LASA: Language-Agnostic Semantic Alignment at the Semantic Bottleneck for LLM Safety

Junxiao Yang; Haoran Liu; Jinzhe Tu; Jiale Cheng; Zhexin Zhang; Shiyao Cui; Jiaqi Weng; Jialing Tao

cs.LGApr 13, 2026

LASA: Language-Agnostic Semantic Alignment at the Semantic Bottleneck for LLM Safety

Authors: Junxiao Yang, Haoran Liu, Jinzhe Tu, Jiale Cheng, Zhexin Zhang, Shiyao Cui, Jiaqi Weng, Jialing Tao,

Organizations: The Conversational AI (CoAI) group, DCST, Tsinghua University · Alibaba Group · Tsinghua University

Abstract

Large language models (LLMs) often demonstrate strong safety performance in high-resource languages, yet exhibit severe vulnerabilities when queried in low-resource languages. We attribute this gap to a mismatch between language-agnostic semantic understanding ability and language-dominant safety alignment biased toward high-resource languages. Consistent with this hypothesis, we empirically identify the semantic bottleneck in LLMs, an intermediate layer in which the geometry of model representations is governed primarily by shared semantic content rather than language identity. Building on this observation, we propose Language-Agnostic Semantic Alignment (LASA), which anchors safety alignment directly in semantic bottlenecks. Experiments show that LASA substantially improves safety across all languages: average attack success rate (ASR) drops from 24.7% to 2.8% on LLaMA-3.1-8B-Instruct and remains around 3-4% across Qwen2.5 and Qwen3 Instruct models (7B-32B). Together, our analysis and method offer a representation-level perspective on LLM safety, suggesting that safety alignment requires anchoring safety understanding not in surface text, but in the model's language-agnostic semantic space.

Figures & tables

Figure 1: Heatmap of safety score for different methods on Qwen2.5-7B-Instruct. When safety training is conducted on English (En), Chinese (Zh) and Korean (Ko) only, the safety score on Swahili (Sw) remains low (50%) across all baselines. In contrast, our LASA framework improves it to 87%.

Figure 2: Left: In the text space, representations cluster by language, causing safety training to fail on semantically equivalent expressions in unseen languages or symbols. Right: In the semantic space, semantically equivalent queries cluster closely across languages and modalities, allowing safety knowledge learned from high-resource languages to naturally transfer to low-resource languages via shared semantic structure.

Figure 3: (Left): Layer-wise Silhouette scores for clustering by language and by query on Llama-3.1-8B-Instruct. Language-based scores follow a U-shaped trajectory, whereas query-based scores exhibit an inverted U-shaped trajectory, and their gap peaks at intermediate layers which we refer to as the Semantic Bottleneck. (Right): t-SNE visualizations of hidden states across selected layers, colored by language (top) and by semantic (bottom). Queries are clustered by semantic at intermediate layers while clustered by language at earlier of later layers.

Figure 4: Framework for Language-Agnostic Semantic Alignment (LASA): Hidden states are extracted from the identified Semantic Bottleneck layer to be processed by a Safety Semantic Interpreter. The resulting safety-relevant semantic signals are then used to condition the subsequent response generation, enabling robust safety generalization across languages.

Panel of Figure 5 — Algorithm 1 Language-Agnostic Semantic Alignment (LASA)

Figure 5: Relationship between MMLU accuracy on Swahili and safety semantic understanding ability of SSI on Swahili. The saturation curve ( $R^{2}=0.988$ ) indicates that the Semantic Bottleneck’s effectiveness on safety scales with multilingual capability.

Method	MultiJail							HarmBench_translated
Method	EN	ZH	KO	TH	SW	BN	Avg	EN	ZH	KO	TH	SW	BN	Avg
Llama-3.1-8B-Instruct
Vanilla Model	13.0	13.0	37.0	17.0	46.0	39.0	21.00	11.0	16.0	48.0	27.0	58.0	65.0	28.40
SFT	1.0	2.0	2.0	2.0	38.0	16.0	7.30	0.0	2.0	6.0	4.0	45.0	29.0	9.70
DPO	1.0	4.0	8.0	3.0	19.0	15.0	6.60	2.0	7.0	19.0	7.0	29.0	24.0	10.90
KTO	1.01	1.0	1.0	1.0	19.0	9.0	3.40	0.0	1.0	3.0	2.0	25.0	15.0	5.40

Table 1: Safety Evaluation Results: Attack Success Rate (ASR%) of different methods. All results are multiplied by 100.

	M-MMLU		MT-Bench		MGSM		Average
	En	Mul.	En	Mul.	En	Mul.	En	Mul.
LLaMA-3.1-8B	65.00	48.50	87.20	66.32	7.41	5.69	53.20	40.17
w/ LASA	65.00	50.00	88.80	67.28	7.54	5.94	53.78	41.07
Qwen-2.5-7B	67.50	48.78	91.60	61.12	7.89	6.41	55.66	38.77
w/ LASA	70.00	58.28	91.20	59.40	7.80	6.21	56.33	41.30

Table 2: Comparison of general performance on English and multilingual benchmarks between base models and those aligned with LASA.

Figure 6: ASR result of LASA on LLaMA-3.1-8B-Instruct with SSI trained on different layers. Training SSI at bottleneck layer reach clearly the best safety performance.

Figure 7: ASR of LASA on Qwen2.5 and Qwen3 series. LASA stabilizes average ASR at 4% across all scales (7B–32B) on HarmBench and MultiJail. The results show that safety alignment improves with model scale, correlating with enhanced base semantic capabilities.

Llama-3-8B-Instruct
Method	EN	ZH	KO	TH	SW	BN	Avg.
Vanilla Model	12.0	14.5	42.5	22.0	52.0	52.0	24.7
LASA (KTO)	0.5	0.0	0.5	0.0	12.0	11.0	2.8
LASA (SFT)	0.5	0.5	0.0	0.0	19.0	11.5	4.0
LASA (ORPO)	0.5	0.0	0.5	0.0	18.5	6.5	2.9
Qwen-2.5-7B-Instruct

Table 3: Ablation of Stage 2 optimization methods. Lower ASR indicates better safety performance.

Model	Total Layers	Bottleneck	Relative Position
Qwen3-32B	64	42	65.6%
Qwen3-14B	40	25	62.5%
Qwen3-8B	36	21	58.3%
Qwen2.5-32B-Instruct	64	29	45.3%
Qwen2.5-14B-Instruct	48	29	60.4%
Qwen2.5-7B-Instruct	28	19	67.9%

Table 4: Relationship between model scale and the location of the Semantic Bottleneck layer.

Similarity	Vanilla	SFT	KTO	ORPO	MPO	LASA
High Similarity	29.0	4.0	7.0	3.0	10.0	3.0
Low Similarity	33.0	10.0	15.0	4.0	21.0	11.0

Table 5: Attack Success Rate (ASR %) across different methods for high and low similarity cases

Figure 8: T-SNE results on different layers of Llama-3.1-8B-Instruct.

Appendix figures & tables15 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 9: Silhouette Score analysis and t-SNE visualizations of hidden states on Qwen2.5-7B-Instruct.

Figure 10: Silhouette Score analysis and t-SNE visualizations of hidden states on Qwen2.5-14B-Instruct.

Figure 11: Silhouette Score analysis and t-SNE visualizations of hidden states on Qwen2.5-32B-Instruct.

Figure 12: Silhouette Score analysis and t-SNE visualizations of hidden states on Qwen3-8B-Instruct.

Figure 13: Relationship between MMLU accuracy on Swahili and safety semantic understanding ability on Swahili for Qwen3-8B.

Figure 14: Relationship between MMLU accuracy on Thai and safety semantic understanding ability on Thai for Qwen2.5-7B-Instruct.

Figure 15: Relationship between MMLU accuracy on Thai and safety semantic understanding ability on Thai for Qwen3-8B.

Method	AR	BN	EN	IT	JV	KO	SW	TH	VI	ZH	Avg.
Direct	95	100	100	100	100	95	80	100	100	95	96.5
Translated	95	100	100	100	95	95	75	100	100	95	95.5

Appendix

Table 6: Safety evaluation accuracy across different languages using GPT-4o directly on original-language responses and on responses translated into English via Google Translate. All results are multiplied with 100.

Figure 16: Silhouette Score analysis and t-SNE visualizations of hidden states on Llama-3.1-8B-Instruct. All data translated by NNLB.

Figure 17: Silhouette Score analysis and t-SNE visualizations of hidden states on Llama-3.1-8B-Instruct. All data translated by Google Translate.

Translation Tool	EN	ZH	KO	TH	SW	BN	AR	IT	JV	VI	Avg
Llama-3.1-8B-Instruct
GPT-4o	0.0	0.0	1.0	0.0	8.0	5.0	2.0	0.0	1.0	0.0	1.70
NLLB	1.0	0.0	1.0	0.0	5.0	4.0	2.0	0.0	1.0	0.0	1.40
Google Translate	0.0	1.0	0.0	0.0	9.0	4.0	2.0	0.0	1.0	2.0	1.90

Appendix

Table 7: Attack Success Rate (ASR%) of different translation tools on MultiJail dataset. All results are multiplied by 100.

Method	EN	ZH	KO	TH	SW	BN	AR	IT	JV	VI	Avg
Llama-3.1-8B-Instruct
Vanilla Model	11.0	16.0	48.0	27.0	58.0	65.0	21.0	16.0	12.0	10.0	28.40
SFT	0.0	2.0	6.0	4.0	45.0	29.0	5.0	2.0	3.0	1.0	9.70
DPO	2.0	8.0	23.0	8.0	32.0	32.0	10.0	10.0	6.0	5.0	13.60
KTO	0.0	1.0	3.0	2.0	25.0	15.0	3.0	1.0	3.0	1.0	5.4
ORPO	0.0	1.0	2.02	1.01	23.0	15.0	1.0	0.0	0.0	0.0	4.3

Appendix

Table 8: Attack Success Rate (ASR%) of different methods on Harmbench-translated dataset. All results are multiplied by 100.

Method	EN	ZH	KO	TH	SW	BN	AR	IT	JV	VI	Avg
Llama-3.1-8B-Instruct
Vanilla Model	13.0	13.0	37.0	17.0	46.0	39.0	11.0	11.0	9.0	14.0	21.00
SFT	1.0	2.0	2.0	2.0	38.0	16.0	4.0	0.0	4.0	4.0	7.30
DPO	4.0	4.0	13.0	2.0	29.0	16.0	9.0	6.0	6.0	4.0	9.30
KTO	1.01	1.0	1.0	1.0	19.0	9.0	0.0	0.0	1.0	1.0	3.40
ORPO	1.0	0.0	2.0	0.0	28.0	13.0	2.0	0.0	3.0	2.0	5.10

Appendix

Table 9: Attack Success Rate (ASR%) of different methods on MultiJail dataset. All results are multiplied by 100.

Figure 18: Response examples of different methods on Llama-3.1-8B-Instruct.

Figure 19: Response examples of different methods on Qwen2.5-7B-Instruct.

LLM Safety Alignment

Large language model safety alignment trains and evaluates systems to follow human policies while resisting harmful requests and misuse.

See all 344 papers

Aligning Large Language Models for Safety in African Languages: A Case Study of Hausa
Oct 27, 2026Valdini Douglace Lemofouet, Blessing Ngozi Uzor, Paula Chikaodinaka Anyanwu +4LLM Safety Alignment Language Model Safety Evaluation
African Institute for Mathematical Sciences (AIMS), Cameroon · Bayero University Kano · University of Hamburg +1
Multilingual Safety Alignment Via Sparse Weight Editing
Feb 26, 2026Jiaming Liang, Zhaoxin Wang, Handing WangLLM Safety Alignment LLM Safety
School of Artificial Intelligence, Xidian University.
When Safety Speaks a Language: A Mechanistic Analysis of Safety-Language Identity Entanglement in LLMs
Aug 30, 2026Apoorva Upadhyaya, Sandipan SikdarLLM Safety Alignment Mechanistic Interpretability
L3S Research Center, Leibniz Universität Hannover, Germany

Oct 27, 2026J/K move · Enter open · S save

Aligning Large Language Models for Safety in African Languages: A Case Study of Hausa

Valdini Douglace Lemofouet, Blessing Ngozi Uzor, Paula Chikaodinaka Anyanwu, Danielle Blanche Kapsa+3

African Institute for Mathematical Sciences (AIMS), Cameroon · Bayero University Kano · University of Hamburg+1

LLM Safety Alignment Language Model Safety Evaluation Low-Resource Language Processing Supervised Fine-Tuning Direct Preference Optimization

Open paper AskPDF arXiv

Safety alignment research for large language models (LLMs) remains concentrated on high-resource languages, leaving open how existing alignment methods perform in low-resource, culturally distinct settings. We study this question for Hausa, a language spoken by more than 200 million people across West Africa. We introduce HausaSafeLM, one of the first Hausa safety preference dataset, built from 10,000 prompts derived from PKU-SafeRLHF: 3,000 human-corrected (gold) and 7,000 machine-translated (silver) examples spanning six harm macro-categories. Using Qwen2.5-7B-Instruct, we compare supervised fine-tuning (SFT) and SFT followed by Direct Preference Optimization (DPO) under both data regimes, evaluating on 500 harmful and 200 benign Hausa prompts.We find that the untuned base model appears highly safe by refusal-rate metrics alone, but this reflects limited Hausa generation ability rather than genuine alignment: its refusals are almost uniformly low quality. SFT improves both refusal fluency and precision and benefits substantially from the larger, noisier silver-tier data, while DPO sharpens refusal precision but comes at a steep, largely data-invariant cost to linguistic quality. No single configuration jointly maximizes safety, helpfulness, and fluency. Our results suggest that current alignment techniques teach models when to refuse more readily than how to do so fluently in underrepresented languages, and that refusal-rate metrics alone are an unreliable signal of safety in low-resource settings.

Abstract

LLM Safety Alignment

Explore similar work

Aligning Large Language Models for Safety in African Languages: A Case Study of Hausa

Multilingual Safety Alignment Via Sparse Weight Editing

When Safety Speaks a Language: A Mechanistic Analysis of Safety-Language Identity Entanglement in LLMs