A Detoxification Method and Device Based on a Large Language Model Using Riemannian Flow Matching

Abstract

This invention discloses a method and apparatus for detoxification of large language models based on Riemann flow matching, belonging to the field of artificial intelligence technology. It addresses the pain points of existing detoxification schemes, such as easy semantic shift and difficulty in balancing detoxification effectiveness and generation quality. This invention extracts interpretable SAE features from the intermediate layer activations of a large language model using a sparse autoencoder. After toxicity subspace determination, for the SAE features that trigger intervention, a semantic null space smoothing detoxification transformation is performed using a Riemann flow matching feature transformation operator constructed from a semantic Riemann manifold. The detoxified features are decoded and reconstructed into detoxified activations, replacing the original model input activations to guide the generation of non-toxic outputs. This invention eliminates the need for fine-tuning the model's backbone weights, achieving efficient and accurate detoxification while geometrically avoiding semantic shifts, thus balancing core semantic integrity and generation fluency. It can be applied to large language model scenarios.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence, specifically to a method and apparatus for detoxification of large language models based on Riemannian flow matching. Background Technology

[0002] As a highly influential and widely followed research area in the field of artificial intelligence, Large Language Models (LLMs) have driven numerous practical applications. However, LLMs pose a risk of generating harmful content such as negative information and biased expressions. This problem stems from the inherent characteristics of their training process: the model needs to ingest massive amounts of internet corpora during training, and these corpora have not undergone thorough cleaning. Various harmful information from human society contained within these corpora is learned and absorbed by the model and reproduced during content generation. Furthermore, the model is susceptible to external manipulation such as prompt word injection and jailbreak attacks, which can lead to the output of toxic content. Therefore, the security issues of LLMs have become a crucial and urgent problem that cannot be underestimated.

[0003] Against this backdrop, the concept of Large Language Model Detoxification (LLM Detoxification) and related engineering have emerged. LLM Detoxification is a technical system with the core objective of suppressing the generation of toxic content by large language models. It is mainly achieved through a variety of technical means such as corpus text processing, model intervention, and engineering control.

[0004] The core objective of LLM detoxification is to minimize or eliminate the possibility of harmful content output by the model without compromising the original core capabilities of LLM—including content generation, semantic understanding, and downstream task execution performance. This technology is not only a crucial element for the secure deployment and trusted application of large language models, but also a key research direction in the field of artificial intelligence security. Currently, various LLM detoxification technologies have emerged in the industry, which can be mainly divided into three categories:

[0005] (1) Alignment during training: The core idea is to optimize model parameters from the source. The core logic of this approach is to inject safety preferences into the model during the training or fine-tuning phase, thereby reducing the probability of generating toxic content from the source by modifying the underlying parameters of the model. Specific implementation methods include data cleaning and safety fine-tuning, human preference alignment, and de-biased training. Essentially, it uses safe data and preference signals to guide the model to establish a core pattern of "non-toxic generation".

[0006] (2) Intervention during inference, characterized by not modifying the original model parameters but dynamically adjusting them during the content generation process. This approach intervenes in the content generation process in real time through representation editing, feature control, and decoding control, offering advantages such as flexibility, efficiency, lightweight design, and rapid iteration. It has become a mainstream research direction in the field of LLM detoxification. Further subdivided, this type of technology can be divided into two specific forms: decoding layer intervention and representation layer intervention.

[0007] (3) Full-process multi-layer defense pipeline technology. Its core concept is not to rely on the result of a single generation of the model, but to conduct a comprehensive review and repair of the entire process of "input-generation-output". Through multi-layer defense mechanisms, the security of the final output content is ensured.

[0008] In existing technologies, intervention methods based on sparse autoencoders (SAEs) belong to the second category of technologies mentioned above. While this method reduces toxic output by indiscriminately absolving toxic features in the model, it also doubles the fluency loss in non-toxic content generation. It's worth noting that the core role of SAEs in this approach is to decompose the activation signals within the LLM into sparse, single-semantic interpretable features, which provides a foundation for precise feature-level control. Currently, SAEs have been applied to scenarios such as LLM bias elimination and rejection behavior control; however, their inherent limitation of indiscriminate intervention in detoxification applications remains unresolved. The relevant existing technologies are as follows:

[0009] Prior Art 1: A. Goyal, V. Rathi, W. Yeh, Y. Wang, Y. Chen, and H.Sundaram, “Breaking bad tokens: Detoxification of LLMs using sparseautoencoders,” in Proceedings of the 30th Conference on Empirical Methods inNatural Language Processing, Suzhou, JS, China, November 2025, pp. 12691–12709.

[0010] Prior art 2: CN121212369B, a feature editing method for content security of large language models.

[0011] The core implementation logic of existing technology 2 is as follows: A sparse autoencoder maps the intermediate activation signals of a large language model to a sparse feature space, extracts the sparse feature differences between positive and negative inputs, and constructs a key dimension index set accordingly. Subsequently, based on this index set, targeted enhancement and suppression are applied to the original sparse features, replacing the original activation signals with the reconstructed activation signals. This achieves lossless control over the model output without requiring fine-tuning of the model to guide the output content to comply with safety standards. While this approach has certain advantages, it still has significant shortcomings: it is a static, binary, index-based feature intervention mode. By comparing the sparse features of positive and negative input pairs to construct a fixed positive / negative feature index set, it only performs index-based targeted enhancement or suppression on the original features of new inputs. The intervention logic presents a binary adjustment of features, essentially a static on / off control of feature dimensions. This intervention mode leads to significant room for improvement in intervention accuracy, generation quality protection, and system robustness. It also suffers from prominent problems such as inaccurate feature localization and semantic entanglement.

[0012] In summary, current LLM detoxification solutions—whether data-driven, decoding-controlled, or model-editing—have failed to effectively balance the core contradiction between "detoxification effect" and "generation quality," which is also a key bottleneck that urgently needs to be overcome in the current LLM detoxification technology field. Summary of the Invention

[0013] To alleviate or partially alleviate the above-mentioned technical problems, the solution of the present invention is as follows:

[0014] On the one hand, this invention discloses a detoxification method for large language models based on Riemannian flow matching, comprising the following steps:

[0015] When the large language model performs inference and generates each word, the intermediate layer outputs the original input activation; the original input activation is used as the input of the encoder of the sparse autoencoder and after encoding, the SAE features are obtained.

[0016] Toxicity subspace judgment is performed on SAE features: if intervention is triggered, the SAE features to be intervened are transformed by the Riemann flow matching feature transformation operator to generate detoxification features after intervention.

[0017] After the detoxified features are decoded by the decoder of the sparse autoencoder, the reconstructed activation after detoxification is obtained. The reconstructed activation is used to replace the original input activation and input into the subsequent layers of the large language model to guide the large language model to generate non-toxic output content.

[0018] Furthermore, the step of transforming the SAE features to be intervened using the Riemann flow matching feature transformation operator to generate the detoxification features after intervention specifically includes the following steps:

[0019] Within the semantic Riemannian manifold (SAE) feature space, a Riemannian flow matching feature transformation operator based on continuous normalized flow is pre-constructed. This Riemannian flow matching feature transformation operator is used to characterize the continuous and smooth mapping relationship from toxic features to non-toxic features and avoids core semantic shifts.

[0020] When intervention is triggered during the inference phase, the SAE features to be intervened are mapped and transformed by the Riemann flow matching feature transformation operator to generate the detoxified features after intervention.

[0021] Furthermore, the step of transforming the SAE features to be intervened using the Riemann flow matching feature transformation operator to generate the detoxification features after intervention specifically includes the following steps:

[0022] Within the semantic Riemannian manifold (SAE) feature space, a dual-drive proxy semantic field and an instantaneous velocity field based on continuous normalized flow are pre-constructed. The dual-drive proxy semantic field is used to characterize the degree of preservation of the core semantics of the large model corresponding to the SAE features, and the instantaneous velocity field is used to characterize the instantaneous evolution speed and direction of the SAE features on the semantic Riemannian manifold within the normalized time interval [0, 1].

[0023] Using toxicity features as the starting point of evolution and predefined non-toxicity features as the endpoint of evolution, a basic path of Euclidean linear interpolation is constructed. The basic path is then projected onto the semantic null space defined by the dual-drive proxy semantic field to construct a geometrically aligned target vector field.

[0024] The instantaneous velocity field is trained by constraining the Riemann flow matching loss function, so that the learned instantaneous velocity field is aligned with the target vector field by flow matching under the semantic Riemann metric constraint, and the trained and converged velocity field is obtained.

[0025] When intervention is triggered during the inference phase, multi-step numerical integration is performed on the instantaneous velocity field that has converged during training over the normalized time interval [0, 1] to obtain the Riemann flow matching feature transformation operator.

[0026] The SAE features to be intervened that trigger intervention are subjected to global smoothing mapping in the semantic null space by the Riemann flow matching feature transformation operator, thereby generating the detoxified features after intervention.

[0027] Furthermore, after performing a toxicity subspace assessment on the SAE features and triggering an intervention, feature transformation is performed using any of the following intervention strategies:

[0028] (1) Minimize intervention strategy: Only perform transformation on the SAE feature corresponding to the last word in each generation time step, and retain the original value of the remaining word features;

[0029] (2) Maximize intervention strategy: Perform transformation on a word-by-word basis for the SAE features corresponding to all words in the generation process;

[0030] (3) Adaptive intervention strategy: Based on the preset decay coefficient, set the dynamic intervention probability for each generated word, and perform transformation on the SAE features of the corresponding word according to the intervention probability, while the remaining words retain the original features.

[0031] Furthermore, the toxicity subspace determination of the SAE features specifically involves:

[0032] Preconstruct toxicity feature subspace and non-toxicity feature subspace, and calculate the matching score between the SAE feature to be detected and the toxicity feature subspace;

[0033] When the matching score exceeds the preset intervention threshold, intervention is triggered; the preset intervention threshold is a fixed threshold or an adaptive threshold that is dynamically adjusted during the generation process.

[0034] Furthermore, the sparse autoencoder is a pre-trained model. During training, the backbone weights of the large language model are fixed, and only the encoder and decoder of the sparse autoencoder are trained. The trained sparse autoencoder is used to extract interpretable semantic features corresponding to the activation of the intermediate layers of the large language model.

[0035] Furthermore, the toxicity subspace judgment of SAE features is specifically performed by using a multi-layer Lipschitz MLP classifier to detect toxicity trigger risk in real time.

[0036] Furthermore, the large language model detoxification method based on Riemann flow matching is executed in a hardware architecture including a host and multiple accelerator cards, wherein:

[0037] The host is responsible for task distribution, data preprocessing, result aggregation, and global scheduling;

[0038] Main inference accelerator card execution: large language model inference, raw input activation extraction, SAE feature encoding and decoding, and activation replacement and subsequent generation;

[0039] Toxicity Assessment Accelerator: Performs toxicity subspace assessment and intervention trigger assessment based on SAE characteristics;

[0040] Detoxification Transformation Accelerator Execution: Inference of Riemann Flow Matching Feature Transformation Operator, Detoxification Transformation of SAE Features.

[0041] On the other hand, this invention also discloses a detoxification device based on a large language model using Riemannian flow matching:

[0042] The device includes a host computer, a main inference acceleration card that establishes a communication connection with the host computer, a toxicity determination acceleration card, and a detoxification transformation acceleration card; the detoxification device based on the large language model of Riemann flow matching performs the following steps:

[0043] Step S1: The host receives the user's input text, completes the text preprocessing, and then distributes the large language model inference task to the main inference acceleration card.

[0044] Step S2: The main inference acceleration card performs large language model inference, generates output sequences word by word, and extracts the original input activations of the intermediate layer of the large model in real time. The SAE features are obtained by encoding through a pre-trained sparse autoencoder and the SAE features are synchronously transmitted to the toxicity determination acceleration card.

[0045] Step S3: The toxicity determination acceleration card performs a toxicity risk assessment on the received SAE features based on the pre-constructed toxicity feature subspace. If the intervention triggering conditions are met, the card sends a detoxification instruction and the SAE features to be intervened to the detoxification transformation acceleration card.

[0046] Step S4: After receiving the detoxification instruction, the detoxification transformation accelerator card calls the pre-trained converged continuous normalized flow velocity field based on semantic Riemannian manifold constraints. Through the Riemannian flow matching feature transformation operator, it performs a smooth mapping transformation in the semantic null space on the SAE features to be intervened, and obtains the detoxified SAE features after intervention. The detoxified SAE features are input into the decoding layer of the sparse autoencoder for reconstruction, and the reconstructed activation after detoxification is obtained. The reconstructed activation is then sent back to the main inference accelerator card.

[0047] Step S5: The main inference acceleration card uses the received reconstructed activation to replace the original input activation of the corresponding intermediate layer of the large model, and feeds the replaced activation back into the subsequent network layers of the large model to guide the model to generate non-toxic output content.

[0048] Step S6: The host aggregates the generated sequence output by the main inference accelerator card, processes it, and returns the final detoxified output content to the user.

[0049] Furthermore, the Riemann flow matching-based large language model detoxification device performs the Riemann flow matching-based large language model detoxification method as described in any of the preceding claims.

[0050] The technical solution of this invention has one or more of the following beneficial technical effects:

[0051] (1) This invention achieves efficient LLM detoxification through local editing at the SAE feature level, significantly reducing toxicity indicators while only slightly losing the quality of generated content.

[0052] (2) At the conceptual level of problem-solving, this invention achieves a hierarchical improvement compared to traditional constrained deep learning schemes (such as related schemes based on Euclidean flow matching), upgrading the technical concept from a constrained deep learning framework to the core level of Generative Manifold Geometry. This improvement also makes the detoxification scheme proposed in this invention more interpretable.

[0053] Specifically, in Euclidean flow matching-based schemes, the naive feature transformation stage has potential stability risks. This risk may not only affect the stability of the detoxification effect but also lead to semantic shift problems. To fundamentally solve the stability problem caused by naive feature transformation and effectively avoid the risk of semantic shift, this invention no longer uses the Euclidean flow matching method. Instead, it innovatively formalizes the LLM detoxification problem into a Riemannian flow matching (RFM) problem on a constrained semantic manifold. Through this formal transformation, more accurate and stable detoxification control is achieved.

[0054] (3) The intervention operation is constrained from the activation layer space of the model to the feature subspace, and the degree of feature transformation can be precisely controlled. In contrast, existing methods operate in a dense and entangled activation layer space, which makes it difficult to capture fine-grained semantic information.

[0055] (4) The present invention operates within the toxicity feature subspace obtained through learning, and guides local feature editing through a smooth feature transformation method, which effectively avoids the problem of unstable detoxification effect when the model is shifted in feature distribution.

[0056] (5) The present invention designs three feature intervention strategies: maximization, minimization and adaptive, to adapt to different safety control needs and scenarios: a) Minimization strategy, lightweight intervention, low time increment, suitable for scenarios with high efficiency requirements and low toxicity risk; b) Maximization strategy, deep intervention, optimal detoxification effect, suitable for scenarios with low time sensitivity but high safety requirements; c) Adaptive strategy, dynamically adjusts the intervention intensity, suitable for most comprehensive scenarios.

[0057] Furthermore, other beneficial effects of the present invention will be mentioned in the specific embodiments. Attached Figure Description

[0058] Figure 1 This is a flowchart of the detoxification method based on Riemannian flow matching for large language models according to the present invention.

[0059] Figure 2 This is a flowchart of the detoxification method based on a large language model using Riemannian flow matching, as described in this invention.

[0060] Figure 3 This is a schematic diagram of the detoxification device based on a large language model using Riemannian flow matching, as per the present invention. Detailed Implementation

[0061] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0062] To facilitate a clear description of the technical solutions in the embodiments of the present invention, the terms "first" and "second" are used to distinguish identical or similar items with essentially the same function and effect. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or execution order.

[0063] Analysis of existing technologies by the inventors revealed that current SAE-Steering-based methods for detoxification involve indiscriminately shifting toxicity features in the opposite direction, failing to precisely control the degree of manipulation and resulting in a significant sacrifice in generation fluency during detoxification. Specifically, existing technologies decompose LLM internal activations into sparse, single-semantic interpretable features, providing a foundation for precise feature-level control. Previous research has used SAE for LLM bias elimination and rejection behavior control, but its application in detoxification suffers from indiscriminate intervention.

[0064] Based on this discovery and analysis, the core improvements of this invention are at least reflected in: (1) by learning the toxicity subspace, the intervention is constrained within the feature-level toxicity subspace, thereby achieving accurate positioning and granular differentiation of toxicity features and avoiding disturbance of irrelevant features; (2) the large model detoxification problem is formalized into Riemannian flow matching on the constrained semantic manifold, which solves the potential instability and semantic offset problem of naive feature transformation.

[0065] This invention pertains to a constrained deep learning approach. Its core element—Riemann flow matching—serves as the key technology supporting subspace-aware feature transformation and is crucial for achieving a smooth remapping of toxic features from a toxic to a non-toxic distribution. Traditional SAE intervention methods, with their simple reverse shift / hard suppression of toxic features, cause abrupt changes in the feature distribution of the LLM latent space, leading to decreased fluency and semantic breaks in the generated text. In contrast, EFM's core function is to learn a continuous and smooth transformation flow from a toxic feature distribution to a non-toxic feature distribution within the learned toxic subspace. This ensures that the adjustment process of toxic features follows a continuous trajectory, rather than a radical hard adjustment, thus avoiding the instability of the detoxification effect caused by feature distribution shifts.

[0066] Figure 1 This is a flowchart of the detoxification method for large language models based on Riemann flow matching, as described in this invention. A large language model (LLM) is essentially a neural network, comprising multiple layers. In this invention, following the execution order of neural network inference, it is divided into a backbone layer and subsequent layers, each comprising multiple layers. For example, the backbone layer includes layers 0 to 1, and the subsequent layers include layers 1 to L+1. The last layer of the backbone layer is an intermediate layer (layer 1) in the LLM, where 1 and L are both positive integers.

[0067] To facilitate understanding, the main concepts and processes of this invention will be explained below. When the large language model performs inference and generates the i-th token, the intermediate layer outputs the original input to activate a. (i) , where i is a positive integer. Here, a (i) These are the native activation values ​​of LLM (assuming no detoxification is performed) used for calculations in subsequent layers, and are the core data generated during the inference process.

[0068] Original input activation a (i) As input to the sparse autoencoder, after encoding, the resulting SAE features are: Here It is a feature space representation used for toxicity determination and detoxification transformation.

[0069] Next, the SAE features were analyzed. Perform toxicity subspace judgment: If intervention is triggered, then match the feature transformation operator using Riemannian flow. The SAE characteristics to be intervened are transformed to generate detoxification characteristics after intervention. If no intervention is triggered, the transformation will not be performed. In other words, the SAE feature to be intervened, after undergoing detoxification intervention, becomes the detoxified feature. .

[0070] Detoxification characteristics after intervention After SAE decoding, the reconstructed and activated product is obtained after detoxification treatment. .

[0071] Finally, activate after refactoring. Replace the original input to activate a (i) This inputs to subsequent layers, guiding the LLM to generate non-toxic output content.

[0072] The above is an introduction to the typical features of the present invention in some typical cases. There are more technical details, such as the intervention strategy and the specific intervention method, which will be explained later.

[0073] Figure 2This is an architecture diagram of the large language model detoxification method of this invention. The LLM detoxification method mainly includes four stages or steps, among which the Riemann flow matching scheme is applied to the "subspace perceptual feature transformation" stage. In summary, it includes at least the following stages / steps:

[0074] (a) Stable Feature Selection. In this step, using 9 languages ​​and 400 pairs of "toxic-nontoxic" samples from the TextDetox dataset, residual flow activations of the LLM target layer are extracted. The t-statistic is used to calculate the activation differences of SAE features in toxic / non-toxic samples, and the top-k toxicity-related features, where k is a positive integer (for example, k=128), constitute a stable subset of toxicity features. ), filtering out low-activation, non-toxic, general multilingual features.

[0075] (b) Toxicity Subspace Learning and Detection. In this step, contrastive loss is introduced to construct separation rules for toxic / non-toxic feature clusters, and a feature subspace characterizing toxicity is learned to achieve fine-grained toxicity feature differentiation. A multilayer Lipschitz perceptron (MLP) classifier is constructed based on the toxicity feature subset to detect toxicity triggering risks in real time during the generation process.

[0076] (c) Subspace-Aware Feature Transformation. In this step, Euclidean flow matching is abandoned in favor of Riemannian flow matching. The new approach transforms and detoxifies SAE toxicity features while strictly protecting the core semantics of the model from shift, thus addressing the weakness of Euclidean flow matching, which only performs feature transformations in Euclidean space and easily destroys the original semantics. In other words, the new approach formalizes the large-scale model detoxification problem into Riemannian flow matching on a constrained semantic manifold, fundamentally solving the potential instability and semantic shift problems of naive feature transformations.

[0077] In summary, compared to the Euclidean flow matching scheme, the Riemann flow matching-based scheme includes three core technical improvements:

[0078] - Lightweight semantic benchmarking through dual-drive proxy semantic fields;

[0079] - By using semantic Riemannian manifolds, we can give the feature space a semantically protected metric;

[0080] - Construct semantically protected feature transformations by matching targets using Riemannian flow.

[0081] (d) Feature intervention strategy. This step involves three strategies: maximization, minimization, and adaptive strategies. These strategies regulate the timing and intensity of intervention to achieve smooth suppression of toxic features.

[0082] The following sections will describe in detail the implementation process and details of the technical solution of this invention, based on the above framework. It is worth noting that the parameters (quantity, factors, etc.), hyperparameters, and datasets used in the specific embodiments here are generally exemplary examples and not intended as the sole limitation of this invention. Those skilled in the art can appropriately adjust these elements based on the concept of this invention to obtain similar technical effects.

[0083] Given a prefix consisting of I positive integers of tokens Large language models generate output sequences in an autoregressive manner, prompted by the input context. The goal of language model detoxification is to reduce the probability of generating toxic content while maintaining the quality of the generated content.

[0084] Regarding sparse autoencoders (SAEs), given the original input activations in the target layer corresponding to the input prefix... (When generating the i-th word, the corresponding activation of the original input is a) (i) , , (where is a positive integer), a sparse autoencoder (SAE) aims to decompose complex activation features into more interpretable high-dimensional representations. This model activates the original input a (i) The original features generated by the sparse autoencoder, which maps to sparse feature activation vectors. , and and decode it into the activation of reconstruction. :

[0085] ,

[0086] ,

[0087] Where f is the original feature generated by the sparse autoencoder. It is the encoder mapping function of a sparse autoencoder, with weights. 'a' is the original input activation. For the decoder parameters of the sparse autoencoder, The encoder parameters are for the sparse autoencoder; It is the activation of reconstruction. It is the decoder mapping function of the sparse autoencoder, with weights. , .

[0088] For example, when generating the i-th word, the corresponding original input activation is a. (i) After SAE encoding, SAE features are obtained. .

[0089] The model loss is minimized by two mutually constraining parameters: one is the square of the L2 norm. The reconstruction error is measured by two hyperparameters that characterize the sparsity of the hidden layer encoding. Weighted L1 regularization penalty term:

[0090] ,

[0091] in, For SAE loss, For reconstruction error, is a hyperparameter, and f is the original feature generated by the sparse autoencoder.

[0092] The L1 penalty term forces the hidden layer to encode—most elements of the original feature f generated by the sparse autoencoder are 0. This prompts the sparse autoencoder to learn localized features, so that each activation dimension in the original feature f generated by the sparse autoencoder ideally corresponds to a single and interpretable feature.

[0093] (A) Selection of stable features. In order to identify informational features for detoxification tasks in the sparse autoencoder (SAE) space, this invention uses the TextDetox dataset containing pairs of “toxic” and “non-toxic” prefixes, which are generated by restatement and retain the same meaning.

[0094] In the feature collection phase, in this invention, for a given pair of samples: Each prefix is ​​input into a frozen, pre-trained large language model, and residual stream activations of the target layer are extracted. These activations are passed through a pre-trained SAE encoder (whose mapping function is...). The process is performed to obtain the latent feature matrix. Where n is the number of sample pairs, m is the size of the SAE dictionary, and i is the index. It has a toxic prefix. It is a non-toxic prefix. It's a toxic label. It is a non-toxic label.

[0095] While initial filtering can separate significant noisy activation patterns for feature pruning of the core set, evaluating features independently using simple scalar statistics ignores the complex covariance structure of the multi-semantic latent space. To strictly isolate semantics that trigger toxicity while preserving the activation manifold geometry, this invention transforms feature selection into a column subset selection problem (CSSP) within the core set framework.

[0096] Assume the contrastive activation matrix is , where the i-th row The precise directional offset from the non-toxic generation space to the toxic generation space is encoded, where The toxic activation is in line i. The i-th row is non-toxic and activated. For Its singular decomposition is as follows:

[0097] ,

[0098] in, , And all of them are matrices with orthogonal columns. , , is the singular value of D, n is the number of sample pairs, and m is the size of the SAE dictionary. This is the transpose symbol.

[0099] To capture each SAE feature dimension To assess the structural importance of toxicity-biased manifolds, this invention calculates the sensitivity using ridge leverage scores. The regularization parameter for ridge regression is also considered. column j Its ridge leverage score It can be precisely derived from the right singular vector:

[0100] ,

[0101] in, It is a ridge lever score, yes The j-th column, It is the transpose symbol. It is the regularization parameter of ridge regression. It is an n-order identity matrix. yes The i-th singular value, V ji It is the i-th component of the j-th row of V, where i and j are both indices of the feature.

[0102] Define a sampling distribution P over all m features, where the selected features... probability Strictly proportional to its sensitivity boundary:

[0103] ,

[0104] in, It is a feature The probability of being selected. , All are ridge leverage scores. As a feature, m is the size of the SAE dictionary. It is an index.

[0105] This invention samples k features (e.g., k=128) based on a sampling distribution P to construct a stable subset of toxicity features. To ensure a sparse subset of toxicity features. In the downstream subspace learning process, as an unbiased estimator of the complete m-dimensional SAE feature space, each selected feature s is assigned a Coreset Rescaling Weight (CRW):

[0106] ,

[0107] in, The core set scaling weights, where k is the number of features sampled. It represents the probability that feature s is selected.

[0108] Theoretically, let For the sampling matrix, diagonal elements are The diagonal matrix, the core activation matrix is It is not difficult to prove that: , The sign is transpose. This confirms that it is a bias-free estimator of the true toxicity offset covariance. Furthermore, applying the matrix Bernstein inequality, it can be determined by choosing... These features ensure a tight spectral approximation. This theoretically ensures the subset of toxicity characteristics. While filtering out common language patterns, it retains the mathematically optimal solution features required for high-fidelity interpretation, among which... It is a ridge lever score, , It is a separation interval. It is a positive smoothing term.

[0109] (B) Learning and detection of the toxicity subspace. Although the above feature filtering methods have separated two significant noisy activation modes, the inherent weak correlation and semantic dispersion between SAE features make it difficult to represent complex toxicity patterns.

[0110] Therefore, this invention proposes to construct a subspace that is located within a subset of toxicity features. The subspace forms a compact discriminative region, and a classifier is built based on this subspace to assess the risk of toxicity triggering at the feature level. Ideally, the subspace learner should be lightweight and easily updated quickly, as it will be used in conjunction with the feature transformation process to guide the generation of the underlying large language model. For labeled feature pairs... Its loss function is:

[0111] ,

[0112] in, It is a gapped classification contrastive loss, used for subsets of toxicity features. The tight, toxic, exclusive subspace for learning. , It is a subset of toxicity characteristics A labeled feature pair, and It is an anchor point feature. These are positive sample features. It is a subset of toxicity characteristics A candidate feature, It is a separation interval. It's a temperature parameter. It is an indicator function used to apply a separating margin penalty only to positive samples; to ensure the unbiased estimation properties of the core set obtained from the steps / steps selected for stable features, during batch optimization, for each selected feature... The contribution to the loss is determined by its corresponding core set weight. Scaling is applied; k is the index of the positive samples, and c is the subset of toxicity features. The traversal index of all candidate features.

[0113] In this formula, the denominator is a subset of toxicity features. Summing all candidate features, and calculating the sum of all features and the anchor feature used as the anchor point. The similarity between the samples constitutes the normalized denominator of the contrast loss. In the numerator, only positive sample pairs are calculated. , The similarity between ().

[0114] The interval-margined classification contrast loss obtained by this formula aims to maximize the similarity of positive samples and minimize the similarity of negative samples.

[0115] ,

[0116] in, It is the total loss. These are hyperparameters used to balance the weights of the two types of losses. It is cross-entropy loss. For including separation interval The classification comparison loss.

[0117] Optionally, a toxicity subspace judgment is performed on the SAE features. Specifically, this can be done by: pre-constructing a toxicity feature subspace and a non-toxicity feature subspace, and calculating the matching score between the SAE feature to be detected and the toxicity feature subspace; when the matching score exceeds a preset intervention threshold, intervention is triggered; the preset intervention threshold is a fixed threshold or an adaptive threshold that is dynamically adjusted during the generation process.

[0118] (C) Subspace-aware feature transformation. In this step / stage, the present invention mainly introduces three major improvement directions: dual-drive proxy semantic field, semantic Riemannian manifold, and semantic flow matching target.

[0119] Since it is computationally infeasible to directly measure the degree of semantic preservation through the predicted distribution of the language model during the integration process, this invention introduces a lightweight dual-drive proxy semantic field. The parameterization is performed by a multilayer perceptron, and its training objective is to approximate the KL divergence of a large language model within the local feature neighborhood.

[0120] ,

[0121] in, The semantic field of the dual-drive agent is related to the mean activation strength. The training loss function, It is the mathematical expectation. The original feature f generated by the sparse autoencoder follows a toxicity feature. The mean and Σ are normal distributions, meaning that training is performed only on feature points sampled in the local neighborhood of the toxicity feature. It is a dual-drive proxy semantic field, a lightweight approximation of the native semantics of LLM; It is the native semantic preservation metric of LLM (i.e., KL divergence, used to measure the difference between two distributions), and it is also the true value that the dual-drive proxy semantic field needs to approximate. This is the lexical prediction distribution of LLM under the original, uninterrupted features, representing the original core semantics. It is the word prediction distribution of LLM under the original features f generated by the current sampled sparse autoencoder. It is an L2 norm; It is the regularization coefficient, used to adjust the weight of the penalty term in the total loss. The gradient of the proxy semantic field with respect to the original features f generated by the sparse autoencoder.

[0122] Here, let the L2 norm of the aforementioned gradient be... Approximating to 1 means forcing the dual-drive proxy semantic field to satisfy Lipshitz continuity, ensuring that small feature changes in the feature space will only bring small semantic value changes, avoiding semantic field mutations, and can apply a key L1 sparse topology to the SAE feature space, matching the sparsity features of SAE, and ensuring the compatibility between the proxy semantic field and the SAE feature space.

[0123] The first half of the above formula It is the principal term, the fitting loss term, and is used to approximate the native KL divergence of LLM. Its function is to make the output of the proxy semantic field as consistent as possible with the KL divergence of the LLM prediction distribution, so as to achieve an accurate approximation of the native semantic measure. It is the accurate fitting driver in the so-called "dual-drive" proxy semantic field.

[0124] The second half of the above formula , is a regularization penalty term that imposes a constraint on the proxy semantic field to force it to satisfy Lipshitz continuity. It is used to ensure the topological stability of the semantic field and avoid poor fitting or instability of the dual-drive proxy semantic field. It is the topological stability driver in the so-called "dual-drive" proxy semantic field.

[0125] Furthermore, this invention assigns a Riemannian metric tensor to the latent space. This is used to actively penalize semantic perturbations. For any tangent vector at feature point z... The metric is defined as follows:

[0126] ,

[0127] in, It is a specific form of the Riemann metric tensor (the Riemann metric is point-dependent, and the semantic protection strength of different feature points is different, as are the metric rules). These are two arbitrary tangent vectors at the feature point z; It is the identity matrix; It is the semantic penalty coefficient; It is the gradient of the dual-drive proxy semantic field with respect to the original features f generated by the sparse autoencoder. It is the mean activation intensity; yes The transpose of .

[0128] The purpose of this formula is to endow the SAE feature space with semantically aware distance / length metric rules, allowing the feature space to actively identify and penalize feature transformations that violate the core semantics. Under the definition of the core Riemannian metric tensor of this semantic Riemannian manifold, the square norm of the velocity vector can be decomposed into... Therefore, any trajectory that alters the core semantics ( All of these will generate huge geometric lengths. In other words, from a mathematical perspective, the detoxification order will automatically avoid the geodesic of semantic offset.

[0129] In this invention, a semantic perturbation penalty term (with a coefficient of ) is used. This means that feature transformations along semantic directions are amplified in length by the Riemannian metric, forcing the detoxification path to automatically avoid semantic directions and choose the path in the semantic null space to complete the transformation, thereby achieving semantic preservation.

[0130] Finally, in the process of matching targets with Riemannian streams, given pairs of (toxic features, non-toxic features) = The optimal transmission path is A geodesic line 𝛾(𝑡) on the line, in which It is a Riemannian metric tensor, which is a semantic protection rule on a manifold. It is a Riemannian manifold ontology, corresponding to the semantically constrained SAE feature space, which can be regarded as the operational stage for detoxification transformation. To circumvent the intractable boundary value problem of accurately solving high-dimensional geodesics, this invention constructs a geometrically aligned target vector field by projecting the Euclidean flow onto the semantic null space:

[0131] , ,

[0132] in, The target vector field after projecting the original features f generated by the sparse autoencoder at time step t, with f as the feature points. t These are the original features generated by the sparse autoencoder corresponding to time step t. It is a toxic characteristic. It is a non-toxic characteristic. It is the identity matrix. It is in f t The gradient of the semantic field of the dual-drive proxy with respect to features. yes transpose, It is a very small positive number and also a smooth term; It is a projection operator, and its essence is an orthogonal projection matrix.

[0133] Regarding the projection operator, the original Euclidean vector... After projection by the projection operator, all components that would disrupt the core semantics are completely removed, retaining only the detoxification direction without semantic disturbance. This is also... The core reason why it can be used as a target for Riemann flow matching.

[0134] Subsequently, continuous normalized flow The vector field is trained to match the vector field in Riemannian metric. The mathematically equivalent, easily tractable Riemannian Stream Matching (RFM) loss function is:

[0135] ,

[0136] in, It is the Riemannian flow matching loss function. It is an optimization goal. It is the mathematical expectation of random time steps and intermediate feature points. The core set is scaled to ensure that the learned flow accurately reflects the structural changes of the complete underlying manifold. It is the actual velocity field of the continuous normalized flow. It is the target vector field projected onto the original features f generated by the sparse autoencoder at time step t. It is the L2 norm. It is the semantic penalty coefficient. yes transpose, It is the original feature f generated by the sparse autoencoder corresponding to the time step t of the dual-drive proxy semantic field. t The gradient. This step unifies the generation of smooth transformations and semantic preservation within a single geometric framework.

[0137] During the inference phase, when the toxicity risk is triggered, this invention uses an s (positive integer)-step Euler solver to dynamically integrate and optimize the final Riemann flow field over the interval [0, 1].

[0138] ,

[0139] in, It is a detoxification characteristic. It is a toxic characteristic. It is the actual velocity field of the continuous normalized flow. It is the optimization objective, f t These are the original features generated by the sparse autoencoder corresponding to time step t. It is a Riemannian flow matching feature transform operator. Finally, it is reconstructed by the SAE decoder and the original input activation is replaced.

[0140] Table 1 compares the core differences between this invention and the scheme based on Euclidean flow matching. As can be seen from Table 1, this invention, from a higher conceptual perspective, not only achieves a smooth detoxification transformation but also preserves the core semantics, avoiding the semantic shift problem.

[0141] Table 1: Comparison of core differences between the present invention and the scheme based on Euclidean flow matching

[0142]

[0143] (D) Feature-based intervention strategies. During the inference phase, operations are performed only on the identified core set dimensions. The intervention strategy dynamically determines the timing and method of intervention using the original features f generated by the sparse autoencoder. Therefore, this module provides three complementary intervention strategies:

[0144] (i) Minimize intervention at the prefix level;

[0145] (ii) Maximize intervention;

[0146] (iii) Adaptive intervention throughout the entire generation process. Specifically, these intervention strategies are:

[0147] (i) Minimize intervention: This minimal intervention strategy modifies only the latent features of the last word at each generation time step, rather than operating on the entire input sequence, in order to achieve minimal intervention. The SAE features obtained in the first step are transformed into the following form: The reconstructed activation is passed to subsequent layers of the LLM, where It is a detoxification characteristic after intervention.

[0148] (ii) Maximizing Intervention: This maximizing intervention strategy determines whether to continue guiding generation at the lexical level. For the i-th lexical, Where I is a positive integer, It is a detoxification characteristic after intervention. This is a characteristic of SAE. This allows LLM to continuously monitor the evolution of toxicity risk throughout the entire generation process.

[0149] (iii) Adaptive intervention: This adaptive intervention strategy uses a threshold-based approach. A dynamic adjustment and intervention mechanism. (Assume...) Let be the decay control intervention probability for the i-th word. During the generation process, is determined by probability. right Apply the transformation; otherwise, retain the original feature f. The updated feature representation is as follows:

[0150] ,

[0151] in, And I is a positive integer. It is a detoxification characteristic after intervention. It's probability. It is a characteristic of SAE. It is a feature transformation mapping.

[0152] The strategy involves stronger detoxification interventions in the early stages of the disease, with the intensity of interventions gradually reduced over time.

[0153] For example, when generating the i-th lexical unit, the SAE features After detoxification intervention, the detoxification characteristics were obtained. .

[0154] Furthermore, the detoxification characteristics after intervention After SAE decoding, the reconstructed and activated product is obtained after detoxification treatment. .

[0155] Next, the reconstructed activation is utilized. Subsequent layers continue to perform inference, completing the network inference process and guiding the LLM to generate non-toxic outputs.

[0156] Figure 3 This is a schematic diagram of the large language model detoxification device of the present invention. The present invention also discloses a large language model detoxification device based on Riemann flow matching, comprising a host and several acceleration cards. The acceleration cards are mainly artificial intelligence (AI) acceleration chips composed of one or more of graphics processing units (GPUs), FPGAs, and application-specific integrated circuits. Mature solutions already exist in the industry, and will not be elaborated upon in this invention.

[0157] This architecture is based on a heterogeneous cluster design with a host and multiple accelerator cards. It can efficiently support the entire process of Sparse Autoencoder (SAE) feature extraction, toxicity subspace determination, continuous normalized flow (CNF) detoxification transformation and multi-granularity intervention, while balancing the real-time performance of large language model inference and detoxification effect.

[0158] The device employs a three-tiered architecture, comprising a main control layer consisting of a host computer, a computing layer consisting of multiple accelerator cards, and a high-speed interconnected communication layer. Each layer works together to complete the entire process of large language model inference and detoxification.

[0159] The main control layer is the core of the system's global control. Exemplary hardware configurations include: a high-performance multi-core central processing unit (CPU), a large-capacity system memory (≥128GB), high-speed NVMe local storage, and Ethernet interfaces of 10 Gigabit or higher.

[0160] The main control layer's primary tasks are to receive user input requests, perform text segmentation, sequence packaging, and task queue management, distribute inference tasks to multiple accelerator cards to achieve global load balancing, and issue configurations such as toxicity judgment thresholds, detoxification intervention strategies (minimization / maximization / adaptive intervention), and CNF flow model hyperparameters, thereby controlling the overall system's operational logic.

[0161] Furthermore, the main control layer also completes input text preprocessing, multi-card inference result aggregation, generated text splicing and post-processing, and finally outputs detoxified and safe content.

[0162] Furthermore, the main control layer monitors the load, memory usage, inference latency, and other statuses of each accelerator card in real time, enabling system operation and maintenance as well as fault tolerance.

[0163] On the one hand, at the computing layer, it consists of multiple high-performance accelerator cards (such as various GPUs or similar AI-accelerated neural network processors), which are deployed through the host's high-speed PCIe slot or NVLink high-speed interconnection to split computing power and accelerate the core computing process of the large language model detoxification solution in parallel.

[0164] On the other hand, in a preferred embodiment, the accelerator cards can be categorized into various types based on their functions. For example, these include: toxicity determination accelerator cards, detoxification transformation accelerator cards, and main inference accelerator cards. In this preferred embodiment, the three core computational tasks—large language model inference, toxicity determination, and detoxification transformation—are split across different accelerator cards, avoiding computational power contention and significantly improving the system's concurrent processing capabilities.

[0165] In the main inference acceleration card, the weights of the backbone layer of the large language model are resident, the word units are generated one by one to generate inference, the activation values ​​of the intermediate layer of the model are extracted in real time, and the original features f are generated through a sparse autoencoder to provide a data foundation for the subsequent detoxification process.

[0166] In the toxicity determination acceleration card, the toxicity subspace discrimination model runs independently. Based on the sparse autoencoder, the original feature f is generated to complete the toxicity risk scoring and intervention timing determination, and outputs the control signal to determine whether to trigger the detoxification intervention.

[0167] In the detoxification transformation acceleration card, a dedicated execution is used to call the pre-trained convergent continuous normalized flow velocity field based on semantic Riemannian manifold constraints. Through the Riemannian flow matching feature transformation operator, a smooth mapping transformation in the semantic null space is performed on the SAE features to be intervened, resulting in the detoxified SAE features after intervention.

[0168] On the other hand, the communication layer serves as a low-latency data transmission channel between multiple accelerator cards and the host, and the accelerator cards themselves. Exemplary preferred hardware includes:

[0169] In-board interconnection: PCIe 4.0 / 5.0 bus and NVLink / NVSwitch multi-card direct connection technology enable high-speed transmission of activation values, SAE feature tensors, and detoxification features between cards, ensuring feature extraction. Toxicity assessment Detoxification and Transformation Low latency throughout the entire inference process.

[0170] Cross-machine interconnection (multi-host cluster scenario): InfiniBand high-speed network card and RoCE Ethernet enable task synchronization, data interaction and computing power expansion between multiple host nodes, supporting ultra-large-scale models and high-concurrency services.

[0171] Referring to the aforementioned large language model detoxification method, the large language model detoxification device based on Riemann flow matching of the present invention, as a complete example of a single application, can be used to perform the following steps:

[0172] Step S1: The host receives the user's input text, completes the text preprocessing, and then distributes the large language model inference task to the main inference acceleration card.

[0173] Step S2: The main inference acceleration card performs large language model inference, generates output sequences word by word, and extracts the original input activations of the intermediate layer of the large model in real time. The SAE features are obtained by encoding through a pre-trained sparse autoencoder and the SAE features are synchronously transmitted to the toxicity determination acceleration card.

[0174] Step S3: The toxicity determination acceleration card performs a toxicity risk assessment on the received SAE features based on the pre-constructed toxicity feature subspace. If the intervention triggering conditions are met, the card sends a detoxification instruction and the SAE features to be intervened to the detoxification transformation acceleration card.

[0175] Step S4: After receiving the detoxification instruction, the detoxification transformation accelerator card calls the pre-trained converged continuous normalized flow velocity field based on semantic Riemannian manifold constraints. Through the Riemannian flow matching feature transformation operator, it performs a smooth mapping transformation in the semantic null space on the SAE features to be intervened, and obtains the detoxified SAE features after intervention. The detoxified SAE features are input into the decoding layer of the sparse autoencoder for reconstruction, and the reconstructed activation after detoxification is obtained. The reconstructed activation is then sent back to the main inference accelerator card.

[0176] Step S5: The main inference acceleration card uses the received reconstructed activation to replace the original input activation of the corresponding intermediate layer of the large model, and feeds the replaced activation back into the subsequent network layers of the large model to guide the model to generate non-toxic output content.

[0177] Step S6: The host aggregates the generated sequence output by the main inference accelerator card, processes it, and returns the final detoxified output content to the user.

[0178] The "post-processing" here only involves decoding and concatenating the original word sequence generated by the model, removing redundancy, formatting, and encapsulating the results. No feature transformation or detoxification intervention is performed, ultimately outputting standardized, safe, and readable text to the user. More details about the detoxification method can be found in the previous text and will not be repeated here.

[0179] This embodiment is merely an illustrative example. Those skilled in the art can make conventional substitutions and improvements based on this architecture, such as replacing the GPU with a similar AI acceleration chip, adjusting the division of labor of the acceleration cards, or adopting a multi-machine, multi-card cluster deployment, all of which fall within the protection scope of this invention.

[0180] To better illustrate the present invention, numerous specific details have been provided in the detailed embodiments described above. Those skilled in the art should understand that the present invention can be practiced even without certain specific details. In some instances, methods, means, components, and circuits well known to those skilled in the art have not been described in detail in order to highlight the main points of the present invention.

[0181] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A detoxification method for large language models based on Riemannian flow matching, characterized in that, Includes the following steps: When the large language model performs inference and generates each word, the intermediate layer outputs the original input activation; the original input activation is used as the input of the encoder of the sparse autoencoder and after encoding, the SAE features are obtained. The SAE features undergo a toxicity subspace assessment: if intervention is triggered, the SAE features to be intervened are transformed using a Riemann flow matching feature transformation operator to generate detoxicated features after intervention. This includes the following steps: within the semantic Riemannian manifold SAE feature space, a Riemann flow matching feature transformation operator based on continuous normalized flow is pre-constructed. This operator is used to characterize a continuous and smooth mapping relationship from toxic features to non-toxic features, avoiding core semantic shifts. When intervention is triggered during the inference stage, the Riemann flow matching feature transformation operator is used to map and transform the SAE features to be intervened that triggered the intervention, generating detoxicated features after intervention. Specifically, this includes the following steps: Within the semantic Riemannian manifold (SAE) feature space, a dual-drive proxy semantic field and an instantaneous velocity field based on continuous normalized flow are pre-constructed. The dual-drive proxy semantic field is used to characterize the degree of preservation of the core semantics of the large model corresponding to the SAE features, and the instantaneous velocity field is used to characterize the instantaneous evolution speed and direction of the SAE features on the semantic Riemannian manifold within the normalized time interval [0, 1]. Using toxicity features as the starting point of evolution and predefined non-toxicity features as the endpoint of evolution, a basic path of Euclidean linear interpolation is constructed. The basic path is then projected onto the semantic null space defined by the dual-drive proxy semantic field to construct a geometrically aligned target vector field. The instantaneous velocity field is trained by constraining the Riemann flow matching loss function, so that the learned instantaneous velocity field is aligned with the target vector field by flow matching under the semantic Riemann metric constraint, and the trained and converged velocity field is obtained. When intervention is triggered during the inference phase, multi-step numerical integration is performed on the instantaneous velocity field that has converged during training over the normalized time interval [0, 1] to obtain the Riemann flow matching feature transformation operator. The SAE features to be intervened that trigger intervention are subjected to global smoothing mapping in the semantic null space by the Riemann flow matching feature transformation operator, thereby generating detoxification features after intervention. After the detoxified features are decoded by the decoder of the sparse autoencoder, the reconstructed activation after detoxification is obtained. The reconstructed activation is used to replace the original input activation and input into the subsequent layers of the large language model to guide the large language model to generate non-toxic output content.

2. The detoxification method for large language models based on Riemannian flow matching according to claim 1, characterized in that: After performing a toxicity subspace assessment on the SAE features and triggering an intervention, feature transformation is performed using any of the following intervention strategies: (1) Minimize intervention strategy: Only perform transformation on the SAE feature corresponding to the last word in each generation time step, and retain the original value of the remaining word features; (2) Maximize intervention strategy: Perform transformation on a word-by-word basis for the SAE features corresponding to all words in the generation process; (3) Adaptive intervention strategy: Based on the preset decay coefficient, set the dynamic intervention probability for each generated word, and perform transformation on the SAE features of the corresponding word according to the intervention probability, while the remaining words retain the original features.

3. The detoxification method for large language models based on Riemannian flow matching according to claim 2, characterized in that: The specific steps for performing toxicity subspace determination on SAE features are as follows: Preconstruct toxicity feature subspace and non-toxicity feature subspace, and calculate the matching score between the SAE feature to be detected and the toxicity feature subspace; When the matching score exceeds the preset intervention threshold, intervention is triggered; the preset intervention threshold is a fixed threshold or an adaptive threshold that is dynamically adjusted during the generation process.

4. The detoxification method for large language models based on Riemannian flow matching according to claim 3, characterized in that: The sparse autoencoder is a pre-trained model. During training, the backbone weights of the large language model are fixed, and only the encoder and decoder of the sparse autoencoder are trained. The trained sparse autoencoder is used to extract interpretable semantic features corresponding to the activation of the intermediate layers of the large language model.

5. The detoxification method for large language models based on Riemannian flow matching according to claim 4, characterized in that: The toxicity subspace judgment of SAE features is specifically performed by using a multi-layer Lipschitz MLP classifier to detect toxicity trigger risk in real time.

6. The detoxification method for large language models based on Riemannian flow matching according to claim 5, characterized in that: The large language model detoxification method based on Riemann flow matching is executed in a hardware architecture that includes a host and multiple accelerator cards, wherein: The host is responsible for task distribution, data preprocessing, result aggregation, and global scheduling; Main inference accelerator card execution: large language model inference, raw input activation extraction, SAE feature encoding and decoding, and activation replacement and subsequent generation; Toxicity Assessment Accelerator: Performs toxicity subspace assessment and intervention trigger assessment based on SAE characteristics; Detoxification Transformation Accelerator Execution: Inference of Riemann Flow Matching Feature Transformation Operator, Detoxification Transformation of SAE Features.

7. A detoxification device based on a large language model using Riemann flow matching, comprising a host computer, a main inference acceleration card communicating with the host computer, a toxicity determination acceleration card, and a detoxification transformation acceleration card; characterized in that: The Riemann flow matching-based large language model detoxification device is used to perform the Riemann flow matching-based large language model detoxification method according to any one of claims 1-6.

Images