Research map / Large language models / Language, safety and interpretability
Refusal Direction is Universal Across Safety-Aligned Languages
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that refusal directions extracted from one safety-aligned language (English, German, Chinese, Thai) can ablate refusal across 14 languages in several open LLMs, and attributes transfer to parallel refusal vectors while noting weak harmful/harmless separation in non-English languages.
Problem
Whether the single-direction refusal mechanism found in English LLMs is universal across languages, and why cross-lingual jailbreaks succeed.
Approach
Extends difference-in-means refusal direction ablation and addition to a 14-language parallel dataset (PolyRefuse), testing English-derived and non-English-derived vectors, and analyzes cross-lingual cosine similarity and clustering geometry to explain transfer and jailbreak vulnerability.
Key results
- English-derived refusal vector ablation raises compliance across 14 languages, e.g., gemma-2-9B-it on Yoruba rises from 0.57 to 0.87.
- Refusal vectors from German, Chinese, or Thai ablation push compliance across other safety-aligned languages to near or above 90% on Llama-3.1-8B, Qwen2.5-7B and gemma-2-9B.
- Silhouette scores for harmful vs harmless embeddings are highest in English (e.g., 0.4960 for Llama3.1-8B) and lower in other languages (e.g., 0.2182 in German).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| ablate the refusal vector extracted from English (ablation) | instruction-tuned models responding to harmful prompts in other languages · PolyRefuse safety-aligned languages | compliance rate: increases from 0.57 to 0.87 | Hurt |
| ablate a refusal vector extracted from German, Chinese, or Thai (ablation) | gemma-2-9B-it, Llama-3.1-8B-Instruct, and Qwen2.5-7B-Instruct · Safety-aligned languages across PolyRefuse | compliance rate: compliance rates consistently approaching or exceeding 90% | Hurt |
| add a refusal vector extracted from English, German, or Thai (ablation) | instruction-tuned models responding to harmful prompts across languages · PolyRefuse | compliance rate: 0% for most languages; Yoruba dropping from 58% to 28% | Helped |
| use a Yoruba-derived refusal vector rather than a vector from a safety-aligned language (ablation) | Llama-3.1-8B-Instruct and Qwen2.5-7B · Cross-lingual harmful-prompt compliance | compliance rate | Mixed |
| subtract the jailbreak vector from harmful bypassed samples (ablation) | Llama3.1-8B, Qwen2.5-7B, and gemma2-9B · Harmful bypassed samples in German, Japanese, Korean, Russian, Thai, and Chinese | compliance rate: 0% original compliance = 100%; Llama3.1-8B: 0, 3.2, 21.3, 0, 0, 7.1; Qwen2.5-7B: 12.9, 11.8, 13.9, 25.0, 12.8, 21.4; gem | Helped |
| add the jailbreak vector to harmful refused samples (ablation) | Llama3.1-8B, Qwen2.5-7B, and gemma2-9B · Harmful refused samples in German, Japanese, Korean, Russian, Thai, and Chinese | compliance rate: 0% original compliance; Llama3.1-8B: 70.3, 91.8, 66.7, 100.0, 66.1, 21.4; Qwen2.5-7B: 21.7, 28.1, 32.6, 38.3, 24.7, 27.0 | Hurt |
| ablate the selected English refusal vector instead of an arbitrary difference-in-means vector (ablation) | Llama-3.1-8B-Instruct · English harmful prompts | refusal rate: 0.99 -> 0.02 | Helped |
| ablate a random vector at layer 12, token position 3 (ablation) | Llama-3.1-8B-Instruct · English harmful prompts | refusal rate: 0.99 -> 1.0 | No clear effect |
| ablate a random vector at layer 3, token position 3 (ablation) | Llama-3.1-8B-Instruct · English harmful prompts | ARC-C score: 52.4 -> 32.8 | Hurt |
| use English rather than non-English prompts to measure harmful/harmless representation separation | Llama3.1-8B, Qwen2.5-7B, and gemma2-9B · Harmful/harmless embeddings | Silhouette Score: English: 0.4960, 0.3887, 0.3063; non-English scores are lower | Helped |
| extract the refusal vector from a safety-aligned source language and transfer it across languages (ablation) | instruction-tuned LLMs · PolyRefuse safety-aligned languages | compliance rate: near or above 90% after vector ablation | Hurt |
Surprising findings
- A refusal direction derived from any one safety-aligned non-English language nearly collapses refusal in all other safety-aligned languages.
- Refusal directions are approximately parallel across languages even though harmful and harmless prompts are poorly separated in non-English languages.
Limitations
- Limited to 14 typologically diverse languages; may not generalize to very low-resource languages.
- Transferability may depend on pretraining representation of each language.
- Does not evaluate concrete defense strategies.
Experimental setup
Datasets: AdvBench MaliciousInstruct TDC2023 Alpaca
Benchmarks: PolyRefuse MMLU WikiText perplexity ARC-C
Metrics: compliance rate refusal score KL divergence silhouette score BLEU SBERT
Baselines: English refusal vector random vector ablation
Builds on: refusal direction (Arditi et al.) difference-in-means WildGuard
Closest papers by meaning
- The Geometry of Refusal in Large Language Models: Concept Cones and Representational Independence (ICML 2025 · similarity 0.93)
- Latent-space Attacks for Refusal Evasion in Language Models (NeurIPS 2026 · similarity 0.92)
- OR-Bench: An Over-Refusal Benchmark for Large Language Models (ICML 2025 · similarity 0.91)
- Refusal in Language Models Is Mediated by a Single Direction (NeurIPS 2024 · similarity 0.90)
- Fail-Closed Alignment for Large Language Models (NeurIPS 2026 · similarity 0.90)
- SORRY-Bench: Systematically Evaluating Large Language Model Safety Refusal (ICLR 2025 · similarity 0.90)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.