💬 NLP

Layer-wise Swapping for Generalizable Multilingual Safety

This paper proposes a training-free, safety-aware layer swapping method that transfers safety alignment from English expert models to low-resource language experts by adaptively selecting specialized modules, thereby enhancing multilingual safety without compromising general language performance.

Original authors: Hyunseo Shin, Wonseok Hwang

Published 2026-02-16

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Hyunseo Shin, Wonseok Hwang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Problem: The "Safety Gap"

Imagine you have a super-smart robot assistant (a Large Language Model) that speaks English perfectly. Because it was trained on millions of English safety rules, it knows exactly how to say "no" when asked to do something dangerous, like build a bomb or write a hate speech. It's very polite and safe.

However, this robot also needs to speak other languages like Korean, Bengali, or Swahili. When researchers teach it these new languages, they often forget to teach it the safety rules in those languages. As a result, the robot becomes a "bad student" in those languages. It might still be smart enough to answer math questions or write stories in Swahili, but if you ask it a dangerous question in Swahili, it might happily comply because it never learned the "safety rules" for that specific language.

The Old Solution: "The Whole House Swap"

Previously, researchers tried to fix this by taking the "safety brain" of the English expert and trying to paste it onto the Swahili expert.

The Analogy: Imagine you have a house (the AI model). The English house has a very strong, reinforced front door (safety). The Swahili house has a flimsy door. The old method was like saying, "Let's just swap the entire front door of the English house onto the Swahili house."
The Problem: This is too blunt. Sometimes the English door doesn't fit the Swahili frame, or swapping the whole door breaks the hallway inside. It's a "one-size-fits-all" approach that often breaks the robot's ability to speak the language well.

The New Solution: "The Modular Swap"

The authors of this paper propose a smarter, more surgical approach called Safety-Aware Layer Swapping.

Instead of swapping the whole house, they look inside the robot's brain, which is made of many small rooms (layers) and specific tools (modules like Attention and MLP). They realized that:

Safety knowledge lives in specific rooms in the middle of the brain.
Language knowledge lives in different rooms, mostly at the beginning and end.

How It Works (The "Chef's Kitchen" Analogy)

Imagine the AI model is a massive, high-tech kitchen.

The English Safety Chef has a special set of knives and spices that make sure no one gets hurt in the kitchen.
The Swahili Language Chef is amazing at cooking delicious local dishes but doesn't have those safety knives.

The old method would try to replace the entire Swahili kitchen with the English one. That's messy and ruins the local recipes.

The new method is like a "Smart Kitchen Swap":

Inspection: The researchers walk through the kitchen and check every station. They ask: "Does this station need the safety knives?"
Automatic Selection:
- If a station is handling "dangerous ingredients" (safety tasks), they automatically swap in the English Safety Chef's tools.
- If a station is handling "local recipes" (language tasks), they keep the Swahili Chef's tools.
- If a station is a mix of both, they blend the tools together (like mixing a little bit of English spice into the Swahili dish).
Result: You get a kitchen that cooks delicious Swahili food and has the safety knives installed exactly where they are needed.

Why This is a Big Deal

No Extra Training: Usually, teaching a robot safety in a new language takes months of expensive training. This method is like a "plug-and-play" upgrade. You just swap the parts, and it works immediately.
It Keeps the Smarts: Because they only swap the specific parts needed for safety, the robot doesn't forget how to speak the language or solve math problems. It stays smart and safe.
It Works Everywhere: They tested this on four difficult languages (Korean, Bengali, Swahili, Telugu) and it worked much better than previous methods.

The Takeaway

The paper solves the problem of "unsafe AI in foreign languages" by realizing that safety and language skills live in different parts of the AI's brain. Instead of forcing a clumsy, whole-model swap, they use a smart, automatic system to pick and choose the best "safety parts" from an English expert and install them into low-resource language models.

It's like giving a local guide a safety vest and a first-aid kit without taking away their map or their knowledge of the local trails. Now, they can guide tourists safely in any language.

1. Problem Statement

Large Language Models (LLMs) have achieved significant progress in reasoning and instruction following, but their safety alignment is uneven across languages.

English-Centric Bias: Most safety-tuning datasets are in English. Consequently, models fine-tuned for low-resource languages (e.g., Korean, Bengali, Swahili, Telugu) often exhibit high rates of unsafe or harmful generations compared to their English counterparts.
Limitations of Existing Methods:
- Naive Fine-tuning: Training a model solely on low-resource instruction data often leads to "catastrophic forgetting" of safety knowledge acquired during pre-training.
- Mixed Supervised Fine-Tuning (SFT): Jointly training on safety and language data is computationally expensive and does not consistently close the safety gap across diverse languages.
- Static Layer Swapping: Previous structural transfer methods (e.g., replacing specific layers from a safety expert into a language expert) rely on manual, static selection, which fails to generalize well across different languages and model architectures.

2. Methodology: Safety-Aware Layer Swapping

The authors propose a training-free strategy that transfers safety alignment from a high-resource English "safety expert" to low-resource "language experts" without additional gradient updates. The method is grounded in Task Vectors and extends to Module-wise Swapping.

Core Concepts

Task Vectors: The difference between fine-tuned parameters ( $\theta_{ft}$ ) and pre-trained base parameters ( $\theta_{base}$ ) defines a task vector ( $\tau = \theta_{ft} - \theta_{base}$ ). This vector encodes the specific knowledge shift (e.g., safety or multilingual capability).
Layer-wise Swapping: Instead of manually selecting layers, the method computes the relative importance of each layer for safety vs. multilingual tasks.
Module-wise Swapping (Key Innovation): Recognizing that sub-modules (Self-Attention and MLP/FFN) exhibit higher linearity than full layers, the method decomposes the model further. It analyzes whether specific modules within a layer are more specialized for safety or language.

The Algorithm

Compute Updates: Calculate parameter updates ( $\Delta W$ ) for the safety-tuned model and the multilingual-tuned model relative to the base model.
Measure Specialization: Compute a normalized ratio ( $n$ ) representing the magnitude of updates for each module ( $m$ ) in each layer ( $l$ ) for both safety ($safe$) and multilingual ($multi$) tasks.
$n_{l,m}^{safe} = \frac{\|\Delta W_{l,m}^{safe}\|^2}{\|\theta_{base}\|^2}$
Determine Dominance: Calculate the difference ( $d_{l,m}$ ) between the normalized safety score and the multilingual score.
$d_{l,m} = p_{l,m}^{safe} - p_{l,m}^{multi}$
Adaptive Selection & Blending:
- Selection: If $|d_{l,m}| > \tau$ (a threshold), the module is directly selected from the expert that dominates (Safety Expert if positive, Language Expert if negative).
- Blending: If $|d_{l,m}| \le \tau$ , the modules are blended using a fixed interpolation weight $\alpha$ :
  $\theta_{hybrid} = \alpha \theta_{safe} + (1-\alpha) \theta_{multi}$

This approach allows the model to automatically propagate safety representations where they are most effective while preserving language understanding capabilities in other parts of the network.

3. Key Contributions

Systematic Formulation: They formalize layer swapping as the composition of multilingual and safety task vectors, providing a principled way to merge these capabilities.
Module-Level Granularity: They extend traditional layer swapping to module-wise swapping (Attention vs. MLP), introducing an automatic selection mechanism based on the degree of specialization. This overcomes the rigidity of static layer replacement.
Training-Free Efficiency: The method requires no additional training or fine-tuning, making it highly efficient for deploying safe models in low-resource settings.
Empirical Validation: Demonstrated significant improvements in safety for four low-resource languages (Korean, Bengali, Swahili, Telugu) while maintaining general language performance.

4. Experimental Results

The authors evaluated their method on LLaMA 3.1 8B Instruct and Qwen3 8B across four low-resource languages.

Safety Performance (MultiJail Benchmark):
- Language-only experts showed high unsafety rates (e.g., ~58% for Swahili on LLaMA).
- The proposed Module-wise Swapping reduced unsafety rates significantly (e.g., down to ~13% for Swahili on LLaMA), outperforming static layer swapping, Task Arithmetic, TIES Merging, and DARE.
- In 20 safety evaluations, the module-wise approach won 65% of the time against baselines.
General Language Understanding (MMMLU, BELEBELE, MGSM):
- The method preserved general capabilities, achieving competitive scores on reasoning and reading comprehension benchmarks.
- Unlike "Mixed SFT" which showed high variance, the swapping methods provided consistent performance across languages.
- The proposed methods outperformed fixed layer swapping in 68% of general benchmark cases.
Analysis of Specialization:
- Visualizations (Figures 3 & 4) revealed that Safety alignment tends to emerge in middle layers and is distributed across both Attention and MLP modules, whereas Multilingual adaptation is often concentrated in bottom/top layers and specific modules. This confirms the necessity of adaptive, module-level selection rather than static layer replacement.

5. Significance

Bridging the Safety Gap: This work addresses a critical ethical and practical gap in LLM deployment. It offers a scalable solution to make low-resource language models safe without the prohibitive cost of retraining or collecting massive safety datasets for every language.
Efficiency: By being training-free, it democratizes safety alignment, allowing researchers and developers to create safe multilingual models using existing English safety experts and standard instruction datasets.
Insight into Model Architecture: The study provides new insights into how safety and language capabilities are localized within Transformer architectures, suggesting that safety is not monolithic but distributed in specific functional components (modules) that can be surgically transferred.

In conclusion, the paper presents a robust, automated, and efficient framework for transferring safety alignment across languages, demonstrating that structural merging via task vectors can effectively balance safety and general utility in multilingual LLMs.