mlsanityData to 7 Oct 2026

Towards Understanding the Fragility of Multilingual LLMs against Fine-Tuning Attacks

arXiv 2410.18210 ↗First posted 23 Oct 2024cs.CL cs.AI cs.CRcited by 33

On the map: LLM safety and security → Safety alignment, refusal and guardrails

Abstract (arXiv)

Recent advancements in Large Language Models (LLMs) have sparked widespread concerns about their safety. Recent work demonstrates that safety alignment of LLMs can be easily removed by fine-tuning with a few adversarially chosen instruction-following examples, i.e., fine-tuning attacks. We take a further step to understand fine-tuning attacks in multilingual LLMs. We first discover cross-lingual generalization of fine-tuning attacks: using a few adversarially chosen instruction-following examples in one language, multilingual LLMs can also be easily compromised (e.g., multilingual LLMs fail to refuse harmful prompts in other languages). Motivated by this finding, we hypothesize that safety-related information is language-agnostic and propose a new method termed Safety Information Localization (SIL) to identify the safety-related information in the model parameter space. Through SIL, we validate this hypothesis and find that only changing 20% of weight parameters in fine-tuning attacks can break safety alignment across all languages. Furthermore, we provide evidence to the alternative pathways hypothesis for why freezing safety-related parameters does not prevent fine-tuning attacks, and we demonstrate that our attack vector can still jailbreak LLMs adapted to new languages.

Key facts. Cited by 33 papers in the map (data through 7 Oct 2026). Placed in Safety alignment, refusal and guardrails, one of 12 directions in LLM safety and security. Builds on 30 of its 46 references that are in the map. First posted on arXiv 23 Oct 2024.

Builds on

30 of 46 references.

Closest ancestors · 5

Same direction, newest first

  1. 2024The Multilingual Alignment Prism: Aligning Global and Local Preferences to Reduce Harm26 Jun
  2. 2024Refusal in Language Models Is Mediated by a Single Direction17 Jun
  3. 2024Lisa: Lazy Safety Alignment for Large Language Models against Harmful Fine-tuning Attack28 May
  4. 2024Assessing the Brittleness of Safety Alignment via Pruning and Low-Rank Modifications7 Feb
  5. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!5 Oct

Other references · 25

  1. 2023GPT-4 Technical Reportcited by 18,132
  2. 2022Training language models to follow instructions with human feedbackcited by 15,712
  3. 2024The Llama 3 Herd of Modelscited by 14,192
  4. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
  5. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 7,916
  6. 2021Finetuned Language Models Are Zero-Shot Learnerscited by 3,747
  7. 2017Axiomatic Attribution for Deep Networkscited by 3,350
  8. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  9. 2024Qwen2 Technical Reportcited by 2,076
  10. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
  11. 2023BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Datasetcited by 828
  12. 2018SNIP: Single-shot Network Pruning based on Connection Sensitivitycited by 802
13 more
  1. 2023Jailbreaking ChatGPT via Prompt Engineering: An Empirical Studycited by 478
  2. 2024Mechanistic Interpretability for AI Safety -- A Reviewcited by 415
  3. 2023Low-Resource Languages Jailbreak GPT-4cited by 290
  4. 2024Do Llamas Work in English? On the Latent Language of Multilingual Transformerscited by 275
  5. 2023Okapi: Instruction-tuned Large Language Models in Multiple Languages with Reinforcement Learning from Human Feedbackcited by 189
  6. 2024Tamper-Resistant Safeguards for Open-Weight LLMscited by 132
  7. 2020Self-Attention Attribution: Interpreting Information Interactions Inside Transformercited by 124
  8. 2024Safe LoRA: the Silver Lining of Reducing Safety Risks when Fine-tuning Large Language Modelscited by 122
  9. 2023Task-Specific Skill Localization in Fine-tuned Language Modelscited by 104
  10. 2022BLOOM+1: Adding Language Support to BLOOM for Zero-Shot Promptingcited by 90
  11. 2024Localize-and-Stitch: Efficient Model Merging via Sparse Task Arithmeticcited by 50
  12. 2024Preference Tuning For Toxicity Mitigation Generalizes Across Languagescited by 31
  13. 2024TuBA: Cross-Lingual Transferability of Backdoor Attacks in LLMs with Instruction Tuningcited by 13

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 2; 2025: 19; 2026: 12.

33 papers.

Sort:

By area:

  1. 2025Emergent Misalignment: Narrow finetuning can produce broadly misaligned LLMscited by 158
  2. 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deploymentcited by 110
  3. 2025MMLU-ProX: A Multilingual Benchmark for Advanced Large Language Model Evaluationcited by 73
  4. 2025The State of Multilingual LLM Safety Research: From Measuring the Language Gap to Mitigating Itcited by 42
  5. 2025MergeBench: A Benchmark for Merging Domain-Specialized LLMscited by 30
  6. 2025Panacea: Mitigating Harmful Fine-tuning for Large Language Models via Post-fine-tuning Perturbationcited by 20
  7. 2025MPO: Multilingual Safety Alignment via Reward Gap Optimizationcited by 18
  8. 2025Unforgotten Safety: Preserving Safety Alignment of Large Language Models with Continual Learningcited by 10
  9. 2025LookAhead Tuning: Safer Language Models via Partial Answer Previewscited by 7
  10. 2025Safety Subspaces are Not Linearly Distinct: A Fine-Tuning Case Studycited by 6
  11. 2024PEFT-as-an-Attack! Jailbreaking Language Models during Federated Parameter-Efficient Fine-Tuningcited by 5
  12. 2025No, of Course I Can! Deeper Fine-Tuning Attacks That Bypass Token-Level Safety Mechanismscited by 5
21 more
  1. 2025sudoLLM: On Multi-role Alignment of Language Modelscited by 4
  2. 2025Mitigating Watermark Forgery in Generative Models via Randomized Key Selectioncited by 4
  3. 2024Knowledge Graph Guided Evaluation of Abstention Techniquescited by 2
  4. 2025Safety-Aligned Weights Are Not Enough: Refusal-Teacher-Guided Finetuning Enhances Safety and Downstream Performance under Harmful Finetuning Attackscited by 2
  5. 2025SPQR: A Multi-Dimensional Benchmark for Safety Alignment under Benign Model Adaptationcited by 2
  6. 2026Alignment-Weighted DPO: A principled reasoning approach to improve safety alignmentcited by 2
  7. 2026Invisible Safety Threat: Malicious Finetuning for LLM via Steganographycited by 2
  8. 2025MENTOR: A Metacognition-Driven Self-Evolution Framework for Uncovering and Mitigating Implicit Domain Risks in LLMscited by 1
  9. 2026TamperBench: Systematically Stress-Testing LLM Safety Under Fine-Tuning and Tamperingcited by 1
  10. 2025Beautiful Images, Toxic Words: Understanding and Addressing Offensive Text in Generated Imagescited by 0
  11. 2025Multilingual Collaborative Defense for Large Language Modelscited by 0
  12. 2025LLaVA-NeuMT: Selective Layer-Neuron Modulation for Efficient Multilingual Multimodal Translationcited by 0
  13. 2026Learning to Stay Safe: Adaptive Regularization Against Safety Degradation during Fine-Tuningcited by 0
  14. 2026Can LLM Safety Be Ensured by Constraining Parameter Regions?cited by 0
  15. 2026The Art of (Mis)alignment: How Fine-Tuning Methods Effectively Misalign and Realign LLMs in Post-Trainingcited by 0
  16. 2026Test-Time Training Undermines Safety Guardrailscited by 0
  17. 2026A Survey of Toxicity Detection and Mitigation Strategies for Multilingual Language Modelscited by 0
  18. 2026A Gravitational Interpretation of Safety Reversion under Fine-Tuningcited by 0
  19. 2026The Heterogeneous Safety Impacts of Benign Multilingual Fine-Tuningcited by 0
  20. 2026Defending Against Harmful Supervision Hidden in Benign Samplescited by 0
  21. 2026Minionese: Comprehensive Benchmark and Mechanistic Study of Multilingual LLM Safetycited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Understanding and Preserving Safety in Fine-Tuned LLMs
  2. 2024The Language Barrier: Dissecting Safety Challenges of LLMs in Multilingual Contexts
  3. 2024No Two Devils Alike: Unveiling Distinct Mechanisms of Fine-tuning Attacks
  4. 2025Fine-Tuning Lowers Safety and Disrupts Evaluation Consistency
  5. 2025Secure LLM Fine-Tuning via Safety-Aware Probing
  6. 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deep
  7. 2026Security in the Fine-Tuning Lifecycle of Large Language Models: Threats, Defenses,Evaluation, and Future Directions
  8. 2025Rethinking Safety in LLM Fine-tuning: An Optimization Perspective