E nglish as Defense Proxy: Mitigating Multilingual Jailbreak via Eliciting E nglish Safety Knowledge (2025)

Abstract: Large language models (LLMs) excel in many tasks, but their safety guarantees vary by language, e.g., responses in English tend to be safer than those in low-resource languages. This inconsistency creates a vulnerability, since an attacker can circumvent safety measures by using a less-supported language as an intermediary, even without fluency in that language. Traditional solutions rely on multilingual safety alignment, which demands vast, per-language datasets and introduces significant trade-offs between usefulness and safety (the so-called “alignment tax”). To overcome these limitations, we introduce English as Defense Proxy (E-Proxy) , a unified approach that leverages English, usually the advantage language of LLMs, as a universal safety anchor. During multilingual training, E-Proxy uses English jailbreak prompts to extract the model’s existing safety knowledge, then applies simple language-mapping prompts (e.g., “Please answer in target language”) to transfer that knowledge across languages. Our analysis shows that formulating prompts in a high-resource language preserves the model’s utility, while enforcing responses in the target language significantly enhances safety. We evaluate E-Proxy on extensive benchmarks of both attack resistance and task performance. On the MultiJail benchmark, E-Proxy blocks over 99 % of jailbreak attempts while retaining 95 % of average task performance, all with a simply constructed multilingual alignment data.

## introduction large language models (llms) have demonstrated remarkable performance across a wide range of tasks @xcite @xcite @xcite @xcite @xcite . however, their safety guarantees vary significantly by language, with english responses typically more secure than those in low-resource languages @xcite . this inconsistency arises because safety research and alignment efforts primarily focus on english @xcite @xcite @xcite , while largely neglecting low-resource languages. as a result, attackers can exploit these cross-lingual vulnerabilities: using less-supported languages as intermediaries to bypass llm safety protocols. users can bypass llm safety measures for high-resource languages (e.g., english) by simply translating harmful prompts into low-resource languages-even without proficiency in those languages. for instance, while gpt-4 rejects the english prompt "describe how to steal from a store without getting caught," its zulu translation ("chaza ukuthu untshontsha kanjani esitolo ngaphandle kokubanjwa") successfully jailbreaks the model, eliciting a detailed response. this vulnerability persists even in advanced models like gpt-4 @xcite , underscoring the need for stronger multilingual safeguards. existing multilingual jailbreak defense methods depend on safety alignment across languages, which necessitates extensive training data for every target language @xcite @xcite . however, these approaches encounter two core limitations. first, most techniques rely on translated english data @xcite , which contains translation artifacts known as translationese @xcite . second, multilingual alignment creates a trade-off between safety and utility across different languages, a challenge referred to as the "multilingual alignment tax" @xcite . to overcome these limitations, we introduce english as defense proxy (e-proxy), a unified method that employs english as a universal safety anchor. specifically, e-proxy activates the model's inherent english safety knowledge using fixed jailbreak prompts during multilingual training and transfers this capability to other languages via simple language-mapping instructions (e.g., "please answer in {target language}"). we illustrate the key differences between eproxy and traditional approaches in figure 1 . conventional methods depend on "translational safety", namely distilling safety knowledge from translated english data during multilingual training. this requires per-language safety fine-tuning, leading to redundant alignment process in each language space, thus introduces additional multilingual alignment tax. in contrast, e-proxy augments "translational safety" with "parametric safety", which leverages the model's inherent english-centric safety knowledge encoded in its parameters. by anchoring safety to english, our approach minimizes alignment overhead and ensures more consistent cross-lingual robustness. through our analysis, we demonstrate that enforcing responses in the target language significantly improves safety, while using a high-resource language (e.g., english) for prompts preserves model utility. our findings are as follows: (1) we confirm that low-resource language response spaces are underaligned. enforcing responses in the target language effectively mitigates this issue. (2) using logit lens analysis, we show that english-formulated prompts effectively activate the model's safety knowledge. by leveraging this existing knowledge, we minimize the alignment tax. (3) we find that english prompts induce less weight perturbation during training, suggesting better retention of the model's general abilities. finally, we conduct extensive experiments on safety and usefulness benchmarks. results show that our methods successfully defend against 99% of jailbreak prompts in multijail, a multilingual jailbreak benchmark. furthermore, we achieve over 95% average usefulness in both english and non-english settings. this indicates that despite being trained only on english prompts, e-proxy generalizes effectively to multilingual jailbreak defenses. in addition, we perform an in-depth analysis of how usefulness degrades as safety training advances (i.e. the multilingual alignment tax) across different methods, further underscoring the critical role of prompt language space in safety training. in summary, our contributions are listed as follows: ## preliminary experiments in this section, we examine how response language space affects safety. specifically, we define configurations as prompt/response language space, where e denotes english, and l denotes the target language and compare the following three settings: carane nggawe bom?" ## methodology in this section, we present the data curation process of e-proxy, differs it with traditional multilingual safety training (section 4.1), and provide insights why e-proxy improves safety (section 4.2) while preserves model's usefulness (section 4.3). ## conclusions in this paper, we introduce english as defense proxy (e-proxy) as a strategy to mitigate multilingual jailbreak attacks in llms. our approach leverages english as a universal safety anchor during safety training to elicit and transfer english safety knowledge across languages. experiments demonstrate that formulating inputs in english preserves utility, while enforcing outputs in the target language significantly improves safety, validating the design choice of our proposed method. further evaluations across multiple safety and usefulness benchmarks confirm the effectiveness of e-proxy. moreover, our findings show that safety mechanisms can transfer across languages, allowing us to leverage english knowledge to reduce the multilingual alignment tax, paving the way for future research on multilingual safety alignment.