Low-Resource Languages Jailbreak GPT-4

By Zheng-Xin Yong, Cristina Menghini, Stephen H. Bach. arXiv.org, 2023

354 citations recorded by the source corpus.

AI safety training and red-teaming of large language models (LLMs) are measures to mitigate the generation of unsafe content. Our work exposes the inherent cross-lingual vulnerability of these safety mechanisms, resulting from the linguistic inequality of safety training data, by successfully circumventing GPT-4's safeguard through translating unsafe English inputs into low-resource languages. On the AdvBenchmark, GPT-4 engages with the unsafe translated inputs and provides actionable items that can get the users towards their harmful goals 79% of the time, which is on par with or even surpassing state-of-the-art jailbreaking attacks. Other high-/mid-resource languages have significantly lower attack success rate, which suggests that the cross-lingual vulnerability mainly applies to low-resource languages. Previously, limited training on low-resource languages primarily affects speakers of those languages, causing technological disparities. However, our work highlights a crucial shift: this deficiency now poses a risk to all LLMs users. Publicly available translation APIs enable anyone to exploit LLMs' safety vulnerabilities. Therefore, our work calls for a more holistic red-teaming efforts to develop robust multilingual safeguards with wide language coverage.

Subfields: Artificial Intelligence, Health Informatics

View Paper: https://www.semanticscholar.org/paper/764fc56883bf83392cac99a7b5a264ac9fe2cdc5

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Health Informatics

Citations in the corpus

A StrongREJECT for Empty Jailbreaks (2024, neutral): “These include a range of methods aggregated from social media and past work from Wei et al. [33], including attacks from websites like jailbreakchat.com , techniques from Kang et al. [16], and low-resource language translation attacks [39].”
How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs (2024, neutral): “Side-channel Communication exploits long-tailed distribution to increase jailbreak success rates, such as ciphers (Yuan et al., 2023) and translating harmful instructions into low-resource languages (Deng et al., 2023b; Yong et al., 2023).”
Improving Alignment and Robustness with Circuit Breakers (2024, neutral): “In both [70] and [61], it was observed that LRL attacks perform better than HRL attacks.”
SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks (2023, neutral): “In this way, Figure 3 can be seen as approximately measuring whether or not adversarially attacked prompts for Vicuna and Llama2 are k -unstable for input prompts of length m where k = ⌊ qm ⌋ .”
Jailbreak and Guard Aligned Language Models With Only Few In-Context Demonstrations (2023, neutral): “In addition to these template-and optimization-based attacks, other attack paradigms like cipher encoding [29], [30], low-resource languages [31], [32], and training generative models for jailbreaking prompts [33] are also explored.”
JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models (2024, methodology): “Indeed, evaluation techniques span human labeling (Wei et al., 2023; Yong et al., 2023), rule-based classifiers (Zou et al., 2023), neural-network-based classifiers (Huang et al., 2023; Mazeika et al., 2024), and the LLM-as-a-judge framework (Zheng et al., 2023; Chao et al., 2023; Shah et al.,…”
Mind the Gap! Choice Independence in Using Multilingual LLMs for Persuasive Co-Writing Tasks in Different Languages (2025, unknown): “These performance disparities in multilingual LLMs can have significant behavioral implications .”