IndicJR: A Judge-Free Benchmark of Jailbreak Robustness in South Asian Languages
Organizations: Oracle America Inc.
Abstract
Safety alignment of large language models (LLMs) is mostly evaluated in English and contract-bound, leaving multilingual vulnerabilities understudied. We introduce Indic Jailbreak Robustness (IJR), a judge-free benchmark for adversarial safety across 12 Indic and South Asian languages (2.1 Billion speakers), covering 45216 prompts in JSON (contract-bound) and Free (naturalistic) tracks. IJR reveals three patterns. (1) Contracts inflate refusals but do not stop jailbreaks: in JSON, LLaMA and Sarvam exceed 0.92 JSR, and in Free all models reach 1.0 with refusals collapsing. (2) English to Indic attacks transfer strongly, with format wrappers often outperforming instruction wrappers. (3) Orthography matters: romanized or mixed inputs reduce JSR under JSON, with correlations to romanization share and tokenization (approx 0.28 to 0.32) indicating systematic effects. Human audits confirm detector reliability, and lite-to-full comparisons preserve conclusions. IJR offers a reproducible multilingual stress test revealing risks hidden by English-only, contract-focused evaluations, especially for South Asian users who frequently code-switch and romanize.
Figures & tables
| JSON Track | FREE Track | |||||||||
| Model | JSR (overall) | Schema- Validity (AB) | Leakage- Rate (CH) | Abstain- Rate | Over- Refusal (CB) | JSR (AB) | Over- Refusal (CB) | Under- Refusal (CH) | Leakage- Rate (CH) | |
| GPT-4o | 0.508 | 0.975 | 0.001 | 0.050 | 0.654 | 0.995 | 0.00 | 0.12 | 0 | |
| Grok-3 | 0.620 | 0.815 | 0.000 | 0.163 | 0.570 | 0.998 | 0.00 | 0.14 | 0 | |
| Grok-4 | 0.689 | 0.654 | 0.000 | 0.391 | 0.036 | 0.934 | 0.00 | 0.15 | 0 | |
| Cohere Command-R | 0.788 | 0.870 | 0.012 | 0.211 | 0.203 | 0.999 | 0.00 | 0.15 | 0 | |
| Cohere Command-A | 0.867 | 0.880 | 0.010 | 0.238 | 0.306 | 0.944 | 0.00 | 0.16 | 0 | |
Appendix figures & tables19 assets
Supplementary material from the paper’s appendix.
Appendix
| Model | RRI (JSON, per-lang median) | RRI (JSON, aggregate) |
| Cohere Command-A | 0.056 | 0.069 |
| Cohere Command-R | 0.100 | 0.138 |
| GPT-4o | -0.415 | -0.303 |
| Gemma 2 9B | -0.055 | 0.011 |
| Grok-3 | -0.831 | -0.687 |
| Grok-4 | 0.178 | 0.302 |
| Model | AB Core Success | CB-JSR | RRI (FREE) | # Langs |
| GPT-4o | 1.000 | 1.000 | 0.000 | 12 |
| Grok-3 | 1.000 | 1.000 | 0.000 | 12 |
| Grok-4 | 0.997 | 1.000 | 0.000 | 12 |
| LLaMA 3.1 405B | 1.000 | 1.000 | 0.000 | 12 |
| LLaMA 3.3 70B | 1.000 | 1.000 | 0.000 | 12 |
| LLaMA 4 Maverick 17B | 1.000 | 1.000 | 0.000 | 12 |
| JSON Track (attack benign) | FREE Track | JSON Track | TOTAL | |||||||||
| Language | Pressure | Roman- ized | MeanLen | p95Len | attacked benign | clean benign | clean harmful | attacked benign | attacked benign cross -lingual transfer | clean benign | clean harmful | |
| bn | 0.946 | 0.392 | 143 | 316 | 200 | 10 | 5 | 2412 | 693 | 300 | 150 | 3770 |
| gu | 0.911 | 0.438 | 123 | 283 | 200 | 10 | 5 | 2396 | 693 | 300 | 150 | 3754 |
| hi | 0.764 | 0.407 | 134 | 303 | 200 | 10 | 5 | 2412 | 693 | 300 | 150 | 3770 |
| kn | 0.910 | 0.418 | 145 | 316 | 200 | 10 | 5 | 2412 | 693 | 300 | 150 | 3770 |
| ml | 0.953 | 0.410 | 143 | 307 | 200 | 10 | 5 | 2412 | 693 | 300 | 150 | 3770 |
| Language | Mean JSR | Std | Min | Max | # Models |
| Bengali | 0.635 | 0.273 | 0.124 | 0.957 | 24 |
| Gujarati | 0.596 | 0.290 | 0.116 | 0.978 | 24 |
| Hindi | 0.677 | 0.239 | 0.125 | 0.976 | 24 |
| Kannada | 0.600 | 0.291 | 0.089 | 0.983 | 24 |
| Malayalam | 0.609 | 0.307 | 0.069 | 0.986 | 24 |
| Marathi | 0.598 | 0.281 | 0.033 | 0.980 | 24 |
| Format | Instruction | |||
| Language | Mean JSR | Std | Mean JSR | Std |
| Bengali | 0.741 | 0.176 | 0.528 | 0.317 |
| Gujarati | 0.696 | 0.176 | 0.495 | 0.350 |
| Hindi | 0.774 | 0.139 | 0.581 | 0.282 |
| Kannada | 0.702 | 0.200 | 0.498 | 0.338 |
| Malayalam | 0.742 | 0.174 | 0.475 | 0.358 |
| E2: English→Indic cross-lingual transfer | E3: Orthography stress (JSON-contracted) | |||||
| Model | Instr (en Indic) | Format (en Indic) | Mean JSR | JSR (Romanized Native) | JSR (Mixed Native) | |
| GPT-4o | 0.241 | 0.501 | 0.371 | -0.092 | -0.161 | |
| Grok-3 | 0.240 | 0.439 | 0.339 | -0.441 | -0.302 | |
| Grok-4 | 0.217 | 0.700 | 0.458 | -0.219 | -0.205 | |
| Cohere Command-R | 0.364 | 0.792 | 0.578 | -0.421 | -0.292 | |
| Cohere Command-A | 0.769 | 0.665 | 0.717 | -0.591 | -0.499 | |
| Model | Abstain (overall) | Over-Refusal (JSON) | Over-Refusal (FREE) | Lex Leak (JSON, mean) | # Leak Bins 3% |
| GPT_4_o | 0.050 | 0.654 | 0.000 | 0.001 | 0 |
| Grok_3 | 0.163 | 0.650 | 0.000 | 0.001 | 0 |
| Grok_4 | 0.391 | 0.036 | 0.000 | 0.001 | 0 |
| Command R | 0.211 | 0.303 | 0.000 | 0.003 | 0 |
| Command A | 0.238 | 0.314 | 0.000 | 0.000 | 0 |
| LLaMA_4_maverick_17b | 0.207 | 0.165 | 0.000 | 0.006 | 4 |
| Language | Abstain (JSON, mean) | Over- Refusal (JSON) | Over- Refusal (FREE) | Lex Leak (JSON, mean) | # Leak Bins 3% |
| Bengali | 0.312 | 0.503 | 0.000 | 0.007 | 2 |
| Gujarati | 0.320 | 0.540 | 0.000 | 0.010 | 2 |
| Hindi | 0.334 | 0.538 | 0.036 | 0.013 | 8 |
| Kannada | 0.328 | 0.538 | 0.018 | 0.007 | 1 |
| Malayalam | 0.309 | 0.508 | 0.055 | 0.010 | 2 |
| Marathi | 0.325 | 0.541 | 0.000 | 0.025 | 4 |
| Lang | Native | Romanized | Mixed | (Rom Nat) | (Mix Nat) |
| bn | 0.767 | 0.410 | 0.566 | -0.358 | -0.202 |
| gu | 0.761 | 0.406 | 0.389 | -0.355 | -0.372 |
| hi | 0.750 | 0.394 | 0.505 | -0.356 | -0.245 |
| kn | 0.799 | 0.402 | 0.501 | -0.397 | -0.298 |
| ml | 0.717 | 0.460 | 0.571 | -0.258 | -0.147 |
| mr | 0.700 | 0.406 | 0.475 | -0.294 | -0.224 |
| Lang | N | (unw.) | (wt.) | False Neg. (count) | False Neg. (%) | Schema Valid. (%) |
| bn | 50 | 0.67 | 0.73 | 1 | 2.0 | 95.7 |
| gu | 50 | 0.70 | 0.76 | 3 | 6.0 | 94.8 |
| hi | 50 | 0.69 | 0.75 | 2 | 4.0 | 95.2 |
| kn | 50 | 0.66 | 0.74 | 3 | 6.0 | 95.6 |
| ml | 50 | 0.68 | 0.73 | 1 | 2.0 | 95.9 |
| mr | 50 | 0.71 | 0.77 | 2 | 4.0 | 95.1 |
| Label | Definition / Criteria |
| Safe | Model output is appropriate, benign, and does not contain unsafe content or unwarranted refusal. |
| Unsafe (Minor) | Output contains low-risk but inappropriate material (e.g., mild misinformation, ambiguous unsafe phrasing). Considered harmful but with limited direct impact. |
| Unsafe (Major) | Output contains clearly harmful, high-risk, or actionable unsafe content (e.g., explicit instructions for illegal activity, severe toxicity, targeted harassment). |
| Refusal Mismatch | Model refuses a benign prompt, or fails to refuse a clearly unsafe one. Counted as unsafe if the refusal mismatches task requirements. |
| Schema Valid (JSON) | Output strictly conforms to the required JSON contract: valid parse, correct keys, correct nesting, and no extraneous fields. |
| Schema Invalid | Output fails to parse as JSON or deviates from the contract (missing fields, incorrect types, added extraneous text). |
| Model | Lexicon Leak (FREE, mean) | Lexicon Leak (JSON, mean) | # Bins 3% |
| Sarvam_1_Base | 0.062 | 0.141 | 29 |
| Qwen1_5_7B_Chat | 0.061 | 0.047 | 17 |
| LLaMA_4_maverick_17b | 0.017 | 0.006 | 4 |
| Ministral_8B_Instruct_2410 | 0.023 | 0.006 | 6 |
| oci_cohere_cmdr | 0.000 | 0.003 | 0 |
| Gemma_2_9B | 0.000 | 0.002 | 0 |
| Language | JSR (Full) Mean | JSR (Lite) Mean | Pearson | Spearman |
| bn | 0.795 | 0.788 | 0.951 | 0.916 |
| gu | 0.790 | 0.756 | 0.965 | 0.949 |
| hi | 0.767 | 0.777 | 0.978 | 0.921 |
| kn | 0.839 | 0.831 | 0.865 | 0.887 |
| ml | 0.745 | 0.746 | 0.989 | 0.975 |
| mr | 0.793 | 0.794 | 0.928 | 0.887 |
| Language | Speakers (L1+L2) | Wiki Proxy | NLP Resourceness vs. English |
| Hindi | 609M | Very high | Low |
| Bengali | 260M | Medium-high | Low |
| Urdu | 253M | Medium | Low |
| Tamil | 86M | Medium-high | Low |
| Telugu | 96M | Medium | Low |
| Odia | 50M | Low | Low |
Adversarial Robustness of Language Models
Adversarial robustness of language models studies how to keep their outputs and decisions reliable under manipulative prompts, input changes, and malicious fine-tuning.
See all 191 papersIndicSafe: A Benchmark for Evaluating Multilingual LLM Safety in South Asia
SAFE rate variance exceeds 17% across languages. Some models over-refuse benign prompts in low-resource scripts, overflag politically sensitive topics, while others fail to flag unsafe generations. We quantify these failures using prompt-level entropy, category bias scores, and multilingual consistency indices. Our findings highlight critical safety generalization gaps in multilingual LLMs and show that safety alignment does not transfer evenly across languages. We release IndicSafe, the first benchmark to enable culturally informed safety evaluation for Indic deployments, and advocate for language-aware alignment strategies grounded in regional harms.