Refusal Direction is Universal Across Safety-Aligned Languages

1. Problem Statement

Large Language Models (LLMs) rely on refusal mechanisms to ensure safety, typically trained via Reinforcement Learning from Human Feedback (RLHF). While recent research has identified that refusal behavior in English is mediated by a specific "refusal direction" (a vector in the activation space), it remains unclear how these mechanisms function across different languages.

• The Gap: Current safety evaluations are English-centric. Cross-lingual jailbreaks (where prompts in non-English languages bypass safety filters that work in English) are a growing concern.
• The Question: Is the refusal mechanism language-specific, or is there a universal, language-agnostic refusal direction that generalizes across languages? If universal, can a vector extracted from English (or any safety-aligned language) be used to bypass or enforce refusals in other languages without fine-tuning?

2. Methodology

The authors employ an activation-based intervention approach to investigate the geometric properties of refusal mechanisms across 14 typologically diverse languages.

A. Dataset: PolyRefuse

The authors constructed PolyRefuse, a multilingual safety dataset.

• Source: Translated harmful prompts from ADVBENCH, MALICIOUSINSTRUCT, and TDC2023, and benign prompts from ALPACA.
• Scope: 14 languages (including English, German, Spanish, French, Italian, Dutch, Japanese, Korean, Polish, Russian, Chinese, Arabic, Thai, and Yoruba) covering 7 different writing systems.
• Validation: Back-translation and semantic similarity (SBERT) checks ensured translation fidelity.

B. Refusal Direction Extraction

Using the Difference-in-Means method, the authors extracted refusal vectors ($\hat{r}$) from the model's residual stream.

• Calculation: $\hat{r} = v_{harmful} - v_{harmless}$, where $v$ represents the mean activation at specific token positions and layers.
• Selection: The most effective vector is identified by ablating candidates and measuring the drop in the "Refusal Score" (log-probability difference between refusal tokens like "Sorry" and non-refusal tokens).

C. Intervention Strategies

The study utilized two primary interventions on the residual stream:

1. Ablation (Jailbreaking): Projecting activations onto the refusal direction and subtracting them ($x' = x - \hat{r}\hat{r}^\top x$) to remove refusal behavior.
2. Addition (Reinforcement): Adding the refusal vector to activations ($x' = x + \alpha\hat{r}$) to enforce refusal behavior.

D. Experimental Setup

• Models: Evaluated across multiple families and scales, including Llama-3 (8B, 70B, 3.1-8B), Qwen2.5 (3B to 32B), Gemma-2 (2B, 9B), and Yi-6B.
• Evaluation: Responses were translated back to English and classified using WildGuard to determine compliance rates with harmful prompts.
• Geometric Analysis: The authors visualized embeddings using PCA and calculated Silhouette Scores to measure the separation between harmful and harmless clusters in the embedding space.

3. Key Contributions & Results

A. Discovery of Cross-Lingual Universality

The paper provides empirical evidence that refusal directions are universal across safety-aligned languages.

• English-to-Other Transfer: A refusal vector extracted from English successfully bypassed safety mechanisms in all 13 other languages. Ablating the English vector caused a massive spike in compliance rates (often exceeding 90%) across all models and languages.
• Non-English-to-Other Transfer: Vectors extracted from three typologically diverse safety-aligned languages (German, Chinese, Thai) were equally effective at jailbreaking models in all other languages, including English.
• Implication: The refusal mechanism is not tied to specific linguistic features but is encoded in a shared, language-agnostic subspace.

B. The "Safety-Misaligned" Language Anomaly

The study identified Yoruba (yo) as a "safety-misaligned" language.

• Models exhibited extremely high baseline compliance rates for Yoruba prompts (e.g., 82.9% for Llama-3.1-8B) even before any intervention.
• Refusal vectors derived from Yoruba showed poor transferability to other languages, whereas vectors from safety-aligned languages transferred universally. This suggests that universality relies on the source language having a robust refusal concept to begin with.

C. Geometric Analysis: Parallelism vs. Separation

The authors analyzed the internal geometry of the models to explain why these attacks work and why vulnerabilities persist.

• Parallel Refusal Vectors: Refusal directions extracted from different languages are approximately parallel in the embedding space. This explains why a vector from one language can modulate behavior in another.
• Weak Cluster Separation: While the direction of refusal is universal, the separation between harmful and harmless embeddings is not.
  • In English, harmful and harmless prompts form distinct, well-separated clusters.
  • In non-English languages (especially low-resource ones), these clusters overlap significantly.
  • Conclusion: Cross-lingual jailbreaks succeed not because the refusal direction is missing, but because the model fails to clearly distinguish harmful inputs from harmless ones in non-English representation spaces. The weak separation makes the refusal signal easier to override.

4. Significance and Implications

• Mechanistic Understanding: The paper shifts the understanding of LLM safety from a language-specific phenomenon to a structural, geometric property. It reveals that safety training creates a universal "refusal axis" but often fails to align the "harmfulness detection" boundaries across languages.
• Vulnerability Insight: It explains the mechanism behind cross-lingual jailbreaks: attackers can use a single vector (even from English) to bypass safety in any language because the refusal direction is shared, and the decision boundary in non-English languages is fuzzy.
• Defense Strategy: The findings suggest that future safety defenses should not just focus on adding more refusal data but on improving the geometric separation between harmful and harmless representations in the embedding space for all languages.
• Actionable Defense: Since refusal vectors are universal, defenses could potentially be developed by reinforcing the refusal direction across all languages simultaneously, rather than training language-specific safety classifiers.

5. Limitations

• The study is limited to 14 languages; results may vary for languages with extremely low representation in pretraining corpora.
• The paper identifies the cause of vulnerabilities (weak separation) but does not propose a concrete defense algorithm to fix it, leaving that as future work.

In summary, the paper demonstrates that refusal is a universal, language-agnostic mechanism in LLMs, but the robustness of safety depends on the model's ability to geometrically separate harmful concepts, a capability that degrades significantly in non-English contexts.