Low-Resource Language Exploit

The attack exploits the safety alignment tax being disproportionately high for low-resource languages. Foundation models undergo extensive RLHF and red-teaming primarily in English and a handful of high-resource languages. When a prohibited prompt is translated into a language like Zulu, Scots Gaelic, or Hmong, the model's internal safety classifiers often fail to recognize the semantic harm, as the activation steering vectors for refusal are linguistically bound. The model may comply with the translated request where it would have refused the English equivalent.

The attack methodology follows a structured pipeline:

• Step 1: Obfuscation - The adversary translates a known malicious prompt into a target low-resource language using a machine translation API.
• Step 2: Injection - The translated prompt is submitted directly to the target LLM.
• Step 3: Exfiltration - The model's harmful output, often generated in the low-resource language, is translated back to English using the same API. This payload splitting via translation effectively bypasses keyword-based perplexity filters because the translated text often appears as a statistically normal, low-perplexity sequence in the target language.

Safety alignment does not reliably transfer across languages due to the tokenization disparity. Low-resource languages are often poorly tokenized, with a single word fragmenting into many subword tokens. This token smuggling effect means the semantic concept of 'building a bomb' is represented by a completely different, unseen neural activation pattern compared to its English counterpart. Representation engineering techniques that identify harmful concepts in the model's latent space often fail to generalize to these fragmented, low-resource linguistic representations.

Mitigation requires expanding the instruction hierarchy to be linguistically robust. Key defensive strategies include:

• Cross-lingual red teaming: Using automated red teaming tools like HarmBench to generate adversarial test cases across hundreds of languages.
• Translation-augmented safety data: Back-translating English safety examples into low-resource languages to fine-tune refusal mechanisms.
• Language-agnostic activation steering: Developing safety vectors that operate on semantic concepts rather than specific linguistic tokens, ensuring the refusal behavior triggers regardless of the input language.

The low-resource language exploit is a linguistic cousin to the CipherChat attack. Both methods bypass safety alignment by transforming the input into a representation the model can process but the safety layer cannot interpret. In CipherChat, the transformation is a substitution cipher; in this exploit, the transformation is a natural language outside the safety training distribution. Both attacks succeed because the model's core reasoning capability is more linguistically flexible than its narrow, English-centric safety conditioning. This highlights the need for Constitutional AI principles that are encoded in a language-agnostic manner.

This attack is cataloged under OWASP Top 10 for LLM Applications as a variant of LLM01: Prompt Injection, specifically an indirect injection via linguistic obfuscation. It demonstrates why a defense-in-depth strategy is critical:

• Input Layer: Multilingual perplexity filters and language detection models to flag anomalous translation requests.
• Model Layer: Instruction hierarchy training that prioritizes safety directives regardless of the user's language.
• Output Layer: Content moderation classifiers that scan generated outputs in all languages, not just English, to catch harmful content before it reaches the user.