Multilingual Collaborative Defense for Large Language Models (2025)

Abstract: The robustness and security of Large Language Models (LLMs) face increasing threats, especially in multilingual settings. A notable vulnerability is “jailbreaking” via translating harmful queries into rare or underrepresented languages, which often bypasses existing safeguards. In this work, we propose Multilingual Collaborative Defense (MCD), a novel learning method that optimizes a continuous soft safety prompt automatically to facilitate multilingual safeguarding of LLMs. MCD organically leverages collaborative signals from multiple languages by rotating each as the training “center,” allowing auxiliary languages to reinforce safety prompt learning and ensuring cross‐lingual consistency. As a result, MCD improves defense performance across all languages, reduces false refusals, and mitigates safety misalignment caused by corpus imbalance. To evaluate MCD, we construct multilingual versions of jailbreak benchmarks such as MaliciousInstruct and AdvBench, including zero-shot languages, to assess language transferability. Experiments show that MCD outperforms prior approaches in multilingual jailbreak defense while exhibiting strong cross-lingual generalization. Our code is available at https://github.com/HLiang-Lee/MCD.

## introduction as large language models (llms) continue to advance rapidly, concerns surrounding their misuse through jailbreaking techniques have grown increasingly prominent @xcite @xcite @xcite @xcite . extensive research has been conducted on llm safety, yet safeguarding capabilities in multilingual contexts remain relatively underexplored @xcite @xcite . meanwhile, as † kaiyu huang is the corresponding author. shown in figure 1 , multilingual jailbreak occurs when users craft queries in languages for which a model's safety mechanisms are less robust, intentionally or inadvertently triggering harmful outputs. the emergence of multilingual jailbreak methods has highlighted the need to improve multilingual safeguard mechanisms for llm @xcite @xcite . existing studies have demonstrated that while llms can often recognize harmful queries, they frequently fail to refuse them @xcite . safety prompts play a pivotal role in increasing the likelihood of refusal in such cases @xcite @xcite . however, llms exhibit two significant limitations across multiple languages: (1) poor safeguarding performance for non-english inputs. as shown in to address challenges in multilingual safety, we propose multilingual collaborative defense (mcd), a novel approach for optimizing multilingual safety prompts. mcd leverages multilingual representations to improve the safeguarding capabilities of llms against harmful queries. its core is a training paradigm that designates one language as "the central language" and uses other languages as "assistant languages", combined with multi-module optimization goals, to mitigate cross-lingual disparities and enhance multilingual refusal robustness, which existing approaches often overlook. we apply mcd to optimize safety prompts and evaluate it on two datasets, advbench and mali-ciousinstruct, extended to five languages @xcite . to test mcd's transferability, we also evaluate it on multijail in two untrained languages. alpacaeval results show that mcd improves safety without compromising general llm performance, addressing a key gap in multilingual red teaming and enhancing llm robustness across languages. through extensive experiments, mcd offers three advantages: multilingual jailbreak defense. recent studies @xcite @xcite @xcite have demonstrated the impressive multilingual capabilities of llms in natural language processing. however, the majority of previous research @xcite @xcite on llm security has focused on jailbreaking, with relatively limited exploration of defense strategies in multilingual contexts. multilingual @xcite introduces the multijail dataset, a multilingual jailbreak benchmark, and proposes self-defense, a method that leverages a combination of english and other languages to finetune llms. multilingual blending @xcite presents a novel workflow that automatically converts a single-language query into a mixedlanguage query. some researchers @xcite show that safety preference tuning with dpo to detoxify llms can generalize across languages in a zero-shot manner. in contrast, our work can serve as a catalyst for future research on multilingual llms, highlighting the need for more creative and effective defense mechanisms. ## conclusion in this work, we observe that llms exhibit weaker defense performance against multilingual jailbreak attacks, especially for non-english language inputs compared to english. given the high cost of retraining llms and the non-continuous nature of the natural language representation space, we adopt a prompt-driven approach and propose a multilingual defense training method, mcd. under this method, different language representations of the same input share a unified space. mcd leverages cross-lingual collaboration to train safety prompts, resulting in a unified multilingual representation. our experiments show that mcd significantly improves llm performance in defending against non-english jailbreak attacks, without causing substantial degradation in general model performance. moreover, mcd demonstrates some degree of language transferability, achieving promising results on non-english languages even without direct training on them. we hope that our work can enhance the defense capabilities of llms in multilingual attack scenarios and contribute to future research in the field of llm safety.