Multilingual Safety Alignment Via Sparse Weight Editing

Jiaming Liang; Zhaoxin Wang; Handing Wang

cs.LGFeb 26, 2026

Multilingual Safety Alignment Via Sparse Weight Editing

Authors: Jiaming Liang, Zhaoxin Wang, Handing Wang

Organizations: School of Artificial Intelligence, Xidian University.

Abstract

Large Language Models (LLMs) exhibit significant safety disparities across languages, with low-resource languages (LRLs) often bypassing safety guardrails established for high-resource languages (HRLs) like English. Existing solutions, such as multilingual supervised fine-tuning (SFT) or Reinforcement Learning from Human Feedback (RLHF), are computationally expensive and dependent on scarce multilingual safety data. In this work, we propose a novel, training-free alignment framework based on Sparse Weight Editing. Identifying that safety capabilities are localized within a sparse set of safety neurons, we formulate the cross-lingual alignment problem as a constrained linear transformation. We derive a closed-form solution to optimally map the harmful representations of LRLs to the robust safety subspaces of HRLs, while preserving general utility via a null-space projection constraint. Extensive experiments across 8 languages and multiple model families (Llama-3, Qwen-2.5) demonstrate that our method substantially reduces Attack Success Rate (ASR) in LRLs with negligible impact on general reasoning capabilities, all achieved with a single, data-efficient calculation.

Figures & tables

Figure 1: Impact of English Safety Neuron Amplification. Scaling the activations of English safety neurons leads to a consistent decrease in harmful response rates across multiple languages, validating the cross-lingual influence of these neurons.

Figure 2: Pairwise safety-neuron set overlap across languages. Higher values indicate greater overlap under this set-based measure. HRLs tend to exhibit stronger overlap, whereas LRLs show weaker overlap both with HRLs and with each other.

Models	Method	Safety							Utility
		ASR $\downarrow$ (#unsafe / 313)							MGSM $\uparrow$	M-MMLU $\uparrow$
		En	Zh	Vi	Ja	Bn	He	$\Delta_{Avg}$	MGSM $\uparrow$	M-MMLU $\uparrow$
Llama-3.2-1B	None	6/313	61/313	31/313	149/313	179/313	109/313	-	18.58	26.54
	Our	0/313 -6	27/313 -34	4/313 -27	81/313 -68	144/313 -35	115/313 +6	-27.33	18.36	27.22
	MPO	0/313 -6	22/313 -39	9/313 -22	78/313 -71	152/313 -27	135/313 +26	-23.15	19.64	25.96
	MPO+Our	0/313 -6	22/313 -39	0/313 -31	66/313 -83	96/313 -83	109/313 -0	-40.33	19.45	26.58

Table 1: Zero-shot multilingual safety and utility evaluation. Safety is reported as the number of unsafe responses flagged by Qwen3Guard-Gen-8B out of 313 prompts (lower is better). Superscripts denote the change in unsafe-response counts compared to None for the same backbone ( negative indicates improvement; positive indicates regression).

\Delta_{Avg}

denotes the average change across the reported languages. Utility is measured by MGSM and M-MMLU accuracy (higher is better).

Method	ASR $\downarrow$	MGSM $\uparrow$	M-MMLU $\uparrow$
None	28.27	18.58	26.54
Other	14.93	17.71	27.14
MPO	19.52	19.64	25.96
MPO + Other	12.53	19.53	26.54

Table 2: Ablation on safety neuron identification. We replace our safety-neuron extraction with the probe-based selection used in NeuroStrike (denoted as Other ), while keeping the remaining alignment pipeline unchanged. We report safety (ASR; lower is better) and utility (MGSM, M-MMLU; higher is better).

Choice $\downarrow$ / Models $\to$	Llama-3.2-1B
UtilityAnchor	$\checkmark$	$\checkmark$
Regular	$\checkmark$		$\checkmark$
ASR $\downarrow$	17.53	68.57	17.25
MGSM $\uparrow$	18.36	0.11	11.02
M-MMLU $\uparrow$	27.22	24.21	26.02

Table 3: Anchor choice ablation on Llama-3.2-1B . We vary whether the alignment uses UtilityAnchor and/or Regular and report safety (ASR; lower is better) and utility (MGSM, M-MMLU; higher is better).

Rank $r$	ASR $\downarrow$ (%)	MGSM $\uparrow$ (%)	M-MMLU $\uparrow$ (%)
4	15.42	18.33	27.19
8	15.54	17.96	27.19
16	15.34	18.18	27.18
32	17.53	18.36	27.22
64	14.90	18.29	27.22
128	14.98	18.11	27.19

Table 4: Effect of rank

r

on safety and utility. Results are reported on Llama-3.2-1B . Performance remains stable across a wide range of ranks, indicating low sensitivity to the rank choice.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Subset	Source datasets	Description
Harmful ( $\mathcal{D}_{harm}$ )	HarmfulQA, CatHarmfulQA, LLM-LAT	Queries spanning diverse malicious and unsafe intents
Harmless ( $\mathcal{D}_{safe}$ )	NaturalReasoning	Benign queries used as control samples

Appendix

Table 5: Composition of the English seed set prior to translation.

Models	Method	Safety
		ASR $\downarrow$ (#unsafe / 313)
		En	Zh	Vi	Ja	Th	Id	Bn	He	$\Delta_{Avg}$
Llama-3.2-1B	None	6/313	61/313	31/313	149/313	69/313	104/313	179/313	109/313	-
	Our	0/313 -6	27/313 -34	4/313 -27	81/313 -68	30/313 -39	38/313 -66	144/313 -35	115/313 +6	-33.625
	MPO	0/313 -6	22/313 -39	9/313 -22	78/313 -71	23/313 -46	70/313 -34	152/313 -27	135/313 +26	-23.15
	MPO+Our	0/313 -6	22/313 -39	0/313 -31	66/313 -83	10/313 -59	22/313 -82	96/313 -83	109/313 -0	-47.875

Appendix

Table 6: Complete zero-shot multilingual safety evaluation on Multi-StrongREJECT . We report the number of unsafe responses flagged by Qwen3Guard-Gen-8B out of 313 prompts for each language (lower is better). Superscripts denote the change in unsafe-response counts relative to None for the same backbone ( negative indicates improvement; positive indicates regression).

\Delta_{Avg}

denotes the average change in unsafe-response counts across all reported languages (En, Zh, Vi, Ja, Th, Id, Bn, He).

LLM Safety Alignment

Large language model safety alignment trains and evaluates systems to follow human policies while resisting harmful requests and misuse.

See all 341 papers

Align Once, Benefit Multilingually: Enforcing Multilingual Consistency for LLM Safety Alignment
Feb 18, 2026Yuyan Bu, Xiaohao Liu, ZhaoXing Ren +2LLM Safety Alignment Cross-Lingual Consistency in Language Models
Beijing Academy of Artificial Intelligence · National University of Singapore · Institute for Artificial Intelligence, Peking University
Multilingual Safety Alignment via Self-Distillation
May 3, 2026Ruiyang Qin, Qingzhuo Wang, Dongrui Liu +3Multilingual Language Models LLM Safety Alignment
Tongji University · Shanghai AI Laboratory
Safety Kernel: Mechanistic Alignment for Cross-Lingual Defense in LLMs
Oct 17, 2026Chengyu Xie, Fei Shen, Shuyi Miao +5LLM Safety Language Model Robustness
School of Computer Science and Engineering, Nanjing University of Science and Technology, Nanjing, China · Nanjing University of Science and Technology, Nanjing, China · School of Artificial Intelligence, Beihang University, Beijing, China +3

Feb 18, 2026J/K move · Enter open · S save

Align Once, Benefit Multilingually: Enforcing Multilingual Consistency for LLM Safety Alignment

Yuyan Bu, Xiaohao Liu, ZhaoXing Ren, Yaodong Yang+1

Beijing Academy of Artificial Intelligence · National University of Singapore · Institute for Artificial Intelligence, Peking University

LLM Safety Alignment Cross-Lingual Consistency in Language Models Cross-Lingual Representation Alignment

Open paper AskPDF arXiv

The widespread deployment of large language models (LLMs) across linguistic communities necessitates reliable multilingual safety alignment. However, recent efforts to extend alignment to other languages often require substantial resources, either through large-scale, high-quality supervision in the target language or through pairwise alignment with high-resource languages, which limits scalability. In this work, we propose a resource-efficient method for improving multilingual safety alignment. We introduce a plug-and-play Multi-Lingual Consistency (MLC) loss that can be integrated into existing monolingual alignment pipelines. By improving collinearity between multilingual representation vectors, our method encourages directional consistency at the multilingual semantic level in a single update. This allows simultaneous alignment across multiple languages using only multilingual prompt variants without requiring additional response-level supervision in low-resource languages. We validate the proposed method across different model architectures and alignment paradigms, and demonstrate its effectiveness in enhancing multilingual safety with limited impact on general model utility. Further evaluation across languages and tasks indicates improved cross-lingual generalization, suggesting the proposed approach as a practical solution for multilingual consistency alignment under limited supervision.

Abstract

LLM Safety Alignment

Explore similar work

Align Once, Benefit Multilingually: Enforcing Multilingual Consistency for LLM Safety Alignment

Multilingual Safety Alignment via Self-Distillation

Safety Kernel: Mechanistic Alignment for Cross-Lingual Defense in LLMs