of the SAE dictionary. It is an index.

[0099] This invention samples k features (e.g., k=128) based on a sampling distribution P to construct a stable subset of toxicity features. To ensure a sparse subset of toxicity features. In the downstream subspace learning process, as an unbiased estimator of the complete m-dimensional SAE feature space, each selected feature s is assigned a Coreset Rescaling Weight (CRW):

[0100] ,

[0101] in, The core set scaling weights, where k is the number of features sampled. It represents the probability that feature s is selected.

[0102] Theoretically, let For the sampling matrix, diagonal elements are The diagonal matrix, the core activation matrix is It is not difficult to prove that: , The sign is transpose. This confirms that it is a bias-free estimator of the true toxicity offset covariance. Furthermore, applying the matrix Bernstein inequality, it can be determined by choosing... These features ensure a tight spectral approximation. This theoretically ensures the subset of toxicity characteristics. While filtering out common language patterns, it retains the mathematically optimal solution features required for high-fidelity interpretation, among which... It is a ridge lever score, , It is a separation interval. It is a positive smoothing term.

[0103] (B) Learning and detection of the toxicity subspace. Although the above feature filtering methods have separated two significant noisy activation modes, the inherent weak correlation and semantic dispersion between SAE features make it difficult to represent complex toxicity patterns.

[0104] Therefore, this invention proposes to construct a subspace that is located within a subset of toxicity features. The subspace forms a compact discriminative region, and a classifier is built based on this subspace to assess the risk of toxicity triggering at the feature level. Ideally, the subspace learner should be lightweight and easily updated quickly, as it will be used in conjunction with the feature transformation process to guide the generation of the underlying large language model. For labeled feature pairs... Its loss function is:

[0105] ,

[0106] in, It is a gapped classification contrastive loss, used for subsets of toxicity features. The tight, toxic, exclusive subspace for learning. , It is a subset of toxicity characteristics A labeled feature pair, and It is an anchor point feature. These are positive sample features. It is a subset of toxicity characteristics A candidate feature, It is a separation interval. It is a temperature parameter; It is an indicator function used to apply a separating margin penalty only to positive samples; to ensure the unbiased estimation properties of the core set obtained from the steps / steps selected for stable features, during batch optimization, for each selected feature... The contribution to the loss is determined by its corresponding core set weight. Scaling is applied; k is the index of the positive samples, and c is the subset of toxicity features. The traversal index of all candidate features.

[0107] In this formula, the denominator is a subset of toxicity features. Summing all candidate features, and calculating the sum of all features and the anchor feature used as the anchor point. The similarity between the samples constitutes the normalized denominator of the contrast loss. In the numerator, only positive sample pairs are calculated. , The similarity between ().

[0108] The interval-margined classification contrast loss obtained by this formula aims to maximize the similarity of positive samples and minimize the similarity of negative samples.

[0109] ,

[0110] in, It is the total loss. These are hyperparameters used to balance the weights of the two types of losses. It is cross-entropy loss. For including separation interval The classification comparison loss.

[0111] Optionally, a toxicity subspace judgment is performed on the SAE features. Specifically, this can be done by: pre-constructing a toxicity feature subspace and a non-toxicity feature subspace, and calculating the matching score between the SAE feature to be detected and the toxicity feature subspace; when the matching score exceeds a preset intervention threshold, intervention is triggered; the preset intervention threshold is a fixed threshold or an adaptive threshold that is dynamically adjusted during the generation process.

[0112] (C) Subspace-based perceptual feature transformation. Based on the learned toxicity subspace, this invention proposes a smooth transformation that edits the toxicity feature distribution into a detoxification distribution, thereby guiding the generation process away from this subspace. Given toxicity features obtained from the toxicity subspace... Non-toxic characteristics The present invention designs feature transformation mappings for candidate features by constructing feature pairs. Set two goals at the time ( and (All are positive integers)

[0113] (1) Detoxification: to make Approaching non-toxic characteristics along the direction of detoxification ;

[0114] (2) Utility preservation: to maintain Maintain closeness to the original semantic space (composed of the original features f generated by the sparse autoencoder).

[0115] Preferably, within the Euclidean SAE feature space, a flow-matching feature transformation operator based on continuous normalized flow is pre-constructed. This flow-matching feature transformation operator is used to characterize the continuous and smooth mapping relationship from toxic features to non-toxic features.

[0116] Since feature transformation is difficult to learn in a single step, this invention employs continuous normalized flow. For modeling, this method can generate smooth transformations that guide features away from the toxic subspace:

[0117] ,

[0118] in, From arrive Intermediate features during the transformation process It is implemented using a locally multilayer Lipschitz MLP classifier, used for parameterized generation of mappings. The flow; t is the time step, It is the stream function in Continuous Normalizing Flow (CNF) The parameter set, typically consisting of the weights and biases of a set of local multilayer Lipschitz MLP classifiers, is used to parameterize the smooth transformation trajectory of features from toxicity to non-toxicity.

[0119] Accordingly, mapping Will Transform into ,Right now To achieve this goal, the present invention utilizes a category-conditional Gaussian distribution. Constraining the evolutionary trajectory of intermediate detoxification states:

[0120] ,

[0121] in, It is the conditional probability density function at time step t. From arrive Intermediate features during the transformation process It is a non-toxic characteristic. It is a toxic characteristic. The distribution follows a Gaussian pattern, where t is the time step. It is the diffusion variance at time step t. It is an identity matrix.

[0122] The formula defines the intermediate features at time step t. Obeying the goal— The distribution is a conditional Gaussian distribution. This invention will be based on the mean path in this formula. The derivative of the target velocity is To guide the stream function The learning ensures that features evolve along a specified detoxification trajectory. In other words, .

[0123] For ease of understanding, the mean path of this invention (= ) is the ideal linear evolution trajectory from a toxic state to a non-toxic state, and its derivative with respect to time step t ( The instantaneous velocity of the trajectory is used as the target velocity supervision stream function. The learning process guides the smooth transformation of features along the detoxification direction.

[0124] From another perspective, It is the instantaneous velocity of the mean path, that is, the ideal direction and magnitude of movement of the feature from toxic to non-toxic. As the target velocity, Supervision Stream Function The learning process aims to make the actual learning speed of the model as close as possible to this ideal speed, ensuring that the features evolve along the correct detoxification direction.

[0125] ,

[0126] in, It is the target velocity, also the instantaneous velocity of the ideal evolutionary trajectory, and the mean path derivative, used to supervise the stream function. The learning process ensures that features evolve along a specified detoxification trajectory. It is the velocity field of the ideal target; From arrive Intermediate features during the transformation process It is a non-toxic characteristic. It is a toxic characteristic.

[0127] In this invention, training is performed by optimizing the loss function. This loss, under the joint distribution of intermediate feature states, makes the learned features... Non-toxic characteristics as the target Alignment:

[0128] ,

[0129] in, It is the velocity matching loss, and also the target velocity alignment loss, which characterizes the stream function. The training loss function, It is the expectation of time step t that follows a uniform distribution in [0, 1]. It is the stream function in continuous normalized flow (CNFs) The set of parameters; From arrive Intermediate features during the transformation process It is the conditional probability density function at time step t. It is a non-toxic characteristic. This indicates that the intermediate features conform to the preceding text. The defined categorical conditional Gaussian distribution, It is the square of the L2 norm, i.e., the mean squared error loss; The core set is used to scale the weights, ensuring that the learned flow accurately reflects the structural changes of the complete underlying manifold; This is the actual velocity field learned by the model, which is the objective function to be optimized. It is the ideal target velocity field.

[0130] This invention minimizes the actual velocity field and the ideal target velocity field through velocity matching loss, in order to supervise the flow function. Learn the trajectory of detoxification and transformation.

[0131] When a toxicity risk is detected and triggered, Apply correction offset (The total change from the starting point to the ending point; this offset is a cumulative result of evolution over time, not a fixed static offset), achieved by performing multiple steps (s, s) over the interval (0, 1). Z) Numerical integration, adjusting it along the detoxification direction, where s is a positive integer:

[0132] ,

[0133] in, It is a detoxification characteristic. It is a feature transformation mapping. It is a toxic characteristic. It is a stream function. From arrive Intermediate features during the transformation process It is the stream function in continuous normalized flow (CNFs) The parameter set.

[0134] Furthermore, the multi-step numerical integration is a fundamental and general method for numerically solving ordinary differential equations. Specifically, an s-step numerical integration is performed on the trained convergent instantaneous velocity field over the normalized time interval (0, 1). The s-step numerical integration involves dividing the (0, 1) interval into s equally spaced discrete time steps and performing discrete iterative solutions on the instantaneous velocity field using the Euler method or the Runge-Kutta method to obtain the Euclidean flow matching feature transformation operator.

[0135] In summary, detoxification characteristics After reconstruction, the original activations in the LLM are replaced, guiding the internal activations to evolve in the direction of generating non-toxic outputs.

[0136] In this invention, the Euclidean flow matching is specifically manifested as follows: within the Euclidean SAE feature space, a smooth velocity field is constructed through continuous normalized flow; the Euclidean linear interpolation mean path is used as the matching benchmark; and L2 distance constraints are used to ensure that the feature evolution flow is strictly aligned with the target detoxification trajectory. Finally, integration forms a feature transformation mapping that achieves continuous matching across the entire domain from toxic features to non-toxic features. .

[0137] In other words, the feature transformation mapping formed by the integral. This is a specific implementation of Euclidean flow matching; in this invention, it is a Euclidean flow matching operator. For feature transformation mappings... It has the following characteristics:

[0138] Input: European toxicity characteristics;

[0139] Middle: Move along the Euclidean smooth flow trajectory;

[0140] Output: A precise match to the European non-toxic feature.

[0141] (D) Feature-based intervention strategies. During the inference phase, operations are performed only on the identified core set dimensions. The intervention strategy dynamically determines the timing and method of intervention using the original features f generated by the sparse autoencoder. Therefore, this module provides three complementary intervention strategies:

[0142] (i) Minimize intervention at the prefix level;

[0143] (ii) Maximize intervention;

[0144] (iii) Adaptive intervention throughout the entire generation process. Specifically, these intervention strategies are:

[0145] (i) Minimize intervention: This minimal intervention strategy modifies only the latent features of the last word at each generation time step, rather than operating on the entire input sequence, in order to achieve minimal intervention. The SAE features obtained in the first step are transformed into the following form: The reconstructed activation is passed to subsequent layers of the LLM, where It is a detoxification characteristic after intervention.

[0146] (ii) Maximizing Intervention: This maximizing intervention strategy determines whether to continue guiding generation at the lexical level. For the i-th lexical, Where I is a positive integer, It is a detoxification characteristic after intervention. This is a characteristic of SAE. This allows LLM to continuously monitor the evolution of toxicity risk throughout the entire generation process.

[0147] (iii) Adaptive intervention: This adaptive intervention strategy uses a threshold-based approach. A dynamic adjustment and intervention mechanism. (Assume...) Let be the decay control intervention probability for the i-th word. During the generation process, is determined by probability. right Apply the transformation; otherwise, retain the original feature f. The updated feature representation is as follows:

[0148] ,

[0149] in, And I is a positive integer. It is a detoxification characteristic after intervention. It's probability. It is a characteristic of SAE. It is a feature transformation mapping.

[0150] The strategy involves stronger detoxification interventions in the early stages of the disease, with the intensity of interventions gradually reduced over time.

[0151] For example, when generating the i-th lexical unit, the SAE features After detoxification intervention, the detoxification characteristics were obtained. .

[0152] Furthermore, the detoxification characteristics after intervention After SAE decoding, the reconstructed and activated product is obtained after detoxification treatment. .

[0153] Next, the reconstructed activation is utilized. Subsequent layers continue to perform inference, completing the network inference process and guiding the LLM to generate non-toxic outputs.

[0154] Finally, the inventors conducted an empirical analysis of inference time on a single NVIDIA H800 80GB GPU, comparing the disclosed technical solution with the Gemma 4 E4B (Effective 4B) model, processing 50 prefixes per batch. Table 1 discloses the increased batch inference time for each variant of the invention compared to the base large language model (base model). To assess the trade-off between efficiency and effectiveness, the table further reports the Expected Maximum Toxicity (EMT) metric.

[0155] Table 1: Performance Indicators Comparison of Various Variants of the Invention Compared to the Base Model

[0156]

[0157] Detoxifying LLMs inevitably incurs additional inference time overhead. This invention achieves an excellent balance between inference time and performance: compared to basic large language models, it only introduces a moderate increase in inference time while significantly reducing EMT.

[0158] Figure 3 This is a schematic diagram of the large language model detoxification device of the present invention. The present invention also discloses a large language model detoxification device based on Euclidean flow matching, comprising a host and several acceleration cards. The acceleration cards are mainly artificial intelligence (AI) acceleration chips composed of one or more of graphics processing units (GPUs), FPGAs, and application-specific integrated circuits. Mature solutions already exist in the industry, and will not be elaborated upon in this invention.

[0159] This architecture is based on a heterogeneous cluster design with a host and multiple accelerator cards. It can efficiently support the entire process of Sparse Autoencoder (SAE) feature extraction, toxicity subspace determination, continuous normalized flow (CNF) detoxification transformation and multi-granularity intervention, while balancing the real-time performance of large language model inference and detoxification effect.

[0160] The device employs a three-tiered architecture, comprising a main control layer consisting of a host computer, a computing layer consisting of multiple accelerator cards, and a high-speed interconnected communication layer. Each layer works together to complete the entire process of large language model inference and detoxification.

[0161] The main control layer is the core of the system's global control. Exemplary hardware configurations include: a high-performance multi-core central processing unit (CPU), a large-capacity system memory (≥128GB), high-speed NVMe local storage, and Ethernet interfaces of 10 Gigabit or higher.

[0162] The main control layer's primary tasks are to receive user input requests, perform text segmentation, sequence packaging, and task queue management, distribute inference tasks to multiple accelerator cards to achieve global load balancing, and issue configurations such as toxicity judgment thresholds, detoxification intervention strategies (minimization / maximization / adaptive intervention), and CNF flow model hyperparameters, thereby controlling the overall system's operational logic.

[0163] Furthermore, the main control layer also completes input text preprocessing, multi-card inference result aggregation, generated text splicing and post-processing, and finally outputs detoxified and safe content.

[0164] Furthermore, the main control layer monitors the load, memory usage, inference latency, and other statuses of each accelerator card in real time, enabling system operation and maintenance as well as fault tolerance.

[0165] On the one hand, at the computing layer, it consists of multiple high-performance accelerator cards (such as various GPUs or similar AI-accelerated neural network processors), which are deployed through the host's high-speed PCIe slot or NVLink high-speed interconnection to split computing power and accelerate the core computing process of the large language model detoxification solution in parallel.

[0166] On the other hand, in a preferred embodiment, the accelerator cards can be categorized into various types based on their functions. For example, these include: toxicity determination accelerator cards, detoxification transformation accelerator cards, and main inference accelerator cards. In this preferred embodiment, the three core computational tasks—large language model inference, toxicity determination, and detoxification transformation—are split across different accelerator cards, avoiding computational power contention and significantly improving the system's concurrent processing capabilities.

[0167] In the main inference acceleration card, the weights of the backbone layer of the large language model are resident, the word units are generated one by one to generate inference, the activation values ​​of the intermediate layer of the model are extracted in real time, and the original features f are generated through a sparse autoencoder to provide a data foundation for the subsequent detoxification process.

[0168] In the toxicity determination acceleration card, the toxicity subspace discrimination model runs independently. Based on the sparse autoencoder, the original feature f is generated to complete the toxicity risk scoring and intervention timing determination, and outputs the control signal to determine whether to trigger the detoxification intervention.

[0169] The detoxification transformation accelerator card is dedicated to performing continuous normalized flow computation, including stream function inference and eigenvalue transformation mapping. Calculation and detoxification characteristics Generate and complete the smooth transformation from toxic characteristics to non-toxic characteristics.

[0170] On the other hand, the communication layer serves as a low-latency data transmission channel between multiple accelerator cards and the host, and the accelerator cards themselves. Exemplary preferred hardware includes:

[0171] In-board interconnection: PCIe 4.0 / 5.0 bus and NVLink / NVSwitch multi-card direct connection technology enable high-speed transmission of activation values, SAE feature tensors, and detoxification features between cards, ensuring low end-to-end latency throughout the entire process of feature extraction, toxicity determination, detoxification transformation, and backfilling inference.

[0172] Cross-machine interconnection (multi-host cluster scenario): InfiniBand high-speed network card and RoCE Ethernet enable task synchronization, data interaction and computing power expansion between multiple host nodes, supporting ultra-large-scale models and high-concurrency services.

[0173] Referring to the aforementioned large language model detoxification method, the large language model detoxification device based on Euclidean flow matching of the present invention, as a complete example of a single application, can be used to perform the following steps:

[0174] Step S1: The host receives the user's input text, completes the text preprocessing, and then distributes the large language model inference task to the main inference acceleration card.

[0175] Step S2: The main inference acceleration card performs large language model inference, generates output word by word, and extracts the original input activation of the intermediate layer of the large model in real time. The SAE features are obtained by encoding through a pre-trained sparse autoencoder and then transmitted to the toxicity determination acceleration card.

[0176] Step S3: The toxicity determination acceleration card performs a toxicity risk assessment on the received SAE features based on the pre-constructed toxicity feature subspace. If the intervention triggering conditions are met, the card sends a detoxification instruction and the SAE features to be intervened to the detoxification transformation acceleration card.

[0177] Step S4: The detoxification transformation acceleration card calls the CNF velocity field and transforms the SAE features to be intervened through the Euclidean flow matching feature transformation operator to obtain the detoxified features after intervention; the detoxified features after intervention are input into the decoder of the sparse autoencoder for reconstruction, and the reconstructed detoxified features are activated and sent back to the main inference acceleration card.

[0178] Step S5: The main inference acceleration card uses the received reconstructed activation to replace the original input activation of the corresponding intermediate layer of the large language model, and feeds the replaced activation back into the subsequent network layers of the large model to guide the model to generate non-toxic output content.

[0179] Step S6: The host aggregates the generated sequence output by the main inference accelerator card, processes it, and returns the final detoxified output content to the user.

[0180] The "post-processing" here only involves decoding and concatenating the original word sequence generated by the model, removing redundancy, formatting, and encapsulating the results. No feature transformation or detoxification intervention is performed, ultimately outputting standardized, safe, and readable text to the user. More details about the detoxification method can be found in the previous text and will not be repeated here.

[0181] This embodiment is merely an illustrative example. Those skilled in the art can make conventional substitutions and improvements based on this architecture, such as replacing the GPU with a similar AI acceleration chip, adjusting the division of labor of the acceleration cards, or adopting a multi-machine, multi-card cluster deployment, all of which fall within the protection scope of this invention.

[0182] To better illustrate the present invention, numerous specific details have been provided in the detailed embodiments described above. Those skilled in the art should understand that the present invention can be practiced even without certain specific details. In some instances, methods, means, components, and circuits well known to those skilled in the art have not been described in detail in order to highlight the main points of the present invention.

[0183] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A detoxification method for large language models based on Euclidean flow matching, characterized in that, Includes the following steps: When the large language model performs inference and generates each word, the intermediate layer outputs the original input activation; the original input activation is used as the input of the encoder of the sparse autoencoder and after encoding, the SAE features are obtained. Toxicity subspace judgment is performed on SAE features: if intervention is triggered, the SAE features to be intervened are transformed by the Euclidean flow matching feature transformation operator to generate detoxified features after intervention. Specifically, this includes: in the Euclidean SAE feature space, a flow matching feature transformation operator based on continuous normalized flow is pre-constructed, which is used to characterize the continuous smooth mapping relationship from toxic features to non-toxic features; when intervention is triggered during the inference stage, the flow matching feature transformation operator is used to map and transform the SAE features to be intervened that triggered intervention to generate detoxified features after intervention. After the detoxified features are decoded by the decoder of the sparse autoencoder, the reconstructed activation after detoxification is obtained. The reconstructed activation is used to replace the original input activation and input into the subsequent layers of the large language model to guide the large language model to generate non-toxic output content.

2. The detoxification method for large language models based on Euclidean flow matching according to claim 1, characterized in that: The process of transforming the SAE features to be intervened using the Euclidean flow matching feature transformation operator to generate the detoxified features after intervention includes the following steps: Within the Euclidean SAE feature space, an instantaneous velocity field based on continuous normalized flow is constructed. This instantaneous velocity field is used to characterize the instantaneous evolution speed and direction of SAE features within the normalized time interval [0,1]. Using toxicity characteristics as the starting point of evolution and predefined non-toxic characteristics as the endpoint of evolution, a mean path of Euclidean linear interpolation is constructed. The target velocity field for flow matching is obtained by differentiating the mean path with respect to time. The instantaneous velocity field is trained by using the square of the L2 norm as a loss function to achieve flow matching and alignment with the target velocity field, thus obtaining a converged velocity field. If intervention is triggered during the inference phase, multi-step numerical integration is performed on the instantaneous velocity field that has converged during training in the normalized time interval [0,1] to obtain the Euclidean flow matching feature transformation operator. The Euclidean flow matching feature transformation operator is used to perform a global smoothing mapping on the SAE features to be intervened that trigger intervention, thereby generating the detoxification features after intervention.

3. The detoxification method for large language models based on Euclidean flow matching according to claim 2, characterized in that: After performing a toxicity subspace assessment on the SAE features and triggering an intervention, feature transformation is performed using any of the following intervention strategies: (1) Minimize intervention strategy: Only perform transformation on the SAE feature corresponding to the last word in each generation time step, and retain the original value of the remaining word features; (2) Maximize intervention strategy: Perform transformation on a word-by-word basis for the SAE features corresponding to all words in the generation process; (3) Adaptive intervention strategy: Based on the preset decay coefficient, set the dynamic intervention probability for each generated word, and perform transformation on the SAE features of the corresponding word according to the intervention probability, while the remaining words retain the original features.

4. The detoxification method for large language models based on Euclidean flow matching according to claim 2, characterized in that: The specific steps for performing toxicity subspace determination on SAE features are as follows: Preconstruct toxicity feature subspace and non-toxicity feature subspace, and calculate the matching score between the SAE feature to be detected and the toxicity feature subspace; When the matching score exceeds the preset intervention threshold, intervention is triggered; the preset intervention threshold is a fixed threshold or an adaptive threshold that is dynamically adjusted during the generation process.

5. The detoxification method for large language models based on Euclidean flow matching according to claim 4, characterized in that: The sparse autoencoder is a pre-trained model. During training, the backbone weights of the large language model are fixed, and only the encoder and decoder of the sparse autoencoder are trained. The trained sparse autoencoder is used to extract interpretable semantic features corresponding to the activation of the intermediate layers of the large language model.

6. The detoxification method for large language models based on Euclidean flow matching according to claim 2, characterized in that: The toxicity subspace judgment of SAE features is specifically performed by using a multi-layer Lipschitz MLP classifier to detect toxicity trigger risk in real time.

7. The detoxification method for large language models based on Euclidean flow matching according to claim 6, characterized in that: The large language model detoxification method based on Euclidean flow matching is executed in a hardware architecture that includes a host and multiple accelerator cards, wherein: The host is responsible for task distribution, data preprocessing, result aggregation, and global scheduling; Main inference accelerator card execution: large language model inference, raw input activation extraction, SAE feature encoding and decoding, and activation replacement and subsequent generation; Toxicity Assessment Accelerator: Performs toxicity subspace assessment and intervention trigger assessment based on SAE characteristics; Detoxification transformation acceleration card execution: inference of Euclidean flow matching feature transformation operator, detoxification transformation of SAE features.

8. A detoxification device based on a large language model using Euclidean flow matching, characterized in that: The device includes a host computer, a main inference acceleration card that establishes a communication connection with the host computer, a toxicity determination acceleration card, and a detoxification transformation acceleration card; the detoxification device based on Euclidean flow matching and a large language model performs the following steps: Step S1: The host receives the user's input text, completes the text preprocessing, and then distributes the large language model inference task to the main inference acceleration card. Step S2: The main inference acceleration card performs large language model inference, generates output sequences word by word, and extracts the original input activations of the intermediate layer of the large model in real time. The SAE features are obtained by encoding through a pre-trained sparse autoencoder and then transmitted to the toxicity determination acceleration card. Step S3: The toxicity determination acceleration card performs a toxicity risk assessment on the received SAE features based on the pre-constructed toxicity feature subspace. If the intervention triggering conditions are met, the card sends a detoxification instruction and the SAE features to be intervened to the detoxification transformation acceleration card. Step S4: The detoxification transformation acceleration card calls the CNF velocity field and transforms the SAE features to be intervened through the Euclidean flow matching feature transformation operator to obtain the detoxification features after intervention. The detoxified features after intervention are input into the decoder of the sparse autoencoder for reconstruction, and the reconstructed detoxified features are activated and sent back to the main inference acceleration card. Step S5: The main inference acceleration card uses the received reconstructed activation to replace the original input activation of the corresponding intermediate layer of the large language model, and feeds the replaced activation back into the subsequent network layers of the large model to guide the model to generate non-toxic output content. Step S6: The host aggregates the generated sequence output by the main inference accelerator card, processes it, and returns the final detoxified output content to the user.

9. The detoxification device based on Euclidean flow matching for a large language model according to claim 8, characterized in that: The large language model detoxification device based on Euclidean flow matching performs the large language model detoxification method based on Euclidean flow matching as described in any one of claims 1-7.

Images