Title: Refusal Direction is Universal Across Safety-Aligned Languages
Venue: NeurIPS 2025
Accepted: yes
Keywords: Multilingual Safety

LLM Jailbreaks

Crosslingual Transfer
Abstract: Refusal mechanisms in large language models (LLMs) are essential for ensuring safety. Recent research has revealed that refusal behavior can be mediated by a single direction in activation space, enabling targeted interventions to bypass refusals. While this is primarily demonstrated in an English-centric context, appropriate refusal behavior is important for any language, but poorly understood. In this paper, we investigate the refusal behavior in LLMs across 14 languages using \textit{PolyRefuse}, a multilingual safety dataset created by translating malicious and benign English prompts into these languages. We uncover the surprising cross-lingual universality of the refusal direction: a vector extracted from English can bypass refusals in other languages with near-perfect effectiveness, without any additional fine-tuning. Even more remarkably, refusal directions derived from any safety-aligned language transfer seamlessly to others. We attribute this transferability to the parallelism of refusal vectors across languages in the embedding space and identify the underlying mechanism behind cross-lingual jailbreaks. These findings provide actionable insights for building more robust multilingual safety defenses and pave the way for a deeper mechanistic understanding of cross-lingual vulnerabilities in LLMs.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper investigates whether representations of refusal are language dependent or language agnostic. In order to investigate this question, the authors translate existing datasets of harmful requests into a wide range of languages, resulting in a new multi-lingual dataset called \"PolyRefuse\". The authors find that refusal directions extracted from any source language can transfer to manipulating refusal behavior in any target language, suggesting that the a model's \"refusal direction\" is language agnostic. Additionally, they find that refusal directions extracted using different languages converge to the same universal refusal direction.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n- The core result of the refusal direction being language agnostic is clear and well-supported by evidence.\n- The new dataset seems useful for future research on multi-lingual adversarial robustness.\n\nWeaknesses:\n- I think the claims of harmful/harmless separability are weak (see details in Questions section).\n\nQUESTIONS:\n- Harmful vs harmless representation analysis\n  - Why is the analysis of harmful vs harmless at the same layer and token position as refusal vs non-refusal? Would we expect these concepts to be represented at precisely the same location? Observing a lack in separability at a single activation site does not imply that the model does not cleanly separate these concepts generally.\n  - Why use Silhouette Score to measure separability between harmful and harmless requests? My instinct would be to use simple linear probing to measure this. It would also be simple to perform linear probing and sweep over layers and token positions, to address my previous point about locality.\n  - Additionally, it is hard to know how to interpret the Silhouette Score. For example, what does a score of 0.4960 mean? Is it good or bad? I find it strange that \"de\" has a lower Silhouette Score than \"yo\", despite \"de\" refusing more harmful requests than \"yo\" - how do you explain this?\n- How does Wildguard work? Why was Wildguard chosen for evaluating compliance vs refusal?\n- In figure 4, why display multiple token positions and layers? In my opinion, the point would be much clearer if you only compared the particular activation site (the specific layer and token position from which the refusal direction was extracted), and show that the extracted vectors have very high cosine similarity (although this would then require some baselines to get a sense of what an \"unusually large\" cosine similarity is in the given dimensionality, but this should be straightforward). My point here is that most of the information displayed in the plot is uninteresting / unimportant (the pair-wise comparisons between vectors at different activation sites) - the important information is concentrated at the comparisons of between vectors from the *same* activation site, and the figure can be greatly simplified to emphasize this.\n\nLIMITATIONS:\n- I think the most significant limitations are those concerning the separation between harmful and harmless embeddings (see Questions section for details). I think these limitations should be acknowledged, or that there should be additional, more thorough analysis conducted on this important claim.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 5, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-06-15"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper evaluates the cross-lingual transferability of refusal vectors in LLMs. The authors construct a comprehensive evaluation dataset covering 14 high-resource and low-resource languages, with experimental results confirming the significant transferability of refusal vectors across safety-aligned languages.\n\nSTRENGTHS AND WEAKNESSES:\n## Strength\n\nThe motivation of this paper is great. While existing LLM safety research mainly focuses on English, this work provides a systematic investigation of refusal vectors in multilingual scenarios, offering valuable insights to the community. The evaluation covers 14 languages, including comparative analyses between high- and low-resource languages. I also enjoy reading the paper, as it is well-structured and easy to follow. \n\n## Weakness\n\n- The current heuristic approach for selecting high-probability refusal tokens (e.g., Table 4) lacks sufficient coverage (e.g., English only includes \"I\" while there are also many typical refusal phrases like \"as\" or \"sorry\"). Therefore, I think the robustness of this method is unknown, and the author should strengthen the discussion in this regard. In my opinion, a simpler method to calculate the \"refusal score\" may be to use SCAV [1]. It trains a linear classifier, so the classification accuracy on test set of each language can be used to select the most effective refusal vector.\n\n- When constructing the dataset, I really appreciate that the authors evaluated the translation quality. However, since there are cultural differences in language, translation may amplify certain biases, so it is necessary to manually evaluate the quality of the dataset.\n\n- In section 5.2, the author concluded that the refusal vectors obtained from English can be effectively transferred to other languages. I want to see what happens if the refusal vectors are used for defense. For example, when applying English refusal vectors to  low-resource languages, will it make the model safer?\n\n- Does the found phenomenon also exist in the reasoning model (like Qwen3 or DeepSeek-R1)/ MOE architecture model?\n\n- Related work should be supplemented with more papers explaining LLM security mechanisms, such as [1][2].\n\n## Reference\n[1] Xu, Zhihao, et al. \"Uncovering safety risks of large language models through concept activation vector.\" Advances in Neural Information Processing Systems 37 (2024): 116743-116782.\n\n[2] Li, Tianlong, et al. \"Revisiting Jailbreaking for Large Language Models: A Representation Engineering Perspective.\" Proceedings of the 31st International Conference on Computational Linguistics. 2025.\n\nQUESTIONS:\n- Does the experiment in 5.2 subtract the refusal vectors at all layers?\n- The color of Figure 2 can be adjusted, as it currently looks too dark.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-28"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper claims that the \"refusal direction\", i.e., the vector obtained as a function of the differences between the activation values of an LLM when refusing harmful prompts vs responding to harmless prompts, works 'universally' across languages. Prior work has shown the impact of this refusal direction vector in controlling how often the model refuses harmful queries for English. This work extends this analysis to multiple languages - (1) the authors show that the refusal direction obtained from english can be used to get the model to refuse less when prompted with harmful prompts in other languages, and (2) the refusal direction obtained from different languages can also be used to get the model to refuse less in other languages. The authors also carry out a geometric analysis of activation vectors and refusal directions under different scenarios to support their claims.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n\n- The motivation for this paper is strong: for any alignment phenomenon demonstrated in English, it's great to get insights on how it holds up for other languages. In general it is known to some extent that multilinguality can be exploited to jailbreak LLMs and so such studies that can (potentially) guide solutions to solve such problems are interesting for the community.\n- The Polyrefuse dataset, which includes 14 different languages, can be a useful artifact for future research.\n\nWeaknesses:\n\n- My main issue is that I am not convinced that the claim of universality is adequately supported. This stems from lack of experiments in two parts:\n\n(1) There is no control: For the experiments in sections 5.2-5.3, there should be results reported with some control vectors/directions. I would have expected to see the effect of using random vectors instead of the refusal direction calculated by the method. I would also have expected another control for the data - if you used some other non-harmful prompts \"neutral\" dataset (say open-instruct) instead of the harmful dataset (i.e., you wouldn't be calculating refusal safety direction anymore), what happens? ---- Basically my concern is that when you are 'ablating' these refusal vectors from the LLM and showing decrease in refusal, how do we know if it is because of these refusal vectors and not because you are in some sense damaging the LLM?\n\n(2) No experiments showing increase of refusal: The paper does not carry out experiments to show that when the refusal direction is added (eq. 5), it increases refusal rate. For a strong claim like universality, in my opinion, the authors need to show this in both settings of sections 5.2-5.3.\n\n- Minor point: I am also not very convinced by the geometric analysis. For instance in Figure 3, I would think that the refusal direction for non-English languages would be from the centroid of \"harmless_<lang>\" to centroid of \"harmful_refuse_<lang>\". But the dotted arrows simply indicate the parallel line to the english counterpart which can be misleading.\n\nQUESTIONS:\nL237: \"at the refusal extraction layer\" -- what does this mean?\n\nLIMITATIONS:\nThe authors discuss some limitations of their work that are not immediately addressed but could be looked at in future research.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis work shows that refusal direction is universal across several languages. Refusal directions extracted from English generalize to other languages, and refusal direction from any safety-aligned language applies to others as well. The authors further highlight that despite the universality of refusal direction, some languages are more vulnerable to jailbreak attacks as the harmful and harmless representations are less separable in these languages.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths**\n- The two observations highlighted in the paper are insightful and useful for understanding safety concerns in low resourced languages\n- The observations in this work could motivate methods to defend against cross-lingual jailbreaks as well\n- Contribution of a dataset PolyRefuse with harmful prompts across 14 languages\n- Thorough experimentation with intuitive visualizations\n\n**Weaknesses/ Areas for further improvement**: \n - Understanding scaling laws with respect to this universality would be very useful as this trend may change across model sizes - how does this behaviour change for smaller / larger models \n - It is not clear what types of prompts this observation generalizes to - is it natural unsafe prompts or adversarial jailbreaks - an analysis on transferability for different types of unsafe/ jailbreak prompts would be insightful \n - The datasets have been generated by translating from English. It would be useful to also check if the transferability holds on completely independent datasets (maybe this is already achieved as the authors maintain a test split)\n - The reason why it is hard to separate harmful and harmless prompts in some languages is not clear - is it because the model is unable to understand the words, or is there a lack of generalization of safety concepts - more experiments / analysis on this would be helpful. For example, if the same target model is asked to translate the two prompts back to English, are the translated prompts correct and well distinguishable?\n\nQUESTIONS:\nPlease refer to the weaknesses above.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-05"}