SEALGuard: Safeguarding the Multilingual Conversations in Southeast Asian Languages for LLM Software Systems

Chakkrit Tantithamthavorn; Michael Fu; Rui Yang; Wenliang Shan

REVIEW 4 major objections 6 minor 57 references

SEALGuard: Safeguarding the Multilingual Conversations in Southeast Asian Languages for LLM Software Systems

T0 review · 4 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A small LoRA-tuned multilingual model detects unsafe and jailbreak prompts in nine Southeast Asian languages at over 97% success, roughly doubling the defense rate of English-centric guardrails.

desk verdict Useful benchmark, but the headline 97% DSR is an in-distribution number and the jailbreak translations likely break the attack structure. read the letter →

arxiv 2507.08898 v3 pith:ROZPMYFN submitted 2025-07-11 cs.CL cs.AI

Wenliang Shan , Michael Fu , Rui Yang , Chakkrit Tantithamthavorn This is my paper

classification cs.CLcs.AI

keywords multilingualsafetyalignmentguardrailsjailbreakdetectionLoRASoutheastAsianlanguagesLLMbenchmarklow-resource

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that a parameter-efficient LoRA adaptation of a multilingual language model, prompted with a guardrail chat template, turns a general-purpose model into a multilingual safety filter that catches unsafe and jailbreak prompts in nine Southeast Asian languages. The authors build SEALSBench, a benchmark of more than 260,000 prompts translated from English into these languages, and report that their SEALGuard model detects 97.23% of unsafe prompts with 98.90% precision, far outperforming LlamaGuard-3-8B and OpenAI Moderation. If correct, the result matters because existing English-centric guardrails measurably degrade on multilingual prompts, and low-resource languages are a known jailbreak vector. The paper also shows via ablation that the LoRA adaptation drives nearly all of the gain, while model size matters less.

What carries the argument

The load-bearing mechanism is LoRA: trainable low-rank matrices A and B inserted into the word embedding, self-attention, and feed-forward layers of the frozen SeaLLM-v3-7B-Chat, with the LlamaGuard chat template framing the task as binary sequence generation ('safe' or 'unsafe'). Greedy decoding reads the first generated token as the decision. The other pillar is SEALSBench, built by taking English safe prompts from Alpaca, unsafe prompts from BeaverTails and four jailbreak source sets, translating all 29,604 prompts into nine Southeast Asian languages, and splitting by prompt ID so language variants stay in the same fold.

What would settle it

Sample SEALSBench prompts from each language, back-translate them to English, and have native speakers judge whether the original safety label survived; if translation errors flip labels on a scale comparable to the reported performance gap, the benchmark labels and the DSR numbers built on them are unreliable.

Watch

Extended reading notes

Core claim

The central discovery is that the multilingual safety gap is not intrinsic: a 7B multilingual model fine-tuned with LoRA, using LlamaGuard's chat template, matches or exceeds English-only guardrail performance on multilingual inputs. On the SEALSBench test set, SEALGuard achieves a Defense Success Rate of 97.23%, precision of 98.90%, and F1 of 98.05%, compared with 48.93%, 95.84%, and 63.55% for LlamaGuard-3-8B and 30.63%, 36.35%, and 40.07% for OpenAI Moderation. The same evaluation shows LlamaGuard-3-8B's DSR drops by 9 percentage points on Southeast Asian unsafe prompts and by 18 points on multilingual jailbreak prompts relative to English, quantifying the vulnerability the method addresses.

Load-bearing premise

Machine translation preserves both the meaning and the safety label of every prompt, so that an unsafe English prompt remains unsafe and a safe Alpaca prompt remains safe after translation into Lao, Khmer, or Burmese.

Editorial extensions

If this is right

A parameter-efficient LoRA adaptation is enough to build a multilingual guardrail, without full fine-tuning of the base model.
Existing guardrails like LlamaGuard lose 9 to 18 percentage points of DSR on multilingual unsafe and jailbreak prompts, so multilingual prompts are a practical attack surface.
SEALGuard maintains DSR above 95% across every studied unsafe category and every studied jailbreak type, according to the paper's per-category analysis.
The high precision (about 99%) means safe multilingual inputs are rarely blocked, so the guardrail does not simply trade false alarms for coverage.
The released model and benchmark allow other researchers to reproduce the numbers and test the recipe on additional languages.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Beyond the paper's claims, the translation-based construction means the benchmark measures detection of translated English prompt distributions, not naturally occurring Southeast Asian-language speech; real-world jailbreaks in these languages may differ.
A native-speaker validation or back-translation check of SEALSBench would test whether the reported advantage partly reflects translation artifacts; the paper itself flags translation variation as a validity threat but does not carry out such a check.
The ablation shows a 1.5B model with LoRA nearly matches the 7B model, suggesting the recipe may transfer to smaller and cheaper deployments, though the paper does not claim this.
The same LoRA-plus-chat-template recipe could plausibly be applied to other regional language families if a base model with adequate multilingual coverage exists; that extension is untested.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The thing to know about this paper: the dataset is a real contribution, the method is standard, and the evaluation is not yet fair enough to support the headline claims. SEALGuard's 97.23% DSR and 98.05% F1 are measured on a test set that is 90% of the same benchmark the model was trained on, with baselines run zero-shot. That gap is largely by construction.

What is genuinely new is SEALSBench: 29,604 English prompts (safe, unsafe, jailbreak) translated into nine Southeast Asian languages, with category and attack-type labels. That is a large, useful resource for a real problem. English-centric guardrails are known to fail on low-resource languages, and the paper documents that clearly: LlamaGuard-8B drops from 58.78% to 49.63% DSR on multilingual unsafe prompts, and to 41.02% on multilingual jailbreaks. The LoRA adaptation recipe itself is not novel, but applying it to a multilingual base with a guardrail template is a sensible baseline. The authors also release the model and benchmark, which is good practice.

Now the soft spots, in decreasing order of severity.

First, evaluation fairness. SEALGuard is trained on a 5% slice of SEALSBench and tested on the remaining 90% of the same dataset. The model has seen the same distribution, including the same jailbreak families. The baselines are zero-shot. A direct comparison under these conditions is not meaningful. The fix is straightforward: fine-tune or LoRA-adapt LlamaGuard on the same training split, and evaluate everything on external multilingual safety datasets. Until then, the 97% DSR is an in-distribution number.

Second, the jailbreak translations. The stress-test note is right: Caesar Cipher, Self Cipher, and Code Chameleon operate at the character or code level. Running those through Google Translate produces text that is not a valid instance of the attack. That means many of the 16,410 'multilingual jailbreak' test items are likely not jailbreak prompts at all. The model may be learning to flag translationese or formatting cues. This undermines the jailbreak-specific claims, though it is less damaging for the plain unsafe prompts.

Third, dataset arithmetic. The paper states 296,040 total prompts in Section 4.2, but the split sums to 296,044, and the test-set component counts (169,433 + 80,601 + 16,410 = 266,444) do not align cleanly with the source counts multiplied by ten. The internal numbers should reconcile. This suggests the pipeline was not run exactly as described.

Fourth, no error bars, no repeated runs, and no native-speaker validation of translations. The threat-to-validity section acknowledges translation variation but does not measure it.

Overall, this is a solid empirical paper about a real gap, and the benchmark is worth building on. But the headline results are not yet credible as stated. A serious referee would need the authors to fix the evaluation protocol, validate (or exclude) translated jailbreak attacks, and reconcile the dataset counts. That is a major revision, not a rejection.

I would send it to review, and I would want to see the revised version. For my own work, I'd cite the benchmark once the numbers are cleaned up, but not the DSR comparison.

Referee Report

4 major / 6 minor

Summary. The paper proposes SEALGuard, a multilingual safety guardrail for Southeast Asian languages, built by LoRA fine-tuning SeaLLM-v3-7B-Chat into a LlamaGuard-style safe/unsafe classifier, and introduces SEALSBench, a multilingual safety alignment benchmark of 29,604 English prompts (safe, unsafe, jailbreak) machine-translated into nine Southeast Asian languages. The evaluation claims that SEALGuard achieves 97.23% DSR, 98.90% precision, and 98.05% F1 on the SEALSBench test set, substantially outperforming LlamaGuard-3-8B and OpenAI Moderation, and an ablation attributes the gain primarily to LoRA adaptation.

Significance. If the reported results are valid, the contribution would be practically valuable: a small LoRA adaptation of an accessible multilingual model would close the multilingual safety gap for low-resource Southeast Asian languages, and the released dataset would support further research. The authors are to be credited for releasing the model and benchmark, for partitioning language variants of the same prompt into the same data split to avoid leakage, and for comparing against widely used guardrails. The conditional value of the contribution, however, rests on two load-bearing assumptions: that machine translation preserves both the semantics and the safety label of every prompt, especially character-level and code-level jailbreak attacks, and that training on a 5% slice of the same benchmark used for testing provides a fair comparison with zero-shot baselines. These assumptions are not validated in the current manuscript, and the internal data counts are inconsistent.

major comments (4)

[§4.6, §5 RQ3] The evaluation is self-referential: SEALGuard is trained on a 5% sample (14,800 examples) of SEALSBench and tested on the remaining 90% of the same benchmark, whose prompts share the same translation pipeline and the same nine jailbreak attack families, while LlamaGuard and OpenAI Moderation are evaluated zero-shot. The reported DSR and F1 gaps therefore largely reflect in-distribution supervised learning versus zero-shot transfer, not necessarily a multilingual guardrail advantage. Please add an out-of-benchmark evaluation, such as training on a subset of source datasets and testing on a held-out source dataset or an independent multilingual unsafe-prompt collection, and report the same zero-shot baselines on that external test set.
[§4.2 Step 2, §4.4, §7] The jailbreak test instances for Caesar Cipher, Self Cipher, Code Chameleon, and Dual use are produced by machine-translating English prompts whose attack mechanism relies on exact character-level or code-level operations. Machine translation via the googletrans library will not preserve ciphertext structure, cipher semantics, or code blocks, so many 'multilingual jailbreak' instances are not valid instances of the named attacks; the per-attack DSR exceeding 95% in Section 6.3 may be detecting translation artifacts rather than attack-specific intent. Please audit attack integrity on a sample of translated instances (for example, verify that the translation still contains the ciphertext or code and can still be decoded by the intended procedure), and either restrict the jailbreak set to attacks that survive translation or report results separately for translation-preserving and non-preserving attacks. Section 7 acknowledges translation variation as an internal-validity threat but proposes no validation beyond relying on a consistent translation tool; this is insufficient for a benchmark whose labels propagate into every reported metric.
[§4.2, §4.6, §5 RQ2/RQ3] The dataset counts are internally inconsistent. The English corpus is stated as 29,604 prompts (18,846 safe + 8,959 unsafe + 1,799 jailbreak); multiplying by ten languages gives 296,040 prompts, but the split in §4.6 sums to 14,800 + 14,800 + 266,444 = 296,044, and the RQ3 test set components sum to 169,433 + 80,601 + 16,410 = 266,444. RQ2 refers to 8,060 English unsafe prompts and 16,410 jailbreak prompts, neither of which follows from 8,959 or from 1,799 × 10 = 17,990. Section 6.3 states '10 jailbreak categories' while only nine are defined in §4.4. Please reconcile all counts and include an exact per-language and per-category breakdown, as the current inconsistencies make the reported test-set sizes and category-wise results impossible to verify.
[§7] The external-validity discussion in Section 7 notes that the results may not generalize beyond SEALSBench, but the proposed mitigation—incorporating prompts from six source datasets—does not address the fact that all prompts are translated through the same pipeline and labeled under the same ten unsafe categories and nine jailbreak families. Since SEALGuard is trained on the same benchmark, generalization cannot be inferred from the reported numbers. A validation strategy such as back-translation agreement, native-speaker spot checks, or a human rating of translated attack instances should be reported, along with agreement statistics.

minor comments (6)

[Abstract, §4.6] The abstract says 'over 260,000 prompts' while the actual total is 296,040 and the test set is 266,444; please unify the wording to the exact number.
[§6.3] Section 6.3 says this analysis covers '10 jailbreak categories,' but Section 4.4 defines nine jailbreak attacks; correct the typo or add the missing category.
[§5 RQ4, Table 1] The method list in RQ4 refers to 'SeaLLM-V3-1B-Chat' while Table 1 and the surrounding text use 'SeaLLM-V3-1.5B-Chat'; make the model naming consistent.
[§5 RQ4] The sentence 'the LoRA module alone contributes 72% of the total F1-Score' should be phrased as a 72-percentage-point improvement (from 26% to 98%), not a 72% contribution, and the comparison conflates LoRA with the chat-template adaptation and the training data; an ablation that isolates LoRA from the template and data is needed for that attribution.
[References] Reference [46] and [47] are the same Yong et al. paper, and [36] and [37] both describe the 'Do Anything Now' work; consolidate duplicate references.
[Metadata] The manuscript retains ACM template placeholder metadata (2018, Woodstock, placeholder DOI) and a reference to the undefined 'Conference acronym XX'; update all venue metadata before submission.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity found; the paper reports a standard held-out evaluation on its own benchmark, with no load-bearing self-citation or definitional reduction.

full rationale

SEALGuard is an empirical fine-tuning study: the authors construct SEALSBench, split it by unique English prompt IDs into 5% training, 5% validation, and 90% testing, train a LoRA adapter on the training split, and measure DSR, precision, and F1 on the held-out test split. This is an in-distribution evaluation, not a circular derivation: the test metrics are direct observations on held-out prompts, and the reported numbers are not fitted parameters renamed as predictions. The test jailbreak prompts share the same nine attack families as the training jailbreak prompts, but that is a distributional property of the benchmark, not a reduction of the claim to its own inputs. The paper even acknowledges in Section 7 that results may not generalize to other datasets, which further indicates the authors do not present the benchmark result as a derivation. The translation-quality limitation noted in Section 7 is a validity threat, not a circularity: even if machine translation corrupts jailbreak structure, that would make the labels unreliable, but it would not make the evaluation logically equivalent to its inputs. There are no self-citations used as load-bearing evidence, no imported uniqueness theorem, and no ansatz smuggled in via citation. The central claim is a measured empirical comparison on a self-constructed benchmark, which is a legitimate experimental design rather than a circular argument.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The paper introduces two artifacts, SEALGuard and SEALSBench, but no new theoretical entities, forces, or particles. The free parameters are standard LoRA fine-tuning hyperparameters chosen by hand. The key assumptions are about translation fidelity, label correctness of source datasets, and the validity of automatically generated jailbreaks.

free parameters (5)

LoRA rank r = 8
Selected hyperparameter controlling the rank of the low-rank adaptation matrices; the paper does not sweep or justify this value.
LoRA scaling factor alpha = 32
Chosen scaling factor for LoRA updates; no sensitivity analysis is reported.
Learning rate = 1e-4
Standard LoRA learning rate used for fine-tuning; no tuning study is reported.
LoRA dropout = 0.05
Fixed dropout for LoRA layers; justification is not given beyond standard practice.
Training split fraction = 5%
Only 5% of the benchmark is used for training; the central performance claim depends on this split and no analysis of split size is provided.

assumptions (5)

domain assumption Google Translate (via the googletrans library) produces translations that preserve both meaning and safety labels.
All benchmark prompts are translated by this pipeline in Section 4.2 Step 2; noisy translations would corrupt the labels that every result depends on.
domain assumption Source dataset labels are correct: Alpaca prompts are safe, and BeaverTails, Do-Not-Answer, CatQA, AdvBench, and Forbidden Questions prompts are unsafe or jailbreak.
The benchmark uses these labels without re-annotation or spot-checking, as stated in Section 4.2 Step 1.
domain assumption The nine jailbreak transformation strategies produce genuinely jailbroken prompts rather than mere paraphrases.
Section 4.4 lists nine attack templates but provides no examples of the transformed prompts and no manual validation that they bypass safety filters.
domain assumption SeaLLM-v3-7B-Chat can follow the LlamaGuard chat template when adapted with LoRA.
The approach depends on the model producing 'safe' or 'unsafe' as the first generated token; Section 3.4 uses greedy decoding on that token.
standard math Standard softmax, cross-entropy, and LoRA low-rank update formulas are valid.
Used in Sections 3.3 and 4.6; no novel math is introduced.

how reviews work

0 comments

Cite this review

Pith. "Pith review of SEALGuard: Safeguarding the Multilingual Conversations in Southeast Asian Languages for LLM Software Systems." pith.science (2026). https://pith.science/paper/ROZPMYFN

@misc{pith2026250708898,
  author       = {Pith},
  title        = {Pith review of: SEALGuard: Safeguarding the Multilingual Conversations in Southeast Asian Languages for LLM Software Systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ROZPMYFN}},
  note         = {Machine review of arXiv:2507.08898}
}

read the original abstract

Safety alignment is critical for LLM-powered systems. While recent LLM-powered guardrail approaches such as LlamaGuard achieve high detection accuracy of unsafe inputs written in English (e.g., ``How to create a bomb?''), they struggle with multilingual unsafe inputs. This limitation leaves LLM systems vulnerable to unsafe and jailbreak prompts written in low-resource languages such as those in Southeast Asia. This paper introduces SEALGuard, a multilingual guardrail designed to improve the safety alignment across diverse languages. It aims to address the multilingual safety alignment gap of existing guardrails and ensure effective filtering of unsafe and jailbreak prompts in LLM-powered systems. We adapt a general-purpose multilingual language model into a multilingual guardrail using low-rank adaptation (LoRA). We construct SEALSBench, a large-scale multilingual safety alignment dataset containing over 260,000 prompts in ten languages, including safe, unsafe, and jailbreak cases. We evaluate SEALGuard against state-of-the-art guardrails such as LlamaGuard on this benchmark. Our findings show that multilingual unsafe and jailbreak prompts substantially degrade the performance of the state-of-the-art LlamaGuard, which experiences a drop in Defense Success Rate (DSR) by 9% and 18%, respectively, compared to its performance on English-only prompts. In contrast, SEALGuard outperforms existing guardrails in detecting multilingual unsafe and jailbreak prompts, improving DSR by 48% over LlamaGuard and achieving the best DSR, precision, and F1-score. Our ablation study further reveals the contributions of adaptation strategies and model size to the overall performance of SEALGuard. We release our pre-trained model and benchmark at https://github.com/awsm-research/SEALGuard to support further research.

Figures

Figures reproduced from arXiv: 2507.08898 by the authors.

**Figure 1.** Overview of how multilingual unsafe prompts interact with runtime guardrails compared to English unsafe prompts. [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗

**Figure 2.** The overview of our SEALGuard approach. parameter set. This preserves SeaLLM’s original multilingual capabilities while introducing guardrail-specific knowledge, enabling the model to detect unsafe content across diverse languages. The core idea behind LoRA is to inject trainable low-rank modifications into selected weight matrices of the model. Specifically, for each target layer, the update is modeled as a low-r… view at source ↗

**Figure 3.** The distribution of safe and unsafe prompts, along with category-wise breakdowns of unsafe and jailbreak prompts. [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗

Figures from the paper (5 more)

**Figure 4.** Figure 4: Workflow for Constructing our SEALSBench Dataset. labeled as C1 through C10, where C stands for Category: C1: Violent Criminal Activity (1,729 samples), C2 – Non-Violent Criminal Conduct (4,196 samples), C3 – Child Sexual Abuse (145 samples), C4 – False and Defamator…

**Figure 5.** Figure 5: DSR result of unsafe prompts in English and SEA [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]

**Figure 6.** Figure 6: DSR result of unsafe prompts in English and Multi [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]

**Figure 7.** Figure 7: (RQ3) The experimental results of our SEALGuard and the three baseline comparisons classifying safe and unsafe (including jailbreaks) prompts. (↗) Higher F1, DSR, Precision, Accuracy = Better [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]

**Figure 8.** Figure 8: (Discussion) The experimental results for our [PITH_FULL_IMAGE:figures/full_fig_p010_8.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

57 extracted references · 17 canonical work pages

[1]

Reda Alami, Ali Khalifa Almansoori, Ahmed Alzubaidi, Mohamed El Amine Seddik, Mugariya Farooq, and Hakim Hacid. 2024. Alignment with preference optimization is all you need for llm safety.arXiv preprint arXiv:2409.07772(2024)

work page Pith review arXiv 2024
[2]

Gabriel Alon and Michael Kamfonas. 2023. Detecting language model attacks with perplexity.arXiv preprint arXiv:2308.14132(2023)

arXiv 2023
[3]

Yoshua Bengio, Geoﬀrey Hinton, Andrew Yao, Dawn Song, Pieter Abbeel, Trevor Darrell, Yuval Noah Harari, Ya-Qin Zhang, Lan Xue, Shai Shalev-Shwartz, et al

work page
[4]

Rishabh Bhardwaj, Do Duc Anh, and Soujanya Poria. 2024. Language Models are Homer Simpson! Safety Re-Alignment of Fine-tuned Language Models through Task Arithmetic.arXiv preprint arXiv:2402.11746(2024)

arXiv 2024
[5]

Bruce G Buchanan and Edward A Feigenbaum. 1981. DENDRAL and Meta- DENDRAL: Their applications dimension. InReadings in artiﬁcial intelligence. Elsevier, 313–322

work page 1981
[6]

Pin-Yu Chen, Han Shen, Payel Das, and Tianyi Chen. 2025. Fundamental Safety- Capability Trade-oﬀs in Fine-tuning Large Language Models.arXiv preprint arXiv:2503.20807(2025)

arXiv 2025
[7]

Yue Deng, Wenxuan Zhang, Sinno Jialin Pan, and Lidong Bing. [n. d.]. Multilin- gual Jailbreak Challenges in Large Language Models. https://doi.org/10.48550/ arXiv.2310.06474 arXiv:2310.06474 [cs]

arXiv doi:10.48550/arxiv.2310.06474
[8]

Tran, Mike Zhang, Shiqi Chen, Tianyu Pang, Chao Du, Xinyi Wan, Wei Lu, and Min Lin

Longxu Dou, Qian Liu, Fan Zhou, Changyu Chen, Zili Wang, Ziqi Jin, Zichen Liu, Tongyao Zhu, Cunxiao Du, Penghui Yang, Haonan Wang, Jiaheng Liu, Yongchi Zhao, Xiachong Feng, Xin Mao, Man Tsung Yeung, Kunat Pipatanakul, Fajri Koto, Min Si Thu, Hynek Kydlíček, Zeyi Liu, Qunshu Lin, Sittipong Sripaisarn- mongkol, Kridtaphad Sae-Khow, Nirattisai Thongchim, Tae...

arXiv 2025

Show all 57 references

[9]

Tianqi Du, Zeming Wei, Quan Chen, Chenheng Zhang, and Yisen Wang. 2025. Advancing llm safe alignment with safety representation ranking.arXiv preprint arXiv:2505.15710(2025)

2025 arXiv
[10]

Duolingo. 2025. Duolingo - The world’s best way to learn a language. https: //www.duolingo.com/

2025
[11]

Deep Ganguli, Liane Lovitt, Jackson Kernion, Amanda Askell, Yuntao Bai, Saurav Kadavath, Ben Mann, Ethan Perez, Nicholas Schiefer, Kamal Ndousse, et al . 2022. Red teaming language models to reduce harms: Methods, scaling behaviors, and lessons learned.arXiv preprint arXiv:220...

2022 arXiv
[12]

Suyu Ge, Chunting Zhou, Rui Hou, Madian Khabsa, Yi-Chia Wang, Qifan Wang, Jiawei Han, and Yuning Mao. 2023. Mart: Improving llm safety with multi-round automatic red-teaming.arXiv preprint arXiv:2311.07689(2023)

2023 arXiv
[13]

Suhun Han. 2025. googletrans 4.0.2. https://pypi.org/project/googletrans/

2025
[14]

Ahmed E Hassan, Gustavo A Oliva, Dayi Lin, Boyuan Chen, Zhen Ming, et al
[15]

Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. 2021. Lora: Low-rank adaptation of large language models.arXiv preprint arXiv:2106.09685(2021)

2021 arXiv
[16]

Rethinking Software Engineering in the Foundation Model Era: From Task-Driven AI Copilots to Goal-Driven AI Pair Programmers.arXiv preprint arXiv:2404.10225(2024)

2024 arXiv
[17]

Jailbreak Chat. 2023. Jailbreak Chat Prompt. https://www.jailbreakchat.com/ prompt/4f37a029-9dﬀ-4862-b323-c96a5504de5d Last accessed: 2024-09-20

2023
[18]

Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, et al . 2023. Llama guard: Llm-based input-output safeguard for human-ai conversations. arXiv preprint arXiv:2312.06674(2023)

2023 arXiv
[19]

Daniel Kang, Xuechen Li, Ion Stoica, Carlos Guestrin, Matei Zaharia, and Tat- sunori Hashimoto. 2024. Exploiting programmatic behavior of llms: Dual-use through standard security attacks. In2024 IEEE Security and Privacy Workshops (SPW). IEEE, 132–143

2024
[20]

Jiaming Ji, Mickel Liu, Josef Dai, Xuehai Pan, Chi Zhang, Ce Bian, Boyuan Chen, Ruiyang Sun, Yizhou Wang, and Yaodong Yang. 2023. Beavertails: Towards improved safety alignment of llm via a human-preference dataset.Advances in Neural Information Processing Systems36 (2023), 24...

2023
[21]

Alyssa Lees, Vinh Q Tran, Yi Tay, Jeﬀrey Sorensen, Jai Gupta, Donald Metzler, and Lucy Vasserman. 2022. A new generation of perspective api: Eﬃcient multilingual character-level transformers. InProceedings of the 28th ACM SIGKDD conference on knowledge discovery and data minin...

2022
[22]

Taku Kudo. 2018. Subword regularization: Improving neural network translation models with multiple subword candidates.arXiv preprint arXiv:1804.10959(2018)

2018 arXiv
[23]

Yuanchun Li, Hao Wen, Weijun Wang, Xiangyu Li, Yizhen Yuan, Guohong Liu, Jiacheng Liu, Wenxing Xu, Xiang Wang, Yi Sun, et al . 2024. Personal llm agents: Insights and survey about the capability, eﬃciency and security.arXiv preprint arXiv:2401.05459(2024)

2024 arXiv
[24]

Xuan Li, Zhanke Zhou, Jianing Zhu, Jiangchao Yao, Tongliang Liu, and Bo Han
[25]

Todor Markov, Chong Zhang, Sandhini Agarwal, Tyna Eloundou, Teddy Lee, Steven Adler, Angela Jiang, and Lilian Weng. 2022. A Holistic Approach to Undesired Content Detection.arXiv preprint arXiv:2208.03274(2022)

2022 arXiv
[26]

Todor Markov, Chong Zhang, Sandhini Agarwal, Florentine Eloundou Nekoul, Theodore Lee, Steven Adler, Angela Jiang, and Lilian Weng. 2023. A holistic approach to undesired content detection in the real world. InProceedings of the AAAI Conference on Artiﬁcial Intelligence, Vol. ...

2023
[27]

Huijie Lv, Xiao Wang, Yuansen Zhang, Caishuang Huang, Shihan Dou, Junjie Ye, Tao Gui, Qi Zhang, and Xuanjing Huang. 2024. Codechameleon: Personalized encryption framework for jailbreaking large language models.arXiv preprint arXiv:2402.16717(2024)

2024 arXiv
[28]

Raymond Ng, Thanh Ngan Nguyen, Yuli Huang, Ngee Chia Tai, Wai Yi Leong, Wei Qi Leong, Xianbin Yong, Jian Gang Ngui, Yosephine Susanto, Nicholas Cheng, et al. 2025. Sea-lion: Southeast asian languages in one network.arXiv preprint arXiv:2504.05747(2025)

2025
[29]

Xuan-Phi Nguyen, Wenxuan Zhang, Xin Li, Mahani Aljunied, Zhiqiang Hu, Chenhui Shen, Yew Ken Chia, Xingxuan Li, Jianyu Wang, Qingyu Tan, et al
[30]

Tula Masterman, Sandi Besen, Mason Sawtell, and Alex Chao. 2024. The landscape of emerging ai agent architectures for reasoning, planning, and tool calling: A survey.arXiv preprint arXiv:2404.11584(2024)

2024 arXiv
[31]

Alicia Parrish, Angelica Chen, Nikita Nangia, Vishakh Padmakumar, Jason Phang, Jana Thompson, Phu Mon Htut, and Samuel R Bowman. 2021. BBQ: A hand-built bias benchmark for question answering.arXiv preprint arXiv:2110.08193(2021)

2021 arXiv
[32]

Adam Paszke, Sam Gross, Soumith Chintala, Gregory Chanan, Edward Yang, Zachary DeVito, Zeming Lin, Alban Desmaison, Luca Antiga, and Adam Lerer
[33]

SeaLLMs–Large Language Models for Southeast Asia.arXiv preprint arXiv:2312.00738(2023)

2023 arXiv
[34]

Eugenio Oliveira, Klaus Fischer, and Olga Stepankova. 1999. Multi-agent systems: which research for which applications.Robotics and Autonomous Systems27, 1-2 (1999), 91–106

1999
[35]

Rico Sennrich. 2015. Neural machine translation of rare words with subword units.arXiv preprint arXiv:1508.07909(2015)

2015 arXiv
[36]

do anything now

Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. 2023. " do anything now": Characterizing and evaluating in-the-wild jailbreak prompts on large language models.arXiv preprint arXiv:2308.03825(2023)

2023 arXiv
[37]

do anything now

Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. 2024. " do anything now": Characterizing and evaluating in-the-wild jailbreak prompts on large language models. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security. 1671–1685

2024
[38]

Gabriel, et al

Maribeth Rauh, John Mellor, Jonathan Uesato, Po-Sen Huang, Johannes Welbl, Laura Weidinger, Sumanth Dathathri, Amelia Glaese, Geoﬀrey Irving, Iason Conference acronym ’XX, June 03–05, 2018, Woodstock, NY Trovato et al. Gabriel, et al . 2022. Characteristics of harmful text: To...

2022
[39]

Traian Rebedea, Razvan Dinu, Makesh Sreedhar, Christopher Parisien, and Jonathan Cohen. 2023. Nemo guardrails: A toolkit for controllable and safe llm applications with programmable rails.arXiv preprint arXiv:2310.10501(2023)

2023 arXiv
[40]

Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al. 2023. Llama: Open and eﬃcient foundation language models.arXiv preprint arXiv:2302.13971(2023)

2023 arXiv
[41]

William Van Melle. 1978. MYCIN: a knowledge-based consultation program for infectious disease diagnosis.International journal of man-machine studies10, 3 (1978), 313–322

1978
[42]

Yuxia Wang, Haonan Li, Xudong Han, Preslav Nakov, and Timothy Baldwin
[43]

Speak. 2025. Speak - The language learning app that gets you speaking. https: //www.speak.com/

2025
[44]

Hashimoto

Rohan Taori, Ishaan Gulrajani, Tianyi Zhang, Yann Dubois, Xuechen Li, Carlos Guestrin, Percy Liang, and Tatsunori B. Hashimoto. 2023. Stanford Alpaca: An Instruction-following LLaMA model. https://github.com/tatsu-lab/stanford_ alpaca

2023
[45]

Yifan Yao, Jinhao Duan, Kaidi Xu, Yuanfang Cai, Zhibo Sun, and Yue Zhang. 2024. A survey on large language model (llm) security and privacy: The good, the bad, and the ugly.High-Conﬁdence Computing(2024), 100211

2024
[47]

Zheng-Xin Yong, Cristina Menghini, and Stephen H Bach. 2023. Low-resource languages jailbreak gpt-4.arXiv preprint arXiv:2310.02446(2023)

2023 arXiv
[48]

Do-not-answer: A dataset for evaluating safeguards in llms.arXiv preprint arXiv:2308.13387(2023)

2023 arXiv
[49]

Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2023. Jailbroken: How does llm safety training fail?Advances in Neural Information Processing Systems 36 (2023), 80079–80110

2023
[50]

Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Rémi Louf, Morgan Funtowicz, et al
[51]

Xuandong Zhao, Will Cai, Tianneng Shi, David Huang, Licong Lin, Song Mei, and Dawn Song. 2025. Improving llm safety alignment with dual-objective optimization.arXiv preprint arXiv:2503.03710(2025)

2025
[52]

Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models.arXiv preprint arXiv:2307.15043(2023)

2023 arXiv
[56]

Youliang Yuan, Wenxiang Jiao, Wenxuan Wang, Jen-tse Huang, Pinjia He, Shum- ing Shi, and Zhaopeng Tu. 2023. Gpt-4 is too smart to be safe: Stealthy chat with llms via cipher.arXiv preprint arXiv:2308.06463(2023)

2023 arXiv
[57]

Wenxuan Zhang, Hou Pong Chan, Yiran Zhao, Mahani Aljunied, Jianyu Wang, Chaoqun Liu, Yue Deng, Zhiqiang Hu, Weiwen Xu, Yew Ken Chia, et al . 2024. Seallms 3: Open foundation and chat multilingual large language models for southeast asian languages.arXiv preprint arXiv:2407.19672(2024)

2024 arXiv
[2017]

InNIPS-W

Automatic diﬀerentiation in PyTorch. InNIPS-W
[2019]

arXiv preprint arXiv:1910.03771(2019)

Huggingface’s transformers: State-of-the-art natural language processing. arXiv preprint arXiv:1910.03771(2019)

2019 arXiv
[2023]

Deepinception: Hypnotize large language model to be jailbreaker.arXiv preprint arXiv:2311.03191(2023)

2023 arXiv
[2024]

Managing extreme AI risks amid rapid progress.Science384, 6698 (2024), 842–845

2024

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

Reda Alami, Ali Khalifa Almansoori, Ahmed Alzubaidi, Mohamed El Amine Seddik, Mugariya Farooq, and Hakim Hacid. 2024. Alignment with preference optimization is all you need for llm safety.arXiv preprint arXiv:2409.07772(2024)

work page Pith review arXiv 2024

[2] [2]

Gabriel Alon and Michael Kamfonas. 2023. Detecting language model attacks with perplexity.arXiv preprint arXiv:2308.14132(2023)

arXiv 2023

[3] [3]

Yoshua Bengio, Geoﬀrey Hinton, Andrew Yao, Dawn Song, Pieter Abbeel, Trevor Darrell, Yuval Noah Harari, Ya-Qin Zhang, Lan Xue, Shai Shalev-Shwartz, et al

work page

[4] [4]

Rishabh Bhardwaj, Do Duc Anh, and Soujanya Poria. 2024. Language Models are Homer Simpson! Safety Re-Alignment of Fine-tuned Language Models through Task Arithmetic.arXiv preprint arXiv:2402.11746(2024)

arXiv 2024

[5] [5]

Bruce G Buchanan and Edward A Feigenbaum. 1981. DENDRAL and Meta- DENDRAL: Their applications dimension. InReadings in artiﬁcial intelligence. Elsevier, 313–322

work page 1981

[6] [6]

Pin-Yu Chen, Han Shen, Payel Das, and Tianyi Chen. 2025. Fundamental Safety- Capability Trade-oﬀs in Fine-tuning Large Language Models.arXiv preprint arXiv:2503.20807(2025)

arXiv 2025

[7] [7]

Yue Deng, Wenxuan Zhang, Sinno Jialin Pan, and Lidong Bing. [n. d.]. Multilin- gual Jailbreak Challenges in Large Language Models. https://doi.org/10.48550/ arXiv.2310.06474 arXiv:2310.06474 [cs]

arXiv doi:10.48550/arxiv.2310.06474

[8] [8]

Tran, Mike Zhang, Shiqi Chen, Tianyu Pang, Chao Du, Xinyi Wan, Wei Lu, and Min Lin

Longxu Dou, Qian Liu, Fan Zhou, Changyu Chen, Zili Wang, Ziqi Jin, Zichen Liu, Tongyao Zhu, Cunxiao Du, Penghui Yang, Haonan Wang, Jiaheng Liu, Yongchi Zhao, Xiachong Feng, Xin Mao, Man Tsung Yeung, Kunat Pipatanakul, Fajri Koto, Min Si Thu, Hynek Kydlíček, Zeyi Liu, Qunshu Lin, Sittipong Sripaisarn- mongkol, Kridtaphad Sae-Khow, Nirattisai Thongchim, Tae...

arXiv 2025