MULBERE : Multilingual Jailbreak Robustness Using Targeted Latent Adversarial Training (2025)

Abstract: Jailbreaking, the phenomenon where specific prompts cause LLMs to assist with harmful requests, remains a critical challenge in NLP, particularly in non-English and lower-resourced languages. To address this, we introduce MULBERE, a method that extends the method of Targeted Latent Adversarial Training (T-LAT) to a multilingual context. We first create and share a multilingual jailbreak dataset spanning high-, medium-, and low-resource languages, and then fine-tune LLaMA-2-7b-chat with interleaved T-LAT for jailbreak robustness and chat examples for model performance. Our evaluations show that MULBERE reduces average multilingual jailbreak success rates by 75% compared to the base LLaMA safety training and 71% compared to English-only T-LAT while maintaining or improving standard LLM performance.

## introduction large language models (llms) have become widely adopted across domains such as personal use, public health, and education @xcite @xcite . however, they remain vulnerable to jailbreaking-prompting them to produce harmful outputs despite safety constraints, such as instructions for making a bomb @xcite . recent work shows that this vulnerability is amplified in non-english and low-resource languages-languages underrepresented in llm training data @xcite @xcite . yet, defenses in this space remain underexplored. in this work, we introduce mul-bere (multilingual jaibreak robustness using targeted latent adversarial training), a multilingual defense method based on targeted latent adversarial training (t-lat) @xcite and supervised finetuning (sft). we evaluate mulbere across nine languages-english, korean, swahili, amharic, arabic, mandarin, greek, vietnamese, and spanish-and find it reduces jailbreak success rates by around 75% while preserving model reasoning ability. to support future research, we also release new multilingual datasets, including translated jailbreak prompts, harmful/harmless completions, and a multilingual harmbench variant. these contributions begin to chart towards safer llms across diverse languages. we make our multilingual datasets, finetuned models, and code available at https://github.com/anastasia21112/multilinguallatent-adversarial-training/tree/main . ## background and related work work in jailbreak robustness has largely centered around classic adversarial training -where models are fine-tuned with a set of example jailbreaks. however, this often overfits to the example of jailbreaks it has seen training examples and cannot protect against unseen jailbreaks. additionally, safety often trades off with model performance and is easily reversed with additional fine-tuning @xcite @xcite . a few recent works have applied these techniques to lower-resourced languages @xcite . however, both of these works are vulnerable to the core issues of finetuning as a safety mechanism: both papers found degradation of model performance with increased jailbreak safety, and the methods do not generalize well to other languages or jailbreaks @xcite . another direction in jailbreak robustness work is in latent adversarial training -which injects perturbations into hidden activations, rather than the input embeddings -can improve robustness to unforeseen failures @xcite . targeted latent adversarial training (t-lat) simultaneously optimizes pertubations to elicit harmful responses as the model is trained under these perturbations to prefer harmless refusals. @xcite used t-lat to defend against english-only jailbreaks, where it outperformed state-of-the-art methods. we extend that work to operate on multilingual jailbreaks by creating new multilingual datasets and introducing a new process pipeline and evaluate its effectiveness.