AMEND: Constraint-Guided Multi-Agent Text Detoxification with Isolated Critics

Tianyu Wang

cs.CLOct 16, 2026

AMEND: Constraint-Guided Multi-Agent Text Detoxification with Isolated Critics

Authors: Tianyu Wang

Organizations: School of Computer Science and Technology, Soochow University

Abstract

Text detoxification requires balancing toxicity removal, semantic preservation, and fluency. Existing methods typically optimize an unconstrained scalar objective---enabling safety scores to mask semantic loss---or rely on open-ended iterative debate prone to semantic drift and high computational cost. We propose AMEND, an inference-time framework that decouples detoxification into role-conditioned proposal generation, isolated multidimensional criticism, and constraint-first selection. AMEND evaluates diverse candidates with role-blind critics and enforces strict semantic and fluency feasibility before ranking by utility. To maximize efficiency, AMEND Lite restricts subsequent search to at most one targeted repair round only when residual toxic spans remain. On ParaDetox, one-round selection over diverse roles improves the joint evaluation metric by $+0.0508$ over the best single role. On a frozen confirmation test set, AMEND Lite achieves a joint score of $0.6597 \pm 0.0062$ , outperforming unconstrained multi-round loops by $+0.0489$ ( $p < 0.05$ ) while reducing inference requests by 28.4%.

Figures & tables

Figure 1: Overview of the AMEND Lite architecture. In Round 1, three role-conditioned generators produce diverse candidates, which are evaluated by isolated, role-blind critics. The constraint-first selector filters candidates by feasibility thresholds before ranking by utility. If residual toxic spans persist, a bounded Round 2 invokes the minimal editor for targeted repair, enforcing monotonic acceptance.

Figure 2: Case study of pathological score oscillation in unconstrained iterative refinement. Rather than converging monotonically toward the safety target ( $\tau=0.20$ ), the rewrite trajectory repeatedly fluctuates between safe paraphrasing (e.g., Round 1: $T=0.08$ ) and severe regression (e.g., Round 2: $T=0.78$ ), illustrating why unconstrained multi-round debate produces diminishing returns and motivating AMEND Lite’s bounded controller, residual-span gating, and monotonic acceptance rules.

Method / Configuration	Safety	Content Preservation		Fluency	Overall Quality
Method / Configuration	Style (Lex.) $\uparrow$	Ref-F1 $\uparrow$	Source-F1 $\uparrow$	Surface $\uparrow$	Joint Proxy ( $J\uparrow$ )
Heuristic Baseline
Keyword Masking	1.0000	0.7512	—	0.3770	0.2817
Single-Role Generators (No Multi-Agent Selection)
Minimal Editor	0.5867	0.7778	0.9010	0.9607	$0.4623\pm 0.0122$
Tone Rewriter	0.7533	0.7102	0.7590	0.9850	$0.5385\pm 0.0080$

Table 1: Ablation of generator role diversity and iterative feedback depth on 100 ParaDetox inputs (seeds 42, 43, 44). Style measures lexicon-level detoxification; Ref-F1 and Source-F1 evaluate semantic overlap against human references and source inputs; Surface denotes output fluency; and Joint Proxy (

J

) is the instance-level product

\text{Style}\times\text{Ref-F1}\times\text{Fluency}

\pm

denotes sample standard deviation across seed means. Multi-agent selection over diverse roles yields a

+0.0508

boost over the strongest single role, capturing

89\%

of the gains achievable by full iterative debate. Bold denotes best overall; underline denotes second-best.

Method / Configuration	Safety	Content Preservation		Fluency	Overall Quality
Method / Configuration	Style (Lex.) $\uparrow$	Ref-F1 $\uparrow$	Source-F1 $\uparrow$	Surface $\uparrow$	Joint Proxy ( $J\uparrow$ )
Keyword Masking	1.0000	0.7449	—	0.3710	0.2761
Legacy AMEND (Up to 3 rounds)	0.8167	0.7497	0.7941	0.9860	$0.6108\pm 0.0156$
AMEND Lite (Targeted 2-round repair)	0.8767	0.7582	0.8067	0.9870	$\mathbf{0.6597\pm 0.0062}$

Table 2: Frozen confirmation results on a disjoint 100-example test split of ParaDetox (offsets 140–239, seeds 42, 43, 44). AMEND Lite achieves simultaneous improvements in safety (

+6.0\%

in Style) and content preservation (

+0.85\%

Ref-F1,

+1.26\%

Source-F1) without compromising fluency, resulting in a

+0.0489

increase in Joint score over legacy AMEND (

95\%

bootstrap CI

[+0.0212,+0.0788]

). Bold denotes best model performance; underline denotes highest safety among generative methods.

Computational Metric	Legacy	Lite	$\Delta$ (%)
Inference Calls
Physical requests / item	13.19	9.45	$-28.4\%$
Standalone est. requests	13.19	12.45	$-5.6\%$
Token Consumption
Prompt tokens / item	3466.7	2481.4	$-28.4\%$
Completion tokens / item	654.2	439.7	$-32.8\%$

Table 3: Computational profiling and execution audit on the confirmation subset. AMEND Lite substantially curtails token overhead and latency by eliminating redundant search rounds. In paired evaluation, Lite reuses input critiques (yielding a

28.4\%

request reduction); restoring these critiques in standalone deployment still yields an overall efficiency gain.

Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

Comparison	Diff.	95% Bootstrap CI
vs. Heuristic Baseline
One-round $-$ Masking	$+0.3077$	$[+.2488,+.3656]^{*}$
Full $-$ Masking	$+0.3138$	$[+.2552,+.3711]^{*}$
Lite $-$ Masking	$+0.3836$	$[+.3286,+.4360]^{*}$
Role Diversity vs. Single Roles (Ablation)
One-round $-$ Minimal	$+0.1270$	$[+.0778,+.1789]^{*}$

Appendix

Table 4: Sample-aligned paired bootstrap comparisons across 5,000 resamples. Differences are calculated on instance-level Joint proxy means averaged across seeds (42, 43, 44). Asterisk (

*

) indicates statistical significance (

95\%

bootstrap confidence interval strictly excludes zero).

Text Detoxification

See all 12 papers

AEGIS: Awareness-Enhanced Guidance for Iterative Safeguard
Jul 20, 2026Kyungwon Park, Sangmin Lee, Heejae Chon +1Language Model Safety Evaluation Text Detoxification
Dept. of Artificial Intelligence, Yonsei University · Dept. of Electrical & Electronic Engineering, Yonsei University · Dept. of Computer Science & Engineering, Yonsei University +1
Test-Time Detoxification without Training or Learning Anything
Jan 14, 2026Baturay Saglam, Dionysis KalogeriasLarge Language Model-Guided Optimization LLM Safety
Department of Electrical and Computer Engineering, Yale University, New Haven, CT.
Detoxification for LLM: From Dataset Itself
Apr 21, 2026Wei Shao, Yihang Wang, Gaoyu Zhu +4Training Data Curation LLM Safety
State Key Laboratory of AI Safety · Institute of Computing Technology, Chinese Academy of Sciences · University of Chinese Academy of Sciences

Jul 20, 2026J/K move · Enter open · S save

AEGIS: Awareness-Enhanced Guidance for Iterative Safeguard

Kyungwon Park, Sangmin Lee, Heejae Chon, Hyungu Kang

Dept. of Artificial Intelligence, Yonsei University · Dept. of Electrical & Electronic Engineering, Yonsei University · Dept. of Computer Science & Engineering, Yonsei University+1

Language Model Safety Evaluation Text Detoxification Text Generation

Open paper AskPDF arXiv

Span-level rationales are often assumed to improve controllability in text detoxification, but it remains unclear when such guidance helps and when it introduces trade-offs. We present Awareness-Enhanced Guidance for Iterative Safeguard (AEGIS) as an exploratory framework for studying span-guided multilingual detoxification across English, Mandarin Chinese, and Korean. AEGIS combines span-level detector outputs with frozen generator backbones, allowing harmful spans, intensity labels, and target attributes to be provided as structured guidance during rewriting. Rather than claiming state-of-the-art detoxification performance, we analyze how span guidance affects the balance between toxicity reduction and meaning preservation across generator families, model scales, and languages. Our results suggest that span-guided detoxification is conditionally useful: explicit rationales change the trade-off between toxicity reduction and meaning preservation, but their effects depend strongly on the generator backbone and the linguistic context. These findings highlight both the promise and the limitations of span-level control signals for multilingual detoxification.

Abstract

Text Detoxification

Explore similar work

AEGIS: Awareness-Enhanced Guidance for Iterative Safeguard

Test-Time Detoxification without Training or Learning Anything

Detoxification for LLM: From Dataset Itself