mlsanityData to 7 Oct 2026

Code-Switching Red-Teaming: LLM Evaluation for Safety and Multilingual Understanding

arXiv 2406.15481 ↗First posted 17 Jun 2024cs.AI cs.CLcited by 34

On the map: LLM safety and security → Prompt injection and agent security

Abstract (arXiv)

As large language models (LLMs) have advanced rapidly, concerns regarding their safety have become prominent. In this paper, we discover that code-switching in red-teaming queries can effectively elicit undesirable behaviors of LLMs, which are common practices in natural language. We introduce a simple yet effective framework, CSRT, to synthesize codeswitching red-teaming queries and investigate the safety and multilingual understanding of LLMs comprehensively. Through extensive experiments with ten state-of-the-art LLMs and code-switching queries combining up to 10 languages, we demonstrate that the CSRT significantly outperforms existing multilingual red-teaming techniques, achieving 46.7% more attacks than standard attacks in English and being effective in conventional safety domains. We also examine the multilingual ability of those LLMs to generate and understand codeswitching texts. Additionally, we validate the extensibility of the CSRT by generating codeswitching attack prompts with monolingual data. We finally conduct detailed ablation studies exploring code-switching and propound unintended correlation between resource availability of languages and safety alignment in existing multilingual LLMs.

Key facts. Cited by 34 papers in the map (data through 7 Oct 2026). Placed in Prompt injection and agent security, one of 12 directions in LLM safety and security. Builds on 32 of its 60 references that are in the map. First posted on arXiv 17 Jun 2024.

Builds on

32 of 60 references.

Closest ancestors · 1

Same direction, newest first

  1. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal6 Feb

Other references · 31

  1. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,393
  2. 2020Measuring Massive Multitask Language Understandingcited by 7,768
  3. 2020Scaling Laws for Neural Language Modelscited by 6,411
  4. 2018Think you have Solved Question Answering? Try ARC, the AI2 Reasoning Challengecited by 4,710
  5. 2019HellaSwag: Can a Machine Really Finish Your Sentence?cited by 4,018
  6. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  7. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
  8. 2018Datasheets for Datasetscited by 1,371
  9. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
  10. 2020RealToxicityPrompts: Evaluating Neural Toxic Degeneration in Language Modelscited by 1,235
  11. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
  12. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
19 more
  1. 2023Prometheus: Inducing Fine-grained Evaluation Capability in Language Modelscited by 558
  2. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Promptscited by 520
  3. 2023Detecting Language Model Attacks with Perplexitycited by 411
  4. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Ciphercited by 401
  5. 2023The Belebele Benchmark: a Parallel Reading Comprehension Dataset in 122 Language Variantscited by 300
  6. 2023A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easilycited by 242
  7. 2024LLaMA Beyond English: An Empirical Study on Language Capability Transfercited by 94
  8. 2020LinCE: A Centralized Benchmark for Linguistic Code-switching Evaluationcited by 92
  9. 2024CodeAttack: Revealing Safety Generalization Challenges of Large Language Models via Code Completioncited by 70
  10. 2020Corpus Creation for Sentiment Analysis in Code-Mixed Tamil-English Textcited by 67
  11. 2023Multilingual Large Language Models Are Not (Yet) Code-Switcherscited by 65
  12. 2023Prompting Multilingual Large Language Models to Generate Code-Mixed Texts: The Case of South East Asian Languagescited by 50
  13. 2021ASCEND: A Spontaneous Chinese-English Dataset for Code-switching in Multi-turn Conversationcited by 43
  14. 2022The Decades Progress on Code-Switching Research in NLP: A Systematic Survey on Trends and Challengescited by 35
  15. 2020A New Dataset for Natural Language Inference from Code-mixed Conversationscited by 29
  16. 2024Sandwich attack: Multi-language Mixture Adaptive Attack on LLMscited by 20
  17. 2022TALCS: An Open-Source Mandarin-English Code-Switching Corpus and a Speech Recognition Baselinecited by 17
  18. 2022KenSwQuAD -- A Question Answering Dataset for Swahili Low Resource Languagecited by 12
  19. 2021CodemixedNLP: An Extensible and Open NLP Toolkit for Code-Mixingcited by 8

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 2; 2025: 15; 2026: 17.

34 papers.

Sort:

By area:

  1. 2025PolyGuard: A Multilingual Safety Moderation Tool for 17 Languagescited by 57
  2. 2025The State of Multilingual LLM Safety Research: From Measuring the Language Gap to Mitigating Itcited by 42
  3. 2025MPO: Multilingual Safety Alignment via Reward Gap Optimizationcited by 18
  4. 2025Investigating and Scaling up Code-Switching for Multilingual Language Model Pre-Trainingcited by 15
  5. 2024Benchmarking LLM Guardrails in Handling Multilingual Toxicitycited by 13
  6. 2026Obscure but Effective: Classical Chinese Jailbreak Prompt Optimization via Bio-Inspired Searchcited by 10
  7. 2025MrGuard: A Multilingual Reasoning Guardrail for Universal LLM Safetycited by 9
  8. 2025Measuring Harmfulness of Computer-Using Agentscited by 8
  9. 2025Beyond Monolingual Assumptions: A Survey of Code-Switched NLP in the Era of Large Language Models across Modalitiescited by 4
  10. 2025Do Methods to Jailbreak and Defend LLMs Generalize Across Languages?cited by 4
  11. 2025Response-Based Knowledge Distillation for Multilingual Jailbreak Prevention Unwittingly Compromises Safetycited by 4
  12. 2025Gradual Code-Switching as Inference-Time Cross-Lingual Representational Alignment for LLMscited by 3
22 more
  1. 2026LASA: Language-Agnostic Semantic Alignment at the Semantic Bottleneck for LLM Safetycited by 3
  2. 2026TukaBench: A Culturally Grounded Jailbreak Benchmark for African Languagescited by 3
  3. 2025Phonetic Perturbations Reveal Tokenizer-Rooted Safety Gaps in LLMscited by 2
  4. 2025Beyond Weaponization: NLP Security for Medium and Lower-Resourced Languages in Their Own Rightcited by 2
  5. 2025CREST: Universal Safety Guardrails Through Cluster-Guided Cross-Lingual Transfercited by 2
  6. 2026Red-Teaming Agent Execution Contexts: Open-World Security Evaluation on OpenClawcited by 2
  7. 2026Multilingual Refusal Alignment for Safer Large Language Modelscited by 2
  8. 2024Human-in-the-Loop Generation of Adversarial Texts: A Case Study on Tibetan Scriptcited by 1
  9. 2025Language steering in latent space to mitigate unintended code-switchingcited by 1
  10. 2026BabelSafe: A Policy-Grounded Multilingual Safety Benchmark for LLMscited by 1
  11. 2026Position: the Stochastic Parrot in the Coal Mine. Model Collapse is a Threat to Low-Resource Communitiescited by 1
  12. 2026Going PLACES: Participatory Localized Red Teaming for Text-to-Image Safety in the Global Southcited by 1
  13. 2026Single Canonical Prompts Underestimate LLM Safety's Surface-Form Sensitivitycited by 1
  14. 2026Register Shifts Break LLM Safety: A Bengali Benchmark with Culturally Grounded Harmscited by 1
  15. 2025Safe in the Future, Dangerous in the Past: Dissecting Temporal and Linguistic Vulnerabilities in LLMscited by 0
  16. 2026Code Mixologist : A Practitioner's Guide to Building Code-Mixed LLMscited by 0
  17. 2026Inverting the Shield: Systematically Generating Safety Tests from Policy Specificationscited by 0
  18. 2026SpeechJBB: Probing Safety Alignment and Comprehension in Large Audio Language Models under Code-Switched Speechcited by 0
  19. 2026MLingualFC: Evaluating Jailbreak Vulnerabilities in Multilingual Vision-Language Modelscited by 0
  20. 2026A Survey of Toxicity Detection and Mitigation Strategies for Multilingual Language Modelscited by 0
  21. 2026Safety Targeted Embedding Exploit via Refinementcited by 0
  22. 2026HiveTraceGuard-Pro: A Compact Generative Guardrail for Prompt Injection, Jailbreaks, and Adversarial Obfuscationcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2023Red-Teaming Large Language Models using Chain of Utterances for Safety-Alignment
  2. 2025LLM-Safety Evaluations Lack Robustness
  3. 2026AMT-X: Phase-Structured Multi-Turn Red-Teaming with Checklist-Gated Evaluation
  4. 2026OpenRT: An Open-Source Red Teaming Framework for Multimodal LLMs
  5. 2026Minionese: Comprehensive Benchmark and Mechanistic Study of Multilingual LLM Safety
  6. 2024Against The Achilles' Heel: A Survey on Red Teaming for Generative Models
  7. 2023All Languages Matter: On the Multilingual Safety of Large Language Models
  8. 2025X-Guard: Multilingual Guard Agent for Content Moderation