Research map / Large language models / Language, safety and interpretability

Multilingual Jailbreak Challenges in Large Language Models

ICLR 2024 · Large language models › Language, safety and interpretability · approach: Jailbreak attacks and defenses · 16 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Shows that non-English (especially low-resource) prompts and multilingual combinations with malicious instructions bypass safety of ChatGPT and GPT-4, releases the MultiJail dataset, and proposes Self-Defense, a self-generated multilingual safety fine-tuning framework.

Problem

Safety alignment of LLMs is mostly English-focused, so jailbreak attacks in non-English languages (unintentional and intentional misuse) may bypass safety mechanisms.

Approach

Frames multilingual jailbreaking as two scenarios (unintentional user queries in low-resource languages; intentional combination of translated harmful prompts with an English malicious instruction), builds a human-translated 10-language benchmark, and uses the LLM itself to generate multilingual safety fine-tuning data (Self-Defense).

Key results

• Low-resource languages yield about 3x the unsafe rate of high-resource ones for ChatGPT (14.92% vs 4.34%) in the unintentional scenario.
• With the AIM malicious instruction, unsafe rate reaches 80.92% for ChatGPT and 40.71% for GPT-4 averaged over non-English languages.
• Self-Defense fine-tuning reduces ChatGPT's unintentional unsafe rate from 10.19% to 3.95% and intentional from 80.92% to 60.00%, with a safety-usefulness trade-off.

Measured effects reported in the paper

Surprising findings

• Machine translation (Google Translate) prompts yield a slightly higher unsafe rate (11.15%) than human translations (10.19%), so native speakers are not required to elicit unsafe content.
• Translating the malicious AIM instruction into the target language lowers the unsafe rate from 80.92% to 58.66%, most strongly for low-resource languages.

Limitations

• Safety evaluation relies on translating outputs to English and on GPT-4 as judge plus limited human labels, adding translation noise.
• Usefulness-safety trade-off: safety training reduces XNLI/X-CSQA accuracy, with refusals being brief.
• Self-Defense experiments use a small seed set (50 pairs) and only ChatGPT via API fine-tuning; open-source model extension is limited.

Experimental setup

Datasets: GPT-4 report harmful prompts (15) Anthropic red-teaming dataset (300 sampled) XNLI X-CSQA

Benchmarks: MultiJail XNLI X-CSQA

Metrics: unsafe rate safe rate invalid rate accuracy Cohen's kappa

Baselines: GPT-4 Llama2-chat Vicuna SeaLLM-v2

Builds on: Self-Instruct red-teaming dataset (Anthropic HH) GPT-4 technical report safety evaluation

Closest papers by meaning

• Speak Easy: Eliciting Harmful Jailbreaks from LLMs with Simple Interactions (ICML 2025 · similarity 0.91)
• Multi-Turn Jailbreaking Large Language Models via Attention Shifting (AAAI 2025 · similarity 0.90)
• Against All Odds: Overcoming Typology, Script, and Language Confusion in Multilingual Embedding Inversion Attacks (AAAI 2025 · similarity 0.89)
• Cannot See the Forest for the Trees: Invoking Heuristics and Biases to Elicit Irrational Choices of LLMs (ICML 2025 · similarity 0.89)
• Playing the Fool: Jailbreaking LLMs and Multimodal LLMs with Out-of-Distribution Strategy (CVPR 2025 · similarity 0.89)
• ChatBug: A Common Vulnerability of Aligned LLMs Induced by Chat Templates (AAAI 2025 · similarity 0.89)