Response-Based Knowledge Distillation for Multilingual Jailbreak Prevention Unwittingly Compromises Safety

2025-12-08 · Max Zhang, Derek Liu, Kai Zhang, Joshua Franco, Haihao Liu arxiv

Large language models (LLMs) are increasingly deployed worldwide, yet their safety alignment remains predominantly English-centric. This allows for vulnerabilities in non-English contexts, especially with low-resource languages. We introduce a novel application of knowledge distillation (KD) in the context of multilingual jailbreak prevention, examining its efficacy. We distill the refusal behaviors of a proprietary teacher model (OpenAI o1-mini) with Low-Rank Adaptation (LoRA) into three open-source student models: Meta-Llama-3-8B-Instruct, Gemma-2-2B-IT, and Qwen3-8B, using ~28,000 multilingual jailbreak prompts from XSafety via black-box response-based, parameter-efficient fine-tuning (PEFT). Evaluation on the MultiJail benchmark reveals a counterintuitive behavior: standard fine-tuning on the teacher's `safe'' refusal data inadvertently increases Jailbreak Success Rate (JSR) for all student models, up to 16.6 percentage points. Our experiments reveal a divergent generalization to unseen languages during distillation, with varying outcomes depending on the base model. By removing a primary source of safety degradation, nuanced boundary' refusals, we mitigate or even reverse safety declines in student models, although reductions in reasoning performance (GSM8K) persist. Overall, our exploratory study highlights the challenges and potential of KD as a technique for multilingual safety alignment, offering a foundation for future research in this direction.

📄 PDF Abstract BibTeX arXiv:2602.11157

Code (0)

등록된 구현이 없습니다.

Tasks

parameter-efficient fine-tuning Knowledge Distillation

Multilingual Safety Alignment via Self-Distillation

2026-05-03 · Ruiyang Qin, Qingzhuo Wang, Dongrui Liu, Qiang Li 외 arxiv

Large language models (LLMs) exhibit severe multilingual safety misalignment: they possess strong safeguards in high-resource languages but remain highly vulnerable to jailbreak attacks in low-resource languages. Current…

BAIT: Boundary-Guided Disclosure Escalation via Self-Conditioned Reasoning

2026-05-26 · Xuan Luo, Yue Wang, Geng Tu, Jing Li 외 arxiv

In this work, we propose BAIT (Boundary-Aware Iterative Trap), a three-step jailbreak framework that approaches malicious goals through internal disclosure. BAIT first asks the model to identify the protection boundary, …

Speak Easy: Eliciting Harmful Jailbreaks from LLMs with Simple Interactions

2025-02-06 · Yik Siu Chan, Narutatsu Ri, Yuxin Xiao, Marzyeh Ghassemi

Despite extensive safety alignment efforts, large language models (LLMs) remain vulnerable to jailbreak attacks that elicit harmful behavior. While existing studies predominantly focus on attack methods that require tech…

Safety Alignment

Retrieval-Augmented Defense: Adaptive and Controllable Jailbreak Prevention for Large Language Models

2025-08-22 · Guangyu Yang, Jinghong Chen, Jingbiao Mei, Weizhe Lin 외 arxiv

Large Language Models (LLMs) remain vulnerable to jailbreak attacks, which attempt to elicit harmful responses from LLMs. The evolving nature and diversity of these attacks pose many challenges for defense systems, inclu…

Multilingual jailbreaking of LLMs using low-resource languages

2026-05-18 · Dylan Marx, Marcel Dunaiski arxiv

Large Language Models (LLMs) remain vulnerable to jailbreak attempts that circumvent safety guardrails. We investigate whether multi-turn conversations using low-resource African languages (Afrikaans, Kiswahili, isiXhosa…