Language-Specific Safety Gaps in Large Language Models

The fundamental issue with multilingual safety in large language models is the heavy bias toward English in alignment data. While models are fine-tuned to refuse harmful requests in English, this "refusal muscle" does not reliably transfer to other languages. If prompted in a language with sparse safety data, the model lacks the specific refusal patterns to reject the request, often defaulting to its unconstrained pre-training state.

Cross-lingual transfer abuses this gap. A user can prompt the model in a low-resource language, where the safety guardrails are weak or non-existent, and then translate the response back to English. Because the initial prompt was in a language the model is not strictly "censored" for, it may generate a response it would normally refuse in English.

Code-switching—mixing languages within a single prompt—further undermines safety. By blending English terms with a non-English context, the prompt can bypass the model's attention to specific danger tokens, tricking it into prioritizing task completion over safety verification.

The technical roots of this problem include:

• Tokenization Mismatch: Non-English languages often require different segmentation, meaning the "danger" features learned for English don't match the input representation in other languages.
• Data Scarcity: There is a severe lack of high-quality, culturally relevant refusal examples in languages other than English, making it impossible for the model to learn robust safety boundaries.
• Translation Dependency: Since safety scanners often rely on translating the input first, a cleverly constructed non-English prompt can bypass detection before the model recognizes it as a safety violation.

As translation capabilities improve, the risk grows. Models become more fluent in interpreting global inputs but remain vulnerable to attacks that exploit their lack of localized safety training. Logprob analysis frequently reveals this ambiguity, showing the model wavering between generation and refusal when forced to operate outside its primary alignment language.