Low-Resource Safety Failures Are Action Failures, Not Representation Failures
On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks
also in 1 more
Abstract (arXiv)
Language models often answer harmful requests in low-resource languages (LRLs) that they refuse in high-resource languages (HRLs). Across three instruction-tuned models and 23 languages, harmful refusal falls from 87.9% in HRLs to 43.9% in LRLs, while harmless refusal remains low. A common explanation is that models represent harmfulness weakly in LRLs. We test whether harmfulness is instead represented but does not reliably produce refusal. Across three models, a harmfulness direction learned from HRL activations still separates harmful from harmless LRL prompts, showing that complete absence of harmfulness information cannot explain many failures. However, harmfulness scores shift downward for LRL prompts, making harmful prompts less likely to reach the range associated with refusal. Motivated by this shift, we train a low-rank logistic classifier on HRL activations and calibrate its threshold with a few target-language examples. During generation, the classifier conditionally adds or ablates the HRL harmfulness direction. With the same HRL data and 32 target-language examples per class, CAST remains limited by low harmful refusal and AdaSteer by high harmless refusal, yielding mean refusal selectivity (Delta = harmful - harmless refusal) of 33.6 and 6.8, respectively. Our intervention reaches 54.5 while preserving MMLU utility. HRL-only calibration improves selectivity for Qwen and Gemma, whereas Llama benefits from target-language calibration. These results show that recalibrating existing representations can offer a training-free method for repairing low-resource safety failures.
Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 33 of its 45 references that are in the map. First posted on arXiv 31 May 2026.
Builds on
33 of 45 references.
Closest ancestors · 10
Same direction, newest first
- 2026LASA: Language-Agnostic Semantic Alignment at the Semantic Bottleneck for LLM Safety13 Apr
- 2026Multilingual Safety Alignment Via Sparse Weight Editing26 Feb
- 2026Align Once, Benefit Multilingually: Enforcing Multilingual Consistency for LLM Safety Alignment18 Feb
- 2025MPO: Multilingual Safety Alignment via Reward Gap Optimization22 May
- 2025AdaSteer: Your Aligned LLM is Inherently an Adaptive Jailbreak Defender13 Apr
- 2025The Hidden Space of Safety: Understanding Preference-Tuned LLMs in Multilingual context3 Apr
- 2025The Geometry of Refusal in Large Language Models: Concept Cones and Representational Independence24 Feb
- 2025Soteria: Language-Specific Functional Parameter Steering for Multilingual Safety Alignment16 Feb
- 2025The Hidden Dimensions of LLM Alignment: A Multi-Dimensional Analysis of Orthogonal Safety Directions13 Feb
- 2024The Language Barrier: Dissecting Safety Challenges of LLMs in Multilingual Contexts23 Jan
Other references · 23
- 2022Training language models to follow instructions with human feedbackcited by 15,712
- 2023LLaMA: Open and Efficient Foundation Language Modelscited by 13,958
- 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,049
- 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,393
- 2020The Pile: An 800GB Dataset of Diverse Text for Language Modelingcited by 2,346
- 2023G-Eval: NLG Evaluation using GPT-4 with Better Human Alignmentcited by 2,205
- 2024Refusal in Language Models Is Mediated by a Single Directioncited by 960
- 2019CCNet: Extracting High Quality Monolingual Datasets from Web Crawl Datacited by 544
- 2024Dolma: an Open Corpus of Three Trillion Tokens for Language Model Pretraining Researchcited by 475
- 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generationcited by 439
- 2023Low-Resource Languages Jailbreak GPT-4cited by 290
- 2024Do Llamas Work in English? On the Latent Language of Multilingual Transformerscited by 275
11 more
- 2024Programming Refusal with Conditional Activation Steeringcited by 191
- 2024Global MMLU: Understanding and Addressing Cultural and Linguistic Biases in Multilingual Evaluationcited by 181
- 2026The Assistant Axis: Situating and Stabilizing the Default Persona of Language Modelscited by 76
- 2025LLMs Encode Harmfulness and Refusal Separatelycited by 75
- 2024The Semantic Hub Hypothesis: Language Models Share Semantic Representations Across Languages and Modalitiescited by 69
- 2025PolyGuard: A Multilingual Safety Moderation Tool for 17 Languagescited by 57
- 2024Separating Tongue from Thought: Activation Patching Reveals Language-Agnostic Concept Representations in Transformerscited by 42
- 2025The State of Multilingual LLM Safety Research: From Measuring the Language Gap to Mitigating Itcited by 42
- 2025Refusal Direction is Universal Across Safety-Aligned Languagescited by 37
- 2026There Is More to Refusal in Large Language Models than a Single Directioncited by 22
- 2025IndoSafety: Culturally Grounded Safety for LLMs in Indonesian Languagescited by 7
Built on by
Citing papers per year: 2026: 2.
2 papers.
Similar, not cited
Close in wording, no citation either way
- 2026The Illusion of Cross-Lingual Safety in Low-Resource Languages
- 2026BabelSteering: Multilingual Safety Alignment via English Steering Vectors
- 2026When Safety Routing Breaks: Understanding Alignment Fragility under Benign Fine-Tuning
- 2026The Geometry of Refusal: Linear Instability in Safety-Aligned LLMs
- 2026SafeEvo: Deciphering the Safety Alignment Mechanism and Evolution in Language Models
- 2026When Choices Become Risks: Safety Failures of Large Language Models under Multiple-Choice Constraints
- 2026When Context Flips, Safety Breaks: Diagnosing Brittle Safety in Aligned Language Models
- 2026When Safety Speaks a Language: A Mechanistic Analysis of Safety-Language Identity Entanglement in LLMs