Summary
Sometimes a language AI refuses a harmful request in English but answers the same request translated into another language, which means its safety features don’t always work reliably across languages. The authors analyze this problem mathematically, linking these safety failures to specific properties in the model’s internal representations. They introduce tools to measure and diagnose when a model’s safety behavior drifts between languages and show different reasons why exact fixes might or might not be possible. The work helps explain why identical safety issues might need very different fixes depending on the model’s internal state.
What this means in practice
- •For machine learning engineers: Diagnose and understand language model safety failures that appear only when inputs are translated between languages.
- •For model evaluators: Assess when recalibration of safety checks will fix issues versus when deeper model-level changes are necessary.
A theory result. No direct application yet.
Abstract
A deployed language model may refuse a harmful request in English yet comply with its faithful translation, revealing a cross-lingual safety failure that cannot be characterized reliably by output behavior alone. We formalize this phenomenon through an audited equivalence relation and show that, for a declared quotient, representation, metric, feature dictionary, scoring head, threshold, and contrast model, the resulting safety drift admits an exact linear-algebraic characterization. Specifically, the drift is a cross-Gram functional of the within-fiber contrast; its worst admissible value is a support function, while margin invariance is characterized by an annihilator condition. We introduce an intrinsic calibrated exposure measure, governed by the leverage duality $χ^2=1/\ell-1$, which separates observed drift into three diagnostically distinct regimes: a reader fault removable by recalibration, an exact correction that is too ill-conditioned to be reliable, and a representation-level collision that no readout-only intervention can remove. Thus, identical observed exposure can lead to fundamentally different remediation verdicts. The framework also extends to cone-valued safety heads. An untied order-swap identity provides a diagnostic for the linear control interface; its calibration-state residual predicts a distinct three-control composition error on unseen states and targets, achieving median Spearman correlation $0.964$, compared with $0.269$ for a static cross-Gram baseline. etc.....