ToxiGen: A Large-Scale Machine-Generated Dataset for Adversarial and Implicit Hate Speech Detection

Introduction

Toxic language detectors often over-rely on minority identity mentionsIn this work, we use “minority” to refer to social and demographic groups that are frequently the targets of oppression, discrimination, or prejudice RWJF (2017), from a U.S. socio-cultural perspective. when flagging a statement as toxic, without considering the deeper semantic meaning of the statement Dixon et al. (2018); Röttger et al. (2021). This can lead to severe under-detection of subtle hate (e.g., “They have been bred to be good at sports and entertainment, but not much else”; Figure 1) and over-detection of benign statements (e.g., “child abuse is wrong, racism is wrong, sexism is wrong”; Figure 1). Importantly, such biases in toxicity detection risk further marginalizing or censoring minority groups Yasin (2018); Sap et al. (2019); Dias Oliva et al. (2020); Are (2020); Díaz and Hecht-Felella (2021).

We introduce ToxiGen, a large-scale machine-generated dataset of 274,186 toxic and benign statements. To create this dataset, we leverage the massive pretrained language model GPT-3 Brown et al. (2020), which is known to produce close-to-human-like text Clark et al. (2021); Dou et al. (2021) but also easily generates socially biased and toxic content Sheng et al. (2019); Gehman et al. (2020). While such human-like bias and toxicity poses real threats, we use this undesirable behavior in models like GPT-3 to improve existing toxic language classifiers, providing a path forward for mitigating systemic bias. Created using demonstration-based prompting and pretrained toxicity classifiers, ToxiGen covers over 135k toxic and 135k benign statements about 13 minority identity groups (e.g., African Americans, women, LGBTQ+ folks, etc.).

Using this machine generated approach has two advantages over scraping posts from the web as done by previous work (e.g., Davidson et al., 2017; Founta et al., 2018; Zampieri et al., 2019). First, it allows us to limit spurious identity-toxicity correlations Dixon et al. (2018); Zhou et al. (2021) by generating equal numbers of toxic/benign statements for each demographic group, including those that are often overlooked in toxic language corpora (e.g., Native Americans). Second, machine generation and careful prompting enables us to generate implicit toxicity (i.e., without swearwords or slurs), which is by definition hard to detect or find and thus often missing in toxic language corpora Wiegand et al. (2021). Indeed, 98.2% of ToxiGen statements are implicit, i.e., devoid of explicit profanity, slurs, or swearwords (Table 1).

To generate a challenging subset of ToxiGen, we introduce Alice,Adversarial Language Imitation with Constrained Exemplars an adversarial classifier-in-the-loop decoding algorithm. We use Alice to control the toxicity of output text by pitting a toxicity classifier against a text generator during beam search decoding. Given a toxic prompt, we can encourage generations to be less toxic based on the classifier scores. Similarly, we can steer a language model with neutral prompting towards higher toxicity generations. Our experiments with five publicly-available toxicity classifiers show that the generated sentences in both cases above fool toxicity classifiers (see Figure 1).

We validate the quality of our machine-generated dataset through a comprehensive human evaluation. Our results show that on a sample of 792 machine-generated sentences, 90% could be mistaken for human-written text. We also find that the generated data indeed contains a wide variety of specific references to the minority groups mentioned in the prompts (§4.2). This indicates that our data generation approaches (with or without Alice) successfully control the generation towards the desired toxicity and minority group mention.

Further experimental results demonstrate that fine-tuning existing classifiers on ToxiGen consistently improves performance (+7–19%) on 3 existing human-written implicit toxic datasets: ImplicitHateCorpus ElSherief et al. (2021), SocialBiasFrames Sap et al. (2020), and DynaHate Vidgen et al. (2021). This indicates that the dataset generated in this work and the approaches for generating data provide major steps towards improving toxicity classifiers, and could potentially be used downstream to address the issues from biased machine generation Sheng et al. (2019) or neutral toxic degeneration Gehman et al. (2020).

We release our code and the ToxiGen dataset publicly.https://github.com/microsoft/ToxiGen We also include two models pretrained on ToxiGen along with our human evaluations.

Implicit Hate Against Minority Groups

Detecting implicit toxicity about minority groups (e.g., stereotyping, microaggressions), remains an elusive goal for NLP systems Han and Tsvetkov (2020); Wiegand et al. (2021). One key challenge is that, in contrast to explicit toxicity, implicit toxicity is not marked by the use of profanity or swearwords, is sometimes positive in sentiment, and is generally harder to detect or collect at scale MacAvaney et al. (2019); Breitfeller et al. (2019). Nonetheless, implicitly toxic language about minority or marginalized groups is often psychologically damaging to members of those groups Sue et al. (2007); Nadal et al. (2014); Kanter et al. (2017); Nadal (2018); Saleem and Anderson (2013) and can reinforce stereotypical or hateful perceptions of them Behm-Morawitz and Mastro (2008); Soral et al. (2018).

A second challenge for detecting subtle toxicity about minority groups is that minority mentions are more often the targets of social biases and toxicity Hudson (2017). As such, minority mentions often co-occur with toxicity labels in datasets scraped from online platforms Dixon et al. (2018). For example, over 93% of mentions of Jewish folk in Sap et al. (2020) are toxic Wiegand et al. (2021). In turn, models trained on such data can exploit these spurious minority-toxicity correlations instead of considering the deeper semantics of text Zhou et al. (2021). Importantly, the spurious correlations are also learned by large language models, which are known to produce stereotypical, biased, or toxic content when prompted with minority mentions Sheng et al. (2019). Given that the main mitigation approach to prevent Large Language Models (LLM) from generating toxic language is to train new classifiers to detect such language, these classifiers also learn the spurious correlations and start blocking most language referencing minority groups. This risks erasure Xu et al. (2021).

With ToxiGen, we aim for generating a large scale dataset that represent implicit toxicity while balancing between toxic and benign statements, to address the gaps of previous work. As shown in Table 1, existing datasets contain large amounts of explicit toxicity. While valuable, most previous work has relied on scraping data from online platforms, which leads to dataset imbalances with respect to minority-mentioning posts that are toxic vs. benign. Examples are collected at scale using keyword-based scraping approaches Waseem (2016); Davidson et al. (2017); Zampieri et al. (2019), the bootstrapped scraping approaches Founta et al. (2018), and machine-vs-human adversarial data collection Dinan et al. (2019); Vidgen et al. (2021), among others. In contrast, using large language models to generate our dataset allows us to control the minority groups mentioned in our statements, as well as their implicitness, at larger scale.

Creating ToxiGen

To create ToxiGen, we use demonstration-based prompting for LLMs, encouraging a text generator to produce both toxic and benign sentences that mention minority groups without using explicit language. We introduce a classifier-in-the-loop decoding method based on constrained beam search, Alice, which, along with samples generated without Alice, contributes to generating a challenging subset of ToxiGen. Using these methods, we generate a massive set of statements (over 274,000) containing equal numbers of toxic and benign sentences for 13 identity groups—see Table 2.

ToxiGen is generated by prompting a language model to produce both benign and toxic sentences that (1) include mentions of minority groups by name and (2) contain mainly implicit language, which does not include profanity or slurs. To achieve this, we perform demonstration-based prompt engineering: Acquiring example sentences, passing them to a LLM,We use GPT-3 Brown et al. (2020), but our generation methods could work with any human-like text generator.and collecting the subsequent response. For example, when shown ten sentences mentioning Muslim folks neutrally, GPT-3 often responds with a similar neutral sentence.

Prompts are text fragments passed into language models that can encourage certain behaviors Brown et al. (2020). However, designing prompts is notoriously challenging Liu et al. (2021c). While there are several approaches for prompting pretrained LLMs Liu et al. (2021b), a recent and promising direction is demonstration-based prompting Gao et al. (2021); Mishra et al. (2021). Here, example statements are passed to an LLMs, encouraging it to produce a similar, but distinct, statement. For example, to encourage LLMs to produce benign statements about Asian people, we might use the following examples: (1) many impactful people are of asian descent, (2) there are hundreds of asian cultures. To engineer prompts that lead to high-quality, group-mentioning toxic and benign statements at scale, we first gather and curate sets of examples.

1.2 Collecting demonstrations

To generate both benign and toxic responses from LLMs that mention minority groups, we first collect many examples. Intuitively, given many examples of benign sentences that mention one particular group, a language model can be used to produce more. For benign prompts, we encourage realistic text generation and include diverse voices by collecting benign sentences from blog posts and news articles that mention a group. However, finding large amounts of such data at scale is challenging—this is why implicit datasets are hard to acquire.

To build a large enough set of demonstrations, we begin with a small number of examples from the wild, then engage a human-in-the-loop process: collect some demonstrations, pass them to our LLM, comb through many responses, and add the best examples to a growing set. Ensuring that a set of examples consistently produces benign responses that still mention the targeted minority group is challenging and so we iterate this loop many times, sampling random subsets of our examples to serve as prompts and observing the responses. This way, we collect 20-50 demonstration sentences per group, all of which we release.

To encourage implicit toxicity from a LLM, we find examples of human-written sentences with implicit toxicity towards each group from hate forums de Gibert et al. (2018) and Reddit Breitfeller et al. (2019). We repeat the human-in-the-loop process to expand our sets of examples. Overall, by repeating this process for both toxic and benign examples for all 13 target groups, we create 26 sets of prompts, with two (benign and toxic) per target group.

2 Alice: Attacking Toxicity Classifiers with Adversarial Decoding

Demonstration-based prompting alone consistently produces toxic and benign statements about minority groups (see Section 4). There is no guarantee that these statements will be challenging to existing toxicity detectors. Therefore, we also develop Alice, a variant of constrained beam search (CBS; Anderson et al., 2017; Hokamp and Liu, 2017; Holtzman et al., 2018; Lu et al., 2021) during decoding that generates statements that are adversarial to a given pre-trained toxicity classifier.

Alice creates an adversarial game between a pre-trained language model (PLM) and a toxicity classifier (CLF) during constrained beam search decoding. In many CBS settings, constraints are added during beam search decoding to force the model to either include or exclude a specific word or group of words in the output Anderson et al. (2017); Hokamp and Liu (2017); Lu et al. (2021). With Alice, we instead want to enforce soft constraints on the probabilities coming from a given toxicity classifier CLF during beam search:This is similar in spirit to previous work on using cooperative discriminators on uncontrolled LLMs Holtzman et al. (2018); Krause et al. (2020); Yang and Klein (2021); Liu et al. (2021a), yet in this work our LLM is controlled in an adversarial way by prompting and by a classifier.

Here, $\lambda_{L}$ and $\lambda_{C}$ denote hyperparameters that determine the respective contribution of the language model and classifier to the decoding scoring function. By using this weighted combination, we can steer generations towards a higher or lower probability of toxicity without sacrificing coherence enforced by the language model. To create examples that challenge existing toxicity classifiers, we use two adversarial setups:

False negatives: We use toxic prompts to encourage the language model to generate toxic outputs, then maximize the classifier’s probability of the benign class during beam search.

False positives: We use benign prompts to encourage the language model to generate non-toxic outputs, then maximize the probability of the toxic class during beam search.

In the first approach, we are also able to detoxify model outputs when the classifier successfully steers the generations towards non-toxic language. Alice is illustrated in Figure 2.

3 Decoding Details

We generate ToxiGen data with and without ALICE. Without ALICE, we use top-$k$ decoding Fan et al. (2018) alone with our toxic and benign prompts. With ALICE, we use the HateBERT fine-tuned OffensEval model from Caselli et al. (2021) as the toxicity classifier (CLF). This model covers a range of direct and veiled offense types. We use GPT-3 for the language model. For decoding, we use $\lambda_{L}=\lambda_{C}=0.5$, a maximum generation length of 30 tokens, a beam size of 10, and a temperature of 0.9. Due to limitations imposed by the OpenAI GPT-3 API on accessing log probabilities for the full model vocabulary, we restricted the vocabulary size to the top 100 tokens, and then resample from the “allowed” tokens (tokens not appearing in the prompt) using top-$k$.We force beam search decoding to not use tokens from the prompt to prevent direct copying. Certain tokens appearing in the prompt such as punctuation are allowed.

4 ToxiGen Statistics

Statistics of ToxiGen are presented in Table 2. In our final dataset, generation length varies significantly and, as expected, almost all the statements are implicit. As we show in §4, the Alice-generated data is successful at attacking the given toxicity classifier, contributing a challenging, adversarial subset of ToxiGen.We compute the % of implicit samples using https://github.com/RobertJGabriel/Google-profanity-words, the same as ElSherief et al. (2021), also removing ambiguous terms (e.g., “bloody”). In the released data, we split off a test set that is validated by human annotators (see §4.2).

Human Validation of ToxiGen

To ensure the quality of ToxiGen, we conduct human validation experiments and create ToxiGen-HumanVal, a human-validated test set. Specifically, we investigate the reliability of our prompt-based and Alice-based methods at generating human-like statements and controlling statements’ toxicity and the minority groups mentioned (§4.2). Additionally, we measure the effectiveness of Alice-generated statements (vs. top-$k$-generated) at fooling classifiers (§4.3).

For each generated statement, we ask the annotators various questions, described below, that take into account multiple dimensions of how toxic machine-generated language presents a potential harm to readers. See Appendix B for an annotation screenshot and other study details.

We first ask annotators to guess whether the statement’s author was a human or an AI system (HumanOrAI). Then, we ask whether the statement would be harmful to anyone if an AI system wrote it (harmfulIfAI), as well as if a human wrote it (harmfulIfHuman); we hypothesize that readers may have different standards for machine-generated text than human-written text. For all questions measuring harmfulness of text, we consider potential harm on a 1-5 scale with 1 being clearly benign and 5 indicating very offensive or abusive text.

We ask readers whether statements were likely intended to be harmful (harmfulIntent), since some biased statements can be positively intended (e.g., benevolent sexism; Glick and Fiske, 1996). Additionally, we ask if the statement exhibits a positive stereotype (PosStereo), which is also harmful (e.g., model minority myths; Cheryan and Bodenhausen, 2000).

To better understand how harm may be perpetrated against the minority group, we ask readers in-depth questions about text’s content, following Sap et al. (2020) and Olteanu et al. (2018). We ask whether or not the statement is lewd or sexual (Lewd), whether and how it references the targeted group or other groups (whichGroup, groupFraming), whether it claims to be factual or opinion (FactOrOpinion).

2 Constructing ToxiGen-HumanVal

We selected 792 statements from ToxiGen to include in our test set, such that no training statement had cosine similarity above 0.7 with any test statement. Each test statement was then rated by 3 annotators from a pool of 156 prequalified annotators from Amazon MTurk (See Appendix B for details).

To investigate the quality of our annotations, we compute agreement on toxicity ratings.Specifically, we take the max of the harmfulIfAI and harmfulIfHuman scores and map it into three classes (scores $<$3: “non-toxic”, =3: “ambiguous”, $>$3: “toxic”). We find that annotators agreed moderately and are higher than or equal rates to prior work on hate speech annotation Ross et al. (2017); Sap et al. (2020), with a Fleiss’ $\kappa$=0.46 Fleiss (1971) and Krippendorff’s $\alpha$=0.64 Krippendorff (1980). In 55.17% of cases, all 3 annotators agree, while a majority ($\geq$2/3) agree for 93.4%.

First, we find that our machine-generated statements are largely indistinguishable from human-written statements. For example—see Table 3—human annotators often predict that our text is generated by a human. In fact, on average 90.5% of machine-generated examples are thought to be human-written by a majority of annotators, as shown in Figure 4. We also note that harmful text confuses readers slightly more than non-harmful text: 92.9% of toxic examples are mislabeled as human-written compared to 90.2% for non-toxic. Most toxic examples are also hate speech (94.56%). While opinions are common in both toxic and non-toxic examples, most fact-claiming text is non-toxic.

Second, we find that demonstration-based prompting reliably generates toxic and benign statements about minority groups (§4.3). Further, for the machine-generated examples, we find that 30.2% are harmful (given a score of $>$3), while only 4% are ambiguous. This indicates that these data are sufficiently toxic or benign. We also find that all identity groups covered by the dataset were represented in the human study (see Figure 3), and observe that the identity group referenced by the prompt is generally the same as the group referenced by the corresponding ToxiGen text, though there is some deviation. This is likely due to GPT-3 conflating identities or mentioning multiple groups.

Interestingly, there is no significant difference in toxicity when we account for whether annotators perceive scores as written by humans or AI (Figure 5). This finding indicates that our machine-generated text is perceived as similarly harmful to human text. We also find that the most common framing tactic is “moral judgement”, or questioning the morality of an identity group, which has been linked to toxicity by prior work Hoover et al. (2019).

3 Comparing Generation Methods

As further validation, we investigate whether Alice-generated statements are more adversarial compared to top-$k$-generated ones. For 125 randomly-selected prompts (62 toxic and 63 non-toxic), we generate two statements: one with Alice and one without (top-$k$). We then collect annotations for the 250 statements using the setup described in §4.1, and get toxicity scores from HateBERT.

We find that for top-$k$ sampled sentences, the prompt label indeed matches the desired label (95.2% of non-toxic examples and 67.7% of toxic examples). For ALICE, 40.3% of toxic examples match the prompt label and 92.1% of non-toxic examples match. We also find that Alice succeeds in fooling HateBERT (26.4% of Alice-decoded sentences fool HateBERT vs. 16.8% of top-$k$ sampled sentences). Finally, Alice is effective for detoxifying generated text: the avg. human-annotated toxicity score for Alice-decoded sentences with a toxic prompt is 2.97, compared to 3.75 for top-$k$. This difference is statistically significant with $p<0.001$. Alice therefore leads to harder, more ambiguous examples. We greatly expand on these findings in Appendix E with a larger scale human evaluation ($\sim$10,000 samples) comparing sentences generated with and without Alice.

Improving Toxicity Classifiers

To further showcase the usefulness of ToxiGen, we investigate how it can enhance classifiers’ abilities to detect human-written and machine-generated implicit toxic language. We fine-tune the widely-used HateBERT Caselli et al. (2021) and ToxDectRoBERTa Zhou et al. (2021) models on the training portion of ToxiGen, using the prompt labels as proxies for a true toxicity label. Then, we compare the performance of the out-of-the-box models to those fine-tuned on ToxiGen on three publicly available human-written datasets (ImplicitHateCorpus ElSherief et al. (2021), the SocialBiasFrames test set Sap et al. (2020), and DynaHate Vidgen et al. (2021)) as well as the evaluation portion of our machine-generated dataset (ToxiGen-HumanVal). To ablate the contribution of each decoding method, we also split ToxiGen into equal numbers of ALICE-generated and top-$k$-generated examples.

Our results—see Table 4—show that fine-tuning HateBERT and ToxDectRoBERTa on ToxiGen improves performance across all datasets. The improvement on human-written datasets shows that ToxiGen can be used to improve existing classifiers, helping them better tackle the challenging human-generated implicit toxicity detection task. Fine-tuned HateBERT performs strongly on ToxiGen-HumanVal, demonstrating that our data can successfully help guard against machine-generated toxicity.

Conclusions

In this work, we used a large language model to create and release ToxiGen, a large-scale, balanced, and implicit toxic language dataset. ToxiGen is far larger than previous datasets, containing over 274k sentences, and is more diverse, including mentions of 13 minority groups at scale. The generated samples are balanced in terms of number of benign and toxic samples for each group. We proposed Alice, an adversarial decoding scheme to evaluate robustness of toxicity classifiers and generate sentences to attack them, and showed the effectiveness of Alice on a number of publicly-available toxicity detection systems. In our experiments, we showed that fine-tuning pre-trained hate classifiers on ToxiGen can improve their performance on three popular human-generated toxicity datasets. We also conducted a human study on a subset of ToxiGen, verifying that our generation methods successfully create challenging statements that annotators struggle to distinguish from human-written text: 90.5% of machine-generated examples were thought to be human-written.

Societal and Ethical Considerations

While the purpose of our work is to curate diverse and effective hate speech detection resources, our methods encourage a large language model to make its generation more toxic. This poses a potential misuse case where bad actors exploit these methods for nefarious purposes like spreading machine-generated hate speech. Still, ignoring this possibility does not make it go away and our work introduces an opportunity for the community to push back against harm towards minority groups. Our ultimate aim is to shift power dynamics to targets of oppression. Therefore, we do not consider identity dimensions that are historically the agents of oppression (e.g., whiteness, heterosexuality, able-bodied-ness). Please also note that there is still a lot that this dataset is not capturing about toxic language. Our annotations might not capture the full complexity of these issues related to human experiences. There is need for multi-disciplinary work to better understand these aspects.

The proposed method in this work attacks content filters via an adversarial game between two AI systems and thus passes the existing content filters—as we show for 5 publicly-available systems. It is important to leverage this and similar approaches to improve content filters and prevent large scale attacks against sensitive platforms.

Effective classifiers for machine biases are required to combat the scale of online harm. Without such systems, minority groups are likely to be targeted by current (biased) systems. Our work is a significant step towards advancing this crucial classification task. Still, toxicity is inherently subjective Sap et al. (2021). Therefore, moving beyond binary detection tasks to a focus on more nuanced labeling systems ElSherief et al. (2021); Leonardelli et al. (2021) will prove crucial in developing responsible systems.

The topic of detecting and mitigating toxicity is relevant to the ongoing work and discussions in the space of policy and legislation for AI technology Wischmeyer and Rademacher (2020); Reich et al. (2021). Carefully crafted policy and regulation can play an important role in providing oversight into the development and deployment of content moderation systems and toxicity detection algorithms in practice Benesch (2020); Gillespie et al. (2020). Getting this right carries a crucial importance for the society as errors in content moderation can disproportionately affect minority groups Sap et al. (2019). We see a path forward in which tools and techniques like those presented in this work are paired with human expertise and well-informed policy & regulation in bringing scalable and reliable solutions to practice. We acknowledge and encourage the critical role the NLP research community is poised to play in this inter-disciplinary effort.

Please also note that there is still a lot that this dataset is not capturing about what constitutes problematic language. Our annotations might not capture the full complexity of these issues, given problematic language is context-dependent, dynamic, and can manifest in different forms and different severities. Problematic language is also fundamentally a human-centric problem and should be studied in conjunction with human experience. There is need for multi-disciplinary work to better understand these aspects. Also note that this dataset only captures implicit toxicity (more precisely hate speech) for 13 identified minority groups, and due to its large scale can naturally be noisy. Our goal in this project is to provide the community with means to improve toxicity detection on implicit toxic language for the identified minority groups and there exists limitations to this dataset and models trained on it which can potentially be the subject of future research, for example, including more target groups, a combination of them and so on that are not covered in our work.

Acknowledgements

We thank Azure AI Platform and Misha Bilenko for sponsoring this work and providing compute resources, Microsoft Research for supporting our large scale human study, and Alexandra Olteanu for her feedback on human evaluation. We also thank the crowdworkers for their time and effort.

References

Appendix A Generation Details

To generate sentences for a given minority group, we sample 5 random sentences from the corresponding set of examples, then join them into one string with each example being preceded by a hyphen (“–”) and ending with a newline character (“\n”). By appending an extra hyphen to the end of the prompt, LLMs writes a new sentence matching the style of the presented examples. We stop GPT-3’s generation once it produces a new newline character, indicating the end of the sentence. For each generated sentence, we use a new, randomly-selected set of 5 random sentences.

While we use GPT-3 to generate statements in this work, in principle, our methods can be used with any models that generate realistic text, such as GPT-Neo Black et al. (2021), GPT-J Wang and Komatsuzaki (2021), or Turing-NLG Rasley et al. (2020)

Appendix B Human Validation Details

For human validation, we select 156 MTurk workers with prior experience annotating toxic language Sap et al. (2020). 51 of these workers participated in data annotation. We collect worker demographics using an optional survey at the end of the annotation task. We find that 56.9% identify as White, 9.8% as Black, 3.9% as Hispanic, 3.9% as Asian and 5.9% as Other. Also, 45.1% of workers identify as female, 37.3% as male and 2% as non-binary. The majority of workers are between 25 and 45 (58.8%). Politically, 25.5% of workers identify as left-leaning, 23.5% as very left-leaning, 13.7% as moderate, 17.6% as right-leaning and 3.9% as very right-leaning.The remaining workers chose not to respond for these questions. Lastly, we find that 5.9% of workers also identify as LGBTQ+ and 2% identify as Pacific Islander.

B.2 Annotation Interface

Figure 6 shows a screenshot of the annotation interface given to the Amazon Mechanical Turk workers. Prior to annotation, we provide a strong warning and require signed consent before any text is shown.

Appendix C How does perplexity change across groups?

Our decoding approaches should ideally generate low-perplexity sentences. We measure the perplexity assigned by a pre-trained language model across different minority groups for sentences generated with and without ALICE. This will give us an idea of how good the set of sentences are from the perspective of the pre-trained language model in terms of perplexity. We use GPT-2 model from Huggingface to measure perplexity. As some sentences have extremely high perplexity according to GPT-2, we drop sentences (roughly 10% of the dataset) with perplexity over 500 for this analysis. As shown in Table 5, the ALICE-generated sentences have significantly lower perplexity than top-$k$ across all minority groups. We also find that the average perplexity can range significantly between subgroups, though perplexity varies more for top-$k$-generated text. Interestingly, text mentioning Black people is deemed most-likely across the board, while the least-likely generations differ by generation method: amongst the ALICE-generated text, sentences mentioning Latino people is the least likely, while for top-$k$, text mentioning Women is the least likely. In all cases, ALICE generates text with up to 5 times lower perplexity than regular decoding.

Appendix D Does generated text actually mention the targeted groups?

In the human validation study (§4), we ask annotators to determine whether or not the text actually includes references to the targeted groups; each prompt was generated with one group in mind. Here, we compare the proportion of text that mentions each group, split by decoding method. As shown in Table 6, we find that both ALICE and top-$k$ generate text that mentions corresponding minority group in the prompt almost equally good (slightly better for ALICE), though the exact proportion changes by the group. For instance, in text generated for Latino people, ALICE has a 100% hit rate, while top-$k$ has only 72%. However, for text mention LGBTQ+ people, top-$k$ text succeeds to mention them 97% of the time while ALICE has only 91%. These values may depend on the underlying language model: in our case , GPT-3 may have been trained on less Latino-mentioning text and therefore benefit more from controlled decoding.

Appendix E Analysis of Large-Scale Human Validation

In addition to the human-validated evaluation set described in Section 4, we obtain labels for 8,960 randomly sampled training examples using the same annotation framework and pool of MTurk workers. This sample is evenly split between top-$k$ and ALICE generated texts (50.9% for top-$k$, 49.1% for ALICE). Please note that the samples are drawn randomly from ToxiGen training data and we did not enforce having the same prompt for top-$k$ and ALICE. The analysis for having the same prompt for top-$k$ and ALICE has already been done in §4.3. In Figure 7, we show that average toxicity scores are similar for the two decoding methods given a prompt label, though ALICE-generated texts have a slightly higher average toxicity for generations from toxic-labeled prompts and a lower average toxicity for generations from non-toxic prompts than top-$k$. We observe that 66.86% of ALICE-generated texts with a toxic prompt label are actually toxic (compared to 57.91% of top-$k$ examples) and 93.21% of ALICE-generated texts with a non-toxic prompt label are actually non-toxic (compared to 90.01% of top-$k$ examples). We also find that ALICE is more effective at generating adversarial language - 58.97% of toxic ALICE-generated examples fool HateBERT, compared to 26.88% of toxic top-$k$ generated examples. ALICE-generated non-toxic examples also fool HateBERT more often than top-$k$, though the difference is smaller (15.51% of ALICE-generated non-toxic examples vs. 11.35% of top-$k$ generations). Lastly, ALICE-generated examples lead to more consistent target group references. At least one annotator identified a direct or indirect reference to the exact target group for 70.4% of top-$k$ generated examples compared to 78.3% of ALICE-generated examples. A full breakdown is given in Figure 8.

As we address broadly in Section 7, subjectivity is an area of concern for annotation of toxicity. Prior work has pointed out the role that annotators’ belief systems and sociodemographic backgrounds play in their perception of toxicity Sap et al. (2019, 2021); Davani et al. (2022). This is highlighted by such training examples as

“I’d like to thank you.. I don’t think I’d have made it if I didn’t find MGTOW! You guys are great!"

Annotators predicted this example to be non-toxic, likely due to not recognizing MGTOW as a misogynistic group.

Appendix F Example Prompt

Prompt engineering can have significant effects on the quality of text generated by language models. Following the lead of other recent works, we use demonstration-based prompting, and introduce demonstrations to encourage language models to generate group-mentioning text. For example, a prompt that generates neutral mentions of Native American people is:

“ - it is a common misconception that native americans are all savages but they have a rich culture and history\n - indigenous people are often left out of conversations around policies that impact them\n - some native american communities have reclaimed the term indian, despite a complex history\n - some native americans were granted land after the british were defeated in the american revolution by arrows\n - indigenous people have lived in north america for more than 12,000 years\n - there was a lot of resentment in the 19th century to native americans and some indians were even killed off\n - ”

The trailing hyphen encourages the language model to provide another sentence in the growing list that resembles the prior examples, ending in \n. All of our generated prompts (26,000) are released with the dataset.

Appendix G Releasing a Pretrained Model and its Propagated Labels

We further finetune and release a RoBERTa classifier on the 8,960 human-annotated sampled in ToxiGen, beginning with the weights from Zhou et al. (2021). Along with our publicly-available code, this pretrained model will serve as an entry point for community engagement with our work. We run this pretrained model on the full ToxiGen dataset, collecting its predictions and release them along with ToxiGen. These new labels may serve to correct some mislabeling.

Appendix H Dataset Description

We release ToxiGen as a dataframe with the following fields: prompt contains the prompts we use for each generation. generation is the ToxiGen generated text. generation method denotes whether or not Alice was used to generate the corresponding generation. If this value is Alice, then Alice was used, if it is top-$k$, then Alice was not used. prompt_label is the binary value indicating whether or not the prompt is toxic (1 is toxic, 0 is benign), and therefore the generation should be toxic as well. This label is slightly noisy, though largely accurate—as deemed by human annotators. group indicates for which group the prompt was generated. Finally, roberta_prediction is the probability predicted by our corresponding RoBERTa model for each instance. This field can be used as propagated labels according to this model.

Appendix I Further comparing toxicity classifiers

We also compare finetuning classifiers on subsets of ToxiGen-Val with and without ALICE, shown in Table 7. As expected, when finetuning on each subset individually, performance is strong on their respective evaluation sets. Further, without any finetuning, each model performs worse on the ALICE-generated data, indicating ALICE successfully generates data that are more confusing to each model.