---
title: "LASA — paper by Yang et al. (2026) — summary and ideas"
description: "The authors argue the cause is a mismatch. 95% agreement. 51 references. Among them: 0."
authors: ["Junxiao Yang", "Haoran Liu", "Jinzhe Tu", "Jiale Cheng", "Zhexin Zhang", "Shiyao Cui", "Jiaqi Weng", "Jialing Tao", "Hui Xue", "Hongning Wang", "Han Qiu", "Minlie Huang"]
year: 2026
venue: "Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)"
source: "https://aclanthology.org/2026.acl-long.1913/"
doi: "10.18653/v1/2026.acl-long.1913"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/yang-2026-lasa-language-agnostic-semantic-alignment/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/yang-2026-lasa-language-agnostic-semantic-alignment/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/38/) / LASA: Language-Agnostic Semantic Alignment at the Semantic Bottleneck for LLM Safety

# LASA: Language-Agnostic Semantic Alignment at the Semantic Bottleneck for LLM Safety

**Authors:** [Junxiao Yang](https://md.research.elamur.ai/free/en/authors/junxiao-yang/), Haoran Liu, Jinzhe Tu, [Jiale Cheng](https://md.research.elamur.ai/free/en/authors/jiale-cheng/), [Zhexin Zhang](https://md.research.elamur.ai/free/en/authors/zhexin-zhang/), [Shiyao Cui](https://md.research.elamur.ai/free/en/authors/shiyao-cui/), [Jiaqi Weng](https://md.research.elamur.ai/free/en/authors/jiaqi-weng/), [Jialing Tao](https://md.research.elamur.ai/free/en/authors/jialing-tao/), [Hui Xue](https://md.research.elamur.ai/free/en/authors/hui-xue/), [Hongning Wang](https://md.research.elamur.ai/free/en/authors/hongning-wang/), [Han Qiu](https://md.research.elamur.ai/free/en/authors/han-qiu/) and [Minlie Huang](https://md.research.elamur.ai/free/en/authors/minlie-huang/) · **Year:** 2026 · **Venue:** [Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)](https://md.research.elamur.ai/free/en/venues/acl/) ([ACL 2026](https://md.research.elamur.ai/free/en/venues/acl/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.acl-long.1913/) · [PDF](https://aclanthology.org/2026.acl-long.1913.pdf) · [DOI 10.18653/v1/2026.acl-long.1913](https://doi.org/10.18653/v1/2026.acl-long.1913) · [OpenAlex](https://openalex.org/W7166890494)

**Citations:** 0 citations (OpenAlex, 2026-10-14)

## Summary
LLMs tend to refuse harmful requests reliably in high-resource languages but are much easier to jailbreak in low-resource ones. The authors argue the cause is a mismatch. Semantic understanding in base models generalizes across languages, but safety tuning happens in text space and inherits the language skew of the alignment data. Using layer-wise Silhouette scores and t-SNE, they locate a "Semantic Bottleneck": an intermediate layer where hidden states group by meaning rather than by language.

Their framework, LASA, works in three steps:
1. It finds this layer.
2. It trains a small Safety Semantic Interpreter (SSI) on the frozen model's bottleneck states to tell benign from malicious queries.
3. It fine-tunes the model with generation conditioned on the SSI signal.

When safety training uses only English, Chinese and Korean, LASA still sharply lowers attack success rates in unseen languages such as Swahili. Results hold across LLaMA and Qwen models. The work suggests that the layer where safety alignment is applied matters, and that a language-agnostic layer gives more scalable multilingual safety.

## Key points
- **Locating the bottleneck:** It is the layer that maximizes the gap between query-based and language-based Silhouette scores. Clustering by language follows a U-shape across depth, while clustering by query follows an inverted U.
- **The SSI module:** It is a lightweight MLP binary classifier trained with BCE loss and adds under 0.2% of the base model's parameters.
- **Overall results:** Average ASR on LLaMA-3.1-8B-Instruct falls from 24.7% to 2.8%. It stays around 3–4% for Qwen2.5 and Qwen3 Instruct models from 7B to 32B.
- **Unseen-language transfer:** On Qwen2.5-7B-Instruct, Swahili ASR drops from roughly 50% under baseline methods to 13.0%.
- **Data, evaluation and limits:** Harmful queries come from MultiJail and HarmBench. GPT-4o serves as the judge, with over 95% agreement with human annotators on LLaMA-3.1-8B. The method is weaker when harmful intent is implicit, for example in low-similarity emoji prompts.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

📚 Shelves (4): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 17,450 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 17,296 works

🧭 Topics (2): [🧠 Language models & pretraining](https://md.research.elamur.ai/free/en/topics/language-models/) · 3,894 works · [🛡️ Bias, fairness & safety](https://md.research.elamur.ai/free/en/topics/bias-fairness-safety/) · 587 works

## Cite

Cite as: Junxiao Yang, Haoran Liu, Jinzhe Tu, Jiale Cheng, Zhexin Zhang, Shiyao Cui, Jiaqi Weng, Jialing Tao, Hui Xue, Hongning Wang, Han Qiu and Minlie Huang. 2026. LASA: Language-Agnostic Semantic Alignment at the Semantic Bottleneck for LLM Safety. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{yang2026lasa,
  title = {{LASA: Language-Agnostic Semantic Alignment at the Semantic Bottleneck for LLM Safety}},
  author = {Junxiao Yang, Haoran Liu, Jinzhe Tu, Jiale Cheng, Zhexin Zhang, Shiyao Cui, Jiaqi Weng, Jialing Tao, Hui Xue, Hongning Wang, Han Qiu and Minlie Huang},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.1913},
  url = {https://doi.org/10.18653/v1/2026.acl-long.1913}
}
```

- [← previous Large-Scale Multimodal Knowledge Graph about Classical Chinese Poetry: Fine-grained Method and Comprehensive Evaluation](https://md.research.elamur.ai/free/en/papers/wang-2026-large-scale-multimodal-knowledge-graph/)
- [next → Late Code Chunking: A Code Chunking Strategy for Repository-Level Code Completion](https://md.research.elamur.ai/free/en/papers/oh-2026-late-code-chunking-code-chunking/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/38/)

## References

51 references, 21 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Afra Amini, Tim Vieira, and Ryan Cotterell. 2024. Direct preference optimization with an offset. In Findings of the Association for Computational Linguistics: ACL 2024, pages 9954– 9972, Bangkok, Thailand. Association for Computational Linguistics. [find](https://scholar.google.com/scholar?q=Afra+Amini%2C+Tim+Vieira%2C+and+Ryan+Cotterell%2E+2024%2E+Direct+preference+optimization+with+an+offset%2E+In+Findings+of+the+Association+for+Computational+Linguistics%3A+ACL+2024%2C+pages+9954%E2%80%93+9972%2C+Bangkok%2C+Thai)
2. AI Anthropic. 2024. The claude 3 model family: Opus, sonnet, haiku. Claude-3 Model Card, 1. [find](https://scholar.google.com/scholar?q=AI+Anthropic%2E+2024%2E+The+claude+3+model+family%3A+Opus%2C+sonnet%2C+haiku%2E+Claude%2D3+Model+Card%2C+1%2E)
3. Berk Atil, Rebecca J Passonneau, and Fred Morstatter. 2025. Do methods to jailbreak and defend llms generalize across languages? arXiv preprint arXiv:2511.00689. — [arXiv:2511.00689](https://arxiv.org/abs/2511.00689) [find](https://scholar.google.com/scholar?q=Berk+Atil%2C+Rebecca+J+Passonneau%2C+and+Fred+Morstatter%2E+2025%2E+Do+methods+to+jailbreak+and+defend+llms+generalize+across+languages%3F+arXiv+preprint+arXiv%3A2511%2E00689%2E+%E2%80%94+%5BarXiv%3A2511%2E00689%5D%28https%3A%2F%2Farxiv%2Eorg)
4. Maciej Chrab aszcz, Filip Szatkowski, Bartosz Wójcik, Jan Dubiński, and Tomasz Trzciński. 2025. Maybe i should not answer that, but... do llms understand the safety of their inputs? arXiv preprint arXiv:2502.16174. — [arXiv:2502.16174](https://arxiv.org/abs/2502.16174) [find](https://scholar.google.com/scholar?q=Maciej+Chrab+aszcz%2C+Filip+Szatkowski%2C+Bartosz+W%C3%B3jcik%2C+Jan+Dubin%CC%81ski%2C+and+Tomasz+Trzcin%CC%81ski%2E+2025%2E+Maybe+i+should+not+answer+that%2C+but%2E%2E%2E+do+llms+understand+the+safety+of+their+inputs%3F+arXiv+preprint+a)
5. Gheorghe Comanici, Eric Bieber, Mike Schaekermann, Ice Pasupat, Noveen Sachdeva, Inderjit Dhillon, Marcel Blistein, Ori Ram, Dan Zhang, Evan Rosen, et al. 2025. [Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities](https://md.research.elamur.ai/free/en/papers/comanici-2025-gemini-2-5-pushing-frontier/). arXiv prep…
6. Alexis Conneau and Guillaume Lample. 2019. Cross-lingual language model pretraining. Advances in neural information processing systems, 32. [find](https://scholar.google.com/scholar?q=Alexis+Conneau+and+Guillaume+Lample%2E+2019%2E+Cross%2Dlingual+language+model+pretraining%2E+Advances+in+neural+information+processing+systems%2C+32%2E)
7. Ganqu Cui, Lifan Yuan, Ning Ding, Guanming Yao, Bingxiang He, Wei Zhu, Yuan Ni, Guotong Xie, Ruobing Xie, Yankai Lin, et al. 2023. Ultrafeedback: Boosting language models with scaled ai feedback. arXiv preprint arXiv:2310.01377. [find](https://scholar.google.com/scholar?q=Ganqu+Cui%2C+Lifan+Yuan%2C+Ning+Ding%2C+Guanming+Yao%2C+Bingxiang+He%2C+Wei+Zhu%2C+Yuan+Ni%2C+Guotong+Xie%2C+Ruobing+Xie%2C+Yankai+Lin%2C+et+al%2E+2023%2E+Ultrafeedback%3A+Boosting+language+models+with+scaled+ai+feedback%2E+arXi)
8. Shiyao Cui, Xijia Feng, Yingkang Wang, Junxiao Yang, Zhexin Zhang, Biplab Sikdar, Hongning Wang, Han Qiu, and Minlie Huang. 2025. When smiley turns hostile: Interpreting how emojis trigger llms’ toxicity. arXiv preprint arXiv:2509.11141. — [arXiv:2509.11141](https://arxiv.org/abs/2509.11141) [find](https://scholar.google.com/scholar?q=Shiyao+Cui%2C+Xijia+Feng%2C+Yingkang+Wang%2C+Junxiao+Yang%2C+Zhexin+Zhang%2C+Biplab+Sikdar%2C+Hongning+Wang%2C+Han+Qiu%2C+and+Minlie+Huang%2E+2025%2E+When+smiley+turns+hostile%3A+Interpreting+how+emojis+trigger+llms%E2%80%99+toxic)
9. Adrian de Wynter, Ishaan Watts, Tua Wongsangaroonsri, Minghui Zhang, Noura Farra, Nektar Ege Altıntoprak, Lena Baur, Samantha Claudet, Pavel Gaj-dušek, Qilong Gu, et al. 2025. Rtp-lx: Can llms evaluate toxicity in multilingual scenarios? In Proceedings of the AAAI Conference on Artificial Intelligen… [find](https://scholar.google.com/scholar?q=Adrian+de+Wynter%2C+Ishaan+Watts%2C+Tua+Wongsangaroonsri%2C+Minghui+Zhang%2C+Noura+Farra%2C+Nektar+Ege+Alt%C4%B1ntoprak%2C+Lena+Baur%2C+Samantha+Claudet%2C+Pavel+Gaj%2Ddu%C5%A1ek%2C+Qilong+Gu%2C+et+al%2E+2025%2E+Rtp%2Dlx%3A+Can+llms+evaluat)
10. Yue Deng, Wenxuan Zhang, Sinno Jialin Pan, and Lidong Bing. 2023. [Multilingual jailbreak challenges in large language models](https://md.research.elamur.ai/free/en/papers/deng-2023-multilingual-jailbreak-challenges-large-language/). arXiv preprint arXiv:2310.06474.
11. Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. 2024. [The llama 3 herd of models](https://md.research.elamur.ai/free/en/papers/grattafiori-2024-llama-3-herd-models/). arXiv preprint arXiv:2407.21783.
12. Anastasia Dunca, Maanas Kumar Sharma, Olivia Munoz, and Victor Rosales. 2025. Mulbere: Multilingual jailbreak robustness using targeted latent adversarial training. In Proceedings of the 9th Widening NLP Workshop, pages 175–181. [find](https://scholar.google.com/scholar?q=Anastasia+Dunca%2C+Maanas+Kumar+Sharma%2C+Olivia+Munoz%2C+and+Victor+Rosales%2E+2025%2E+Mulbere%3A+Multilingual+jailbreak+robustness+using+targeted+latent+adversarial+training%2E+In+Proceedings+of+the+9th+Widening+)
13. Kawin Ethayarajh, Winnie Xu, Niklas Muennighoff, Dan Jurafsky, and Douwe Kiela. 2024. Kto: Model alignment as prospect theoretic optimization. arXiv preprint arXiv:2402.01306. [find](https://scholar.google.com/scholar?q=Kawin+Ethayarajh%2C+Winnie+Xu%2C+Niklas+Muennighoff%2C+Dan+Jurafsky%2C+and+Douwe+Kiela%2E+2024%2E+Kto%3A+Model+alignment+as+prospect+theoretic+optimization%2E+arXiv+preprint+arXiv%3A2402%2E01306%2E)
14. Yu Fei, Yasaman Razeghi, and Sameer Singh. 2025. [Nudging: Inference-time alignment of llms via guided decoding](https://md.research.elamur.ai/free/en/papers/fei-2025-nudging-inference-time-alignment-llms/). In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 12702– 12739.
15. Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, et al. 2025. [Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning](https://md.research.elamur.ai/free/en/papers/deepseek-ai-2025-deepseek-r1-incentivizing-reasoning-capability/). arXiv preprint arXiv:2501.12948.
16. Prannaya Gupta, Le Qi Yau, Hao Han Low, I-Shiang Lee, Hugo Maximus Lim, Yu Xin Teoh, Koh Jia Hng, Dar Win Liew, Rishabh Bhardwaj, Rajat Bhardwaj, et al. 2024. Walledeval: A comprehensive safety evaluation toolkit for large language models. In Proceedings of the 2024 Conference on Empirical Methods i… [find](https://scholar.google.com/scholar?q=Prannaya+Gupta%2C+Le+Qi+Yau%2C+Hao+Han+Low%2C+I%2DShiang+Lee%2C+Hugo+Maximus+Lim%2C+Yu+Xin+Teoh%2C+Koh+Jia+Hng%2C+Dar+Win+Liew%2C+Rishabh+Bhardwaj%2C+Rajat+Bhardwaj%2C+et+al%2E+2024%2E+Walledeval%3A+A+comprehensive+safety+evalua)
17. Rajdeep Haldar, Ziyi Wang, Qifan Song, Guang Lin, and Yue Xing. 2025. Llm safety alignment is divergence estimation in disguise. arXiv preprint arXiv:2502.00657. — [arXiv:2502.00657](https://arxiv.org/abs/2502.00657) [find](https://scholar.google.com/scholar?q=Rajdeep+Haldar%2C+Ziyi+Wang%2C+Qifan+Song%2C+Guang+Lin%2C+and+Yue+Xing%2E+2025%2E+Llm+safety+alignment+is+divergence+estimation+in+disguise%2E+arXiv+preprint+arXiv%3A2502%2E00657%2E+%E2%80%94+%5BarXiv%3A2502%2E00657%5D%28https%3A%2F%2Farxiv%2Eorg)
18. Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. 2021. [Measuring massive multitask language understanding](https://md.research.elamur.ai/free/en/papers/hendrycks-2020-measuring-massive-multitask-language-understanding/).
19. Jiwoo Hong, Noah Lee, and James Thorne. 2024. ORPO: Monolithic preference optimization without reference model. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 11170–11189, Miami, Florida, USA. Association for Computational Linguistics. [find](https://scholar.google.com/scholar?q=Jiwoo+Hong%2C+Noah+Lee%2C+and+James+Thorne%2E+2024%2E+ORPO%3A+Monolithic+preference+optimization+without+reference+model%2E+In+Proceedings+of+the+2024+Conference+on+Empirical+Methods+in+Natural+Language+Processin)
20. Linghan Huang, Haolin Jin, Zhaoge Bi, Pengyue Yang, Peizhou Zhao, Taozhao Chen, Xiongfei Wu, Lei Ma, and Huaming Chen. 2025. The tower of babel revisited: Multilingual jailbreak prompts on closed-source large language models. arXiv preprint arXiv:2505.12287. — [arXiv:2505.12287](https://arxiv.org/abs/2505.12287) [find](https://scholar.google.com/scholar?q=Linghan+Huang%2C+Haolin+Jin%2C+Zhaoge+Bi%2C+Pengyue+Yang%2C+Peizhou+Zhao%2C+Taozhao+Chen%2C+Xiongfei+Wu%2C+Lei+Ma%2C+and+Huaming+Chen%2E+2025%2E+The+tower+of+babel+revisited%3A+Multilingual+jailbreak+prompts+on+closed%2Dsour)
21. Jiaming Ji, Donghai Hong, Borong Zhang, Boyuan Chen, Josef Dai, Boren Zheng, Tianyi Alex Qiu, Jiayi Zhou, Kaile Wang, Boxun Li, et al. 2025. [Pku-saferlhf: Towards multi-level safety alignment for llms with human preference](https://md.research.elamur.ai/free/en/papers/ji-2025-pku-saferlhf-multi-level-safety/). In Proceedings of the 63rd Annual Meeting of the Association for Computation…
22. Artūrs Kanepajs, Vladimir Ivanov, and Richard Moulange. 2024. Towards safe multilingual frontier ai. arXiv preprint arXiv:2409.13708. — [arXiv:2409.13708](https://arxiv.org/abs/2409.13708) [find](https://scholar.google.com/scholar?q=Artu%CC%84rs+Kanepajs%2C+Vladimir+Ivanov%2C+and+Richard+Moulange%2E+2024%2E+Towards+safe+multilingual+frontier+ai%2E+arXiv+preprint+arXiv%3A2409%2E13708%2E+%E2%80%94+%5BarXiv%3A2409%2E13708%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2409%2E13708%29)
23. Chong Li, Shaonan Wang, Jiajun Zhang, and Chengqing Zong. 2024a. Improving in-context learning of multilingual generative language models with cross-lingual alignment. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language… [find](https://scholar.google.com/scholar?q=Chong+Li%2C+Shaonan+Wang%2C+Jiajun+Zhang%2C+and+Chengqing+Zong%2E+2024a%2E+Improving+in%2Dcontext+learning+of+multilingual+generative+language+models+with+cross%2Dlingual+alignment%2E+In+Proceedings+of+the+2024+Confe)
24. Yahan Li, Yi Wang, Yi Chang, and Yuan Wu. 2024b. Xtrust: On the multilingual trustworthiness of large language models. arXiv preprint arXiv:2409.15762. — [arXiv:2409.15762](https://arxiv.org/abs/2409.15762) [find](https://scholar.google.com/scholar?q=Yahan+Li%2C+Yi+Wang%2C+Yi+Chang%2C+and+Yuan+Wu%2E+2024b%2E+Xtrust%3A+On+the+multilingual+trustworthiness+of+large+language+models%2E+arXiv+preprint+arXiv%3A2409%2E15762%2E+%E2%80%94+%5BarXiv%3A2409%2E15762%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2409%2E)
25. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, et al. 2024. [Harmbench: A standardized evaluation framework for automated red teaming and robust refusal](https://md.research.elamur.ai/free/en/papers/mazeika-2024-harmbench-standardized-evaluation-framework-automated/). arXiv preprint arXiv:2402.04249.
26. Cheng Qian, Hainan Zhang, Lei Sha, and Zhiming Zheng. 2025. Hsf: Defending against jailbreak attacks with hidden state filtering. In Companion Proceedings of the ACM on Web Conference 2025, pages 2078–2087. [find](https://scholar.google.com/scholar?q=Cheng+Qian%2C+Hainan+Zhang%2C+Lei+Sha%2C+and+Zhiming+Zheng%2E+2025%2E+Hsf%3A+Defending+against+jailbreak+attacks+with+hidden+state+filtering%2E+In+Companion+Proceedings+of+the+ACM+on+Web+Conference+2025%2C+pages+2078)
27. Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. 2023. [Direct preference optimization: Your language model is secretly a reward model](https://md.research.elamur.ai/free/en/papers/rafailov-2023-direct-preference-optimization-language-model/). Advances in neural information processing systems, 36:53728–53741.
28. Peter J. Rousseeuw. 1987. Silhouettes: A graphical aid to the interpretation and validation of cluster analysis. Journal of Computational and Applied Mathematics, 20:53–65. [find](https://scholar.google.com/scholar?q=Peter+J%2E+Rousseeuw%2E+1987%2E+Silhouettes%3A+A+graphical+aid+to+the+interpretation+and+validation+of+cluster+analysis%2E+Journal+of+Computational+and+Applied+Mathematics%2C+20%3A53%E2%80%9365%2E)
29. Lingfeng Shen, Weiting Tan, Sihao Chen, Yunmo Chen, Jingyu Zhang, Haoran Xu, Boyuan Zheng, Philipp Koehn, and Daniel Khashabi. 2024. The language barrier: Dissecting safety challenges of arXiv preprint llms in multilingual contexts. arXiv:2401.13136. — [arXiv:2401.13136](https://arxiv.org/abs/2401.13136) [find](https://scholar.google.com/scholar?q=Lingfeng+Shen%2C+Weiting+Tan%2C+Sihao+Chen%2C+Yunmo+Chen%2C+Jingyu+Zhang%2C+Haoran+Xu%2C+Boyuan+Zheng%2C+Philipp+Koehn%2C+and+Daniel+Khashabi%2E+2024%2E+The+language+barrier%3A+Dissecting+safety+challenges+of+arXiv+preprin)
30. Freda Shi, Mirac Suzgun, Markus Freitag, Xuezhi Wang, Suraj Srivats, Soroush Vosoughi, Hyung Won Chung, Yi Tay, Sebastian Ruder, Denny Zhou, Dipanjan Das, and Jason Wei. 2022. [Language models are multilingual chain-of-thought reasoners](https://md.research.elamur.ai/free/en/papers/shi-2022-language-models-multilingual-chain-thought/).
31. Feifan Song, Bowen Yu, Minghao Li, Haiyang Yu, Fei Huang, Yongbin Li, and Houfeng Wang. 2024. [Preference ranking optimization for human alignment](https://md.research.elamur.ai/free/en/papers/song-2023-preference-ranking-optimization-human-alignment/). In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 18990– 18998.
32. Jiayang Song, Yuheng Huang, Zhehua Zhou, and Lei Ma. 2025. Multilingual blending: Large language model safety alignment evaluation with language mixture. In Findings of the Association for Computational Linguistics: NAACL 2025, pages 3433–3449. [find](https://scholar.google.com/scholar?q=Jiayang+Song%2C+Yuheng+Huang%2C+Zhehua+Zhou%2C+and+Lei+Ma%2E+2025%2E+Multilingual+blending%3A+Large+language+model+safety+alignment+evaluation+with+language+mixture%2E+In+Findings+of+the+Association+for+Computation)
33. Nikhil Verma and Manasa Bharadwaj. 2025. The hidden space of safety: Understanding preference-tuned llms in multilingual context. arXiv preprint arXiv:2504.02708. — [arXiv:2504.02708](https://arxiv.org/abs/2504.02708) [find](https://scholar.google.com/scholar?q=Nikhil+Verma+and+Manasa+Bharadwaj%2E+2025%2E+The+hidden+space+of+safety%3A+Understanding+preference%2Dtuned+llms+in+multilingual+context%2E+arXiv+preprint+arXiv%3A2504%2E02708%2E+%E2%80%94+%5BarXiv%3A2504%2E02708%5D%28https%3A%2F%2Farxiv%2Eor)
34. Cheng Wang, Zeming Wei, Qin Liu, and Muhao Chen. 2025a. [False sense of security: Why probing-based malicious input detection fails to generalize](https://md.research.elamur.ai/free/en/papers/wang-2026-false-sense-security-why-probing/). arXiv preprint arXiv:2509.03888.
35. Mengru Wang, Ningyu Zhang, Ziwen Xu, Zekun Xi, Shumin Deng, Yunzhi Yao, Qishen Zhang, Linyi Yang, Jindong Wang, and Huajun Chen. 2024a. [Detoxifying large language models via knowledge editing](https://md.research.elamur.ai/free/en/papers/wang-2024-detoxifying-large-language-models-knowledge/).
36. Wenxuan Wang, Zhaopeng Tu, Chang Chen, Youliang Yuan, Jen-tse Huang, Wenxiang Jiao, and Michael Lyu. 2024b. All languages matter: On the multilingual safety of llms. In Findings of the Association for Computational Linguistics: ACL 2024, pages 5865–5877. [find](https://scholar.google.com/scholar?q=Wenxuan+Wang%2C+Zhaopeng+Tu%2C+Chang+Chen%2C+Youliang+Yuan%2C+Jen%2Dtse+Huang%2C+Wenxiang+Jiao%2C+and+Michael+Lyu%2E+2024b%2E+All+languages+matter%3A+On+the+multilingual+safety+of+llms%2E+In+Findings+of+the+Association+for)
37. Xinpeng Wang, Mingyang Wang, Yihong Liu, Hinrich Schütze, and Barbara Plank. 2025b. Refusal direction is universal across safety-aligned languages. arXiv preprint arXiv:2505.17306. — [arXiv:2505.17306](https://arxiv.org/abs/2505.17306) [find](https://scholar.google.com/scholar?q=Xinpeng+Wang%2C+Mingyang+Wang%2C+Yihong+Liu%2C+Hinrich+Sch%C3%BCtze%2C+and+Barbara+Plank%2E+2025b%2E+Refusal+direction+is+universal+across+safety%2Daligned+languages%2E+arXiv+preprint+arXiv%3A2505%2E17306%2E+%E2%80%94+%5BarXiv%3A2505%2E17306)
38. Xunguang Wang, Wenxuan Wang, Zhenlan Ji, Zongjie Li, Pingchuan Ma, Daoyuan Wu, and Shuai Wang. 2025c. Stshield: Single-token sentinel for real-time jailbreak detection in large language models. arXiv preprint arXiv:2503.17932. — [arXiv:2503.17932](https://arxiv.org/abs/2503.17932) [find](https://scholar.google.com/scholar?q=Xunguang+Wang%2C+Wenxuan+Wang%2C+Zhenlan+Ji%2C+Zongjie+Li%2C+Pingchuan+Ma%2C+Daoyuan+Wu%2C+and+Shuai+Wang%2E+2025c%2E+Stshield%3A+Single%2Dtoken+sentinel+for+real%2Dtime+jailbreak+detection+in+large+language+models%2E+arXiv+)
39. BigScience Workshop, Teven Le Scao, Angela Fan, Christopher Akiki, Ellie Pavlick, Suzana Ilić, Daniel Hesslow, Roman Castagné, Alexandra Sasha Luccioni, François Yvon, et al. 2022. Bloom: A 176b-parameter open-access multilingual language model. arXiv preprint arXiv:2211.05100. [find](https://scholar.google.com/scholar?q=BigScience+Workshop%2C+Teven+Le+Scao%2C+Angela+Fan%2C+Christopher+Akiki%2C+Ellie+Pavlick%2C+Suzana+Ilic%CC%81%2C+Daniel+Hesslow%2C+Roman+Castagn%C3%A9%2C+Alexandra+Sasha+Luccioni%2C+Fran%C3%A7ois+Yvon%2C+et+al%2E+2022%2E+Bloom%3A+A+176b%2Dpara)
40. Haoran Xu, Amr Sharaf, Yunmo Chen, Weiting Tan, Lingfeng Shen, Benjamin Van Durme, Kenton Murray, and Young Jin Kim. 2024. [Contrastive preference optimization: Pushing the boundaries of llm performance in machine translation](https://md.research.elamur.ai/free/en/papers/xu-2024-contrastive-preference-optimization-pushing-boundaries/). arXiv preprint arXiv:2401.08417.
41. An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, et al. 2025. [Qwen3 technical report](https://md.research.elamur.ai/free/en/papers/yang-2025-qwen3-technical-report/). arXiv preprint arXiv:2505.09388.
42. An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, et al. 2024. Qwen2. 5 technical report. arXiv preprint arXiv:2412.15115. [find](https://scholar.google.com/scholar?q=An+Yang%2C+Baosong+Yang%2C+Beichen+Zhang%2C+Binyuan+Hui%2C+Bo+Zheng%2C+Bowen+Yu%2C+Chengyuan+Li%2C+Dayiheng+Liu%2C+Fei+Huang%2C+Haoran+Wei%2C+et+al%2E+2024%2E+Qwen2%2E+5+technical+report%2E+arXiv+preprint+arXiv%3A2412%2E15115%2E)
43. Zheng-Xin Yong, Beyza Ermis, Marzieh Fadaee, Stephen Bach, and Julia Kreutzer. 2025. [The state of multilingual llm safety research: From measuring the language gap to mitigating it](https://md.research.elamur.ai/free/en/papers/yong-2025-state-multilingual-llm-safety-research/). In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 15856–15871.
44. Zheng-Xin Yong, Cristina Menghini, and Stephen H Bach. 2023. [Low-resource languages jailbreak gpt-4](https://md.research.elamur.ai/free/en/papers/yong-2023-low-resource-languages-jailbreak-gpt/). arXiv preprint arXiv:2310.02446.
45. Haneul Yoo, Yongjin Yang, and Hwaran Lee. 2025. [Code-switching red-teaming: Llm evaluation for safety and multilingual understanding](https://md.research.elamur.ai/free/en/papers/yoo-2025-code-switching-red-teaming-llm/). In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 13392–13413.
46. Hongyi Yuan, Zheng Yuan, Chuanqi Tan, Wei Wang, Songfang Huang, and Fei Huang. 2023. Rrhf: Rank responses to align language models with human feedback. Advances in Neural Information Processing Systems, 36:10935–10950. [find](https://scholar.google.com/scholar?q=Hongyi+Yuan%2C+Zheng+Yuan%2C+Chuanqi+Tan%2C+Wei+Wang%2C+Songfang+Huang%2C+and+Fei+Huang%2E+2023%2E+Rrhf%3A+Rank+responses+to+align+language+models+with+human+feedback%2E+Advances+in+Neural+Information+Processing+System)
47. Xiang Zhang, Senyu Li, Bradley Hauer, Ning Shi, and Grzegorz Kondrak. 2023. Don’t trust chatgpt when your question is not in english: a study of multilingual abilities and types of llms. arXiv preprint arXiv:2305.16339. [find](https://scholar.google.com/scholar?q=Xiang+Zhang%2C+Senyu+Li%2C+Bradley+Hauer%2C+Ning+Shi%2C+and+Grzegorz+Kondrak%2E+2023%2E+Don%E2%80%99t+trust+chatgpt+when+your+question+is+not+in+english%3A+a+study+of+multilingual+abilities+and+types+of+llms%2E+arXiv+preprin)
48. Yuanchi Zhang, Yile Wang, Zijun Liu, Shuo Wang, Xiaolong Wang, Peng Li, Maosong Sun, and Yang Liu. 2024. Enhancing multilingual capabilities of large language models through self-distillation arXiv preprint from resource-rich languages. arXiv:2402.12204. — [arXiv:2402.12204](https://arxiv.org/abs/2402.12204) [find](https://scholar.google.com/scholar?q=Yuanchi+Zhang%2C+Yile+Wang%2C+Zijun+Liu%2C+Shuo+Wang%2C+Xiaolong+Wang%2C+Peng+Li%2C+Maosong+Sun%2C+and+Yang+Liu%2E+2024%2E+Enhancing+multilingual+capabilities+of+large+language+models+through+self%2Ddistillation+arXiv+pr)
49. Weixiang Zhao, Jiahe Guo, Yulin Hu, Yang Deng, An Zhang, Xingyu Sui, Xinyang Han, Yanyan Zhao, Bing Qin, Tat-Seng Chua, et al. 2025a. [Adasteer: Your aligned llm is inherently an adaptive jailbreak defender](https://md.research.elamur.ai/free/en/papers/zhao-2025-adasteer-your-aligned-llm-is/). arXiv preprint arXiv:2504.09466.
50. Weixiang Zhao, Yulin Hu, Yang Deng, Tongtong Wu, Wenxuan Zhang, Jiahe Guo, An Zhang, Yanyan Zhao, Bing Qin, Tat-Seng Chua, et al. 2025b. [Mpo: Multilingual safety alignment via reward gap optimization](https://md.research.elamur.ai/free/en/papers/zhao-2025-mpo-multilingual-safety-alignment-reward/). arXiv preprint arXiv:2505.16869.
51. Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric P. Xing, Hao Zhang, Joseph E. Gonzalez, and Ion Stoica. 2023. [Judging llm-as-a-judge with mt-bench and chatbot arena](https://md.research.elamur.ai/free/en/papers/zheng-2023-judging-llm-judge-mt-bench/).

*Updated 2 November 2026*