Suppose a large language model is trained on web pages and Reddit posts that include hateful speech. Filtering screens that material against safety criteria and removes selected content before training, aiming to make harmful responses less likely. section 3.7
One approach uses a classifier—a system trained to recognize potentially toxic or unsafe content—to examine a large training dataset. Filtering removes material it flags. Conditional pretraining takes a different route: it can retain material labeled unsafe, then ask the model to generate responses resembling the safe material. Both depend on classifying vast amounts of data, sometimes imperfectly. section 3.7
A training-data choice
If particular subreddits contain substantial toxic speech, a developer might exclude them from training. Alternatively, the developer might retain them with unsafe labels for conditional pretraining. Neither choice is simply a matter of deleting bad words: each changes what the model can learn from. section 3.7
Filtering has costs and risks. Screening a frontier-scale training dataset is expensive, and the efficient classifier needed for the task may be less accurate than a larger model. Removing hate speech or explicit content from web data may also suppress the voices of LGBTQ+ people and other marginalized groups. More sophisticated methods seek to preserve diverse voices, but remain imperfect and often proprietary. section 3.7 section 3.2
Filtering can also be applied to inputs reaching AI agents. It is one safeguard against malicious instructions hidden in material an agent reads, alongside measures such as memory segmentation and permission boundaries. It is not a complete defense: agent security remains difficult to test, and defenses can be brittle under attack. section 8.22
