mlsanityData to 7 Oct 2026

Response-Based Knowledge Distillation for Multilingual Jailbreak Prevention Unwittingly Compromises Safety

arXiv 2602.11157 ↗First posted 8 Dec 2025cs.CLcited by 4

On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks

also in 1 more
Abstract (arXiv)

Large language models (LLMs) are increasingly deployed worldwide, yet their safety alignment remains predominantly English-centric. This allows for vulnerabilities in non-English contexts, especially with low-resource languages. We introduce a novel application of knowledge distillation (KD) in the context of multilingual jailbreak prevention, examining its efficacy. We distill the refusal behaviors of a proprietary teacher model (OpenAI o1-mini) with Low-Rank Adaptation (LoRA) into three open-source student models: Meta-Llama-3-8B-Instruct, Gemma-2-2B-IT, and Qwen3-8B, using ~28,000 multilingual jailbreak prompts from XSafety via black-box response-based, parameter-efficient fine-tuning (PEFT). Evaluation on the MultiJail benchmark reveals a counterintuitive behavior: standard fine-tuning on the teacher's ``safe'' refusal data inadvertently increases Jailbreak Success Rate (JSR) for all student models, up to 16.6 percentage points. Our experiments reveal a divergent generalization to unseen languages during distillation, with varying outcomes depending on the base model. By removing a primary source of safety degradation, nuanced `boundary' refusals, we mitigate or even reverse safety declines in student models, although reductions in reasoning performance (GSM8K) persist. Overall, our exploratory study highlights the challenges and potential of KD as a technique for multilingual safety alignment, offering a foundation for future research in this direction.

Key facts. Cited by 4 papers in the map (data through 7 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 30 of its 33 references that are in the map. First posted on arXiv 8 Dec 2025.

Builds on

30 of 33 references.

Closest ancestors · 2

Same direction, newest first

  1. 2024The Language Barrier: Dissecting Safety Challenges of LLMs in Multilingual Contexts23 Jan
  2. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!5 Oct

Other references · 28

  1. 2020Language Models are Few-Shot Learnerscited by 32,199
  2. 2022Training language models to follow instructions with human feedbackcited by 15,712
  3. 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,084
  4. 2015Distilling the Knowledge in a Neural Networkcited by 10,076
  5. 2021Training Verifiers to Solve Math Word Problemscited by 9,743
  6. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,393
  7. 2016Overcoming catastrophic forgetting in neural networkscited by 4,718
  8. 2022Self-Instruct: Aligning Language Models with Self-Generated Instructionscited by 2,674
  9. 2024A Survey on LLM-as-a-Judgecited by 1,384
  10. 2023Distilling Step-by-Step! Outperforming Larger Language Models with Less Training Data and Smaller Model Sizescited by 710
  11. 2022ToxiGen: A Large-Scale Machine-Generated Dataset for Adversarial and Implicit Hate Speech Detectioncited by 419
  12. 2022A Holistic Approach to Undesired Content Detection in the Real Worldcited by 337
16 more
  1. 2023Multilingual Jailbreak Challenges in Large Language Modelscited by 222
  2. 2024What is in Your Safe Data? Identifying Benign Data that Breaks Safetycited by 114
  3. 2023Mechanistically analyzing the effects of fine-tuning on procedurally defined taskscited by 110
  4. 2024A Closer Look at the Limitations of Instruction Tuningcited by 76
  5. 2023All Languages Matter: On the Multilingual Safety of Large Language Modelscited by 51
  6. 2024Beyond Answers: Transferring Reasoning Capabilities to Smaller LLMs Using Multi-Teacher Knowledge Distillationcited by 46
  7. 2025The State of Multilingual LLM Safety Research: From Measuring the Language Gap to Mitigating Itcited by 42
  8. 2025Play Favorites: A Statistical Method to Measure Self-Bias in LLM-as-a-Judgecited by 35
  9. 2024Code-Switching Red-Teaming: LLM Evaluation for Safety and Multilingual Understandingcited by 34
  10. 2025Safer or Luckier? LLMs as Safety Evaluators Are Not Robust to Artifactscited by 25
  11. 2022On the benefits of knowledge distillation for adversarial robustnesscited by 17
  12. 2024Challenges in Adapting Multilingual LLMs to Low-Resource Languages using LoRA PEFT Tuningcited by 14
  13. 2023Distilling Rule-based Knowledge into Large Language Modelscited by 9
  14. 2025Cascading Adversarial Bias from Injection to Distillation in Language Modelscited by 8
  15. 2024DistillSeq: A Framework for Safety Alignment Testing in Large Language Models using Knowledge Distillationcited by 5
  16. 2025KDA: A Knowledge-Distilled Attacker for Generating Diverse Prompts to Jailbreak LLMscited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 4.

4 papers.

  1. 2026Knowledge Distillation Must Account for What It Losescited by 1
  2. 2026Multilingual Safety Alignment via Self-Distillationcited by 1
  3. 2026LLM Safety Alignment in Low-Resource Languages: A Systematic Literature Reviewcited by 0
  4. 2026When Safety Speaks a Language: A Mechanistic Analysis of Safety-Language Identity Entanglement in LLMscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Confusion is the Final Barrier: Rethinking Jailbreak Evaluation and Investigating the Real Misuse Threat of LLMs
  2. 2025Speak Easy: Eliciting Harmful Jailbreaks from LLMs with Simple Interactions
  3. 2024Understanding Jailbreak Success: A Study of Latent Space Dynamics in Large Language Models
  4. 2025Do Methods to Jailbreak and Defend LLMs Generalize Across Languages?
  5. 2026Minionese: Comprehensive Benchmark and Mechanistic Study of Multilingual LLM Safety
  6. 2025Reasoned Safety Alignment: Ensuring Jailbreak Defense via Answer-Then-Check
  7. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations
  8. 2024Rethinking How to Evaluate Language Model Jailbreak