SEDATE: Do Large Language Models Share an Aggression Circuit Across Languages?

Sagnik Basu; Sayan Das; Somnath Banerjee; Animesh Mukherjee

cs.CLOct 24, 2026

SEDATE: Do Large Language Models Share an Aggression Circuit Across Languages?

Authors: Sagnik Basu, Sayan Das, Somnath Banerjee, Animesh Mukherjee

Organizations: Indian Institute of Technology Kharagpur · Singapore Institute of Technology

Abstract

As the applications of AI continue to expand across various multimodal and multilingual domains, ensuring safe and responsible deployment of these systems has become an important concern. A wide-range of interventions have been proposed to make AI responses safer and more reliable. They often incur substantial computational or annotation costs, or cannot be extended to multilingual settings. In this work, we propose Selective Detection And Targeted Editing (SEDATE), a training-free approach based on detect-edit-verify strategy. SEDATE first detects the responsible neurons, edits them as and when necessary and finally verifies the model responses; all without any additional model training. We evaluate SEDATE across 7 languages and 4 model families. We further evaluate its effectiveness across 4 out-of-distribution languages and 4 additional datasets. We show that SEDATE achieves substantially superior safety scores across all languages and models over the best-performing baseline while retaining the general capabilities and incurring negligible overhead. Our results are robust, with the trends remaining similar for out-of-distribution languages and datasets.

Figures & tables

Figure 1: Overview of SeDATE . (a) Language-specific aggression neurons are intersected into a shared core

S_{k}^{\text{core}}

. (b) At each decoding step, the signal

\alpha

read from this core decides whether to pass, edit (suppress and steer), or refuse.

CostPerToken $\Delta$	EN	ES	DE	FR	IT	ZH	JA
Llama-base
Safety Arithmetic	0.0015	-0.0098	-0.0052	0.0023	0.0115	-0.0213	-0.0082
Soteria	-0.0336	-0.0231	-0.0500	-0.0241	-0.0483	-0.0147	-0.0645
Safe prompting	-0.0457	-0.0137	-0.0177	-0.0313	-0.0200	0.0032	-0.0045
SeDATE	-0.4279	-0.2029	-0.1953	-0.1607	-0.1441	-0.1483	-0.1259
Llama-instruct

Table 1: Safety score per token

\Delta

(lower is better) across seven models and seven languages, comparing Safety Arithmetic, Soteria, Safe prompting, and SeDATE .

Lang	Method	HexPhi	XThreatBench	HarmfulQA	HarmEval
EN	SeDATE	-0.3329	-0.2725	-0.1935	-0.3567
EN	Safe prompting	-0.0586	-0.0023	-0.0252	-0.0295
ES	SeDATE	-0.1316	-0.1235	-0.0662	-0.1447
ES	Safe prompting	-0.0248	-0.0244	-0.0143	-0.0199
DE	SeDATE	-0.1179	-0.1219	-0.0631	-0.1178
DE	Safe prompting	-0.0316	-0.0012	-0.0052	-0.0124

Table 2: OOD dataset results for Llama-base.

Model	Method	AR	KO	PT	RT
Ll ${}_{\textrm{B}}$	SeDATE	-0.0499	-0.0946	-0.2086	-0.2043
Ll ${}_{\textrm{B}}$	Safe prompting	-0.0131	- 0.0008	-0.0269	-0.0199
Ll ${}_{\textrm{I}}$	SeDATE	-0.0434	-0.0637	-0.1642	-0.1820
Ll ${}_{\textrm{I}}$	Safe prompting	-0.0237	-0.0039	-0.0810	-0.0248
Mi ${}_{\textrm{B}}$	SeDATE	-0.0957	-0.1265	-0.2873	-0.2850
Mi ${}_{\textrm{B}}$	Safe prompting	-0.0112	-0.0084	-0.0125	-0.0115

Table 3: OOD language results.

	Safety		Coherence
Lang	Win+Tie	Loss	Win+Tie	Loss
EN	80	20	70	30
ES	70	30	70	30
FR	80	20	80	20
IT	90	10	40	60
DE	80	20	70	30

Table 4: Human evaluation: percentage of prompts on which SeDATE wins, ties, or loses against the safe prompting baseline, by language and axis (

10

prompts per language). Win+Tie = SeDATE preferred or is equally good. The results are for the responses from the intervened Llama-base.

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

	Belebele (acc)		MNLI (acc)		GSM8K (acc)		SQuAD (F1)		CNN/DM (R-L)
Model	Base	SeDATE	Base	SeDATE	Base	SeDATE	Base	SeDATE	Base	SeDATE
Llama-base	53.18	53.17 ( -0.01 )	35.67	35.57 ( -0.10 )	12.74	12.74	68.53	68.45 ( -0.08 )	22.83	21.42 ( -1.41 )
Llama-instruct	71.60	71.60	58.69	58.69	80.44	80.44	81.13	81.13	24.67	20.25 ( -4.42 )
Mistral-base	20.61	18.75 ( -1.86 )	13.54	13.55 ( +0.01 )	10.16	10.16	43.51	43.35 ( -0.16 )	22.01	20.46 ( -1.55 )
Mistral-instruct	65.36	65.34 ( -0.02 )	70.43	70.43	53.07	53.07	43.19	43.12 ( -0.07 )	23.65	19.80 ( -3.85 )
Qwen-base	80.82	80.82	74.19	74.19	73.84	73.84	70.80	70.80	23.96	23.92 ( -0.04 )

Appendix

Table 5: General-capability evaluation of SeDATE against the unintervened baseline across seven models and five benchmarks. Belebele scores are averaged over

11~(7~[\mathrm{base}]+4~[\mathrm{OOD}])

languages; all other benchmarks are in English.

	Judged Better			Overall (%)
Model	Safe prompting	SeDATE	Tie	Win+Tie
Llama-base	1,250	4,808	941	82.14
Llama-instruct	1,087	3,702	2,210	84.47
Mistral-base	673	5,678	648	90.38
Mistral-instruct	313	5,479	1,207	95.53
Qwen-base	2,075	4,005	919	70.35

Appendix

Table 6: Comparative LLM-as-a-Judge evaluation results using Gemini 3.6 Flash. Safe prompting = baseline is better, SeDATE = SeDATE is better. Win+Tie represents the total percentage of prompts where SeDATE was preferred or equally good.

	English	Spanish	German	French	Italian	Chinese	Japanese
Model	$\Delta$ Unsafe	$\Delta$ Unsafe	$\Delta$ Unsafe	$\Delta$ Unsafe	$\Delta$ Unsafe	$\Delta$ Unsafe	$\Delta$ Unsafe
Llama-base	-50.70	-39.25	-35.14	-38.02	-36.28	-28.70	-30.86
Llama-instruct	-1.05	-1.66	-1.92	-2.80	-1.75	-2.27	-14.60
Mistral-base	-56.12	-53.85	-52.36	-48.08	-52.53	-38.50	-36.89
Mistral-instruct	-40.12	-32.43	-26.49	-27.45	-26.84	-26.42	-28.06
Qwen-base	-32.26	-22.55	-18.79	-23.25	-24.48	-21.00	-26.40

Appendix

Table 7: Unsafe rate difference summary (

\Delta

Unsafe %) across seven multilingual model backbones comparing Base vs. SeDATE .

Panel of Figure 3 — Figure 3: Percentile curves of the aggression signal $\alpha$ for Mistral-base ( $\gamma=0.5$ , $\beta=0.05$ ). Dotted: first pass (raw); solid: second pass (intervened).

LLM Safety

Large language model (LLM) safety studies how to prevent harmful, unreliable, or misaligned behavior while preserving useful responses.

See all 440 papers

The Heterogeneous Safety Impacts of Benign Multilingual Fine-Tuning
Jun 27, 2026Will Hawkins, Kaivalya Rawal, Jonathan Rystrøm +8LLM Safety Benchmarks Multilingual Language Model Evaluation
Oxford Internet Institute, University of Oxford · Hasso Plattner Institute, University of Potsdam · Chinese University of Hong Kong +2
AfriGuard: Safety and Robust Refusal For African Languages
Oct 19, 2026Israel Abebe Azime, Jesujoba O. Alabi, Iffat Maab +20LLM Safety Language Model Safety Evaluation
Saarland University, Saarland Informatic Campus, Germany · Masakhane NLP · National Institute of Informatics, Japan +13
Safety Targeted Embedding Exploit via Refinement
Jul 2, 2026Joshua Adrian CahyonoMultilingual Language Model Evaluation Adversarial Attacks on LLMs
Nanyang Technological University, Singapore.

Jun 27, 2026J/K move · Enter open · S save

The Heterogeneous Safety Impacts of Benign Multilingual Fine-Tuning

Will Hawkins, Kaivalya Rawal, Jonathan Rystrøm, Stratis Tsirtsis+7

Oxford Internet Institute, University of Oxford · Hasso Plattner Institute, University of Potsdam · Chinese University of Hong Kong+2

LLM Safety Benchmarks Multilingual Language Model Evaluation Language Model Safety Evaluation LLM Fine-Tuning LLM Safety Fine-Tuning Language Models

Open paper AskPDF arXiv

Fine-tuning a large language model is a ubiquitous method for enhancing its capability on a specific downstream task. However, prior work has shown that this increase in capability comes with a cost: it can increase a model's tendency to respond to unsafe adversarial prompts, even when fine-tuning with non-adversarial data. We present the first comprehensive empirical study of this phenomenon in multilingual settings by fine-tuning Llama-3.2, Qwen3, and Gemma-3 models using benign data translated across nine languages. We find that safety outcomes are highly sensitive to both the choice of fine-tuning language and the evaluation language, with adversarial compliance rates increasing four-fold in some settings. Multilingual safety drift is decoupled from general capability metrics, and occurs heterogeneously across languages and models. Fine-tuning in non-English languages often induces smaller internal representational drifts than English, but these shifts lead models to default to either exaggerated compliance or refusal. As such, assessing fine-tuning impacts solely in English provides inadequate assurance for deployment. To facilitate further research into these cross-lingual safety blind spots, we release the Multilingual-Benign-Tune dataset and the SORRY-Bench-Multilingual evaluation suite.

Abstract

LLM Safety

Explore similar work

The Heterogeneous Safety Impacts of Benign Multilingual Fine-Tuning

AfriGuard: Safety and Robust Refusal For African Languages

Safety Targeted Embedding Exploit via Refinement