The Illusion of Cross-Lingual Safety in Low-Resource Languages

Abigail Oppong; Abubakar Juma Chilala; Alfred Malengo Kondoro; Esmael Ahmed Abdu; Idris Abdulmumin; Jessica Oparebea; Lemofouet Valdini Douglace; Maryam Ibrahim Mukhtar; Nicholaus Dismas Ladislaus; P Sam Sahil

REVIEW 5 major objections 5 minor 29 references

The Illusion of Cross-Lingual Safety in Low-Resource Languages

T0 review · 5 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read English-trained safety alignment does not transfer to four African languages at the representational level.

desk verdict Useful dataset and a fresh geometric measurement, but the headline 10% retained-signal numbers are not yet trustworthy because the target-language 'safe' baselines are mismatched; still worth a serious referee. read the letter →

arxiv 2608.11146 v1 pith:LQCMN7OP submitted 2026-08-11 cs.CL

Abigail Oppong , P Sam Sahil , Tadesse Destaw Belay , Maryam Ibrahim Mukhtar , Esmael Ahmed Abdu , Tassallah Abdullahi , Jessica Oparebea , Saminu Mohammad Aliyu

show 7 more authors

Idris Abdulmumin Abubakar Juma Chilala Nicholaus Dismas Ladislaus Alfred Malengo Kondoro Lemofouet Valdini Douglace Shamsuddeen Hassan Muhammad Seid Muhie Yimam

This is my paper · ORCID

classification cs.CL

keywords cross-lingualsafetytransferlow-resourcelanguagesrefusaldirectionlatentgeometricframeworkLoDNAdatasetAfricanmultilingualalignmenthidden-stateprobing

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that English-centric safety alignment does not transfer to low-resource languages inside the model, not just in its outputs. Across Twi, Hausa, Amharic, and Swahili, harmful prompts—both literal translations and culturally localized rewrites—recover less than 10% of the English refusal signal in most model-language pairs. The authors argue the failure is not a failure to understand: literal and cultural prompts sit almost identically in the model's semantic space (cosine 0.95-0.996), yet they barely activate the refusal direction that cleanly separates safe from unsafe English prompts. If correct, multilingual safety alignment is superficial: models often grasp the harmful request but never route it into the English-trained refusal mechanism.

What carries the argument

The Latent Geometric Framework compares, layer by layer, the mean hidden states of safe and unsafe prompts. The load-bearing object is the English refusal direction $r_k^{en}=\mu_k(U_{en})-\mu_k(S_{en})$, the difference between mean unsafe and mean safe final-token hidden states at layer $k$; target-language displacements $r_k^{\ell,\mathrm{lit}}=\mu_k(L_\ell)-\mu_k(S_\ell)$ and $r_k^{\ell,\mathrm{ctx}}=\mu_k(C_\ell)-\mu_k(S_\ell)$ are projected onto it through the Signed Retained Component $\frac{(r_k^{en})^\top r}{(r_k^{en})^\top r_k^{en}}\times 100\%$. Layer-wise drift, English-trained linear probes evaluated zero-shot on target languages, and PCA projections onto the English refusal plane separate structural cross-lingual mapping failure from semantic-complexity failure. Downstream grounding uses the normalized refusal-sequence log-likelihood and the aggregate probability of emitting any refusal sequence, because the paper argues LLM-as-judge attack-success rates are unreliable for low-resource languages.

What would settle it

Measure the signed retained component for a moderately-resourced language that is explicitly safety-aligned in the same 7B-8B model family; if it also stays below 10%, the low values reflect a general cross-lingual mapping limitation rather than a peculiarity of Twi, Hausa, Amharic, or Swahili. Alternatively, patch the English refusal direction from layer 16 into target-language hidden states and test whether refusal probability rises; if it does not, the retained component is not the causal gate of refusal.

Watch

Extended reading notes

Core claim

Using hidden-state geometry at an intermediate layer (layer 16 for the 32-layer models, a comparable depth for Qwen2.5), the paper defines an English refusal direction as the vector from mean safe to mean unsafe English hidden states, then measures how much of that direction is recovered by literal and culturally localized harmful prompts in each target language. The Signed Retained Component is below 10% for nearly all language-model pairs—Hausa drops as low as 0.97% literal retention in Qwen2.5 and goes negative in Mistral and Llama—with Swahili in Llama the single clear exception at about 27%. The very high literal-to-cultural cosine similarity shows that the two prompt forms share a semantic subspace within the target language, while the near-zero or negative English alignment shows that this shared harm representation does not map into the English-derived safety subspace. The paper concludes that English refusal boundaries are robustly learned and linearly separable, yet target-language harmful prompts fail to enter that boundary, giving evidence against a universal, language-agnostic harm manifold for these languages.

Load-bearing premise

The geometric result assumes that the safe target-language prompts used as baselines match the harmful prompts in domain, style, register, and tokenization, so that subtracting them isolates harmfulness rather than unrelated differences; without a safety-aligned control language, low alignment with the English direction could also be a language-specific but still functional safety subspace rather than a routing failure.

Editorial extensions

If this is right

English-trained refusal geometry does not act as a universal safety subspace for low-resource languages; different architectures fail in different ways.
Because literal and culturally localized harmful prompts are semantically close in hidden space, safety failures are not caused by cultural localization moving the prompt out of distribution; the bottleneck is routing.
Models can understand a harmful request and still comply convincingly, so generation-only refusal rates can miss safety failures that hidden-state geometry reveals.
Multilingual safety evaluation built on translated benchmarks alone may overstate cross-lingual transfer; culturally localized prompts and representational metrics are needed.
Safety alignment work for these languages should target the mapping that carries a recognized harmful concept into the refusal mechanism, not just the detection of harmful content.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the low retained component is a causal proxy for weak refusal, then steering target-language hidden states toward the English refusal direction per language or per culture is a natural testable intervention, and it may need to be done separately for each language rather than once globally.
The paper lacks a safety-aligned control language; a direct extension would measure retained components in a moderately-resourced language that does have explicit safety tuning, which would separate a general cross-lingual mapping deficit from tokenization artifacts.
The interpretation that models 'encode the concept without routing it' is correlational; activation-patching at the layers where drift is largest could confirm whether the low retained component actually suppresses refusal behavior.
Since literal and cultural forms align within each language, a safety direction learned inside that language's own subspace may transfer across prompt variants even when the English direction does not.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Things to know first: the paper builds the LoDNA dataset—literal and culturally localized harmful prompts in Twi, Hausa, Amharic, and Swahili—and a latent-geometric protocol for measuring how much of the English refusal direction survives in those languages. The headline result (less than 10% retained signal for nearly all model–language pairs) is plausible but the exact numbers are not reliable yet because the target-language 'safe' baselines come from unrelated corpora. The paper is honest about several confounds, which makes it fixable rather than dismissible.

What is genuinely new: as far as I know, LoDNA is the first dataset pairing literal translations with culturally localized harmful prompts for these languages, and projecting target-language displacement vectors onto an English refusal direction is a fresh measurement. The paper also does the right thing by grounding the geometry in downstream refusal log-likelihoods and in qualitative outputs. The limitations section is unusually candid—they admit Amharic tokenization is a severe confound, that no safety-aligned control language exists, and that the framework is correlational. That honesty counts in its favor.

The main soft spot is the safe baseline for each target language. S_l is pulled from English-Twi parallel text or Aya datasets, not matched to the harmful prompts in topic, register, or format, so r_lit = μ(L_l) − μ(S_l) mixes harmfulness with domain and style differences. Low retained component could be a cross-corpus artifact. The Swahili-Llama result, with a large retained component where behavior is safer, is one control but not enough to calibrate near-zero values. Table 2 has no confidence intervals or significance tests, and the primary claim relies on a single hand-picked layer (layer 16). The downstream SLL/refusal-probability analysis gives independent support, but the paper itself notes those rely on generation stability and refusal-token coverage.

Who this is for: anyone working on multilingual safety in low-resource African languages, and people interested in representation-level interpretability of refusal. The dataset alone is likely to be reused; the specific claim against a universal harm manifold is not fully proven, but the evidence is enough to treat it as a serious open question.

Recommendation: send this to peer review. The measurement problem is fixable—release data and code, add matched safe baselines or show robustness to baseline choice, report uncertainty, and ideally test with a safety-aligned control language. A careful referee could turn this into a solid contribution.

Referee Report

5 major / 5 minor

Summary. This paper investigates whether English-centric safety alignment transfers to four low-resource African languages (Twi, Hausa, Amharic, Swahili). The authors introduce LoDNA, a dataset of literal and culturally localized translations of Do-Not-Answer prompts, and a latent geometric framework that measures alignment between the English refusal direction and target-language displacement vectors in hidden-state space, supported by PCA projections, linear probes, and downstream refusal log-likelihood/probability metrics. Across Mistral, Llama, Qwen2.5, and AfriqueQwen, the authors find that the retained component of the English refusal signal is below 10% for nearly all language-model pairs (with Swahili-Llama the exception at about 27%), leading to the claim that multilingual safety alignment is superficial and that no universal harm manifold exists.

Significance. The paper addresses an important and under-explored question about multilingual safety alignment in low-resource languages, and its main contributions—the LoDNA dataset and the latent geometric evaluation framework—are valuable to the community. The inclusion of culturally localized prompts goes beyond typical translated benchmarks, and the multi-method design (probe validation, PCA, retained components, refusal-sequence likelihoods, qualitative outputs) is a strength. The headline quantitative claim is falsifiable, and the paper is careful to frame its geometric evidence as correlational rather than causal. However, the strength of the central claim depends critically on the validity of the safe-target-language baselines and on statistical calibration of the geometric metric, both of which are currently insufficient. If those concerns are addressed, the paper would be a significant contribution to interpretability and multilingual safety evaluation.

major comments (5)

[4.3 / Appendix A.1] The definition of the target-language displacements r_ℓ,lit = mu(L_ℓ) - mu(S_ℓ) and r_ℓ,ctx = mu(C_ℓ) - mu(S_ℓ) (Section 4.3) relies on safe baselines S_ℓ that are not matched to the harmful prompts. As described in Appendix A.1, S_ℓ is drawn from English-Twi parallel text for Twi, Aya_amharic for Amharic, and Aya for Hausa/Swahili, while L_ℓ and C_ℓ are translated/culturally localized Do-Not-Answer queries. These corpora differ from the harmful-prompt set in register, format, and topic, so the displacement vectors mix harmfulness with corpus-level differences. The low retained components in Table 2 could therefore be a cross-corpus artifact rather than evidence that harmful intent fails to route into the English refusal direction. Please re-run the analysis with a matched safe baseline (e.g., translations of the English safe prompts into each target language) or demonstrate through a control experiment that the results are insensitive to the choice of S_ℓ.
[Table 2 / Section 5] The primary headline result—retained components below 10% for nearly all language-model pairs—rests on point estimates in Table 2 with no confidence intervals, significance tests, or reported dataset sizes. Given that the English and target-language means are computed over small prompt sets, the difference between, e.g., Swahili-Llama at 27.31% and the other near-zero entries may not be statistically meaningful. Please provide bootstrap intervals (or equivalent) for the retained component, cosine similarities, and drift, and report the number of prompts in each set.
[5.1 / 7, Figure 12] The paper itself states that severe Amharic tokenization fragmentation 'likely distorts geometric analysis before safety routing occurs,' yet Amharic rows in Table 2 and the corresponding PCA/probe results are treated as evidence about safety transfer. If tokenization corrupts the hidden states, the negative retained components and unstable alignments for Amharic cannot support the paper's conclusion. Please either exclude Amharic from the geometric claims or provide a tokenization-robust analysis (e.g., compare character-level vs. subword-level extraction, or mask out heavily fragmented inputs).
[7] Section 7 concedes that no safety-aligned control language exists in the 7B-8B open-weight ecosystem. Without such a control, low alignment with the English refusal direction is ambiguous between failed transfer and a language-specific but functional safety subspace. The paper's conclusion that multilingual safety alignment is 'superficial' therefore goes beyond what the evidence can establish. A permutation test comparing target-language displacements to random directions or safe-vs-safe displacements would help calibrate the metric; as it stands, the Swahili-Llama positive case is the only internal calibration point.
[4.6 / Figure 3] The PCA projection in Figure 3 is fitted only on English states, and the target-language prompts then form compact, language-specific clusters. This clustering may reflect language identity or tokenization differences rather than safety geometry. The paper should control for language-identity confounds, for example by centering each language's representations before projecting or by projecting matched safe target-language prompts, before interpreting the clusters as evidence for a 'language-specific safety geometry' (RQ2).

minor comments (5)

[Abstract / throughout] The text contains typographic artifacts (e.g., 'language⚶model pairs' in the abstract, 'T wi' in Figure 10's caption) that should be cleaned before submission.
[Section 1] 'rather than a absence of alignment' should read 'rather than an absence of alignment.'
[Table 2] The column header 'Retained Comp: Lit' is written as 'Retained Component: Lit' in the caption; please use consistent terminology.
[Section 3 / Appendix A.1] The paper states that the LoDNA dataset will be publicly released, but no repository link or release date is provided; for reproducibility, a permanent URL should be included.
[Figure 10] The label 'Cultural T wi' for the Swahili Input B should be 'Cultural Swahili.'

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the headline retained-component numbers are measurements, not fitted predictions, and the central claim is independently grounded in refusal probabilities and normalized log-likelihoods.

full rationale

The paper's derivation chain is self-contained rather than circular. The English refusal direction is defined as r_en = mu(U_en) - mu(S_en) from English prompts only, and target-language displacements are defined as r_lit = mu(L_l) - mu(S_l) and r_ctx = mu(C_l) - mu(S_l). The retained component is then the projection (r_en^T r_lit)/(r_en^T r_en), reported in Table 2. No parameter is fitted to the target-language outcome, and the headline claim that harmful prompts retain less than 10% of the English refusal signal is a direct report of this computed quantity, not a prediction derived from a variable that already encodes the result. Moreover, the central conclusion about shallow cross-lingual safety transfer is supported by independent behavioral evidence: refusal-sequence probability is around 1% and normalized refusal log-likelihoods are low across languages and models (Table 4), plus qualitative examples show compliance or degeneration. The paper itself acknowledges the main validity threats in Appendix A.1 and Section 7: safe target-language baselines are drawn from unrelated corpora (English-Twi parallel text, Aya datasets), Amharic tokenization fragmentation may distort geometry, and no safety-aligned control language exists in the 7B-8B open-weight ecosystem. These are construct-validity and generalizability limitations, not circular reductions: the low retained component does not by construction force the behavioral refusal failure. The refusal-direction method is cited from independent prior work (Arditi et al., Zou et al.), and the only author-overlapping reference (Abdullahi et al. 2026) is used for background motivation, not as the load-bearing justification for the findings. No step in the derivation reduces, by equation or by self-citation, to its own inputs.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

No new physical or conceptual entities such as particles, forces, dimensions, or conserved quantities are postulated. LoDNA is a new dataset and the metrics are new measurements, but they are not invented entities in the graviton-problem sense. The load-bearing assumptions are the validity of the English refusal direction as a cross-lingual yardstick and the suitability of unrelated safe corpora as baselines.

free parameters (2)

analysis layer = layer 16 primary; layer 20 for AfriqueQwen PCA
Layer 16 is selected by hand for Table 2, motivated by prior interpretability work on mid-to-late layers; figures scan layers 14-24, but the primary retained-component numbers are not shown to be stable across layer choice.
refusal candidate sequences for SLL = per-language templates such as 'I'm sorry', 'Samahani', 'Ba zan iya'
The probability-of-refusal and SLL metrics depend on a manually chosen set of standard refusal phrases per language; if the set is incomplete, the reported 1% refusal probability would be underestimated.

assumptions (5)

domain assumption Linear refusal direction in residual stream mediates refusal (Arditi et al. 2024; Zou et al. 2025).
The framework assumes refusal maps to a direction and that comparing this direction across languages is meaningful; this is cited prior work, not derived here.
domain assumption English refusal direction r_en is a valid universal safety subspace for evaluating target languages.
The paper relies on English as internal control because no aligned control language exists at this model scale (Section 7); low alignment is interpreted as failed transfer rather than a legitimate language-specific safety subspace.
ad hoc to paper Safe target-language prompts from parallel-text and Aya datasets are appropriate baselines.
S_l is drawn from Ghana-NLP English-Twi parallel text, Henok/aya_amharic_dataset, and CohereForAI/aya_dataset (Appendix A.1); these are not matched to harmful LoDNA prompts, so displacements may include non-safety distributional differences.
domain assumption Final-token hidden states at chosen layers capture safety-relevant semantics.
Only the final input token representation is extracted; mid-to-late layer salience is assumed from prior work (Zou et al. 2025), and no ablation over token positions is reported.
ad hoc to paper Tokenization confounds, especially Amharic, do not invalidate the geometric conclusions.
Section 7 admits severe tokenization fragmentation likely distorts geometric analysis before safety routing, yet Amharic is retained in the primary metrics without correction.

how reviews work

0 comments

Cite this review

Pith. "Pith review of The Illusion of Cross-Lingual Safety in Low-Resource Languages." pith.science (2026). https://pith.science/paper/LQCMN7OP

@misc{pith2026260811146,
  author       = {Pith},
  title        = {Pith review of: The Illusion of Cross-Lingual Safety in Low-Resource Languages},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LQCMN7OP}},
  note         = {Machine review of arXiv:2608.11146}
}

read the original abstract

Safety alignment in large language models (LLMs) is largely developed in English, assuming these safeguards generalize across multilingual settings. However, this assumption remains underexplored and exposes a vulnerability in low-resource languages. We investigate cross-lingual safety transfer in four African languages, Twi, Hausa, Amharic, and Swahili, using LoDNA, a new safety dataset that pairs literal translations with culturally localized prompts. To move beyond generation-based evaluation, we propose a latent geometric framework that probes hidden-state refusal representations in LLMs. Our experimental results show that cross-lingual safety transfer is severely limited; harmful prompts retain less than 10% of the English refusal signal across most language-model pairs. Literal and localized prompts are semantically aligned (cosine 0.95-0.996) but drift across layers, suggesting models encode the concepts without routing them to safety mechanisms. These findings demonstrate that current multilingual safety alignment is superficial, providing strong evidence against the assumption of a universal, language-agnostic harm manifold within the specific low-resource languages studied. Warning: This paper contains example data that may be offensive or harmful.

Figures

Figures reproduced from arXiv: 2608.11146 by the authors.

**Figure 1.** (A) Two-stage construction of LoDNA: source prompts are translated, native-speaker corrected, and culturally localised. (B) Localisation rewrites a literal translation into a culturally grounded variant preserving harmful intent; modified spans highlighted. Bottom row shows a community-sourced English prompt redesigned into two direct DNA questions. Research Questions RQ1: Does safety alignment in highresource lang… view at source ↗

**Figure 2.** Geometric framework for measuring cross-lingual refusal transfer. (A) English and target-language prompts (𝑆 𝑒𝑛, 𝑈𝑒𝑛, 𝑆ℓ , 𝐿ℓ , 𝐶ℓ ) are passed through the decoder; hidden states ℎ𝑘 (𝑥) are extracted at layers 𝑘 ∈ [14, 24]. (B) The English refusal direction 𝑟 𝑒𝑛 𝑘 = 𝜇𝑘 (𝑈 𝑒𝑛) − 𝜇𝑘 (𝑆 𝑒𝑛) is compared to literal and cultural targetlanguage displacements via cosine similarity and a signed refusal component. (C) PCA, d… view at source ↗

**Figure 3.** PCA 2D Projections on the English refusal plane for Hausa, Twi, Amharic, and Swahili across evaluated models. This figure visualizes the internal representations of safe and unsafe prompts within the models’ hidden states at an intermediate layer, projected onto a 2D space generated by Principal Component Analysis (PCA) fitted on the English baseline states. Point Clusters: Light blue points (harmless_en) represent … view at source ↗

Figures from the paper (14 more)

**Figure 4.** Figure 4: Layer-wise mean dot product drift for Hausa, Twi, Amharic, and Swahili across Llama, Mistral, and Qwen2.5 architectures. This figure illustrates the difference in internal refusal alignment between literal translations and culturally contextualized harmful prompts acro…

**Figure 5.** Figure 5: Refusal vector cosine similarity for Hausa, Twi, Amharic, and Swahili across Llama, Mistral, and Qwen2.5 architectures. This figure displays the cosine similarity between the isolated refusal vectors at an intermediate hidden layer (Layer 16). For each language and mo…

**Figure 6.** Figure 6: Internal alignment (dot product) with the refusal direction across layers for Hausa, Twi, Amharic, and Swahili across evaluated models. This figure tracks the evolution of the refusal signal through the intermediate hidden layers of each network. The y-axis displays t…

**Figure 7.** Figure 7: Linear probe confidence across layers for Hausa, Twi, Amharic, and Swahili across evaluated models. This figure illustrates the layer-wise performance of a linear classifier (probe)—trained on English safe and unsafe representations—when evaluated on target-language p…

**Figure 8.** Figure 8: Linear probe validation performance for Hausa, Twi, Amharic, and Swahili across evaluated models. This figure presents the layer-wise validation metrics for the linear classifier (probe) trained to distinguish between safe and unsafe English representations. The x-axi…

**Figure 9.** Figure 9: Model Outputs Across English and Twi Prompts [PITH_FULL_IMAGE:figures/full_fig_p019_9.png]

**Figure 10.** Figure 10: Model Outputs Across English and Swahili Prompts [PITH_FULL_IMAGE:figures/full_fig_p019_10.png]

**Figure 11.** Figure 11: Model Outputs Across English and Hausa Prompts [PITH_FULL_IMAGE:figures/full_fig_p020_11.png]

**Figure 12.** Figure 12: Model Outputs Across English and Amharic Prompts [PITH_FULL_IMAGE:figures/full_fig_p020_12.png]

**Figure 13.** Figure 13: (Left) Distribution of data for Twi across harm categories (Right) Distribution for community-sourced [PITH_FULL_IMAGE:figures/full_fig_p021_13.png]

**Figure 14.** Figure 14: Distribution of data for Hausa across harm categories [PITH_FULL_IMAGE:figures/full_fig_p021_14.png]

**Figure 15.** Figure 15: Distribution of data for Amharic across harm categories [PITH_FULL_IMAGE:figures/full_fig_p021_15.png]

**Figure 16.** Figure 16: Distribution of data for Swahili across harm categories [PITH_FULL_IMAGE:figures/full_fig_p022_16.png]

**Figure 17.** Figure 17: Annotation interface used for localisation and validation across languages [PITH_FULL_IMAGE:figures/full_fig_p022_17.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

29 extracted references · 8 canonical work pages

[1]

The Language Barrier: Dissecting Safety Challenges of LLM s in Multilingual Contexts

Shen, Lingfeng and Tan, Weiting and Chen, Sihao and Chen, Yunmo and Zhang, Jingyu and Xu, Haoran and Zheng, Boyuan and Koehn, Philipp and Khashabi, Daniel. The Language Barrier: Dissecting Safety Challenges of LLM s in Multilingual Contexts. Findings of the Association for Computational Linguistics: ACL 2024. 2024. doi:10.18653/v1/2024.findings-acl.156

doi:10.18653/v1/2024.findings-acl.156 2024
[2]

All Languages Matter: On the Multilingual Safety of LLM s

Wang, Wenxuan and Tu, Zhaopeng and Chen, Chang and Yuan, Youliang and Huang, Jen-tse and Jiao, Wenxiang and Lyu, Michael. All Languages Matter: On the Multilingual Safety of LLM s. Findings of the Association for Computational Linguistics: ACL 2024. 2024. doi:10.18653/v1/2024.findings-acl.349

doi:10.18653/v1/2024.findings-acl.349 2024
[3]

The State of Multilingual LLM Safety Research: From Measuring The Language Gap To Mitigating It

Yong, Zheng Xin and Ermis, Beyza and Fadaee, Marzieh and Bach, Stephen and Kreutzer, Julia. The State of Multilingual LLM Safety Research: From Measuring The Language Gap To Mitigating It. Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing. 2025. doi:10.18653/v1/2025.emnlp-main.800

doi:10.18653/v1/2025.emnlp-main.800 2025
[4]

The Thirty-eighth Annual Conference on Neural Information Processing Systems , year=

Refusal in Language Models Is Mediated by a Single Direction , author=. The Thirty-eighth Annual Conference on Neural Information Processing Systems , year=
[5]

The Thirty-ninth Annual Conference on Neural Information Processing Systems , year=

Refusal Direction is Universal Across Safety-Aligned Languages , author=. The Thirty-ninth Annual Conference on Neural Information Processing Systems , year=
[6]

Second Conference on Language Modeling , year=

PolyGuard: A Multilingual Safety Moderation Tool for 17 Languages , author=. Second Conference on Language Modeling , year=
[7]

C ulture G uard: Towards Culturally-Aware Dataset and Guard Model for Multilingual Safety Applications

Joshi, Raviraj Bhuminand and Paul, Rakesh and Singla, Kanishk and Kamath, Anusha and Evans, Michael and Luna, Katherine and Ghosh, Shaona and Vaidya, Utkarsh and Long, Eileen Margaret Peters and Chauhan, Sanjay Singh and Wartikar, Niranjan. C ulture G uard: Towards Culturally-Aware Dataset and Guard Model for Multilingual Safety Applications. Proceedings ...

2025
[8]

U nity AI Guard: Pioneering Toxicity Detection Across Low-Resource I ndian Languages

Beniwal, Himanshu and Venkat, Reddybathuni and Kumar, Rohit and Srivibhav, Birudugadda and Jain, Daksh and Doddi, Pavan Deekshith and Dhande, Eshwar and Ananth, Adithya and Kuldeep and Singh, Mayank. U nity AI Guard: Pioneering Toxicity Detection Across Low-Resource I ndian Languages. Proceedings of the 2025 Conference on Empirical Methods in Natural Lang...

work page doi:10.18653/v1/2025.emnlp-demos.33 2025

Show all 29 references

[9]

AEGIS 2.0: A Diverse AI Safety Dataset and Risks Taxonomy for Alignment of LLM Guardrails

Ghosh, Shaona and Varshney, Prasoon and Sreedhar, Makesh Narsimhan and Padmakumar, Aishwarya and Rebedea, Traian and Varghese, Jibin Rajan and Parisien, Christopher. AEGIS 2.0: A Diverse AI Safety Dataset and Risks Taxonomy for Alignment of LLM Guardrails. Proceedings of the 2...

2025 doi
[10]

2025 , eprint=

Representation Engineering: A Top-Down Approach to AI Transparency , author=. 2025 , eprint=

2025
[11]

The Eleventh International Conference on Learning Representations , year=

Editing models with task arithmetic , author=. The Eleventh International Conference on Learning Representations , year=
[12]

2025 , eprint=

Language-Specific Latent Process Hinders Cross-Lingual Performance , author=. 2025 , eprint=

2025
[13]

from Benign import Toxic: Jailbreaking the Language Model via Adversarial Metaphors

Yan, Yu and Sun, Sheng and Duan, Zenghao and Liu, Teli and Liu, Min and Yin, Zhiyi and Lei, Jingyu and Li, Qi. from Benign import Toxic: Jailbreaking the Language Model via Adversarial Metaphors. Proceedings of the 63rd Annual Meeting of the Association for Computational Lingu...

2025 doi
[14]

2026 , eprint=

Adversarial Poetry as a Universal Single-Turn Jailbreak Mechanism in Large Language Models , author=. 2026 , eprint=

2026
[15]

Crosslingual Generalization through Multitask Finetuning

Muennighoff, Niklas and Wang, Thomas and Sutawika, Lintang and Roberts, Adam and Biderman, Stella and Le Scao, Teven and Bari, M Saiful and Shen, Sheng and Yong, Zheng Xin and Schoelkopf, Hailey and Tang, Xiangru and Radev, Dragomir and Aji, Alham Fikri and Almubarak, Khalid a...

2023
[16]

Unsupervised Cross-lingual Representation Learning at Scale

Conneau, Alexis and Khandelwal, Kartikay and Goyal, Naman and Chaudhary, Vishrav and Wenzek, Guillaume and Guzm \'a n, Francisco and Grave, Edouard and Ott, Myle and Zettlemoyer, Luke and Stoyanov, Veselin. Unsupervised Cross-lingual Representation Learning at Scale. Proceedin...

2020 doi
[17]

The Eleventh International Conference on Learning Representations , year=

Language models are multilingual chain-of-thought reasoners , author=. The Eleventh International Conference on Learning Representations , year=
[18]

Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)

Aya Model: An Instruction Finetuned Open-Access Multilingual Language Model. Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 2024. doi:10.18653/v1/2024.acl-long.845

2024 doi
[19]

Do-Not-Answer: Evaluating Safeguards in LLM s

Wang, Yuxia and Li, Haonan and Han, Xudong and Nakov, Preslav and Baldwin, Timothy. Do-Not-Answer: Evaluating Safeguards in LLM s. Findings of the Association for Computational Linguistics: EACL 2024. 2024. doi:10.18653/v1/2024.findings-eacl.61

2024 doi
[20]

RLHF Can Speak Many Languages: Unlocking Multilingual Preference Optimization for LLM s

Dang, John and Ahmadian, Arash and Marchisio, Kelly and Kreutzer, Julia and. RLHF Can Speak Many Languages: Unlocking Multilingual Preference Optimization for LLM s. Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing. 2024. doi:10.18653/v1/2...

2024 doi
[21]

Cross-lingual Transfer of Reward Models in Multilingual Alignment

Hong, Jiwoo and Lee, Noah and Mart \'i nez-Casta \ n o, Rodrigo and Rodr \'i guez, C \'e sar and Thorne, James. Cross-lingual Transfer of Reward Models in Multilingual Alignment. Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for C...

2025 doi
[22]

arXiv preprint arXiv:2504.14105 , year=

Amplify initiative: Building a localized data platform for globalized AI , author=. arXiv preprint arXiv:2504.14105 , year=

arXiv
[23]

Proceedings of the 2026 ACM Conference on Fairness, Accountability, and Transparency , pages =

Rashid, Qazi and Nakatumba-Nabende, Joyce and van Liemt, Erin MacMurray and Baguma, Rehema and Shih, Tiffany and Yang, Xuan and Ebinama, Amber and Yang, Zhengzhe and Maji, Madhurima and Verma, Aishwarya and Kalia, Charu and Barrios Ramos, Karla and Katumba, Andrew and Smith-Lo...

2026
[24]

U buntu G uard: A Culturally-Grounded Policy Benchmark for Equitable AI Safety in A frican Languages

Abdullahi, Tassallah and Mgonzo, Macton and Oduwole, Mardiyyah and Okewunmi, Paul and Owodunni, Abraham Toluwase and Singh, Ritambhara and Eickhoff, Carsten. U buntu G uard: A Culturally-Grounded Policy Benchmark for Equitable AI Safety in A frican Languages. Findings of the A...

2026 doi
[25]

2026 , eprint=

AfriqueLLM: How Data Mixing and Model Architecture Impact Continued Pre-training for African Languages , author=. 2026 , eprint=

2026
[26]

Multilingual Refusal Alignment for Safer Large Language Models

Krasnod e bska, Aleksandra and Kusa, Wojciech and Lipani, Aldo. Multilingual Refusal Alignment for Safer Large Language Models. Findings of the A ssociation for C omputational L inguistics: ACL 2026. 2026. doi:10.18653/v1/2026.findings-acl.1537

2026 doi
[27]

Large language models hallucination: A comprehensive survey , journal =

Aisha Alansari and Hamzah Luqman , keywords =. Large language models hallucination: A comprehensive survey , journal =. 2026 , issn =. doi:https://doi.org/10.1016/j.cosrev.2026.100970 , url =

2026
[28]

2025 , eprint=

Why Language Models Hallucinate , author=. 2025 , eprint=

2025
[29]

2025 , url=

Tinghao Xie and Xiangyu Qi and Yi Zeng and Yangsibo Huang and Udari Madhushani Sehwag and Kaixuan Huang and Luxi He and Boyi Wei and Dacheng Li and Ying Sheng and Ruoxi Jia and Bo Li and Kai Li and Danqi Chen and Peter Henderson and Prateek Mittal , booktitle=. 2025 , url=

2025

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.

[1] [1]

The Language Barrier: Dissecting Safety Challenges of LLM s in Multilingual Contexts

Shen, Lingfeng and Tan, Weiting and Chen, Sihao and Chen, Yunmo and Zhang, Jingyu and Xu, Haoran and Zheng, Boyuan and Koehn, Philipp and Khashabi, Daniel. The Language Barrier: Dissecting Safety Challenges of LLM s in Multilingual Contexts. Findings of the Association for Computational Linguistics: ACL 2024. 2024. doi:10.18653/v1/2024.findings-acl.156

doi:10.18653/v1/2024.findings-acl.156 2024

[2] [2]

All Languages Matter: On the Multilingual Safety of LLM s

Wang, Wenxuan and Tu, Zhaopeng and Chen, Chang and Yuan, Youliang and Huang, Jen-tse and Jiao, Wenxiang and Lyu, Michael. All Languages Matter: On the Multilingual Safety of LLM s. Findings of the Association for Computational Linguistics: ACL 2024. 2024. doi:10.18653/v1/2024.findings-acl.349

doi:10.18653/v1/2024.findings-acl.349 2024

[3] [3]

The State of Multilingual LLM Safety Research: From Measuring The Language Gap To Mitigating It

Yong, Zheng Xin and Ermis, Beyza and Fadaee, Marzieh and Bach, Stephen and Kreutzer, Julia. The State of Multilingual LLM Safety Research: From Measuring The Language Gap To Mitigating It. Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing. 2025. doi:10.18653/v1/2025.emnlp-main.800

doi:10.18653/v1/2025.emnlp-main.800 2025

[4] [4]

The Thirty-eighth Annual Conference on Neural Information Processing Systems , year=

Refusal in Language Models Is Mediated by a Single Direction , author=. The Thirty-eighth Annual Conference on Neural Information Processing Systems , year=

[5] [5]

The Thirty-ninth Annual Conference on Neural Information Processing Systems , year=

Refusal Direction is Universal Across Safety-Aligned Languages , author=. The Thirty-ninth Annual Conference on Neural Information Processing Systems , year=

[6] [6]

Second Conference on Language Modeling , year=

PolyGuard: A Multilingual Safety Moderation Tool for 17 Languages , author=. Second Conference on Language Modeling , year=

[7] [7]

C ulture G uard: Towards Culturally-Aware Dataset and Guard Model for Multilingual Safety Applications

Joshi, Raviraj Bhuminand and Paul, Rakesh and Singla, Kanishk and Kamath, Anusha and Evans, Michael and Luna, Katherine and Ghosh, Shaona and Vaidya, Utkarsh and Long, Eileen Margaret Peters and Chauhan, Sanjay Singh and Wartikar, Niranjan. C ulture G uard: Towards Culturally-Aware Dataset and Guard Model for Multilingual Safety Applications. Proceedings ...

2025

[8] [8]

U nity AI Guard: Pioneering Toxicity Detection Across Low-Resource I ndian Languages

Beniwal, Himanshu and Venkat, Reddybathuni and Kumar, Rohit and Srivibhav, Birudugadda and Jain, Daksh and Doddi, Pavan Deekshith and Dhande, Eshwar and Ananth, Adithya and Kuldeep and Singh, Mayank. U nity AI Guard: Pioneering Toxicity Detection Across Low-Resource I ndian Languages. Proceedings of the 2025 Conference on Empirical Methods in Natural Lang...

work page doi:10.18653/v1/2025.emnlp-demos.33 2025