mlsanityData to 14 Oct 2026

The Tower of Babel Revisited: Multilingual Jailbreak Prompts on Closed-Source Large Language Models

arXiv 2505.12287 ↗First posted 18 May 2025cs.CL cs.AIcited by 3

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Large language models (LLMs) have seen widespread applications across various domains, yet remain vulnerable to adversarial prompt injections. While most existing research on jailbreak attacks and hallucination phenomena has focused primarily on open-source models, we investigate the frontier of closed-source LLMs under multilingual attack scenarios. We present a first-of-its-kind integrated adversarial framework that leverages diverse attack techniques to systematically evaluate frontier proprietary solutions, including GPT-4o, DeepSeek-R1, Gemini-1.5-Pro, and Qwen-Max. Our evaluation spans six categories of security contents in both English and Chinese, generating 38,400 responses across 32 types of jailbreak attacks. Attack success rate (ASR) is utilized as the quantitative metric to assess performance from three dimensions: prompt design, model architecture, and language environment. Our findings suggest that Qwen-Max is the most vulnerable, while GPT-4o shows the strongest defense. Notably, prompts in Chinese consistently yield higher ASRs than their English counterparts, and our novel Two-Sides attack technique proves to be the most effective across all models. This work highlights a dire need for language-aware alignment and robust cross-lingual defenses in LLMs, and we hope it will inspire researchers, developers, and policymakers toward more robust and inclusive AI systems.

Key facts. Cited by 3 papers in the map (data through 14 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 29 of its 55 references that are in the map. First posted on arXiv 18 May 2025.

Builds on

29 of 55 references.

Closest ancestors · 5

Same direction, newest first

  1. 2025Evolving Security in LLMs: A Study of Jailbreak Attacks and Defenses2 Apr
  2. 2025Understanding and Enhancing the Transferability of Jailbreaking Attacks5 Feb
  3. 2024SequentialBreak: Large Language Models Can be Fooled by Embedding Jailbreak Prompts into Sequential Prompt Chains10 Nov
  4. 2024Jailbreak Attacks and Defenses Against Large Language Models: A Survey5 Jul
  5. 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul

Other references · 24

  1. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 14,132
  2. 2024Gemini 1.5: Unlocking multimodal understanding across millions of tokens of contextcited by 3,224
  3. 2022Constitutional AI: Harmlessness from AI Feedbackcited by 3,050
  4. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  5. 2023Prompt Injection attack against LLM-integrated Applicationscited by 605
  6. 2024Frontier Models are Capable of In-context Schemingcited by 287
  7. 2025The Hidden Risks of Large Reasoning Models: A Safety Assessment of R1cited by 91
  8. 2024Red-Teaming for Generative AI: Silver Bullet or Security Theater?cited by 83
  9. 2024Safeguarding Large Language Models: A Surveycited by 78
  10. 2024A Complete Survey on LLM-based AI Chatbotscited by 71
  11. 2024Jailbreak Large Vision-Language Models Through Multi-Modal Linkagecited by 62
  12. 2023All Languages Matter: On the Multilingual Safety of Large Language Modelscited by 53
12 more
  1. 2024COIG-CQIA: Quality is All You Need for Chinese Instruction Fine-tuningcited by 45
  2. 2024Jailbreak Attacks and Defenses against Multimodal Generative Models: A Surveycited by 32
  3. 2023UHGEval: Benchmarking the Hallucination of Chinese Large Language Models via Unconstrained Generationcited by 22
  4. 2024Multilingual Blending: LLM Safety Alignment Evaluation with Language Mixturecited by 22
  5. 2024Sandwich attack: Multi-language Mixture Adaptive Attack on LLMscited by 20
  6. 2024The Open Source Advantage in Large Language Models (LLMs)cited by 18
  7. 2024Towards Comprehensive Post Safety Alignment of Large Language Models via Safety Patchingcited by 17
  8. 2024Look Within, Why LLMs Hallucinate: A Causal Perspectivecited by 11
  9. 2025Bridging the Safety Gap: A Guardrail Pipeline for Trustworthy LLM Inferencescited by 8
  10. 2025`From Prompt to Perturbation': An Adaptive Framework for Voice-Based Jailbreaks on Audio LLMscited by 7
  11. 2025Bridging the LLM Accessibility Divide? Performance, Fairness, and Cost of Closed versus Open LLMs for Automated Essay Scoringcited by 7
  12. 2025Safety Evaluation and Enhancement of DeepSeek Models in Chinese Contextscited by 4

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 1; 2026: 2.

3 papers.

  1. 2025Evaluating the Robustness of Large Language Model Safety Guardrails Against Adversarial Attackscited by 5
  2. 2026ROK-FORTRESS: Measuring the Effect of Geopolitical Transcreation for National Security and Public Safetycited by 0
  3. 2026Safety Targeted Embedding Exploit via Refinementcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Jailbreaking and Mitigation of Vulnerabilities in Large Language Models
  2. 2026SoK: Robustness in Large Language Models against Jailbreak Attacks
  3. 2024JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks
  4. 2025Do Methods to Jailbreak and Defend LLMs Generalize Across Languages?
  5. 2025Evaluating Adversarial Vulnerabilities in Modern Large Language Models
  6. 2024A Comprehensive Study of Jailbreak Attack versus Defense for Large Language Models
  7. 2023A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easily
  8. 2025AutoAdv: Automated Adversarial Prompting for Multi-Turn Jailbreaking of Large Language Models