A Survey of Toxicity Detection and Mitigation Strategies for Multilingual Language Models

A new survey of multilingual large language models finds that safety protections remain inconsistent across languages, with attackers able to bypass toxicity filters by switching languages, mixing scripts, or using translation tools. The paper, posted to arXiv on 24 June 2026, synthesizes research on toxicity detection and detoxification for LLMs deployed in multiple languages [1][2]. It catalogues threat models that exploit language choice, translation pivots, code-switching, orthographic variation, multi-turn interaction, and post-deployment fine-tuning to weaken safety alignment [2]. Mitigation strategies reviewed in the survey span data filtering, supervised and preference-based tuning, decoding-time steering, representation editing, and multilingual guardrails [2]. Detection approaches include cross-lingual encoders, translation pipelines, representation-level probes, and LLM-based detectors [2]. The authors identify persistent challenges that complicate deployment. Uneven language coverage means safety tools tested on English often fail on lower-resource languages [2]. Culturally contingent definitions of harm make it difficult to build a single toxicity standard [2]. Fragmented evaluation protocols prevent consistent benchmarking across models [2]. The survey also warns that detoxification can suppress legitimate dialectal or identity-related expression [2]. Large language models are a type of machine learning model trained with self-supervised learning on vast amounts of text [11]. Their rapid adoption has outpaced safety research for non-English contexts. The survey notes that threat actors can pivot through a high-resource language to generate toxic content in a lower-resource one, or mix scripts within a single prompt to confuse classifiers [2]. The findings arrive as LLM deployment accelerates globally. Chinese firm DeepSeek, founded in July 2023, launched its R1 model in January 2025 with performance comparable to OpenAI's GPT-4 and o1, while reporting training costs far below those of U.S. competitors [10]. DeepSeek's models are described as open-weight, meaning parameters are shared but training data is not openly licensed [10]. The company trained its models using weaker AI chips intended for export, operating under ongoing trade restrictions on AI chip exports to China [10]. The survey's task formulations include toxic-to-neutral rewriting, toxicity classification, and toxic-generation evaluation [2]. The authors call for evaluation protocols that account for linguistic diversity and cultural context, noting that a phrase flagged as toxic in one language may be benign or even affirming in another [2].