ToxiGAN: Controlled Toxic Text Augmentation

• ToxiGAN is a class-aware augmentation framework that fuses adversarial generation with LLM-generated semantic ballast to control toxic text production.
• It employs a two-step directional training procedure by alternately maximizing divergence from neutral anchors and aligning with authentic toxic distributions.
• Experimental results show that ToxiGAN effectively improves Macro-F1 and Hate-F1 scores in low-resource toxicity detection scenarios.

ToxiGAN is a class-aware data augmentation framework for controllable toxic text generation, specifically designed to address severe class imbalance and poor decision boundary calibration in toxicity classification tasks. Unlike conventional generative adversarial network (GAN) approaches or LLM augmentation pipelines, ToxiGAN fuses adversarial generation with LLM-based semantic guidance. The system employs "semantic ballast"—LLM-generated neutral anchors in embedding space—and implements a two-step directional training regimen, pushing synthetic examples away from neutrality while maintaining class fidelity and linguistic realism. This results in diverse and label-consistent toxic samples that enhance classifier robustness, especially in low-resource regimes (Li et al., 6 Jan 2026).

1. Motivation and Problem Context

Toxicity classification remains hampered by pronounced class imbalance: neutral examples vastly outnumber rare but critical subtypes of toxic language. This imbalance impairs coverage of minority hate categories and yields poor classifier calibration for nuanced boundaries. Standard GANs for text generation frequently succumb to failure modes such as mode collapse, semantic drift toward neutrality, or generation restricted to narrow toxic sub-domains. Meanwhile, state-of-the-art LLMs possess strong fluency but are explicitly alignment-tuned to avoid generating toxic content, limiting their utility for minority class augmentation.

ToxiGAN addresses these obstacles by explicitly combining three elements:

• Class-Aware Adversarial Generation: Generation remains targeted to specific hate subcategories.
• Semantic Ballast via LLMs: LLMs supply neutral exemplars acting as anchors in the embedding space, controlling the semantic drift of synthetic toxic candidates.
• Alternating Directional Training: Generator optimization alternates between maximizing divergence from these neutral anchors and maximizing discriminator-rated authenticity.

2. Model Framework and Components

ToxiGAN comprises three principal modules:

Module	Function	Key Implementation Details
Toxic Generator $G$	Class-conditional text generation	LSTM-based, $K$ decoding heads (one per toxic subclass), maximum-likelihood pretraining
Multi-class Discriminator $D$	Realism and class membership assessment	RoBERTa/BERT encoder, $K+2$ heads: $K$ for toxic subclasses, 1 for real neutral, 1 for fake/out-of-distribution
LLM-based Neutral Text Provider	Supplies "semantic ballast"	Few-shot prompted (e.g., LLaMA 3.2) to generate in-domain, neutral exemplars, dynamically updated

During generation, $G_i(z)$ (for class $i$ and random noise $z$) produces candidate toxic sentences that the discriminator $D$ evaluates. The LLM-generated neutral sentence pool $\mathcal B_{\text{neutral}}$ anchors the embedding space.

3. Two-Step Directional Training Procedure

Training alternates between two distinct loss functions for each class-conditional generator $G_i$ at step $t$:

1. Toxicity Step (Directional Divergence, odd $t$):
   • For a sampled neutral anchor $x_{\text{neut}} \in \mathcal B_{\text{neutral}}$ and embedding function $\Phi(\cdot)$ (e.g., all-MiniLM), the loss is:

   $$\mathcal{L}^{(t)}_{\mathrm{dir},\,i} = \mathbb{E}_{z\sim P_z}\Big[\max_{x\in\mathcal B_{\text{neutral}}} \cos\!\big(\Phi(G_i(z)),\,\Phi(x)\big)\Big]$$

• Minimizing $\mathcal{L}_{\mathrm{dir}}$ drives generated samples away from the semantic space of neutrality.

1. Authenticity Step (Adversarial Alignment, even $t$):
   • Standard GAN-style class-targeted loss:

   $$\mathcal{L}^{(t)}_{\mathrm{adv},\,i} = \mathbb{E}_{z\sim P_z}\big[\,1 - D_i(G_i(z))\big]$$

• Minimizing $\mathcal{L}_{\mathrm{adv}}$ aligns generated sentences to the true (labeled) distribution of toxic subclass $i$.

The training schedule alternates these objectives (rather than optimizing a fixed weighted sum), empirically delivering improved stability and class-consistent diversity relative to monolithic objectives. A plausible implication is that this decoupling mitigates reward interference between toxicity control and authenticity objectives.

4. Dynamic Semantic Ballast Selection

LLMs generate neutral exemplars for semantic anchoring, but these anchors require continual adaptation to keep pace with evolving discriminator boundaries. ToxiGAN implements a dynamic selection pool:

• From a large initial set $\mathcal X_{\mathrm{neutral}}$, the discriminator head $D_0(x)$ (neutral probability) scores each candidate.
• At each epoch, the top $r\%$ by $D_0(x)$ are retained, recursively halving $r$ until reaching a fixed-size ballast pool (e.g., 100 anchors):

$$\mathcal B_{\text{neutral}}^{(t)} = \mathrm{Top}_{r}\!\big\{\,x\in\mathcal X_{\mathrm{neutral}}\mid s(x)\big\}$$

• The resulting $\mathcal B_{\text{neutral}}^{(t)}$ serves both for the directional loss and for re-prompting LLM generation in subsequent epochs.

This dynamic filtering ensures that the semantic ballast remains aligned with the real neutral distribution, stabilizing generator trajectories and mitigating degeneration into irrelevant or off-domain anchors.

5. Experimental Protocol and Baselines

ToxiGAN was evaluated across four publicly available social media hate/abuse benchmarks: WZ (Waseem & Hovy, Twitter), DC (Discord Chat, fine-grained linguistics), HX (HateXplain), and OR (Offensive Reddit). Metrics include Macro-F1 (unweighted), Hate-F1 (averaged over toxic/hate classes), and a Detoxify toxicity score sanity check.

The experimental protocol enforced a low-resource regime: only 50% of the real toxic samples were provided, with the remaining toxic instances filled by synthetic data from the method under evaluation. Each result reflects mean performance over five random seeds. Baselines spanned conventional augmentation (e.g., back-translation, SentiGAN) and LLM-based (Mistral-0.3 ZeroGen, Llama3.2-ToxicCraft, GPT-4.1/4o-ToxiCraft).

6. Results, Ablation, and Analytic Insights

ToxiGAN delivered the highest mean Macro-F1 and Hate-F1 across both BERT and RoBERTa classifier backbones. The improvement in nuanced, multi-category settings (DC/OR) was especially pronounced (up to +2.4 Hate-F1 versus alternative augmentation). LLM-only generations could not match traditional synthetic text approaches—despite greater fluency—due to alignment-induced toxicity filtering.

Key results from ablation studies include:

• Removing semantic ballast (reduction to SentiGAN-like objectives) resulted in −2.4 Macro-F1 and −2.7 Hate-F1.
• Eliminating the toxicity (directional) step cost −0.8 Macro-F1 and −1.2 Hate-F1.
• Full ToxiGAN outperformed both ablations, confirming the necessity of both semantic guidance and two-step training.

Sensitivity analysis demonstrated that ToxiGAN consistently outperformed oversampling for all real:synthetic toxic data ratios, narrowing the gap to the (unachievable) ideal full-gold label upper bound as more real samples were added.

Training curve analysis indicated smoother, faster generator loss convergence and lower discriminator variance when using alternating directional learning and semantic ballast. Embedding-space t-SNE visualization further confirmed that ToxiGAN’s outputs span the space between neutral and out-of-domain toxic clusters, with clear, controlled shifts driven by the training objective.

7. Practical Considerations and Recommendations

Semantic ballast anchoring—realized via dynamically filtered LLM-generated neutral examples—provides reliable control over semantic deviation, directly mitigating the mode collapse and drift commonly observed in vanilla GANs. Critically, alternating (rather than weighted-sum) update scheduling avoids interference between toxicity and authenticity gradients, enabling practitioners to monitor and adjust step frequencies in response to saturation in either objective.

For deployment in low-resource or rapidly evolving domains (e.g., emergent hate-related lexicons), ToxiGAN can bolster minority class coverage. Strong downstream performance depends on pairing the system with robust embedding and discriminator architectures, such as RoBERTa or DeBERTa. Ethical risk mitigation remains essential: generated data should undergo human or automated review prior to release or use in production settings. Parameter tuning for ballast pool size, cosine similarity threshold, and alternation schedule should be performed to optimize for domain-specific characteristics.

In conclusion, ToxiGAN establishes an adversarial, class-aware mechanism achieving controllable and diverse toxic text augmentation. By leveraging LLMs in a neutral anchor role with a two-step directional learning regimen, ToxiGAN substantially improves classifier robustness and label consistency in low-resource toxicity detection scenarios (Li et al., 6 Jan 2026).