Multilingual Safety Signals Are Multi-Layered: Filtering Safety-Degrading Data for Safer LLMs

Jiakun Li; Guowei Song; Sijia Li; Xingwei He; Hongzheng Chai; Yuan Yuan

cs.CLAug 26, 2026

Multilingual Safety Signals Are Multi-Layered: Filtering Safety-Degrading Data for Safer LLMs

Authors: Jiakun Li, Guowei Song, Sijia Li, Xingwei He, Hongzheng Chai, Yuan Yuan

Organizations: School of Computer Science and Engineering, Beihang University · Zhongguancun Laboratory · Hangzhou Innovation Institute, Beihang University · Qingdao Research Institute, Beihang University

Abstract

Preserving safety alignment during large language models fine-tuning is critical, however, recent studies have demonstrated that even benign fine-tuning data may contain safety-degrading samples that silently undermine safety alignment. Existing approaches typically identify such samples using representations from a single safety-sensitive layer. While this assumption has shown effectiveness in monolingual settings, its validity for multilingual models remains unclear due to potential cross-lingual differences in representation patterns. Through a cross-lingual analysis, we show that sensitive layers are only partially shared across languages, with safety-relevant signals often distributed across multiple layers. Motivated by these observations, we propose MMSAFE, a multi-layer framework for multilingual safety-degrading data identification that captures both shared and language-specific safety signals. Extensive experiments across multiple models, languages, and safety benchmarks demonstrate that MMSAFE reduces the average harmful-response ratio by 60% compared with random filtering and achieves stronger average performance than the strongest single-layer baseline, demonstrating the effectiveness of multi-layer modeling for robust multilingual safety alignment.

Figures & tables

Figure 1: Cross-lingual layer sensitivity of LLaMA3.1-8B-Instruct across 18 languages. Each row is normalized within a language, and darker orange indicates higher sensitivity. The heatmap reveals a mixed pattern: some layers are consistently salient across languages, while others form language- or language-group-specific sensitivity peaks.

Layer	Main focus	Representative concepts
3	Lexical / local semantic cues	Spoofing; lying; spying
7	Concrete harmful scenarios	Hoaxes; crimes; dangerous activities; bomb/gun making
11	Harmful intent and deception	Fraud; illicit requests; dangerous instructions; hiding evidence
15	Broad safety-policy violations	Illegal activities; abuse/hate; evasion; conspiracy theories

Table 1: Representative SAE-interpreted features activated by HarmBench harmful queries on LLaMA3.1-8B-Instruct.

Figure 2: Relative sensitivity of the top-3 sensitive layers across models. Sensitivity is normalized by the most sensitive layer within each model.

Figure 3: Overview of MMSafe . The framework first discovers language-shared and language-specific sensitive layers through multilingual layer perturbation, and then uses safe-unsafe contrastive representations from these layers to score and filter safety-degrading samples.

Method	Aya Dataset						Nemotron-SG						Avg.
	LinguaSafe		XSafety		MultiJail		LinguaSafe		XSafety		MultiJail
	#Harm $\downarrow$	H/R $\downarrow$	#Harm $\downarrow$	H/R $\downarrow$	#Harm $\downarrow$	H/R $\downarrow$	#Harm $\downarrow$	H/R $\downarrow$	#Harm $\downarrow$	H/R $\downarrow$	#Harm $\downarrow$	H/R $\downarrow$	H/R
LLaMA3-8B-Instruct
Random	4,901	100.0%	1,810	100.0%	719	100.0%	2,148	100.0%	548	100.0%	794	100.0%	100.0%
SEAL	2,786	56.8%	1,192	65.9%	240	33.4%	4,134	192.5%	1,363	248.7%	324	40.8%	106.4%
Bi-Anchor	3,179	64.9%	1,378	76.1%	521	72.5%	3,185	148.3%	391	71.4%	439	55.3%	81.4%

Table 2: Evaluation results on Aya Dataset and Nemotron-SG. #Harm denotes the number of harmful or safety-violating responses. H/R denotes the harmful-response ratio relative to Random under the same model, fine-tuning dataset, and safety benchmark:

H/R=\#\mathrm{Harm}_{\mathrm{method}}/\#\mathrm{Harm}_{\mathrm{Random}}\times 100\%

. Avg. reports the average H/R across the six benchmark–dataset combinations. The best Avg. result within each model group is shown in bold , and the second-best is underlined .

Model	FT Data	MATH	Code	XNLI	MLQA
Qwen3-8B	Base	90.4	52.5	71.09	61.41
	Aya Dataset	90.5	51.5	74.51	64.83
	Nemotron-SG	89.6	52.0	72.32	62.32
Qwen3-32B	Base	92.2	60.7	70.95	62.94
	Aya Dataset	91.7	59.9	72.56	65.25
	Nemotron-SG	91.1	60.1	72.15	63.86

Table 3: Utility evaluation after fine-tuning with data selected by MMSAFE. MATH and Code evaluate general reasoning and programming capabilities, while XNLI and MLQA evaluate multilingual natural language understanding and question answering. For Code, Qwen models are evaluated on LiveCodeBench and LLaMA models on HumanEval.

Figure 6: Language-wise unsafe counts on XSafety. Negative changes indicate fewer harmful responses with MMSafe .

Figure 7: Unsafe counts on LinguaSafe after fine-tuning with top-20% vs. bottom-20% ranked Aya dataset.

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

Category	Dataset	Languages	Size / Coverage
Candidate fine-tuning data	Aya Dataset	65	204K samples
Candidate fine-tuning data	Nemotron-SG	12	$>$ 200K safe-labeled samples
Sensitive layer discovery	OR-Bench	18 †	1K hard queries translated into multiple languages
Sensitive layer discovery	PolyGuardMix	17	1.91M samples
Safe-unsafe centroid construction	PolyGuardMix	17	1.91M samples
Safe-unsafe centroid construction	Nemotron-SG Val.	12	$\sim$ 10K validation samples

Appendix

Table 4: Summary of datasets and benchmarks used in our experiments. Nemotron-SG denotes Nemotron-Safety-Guard-v3. † indicates languages obtained through translation.

Model	Shared layer	Language-specific layers
Qwen3-8B	19	Arabic: 27, 17; Czech: 28, 14; German: 14, 24; English: 14, 13; Spanish: 14, 17; French: 26, 14; Hindi: 17, 24; Italian: 13, 20; Japanese: 24, 21; Korean: 29, 27; Dutch: 13, 24; Thai: 22, 5; Chinese: 15, 22; Portuguese: 29, 17; Russian: 28, 29; Polish: 24, 17; Swedish: 24, 29.
LLaMA3-8B-Instruct	9	Arabic: 10, 0; Czech: 13, 2; German: 29, 23; English: 10, 14; Spanish: 13, 11; French: 28, 11; Hindi: 0, 2; Italian: 2, 3; Japanese: 10, 0; Korean: 10, 0; Dutch: 13, 10; Thai: 13, 10; Chinese: 10, 0; Portuguese: 13, 11; Russian: 10, 13; Polish: 2, 10; Swedish: 2, 1.
LLaMA3.1-8B-Instruct	8	Arabic: 10, 2; Czech: 28, 2; German: 4, 19; English: 2, 15; Spanish: 15, 10; French: 15, 10; Hindi: 20, 2; Italian: 15, 2; Japanese: 12, 14; Korean: 12, 14; Dutch: 18, 19; Thai: 10, 9; Chinese: 10, 15; Portuguese: 15, 10; Russian: 20, 2; Polish: 2, 15; Swedish: 2, 4.
Qwen3-32B	42	Arabic: 52, 51; Czech: 51, 55; German: 44, 37; English: 44, 40; Spanish: 52, 56; French: 44, 58; Hindi: 57, 54; Italian: 51, 52; Japanese: 20, 40; Korean: 59, 50; Dutch: 61, 45; Thai: 52, 51; Chinese: 44, 46; Portuguese: 52, 59; Serbian: 1, 56; Russian: 54, 41; Polish: 54, 56; Swedish: 56, 54.

Appendix

Table 5: Selected language-shared and language-specific sensitive layers used by MMSafe . For each model, the shared layer is selected by aggregating sensitivity across languages, and the language-specific layers are selected from each language’s top-ranked layers after excluding the shared layer.

Figure 8: Cross-lingual layer sensitivity of LLaMA3-8B-Instruct across 18 languages. Each row is normalized within a language, and darker orange indicates higher sensitivity.

Figure 9: Cross-lingual layer sensitivity of Qwen3-8B across 18 languages. Each row is normalized within a language, and darker orange indicates higher sensitivity.

Figure 10: Cross-lingual layer sensitivity of Qwen3-32B across 18 languages. Each row is normalized within a language, and darker orange indicates higher sensitivity.

Model	LG-3	GPT-4	T-LG	Human
Qwen3-8B	532	518	535	528
Qwen3-32B	504	496	509	481
LLaMA3-8B	445	430	441	432
LLaMA3.1-8B	391	387	388	385

Appendix

Table 6: Unsafe response counts under different safety evaluation protocols. Each model is evaluated on 1,200 sampled responses. LG-3 denotes LlamaGuard 3, and T-LG denotes translate-then-LlamaGuard.

Model	$\mathbf{k=1}$	$\mathbf{k=2}$	$\mathbf{k=3}$
Qwen3-8B	4891	4576	4673
LLaMA3.1-8B	3894	3746	3937
LLaMA3-8B	4810	4881	5031

Appendix

Table 7: Sensitivity to the number

k

of language-specific sensitive layers. We report summed unsafe-response counts across evaluation settings; lower is better.

Figure 11: Category-specific SAE activations across layers on HarmBench harmful queries using LLaMA3.1-8B-Instruct. Bubble size and color indicate activation strength. Different layers exhibit distinct activation patterns across harmful categories, suggesting that safety-relevant signals are semantically complementary across layers.

LLM Safety

Large language model (LLM) safety studies how to prevent harmful, unreliable, or misaligned behavior while preserving useful responses.

See all 442 papers

The Heterogeneous Safety Impacts of Benign Multilingual Fine-Tuning
Jun 27, 2026Will Hawkins, Kaivalya Rawal, Jonathan Rystrøm +8LLM Safety Benchmarks Multilingual Language Model Evaluation
Oxford Internet Institute, University of Oxford · Hasso Plattner Institute, University of Potsdam · Chinese University of Hong Kong +2
Multilingual Safety Alignment Via Sparse Weight Editing
Feb 26, 2026Jiaming Liang, Zhaoxin Wang, Handing WangLLM Safety Alignment LLM Safety
School of Artificial Intelligence, Xidian University.
When Safety Speaks a Language: A Mechanistic Analysis of Safety-Language Identity Entanglement in LLMs
Aug 30, 2026Apoorva Upadhyaya, Sandipan SikdarLLM Safety Alignment Mechanistic Interpretability
L3S Research Center, Leibniz Universität Hannover, Germany

Jun 27, 2026J/K move · Enter open · S save

The Heterogeneous Safety Impacts of Benign Multilingual Fine-Tuning

Will Hawkins, Kaivalya Rawal, Jonathan Rystrøm, Stratis Tsirtsis+7

Oxford Internet Institute, University of Oxford · Hasso Plattner Institute, University of Potsdam · Chinese University of Hong Kong+2

LLM Safety Benchmarks Multilingual Language Model Evaluation Language Model Safety Evaluation LLM Fine-Tuning LLM Safety Fine-Tuning Language Models

Open paper AskPDF arXiv

Fine-tuning a large language model is a ubiquitous method for enhancing its capability on a specific downstream task. However, prior work has shown that this increase in capability comes with a cost: it can increase a model's tendency to respond to unsafe adversarial prompts, even when fine-tuning with non-adversarial data. We present the first comprehensive empirical study of this phenomenon in multilingual settings by fine-tuning Llama-3.2, Qwen3, and Gemma-3 models using benign data translated across nine languages. We find that safety outcomes are highly sensitive to both the choice of fine-tuning language and the evaluation language, with adversarial compliance rates increasing four-fold in some settings. Multilingual safety drift is decoupled from general capability metrics, and occurs heterogeneously across languages and models. Fine-tuning in non-English languages often induces smaller internal representational drifts than English, but these shifts lead models to default to either exaggerated compliance or refusal. As such, assessing fine-tuning impacts solely in English provides inadequate assurance for deployment. To facilitate further research into these cross-lingual safety blind spots, we release the Multilingual-Benign-Tune dataset and the SORRY-Bench-Multilingual evaluation suite.

Abstract

LLM Safety

Explore similar work

The Heterogeneous Safety Impacts of Benign Multilingual Fine-Tuning

Multilingual Safety Alignment Via Sparse Weight Editing

When Safety Speaks a Language: A Mechanistic Analysis of Safety-Language Identity Entanglement in LLMs