Hard Negatives Reveal What Easy Negatives Hide: Cross-Lingual Harmfulness Representations Degrade with Resource Tier Under Hard Negatives
On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks
also in 1 more
Abstract (arXiv)
Safety alignment in large language models is trained primarily in English, and recent work reports that the underlying harmfulness representation survives translation: English-trained probes separate harmful from harmless prompts almost as well in low-resource languages as in English. This has been taken as evidence that cross-lingual refusal failures mainly reflect calibration rather than representation quality. We show that this conclusion depends on the choice of negative examples. Across nine languages spanning three resource tiers, we replicate near-perfect transfer (AUROC > 0.98) when harmless prompts come from an unrelated distribution (easy negatives). With XSTest contrast prompts, which are benign but surface-similar to harmful requests (hard negatives), transfer collapses in low-resource languages while remaining largely stable in high-resource languages. On Qwen2.5-7B-Instruct, mean AUROC drop increases from 0.003 in English to 0.017 in high-resource, 0.042 in mid-resource, and 0.276 in low-resource languages. The pattern replicates on Aya Expanse. Back-translation chrF controls and a matched-chrF comparison across three languages reduce the likelihood that translation quality explains the effect. The collapse remains after controlling for chrF (partial r = 0.70, p = 0.03). Tokenizer fertility correlates with the collapse and explains part of the resource-tier effect, but not all of it. The results show that easy-negative transfer can coexist with substantial degradation under hard negatives. Easy-negative evaluation alone therefore cannot establish that the harmfulness representation survives translation.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 10 of its 13 references that are in the map. First posted on arXiv 15 Aug 2026.
Builds on
10 of 13 references.
Closest ancestors · 2
Same direction, newest first
- 2026Low-Resource Safety Failures Are Action Failures, Not Representation Failures31 May
- 2026Harmful Intent as a Geometrically Recoverable Feature of LLM Residual Streams20 Apr
Other references · 8
- 2023XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Modelscited by 505
- 2023Low-Resource Languages Jailbreak GPT-4cited by 309
- 2025LLMs Encode Harmfulness and Refusal Separatelycited by 88
- 2025Refusal Direction is Universal Across Safety-Aligned Languagescited by 38
- 2026Do LLM hallucination detectors suffer from low-resource effect?cited by 4
- 2026Before the Last Token: Diagnosing Final-Token Safety Probe Failurescited by 3
- 2026The Entanglement Wall: Activation-Space Probes as Risk Detectors, Not Context Adjudicatorscited by 2
- 2026The Illusion of Cross-Lingual Safety in Low-Resource Languagescited by 1
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2026Lost in Translation? A Comparative Study on the Cross-Lingual Transfer of Composite Harms
- 2026Decided Upstream, Written Late: Locating and Pricing the Cross-Lingual Refusal Circuit of a Multilingual MoE
- 2024The Language Barrier: Dissecting Safety Challenges of LLMs in Multilingual Contexts
- 2026LSR: Linguistic Safety Robustness Benchmark for Low-Resource West African Languages
- 2026SomaliBench Eval: Measuring English-to-Somali Refusal Gaps in Open-Weight Language Models
- 2026BabelSteering: Multilingual Safety Alignment via English Steering Vectors
- 2026How Narrative Wrapping Affects LLM Refusal: A Cross-Language Benchmark and Defense
- 2026Minionese: Comprehensive Benchmark and Mechanistic Study of Multilingual LLM Safety