Multi-lingual Multi-turn Automated Red Teaming for LLM s (2025)

Abstract: Language Model Models (LLMs) have improved dramatically in the past few years, increasing their adoption and the scope of their capabilities over time. A significant amount of work is dedicated to “model alignment”, i.e., preventing LLMs to generate unsafe responses when deployed into customer-facing applications. One popular method to evaluate safety risks is red-teaming, where agents attempt to bypass alignment by crafting elaborate prompts that trigger unsafe responses from a model. Standard human-driven red-teaming is costly, time-consuming and rarely covers all the recent features (e.g., multi-lingual, multi-modal aspects), while proposed automation methods only cover a small subset of LLMs capabilities (i.e., English or single-turn). We present Multi-lingual Multi-turn Automated Red Teaming (MM-ART), a method to fully automate conversational, multi-lingual red-teaming operations and quickly identify prompts leading to unsafe responses. Through extensive experiments on different languages, we show the studied LLMs are on average 71% more vulnerable after a 5-turn conversation in English than after the initial turn. For conversations in non-English languages, models display up to 195% more safety vulnerabilities than the standard single-turn English approach, confirming the need for automated red-teaming methods matching LLMs capabilities.

## introduction in recent years, the landscape of language model models (llms) has evolved drastically, with numerous releases showcasing enhanced capabilities over time. these advancements have positioned llms as formidable tools capable of a wide range of tasks, from generating creative text to powering virtual assistants and chat-bots. even smaller open llms such as mistral @xcite , llama (meta-ai, 2024) or molmo @xcite have demonstrated close to state-of-the-art performance across various tasks. their effectiveness makes them viable options for integration into enterprise applications, particularly due to their lower latency and cost-effectiveness. however, this increase in capabilities means that models are even more susceptible to generate unsafe content which could harm customers (e.g., detailed instructions to build a bomb). recent models are now capable of holding long conversations in multiple languages, which offer even more possibilities for unsafe content generation. to tackle this challenge, "red-teaming" emerges as a crucial strategy aimed at assessing and mitigating the potential adverse effects of llm-generated content. red-teaming entails a systematic approach to adversarial probing and evaluation of an llm's responses, with the objective of identifying safety violations. llms are then "aligned" by incorporating red-teaming data into their training, making them more robust to attacks and ensuring the generated content adheres to ethical standards set by their builders. standard redteaming involves human testers interacting with llms in an attempt to trigger unsafe responses, aka "jailbreaking". this approach relies on the creativity and expertise of humans, who craft scenarios to challenge the llm across different contexts. however, due to its manual nature, human red-teaming can be time-consuming and resource-intensive. in contrast, automated red-teaming relies on various ml models, allowing for more scalable and efficient evaluation, although human creativity is still needed for exploring new vulnerabilities. most recent studies focus on capturing jailbreak methods in either multi-turn or multilingual scenarios @xcite , but no existing research conduct simultaneous safety evaluation across multiple capability dimensions during red-teaming. we present a novel approach, multilingual and multi-turn automated red teaming (mm-art), and the first safety evaluation on a set of widely popular llms for attacks in non-english conversational settings. we believe this line of study is critical for expanding llms across the globe, covering different languages and delivering a similar safe experience to different users. our contributions: 1) we propose a novel approach, mm-art, to evaluate the safety of models across both languages and conversational depth. we provide a detailed description of our approach and share the components used to build this method. ## related work a wide variety of single-turn "static jailbreaking" methods have been proposed in the past year, which consist of formatting a static prompt in a way that triggers unsafe response from the llm by rephrasing, spreading across multiple turns or adding many prompts into llm context @xcite @xcite @xcite . other works have looked into multi-turn "static jailbreaking", where from a static adversarial prompt, a conversation is held with the target llm aiming at triggering a response to the initial prompt. for instance, @xcite propose an automated method to manipulate the target llm with regeneration and gradual intensification of prompts. additionally, @xcite include a semantic-driven strategy for generating new turns and show that incorporating more complex, multiturn contextual scenarios into the safety alignment phase strengthen llm protection. both methods are restricted to the provided input task/prompt. we add a conversation starter generation component which makes mm-art more flexible and suitable to cover broader assessment over a given safety category. plus, these studies rely on large closed models with very long prompt templates and multiple regenerations per turn while our experiments are exclusively conducted with small open models significantly increasing efficiency and scalability. studies on multi-lingual llms focus on singleturn attacks, showing llms are more vulnerable when prompted in low resource languages @xcite or with codeswitching @xcite than in english. undesirable outputs are significantly reduced by instructing the llm to think in english @xcite . while there has been major progress in automated red-teaming, existing work on simultaneous multilingual and multi-turn red teaming is limited, even more so when considering conversations on unrestricted topics. mm-art is designed to bridge that gap by providing an efficient and scalable method to systematically identify safety gaps in llms. ## conclusion we present mm-art, a method for automatically conducting multi-turn and multi-lingual red teaming on black box llms. from a few conversation starters, our method automatically generates more starters and automatically conduct adversarial conversations against any target llms in a wide range of languages. we showed that multi-lingual llms are not uniformly safe across their supported languages and that machine translation can bypass model alignment. moreover, the robustness of llms with unsafe queries deteriorates with conversation depth. through our analysis, we found that translation and multi-turn attacks have compounding effect on the asr, reaching up to 195% higher than with standard english single-turn approach. in the future, we will explore various techniques for regenerating prompts upon llm refusal @xcite . we plan to reduce even more reliance on human-crafted prompts by leveraging zero-shot generation @xcite . finally, most recent models support modalities beyond text and we will expand our work to support those.