跨语言检测越狱攻击,让模型不被语言差异骗到。
One Jailbreak, Many Tongues: Learning Language-Insensitive Intention Representations for Multilingual Jailbreak Detection

- 用多语言回译增强数据,覆盖11种语言的越狱样本。
- 在11种语言上达到98.5%的F1分数,未见语言平均97.1%。
- 适合需要多语言安全防护的研究与应用团队。
大型语言模型在面向全球多语言用户的应用中日益普及,但安全训练仍集中于主流语言,未能同步发展,造成越狱攻击可乘之机。现有防御方法主要在主流语言中开发与评估,受限于对齐的多语言标注数据稀缺及语言差异导致的表示发散。为此,我们提出MLJailDe,一种提升多语言鲁棒性与跨语言泛化能力的越狱检测框架。该框架首先引入多语言回译数据增强算法,构建覆盖11种语言的语义一致、功能有效的数据集,包含2,232个良性样本和1,239个越狱样本。在此基础上,通过相对距离约束减少跨语言表示发散,促使具有相似意图的越狱提示在不同语言中形成一致聚类;同时采用不平衡感知分类目标缓解类别不平衡,学习更可靠的多语言决策边界。实验表明,MLJailDe在多种语言上均优于现有最先进基线,取得98.5%的F1分数,并在未见语言上实现97.1%的平均F1分数,展现出强大有效性和跨语言泛化能力。
原文摘要 · Abstract (English)
Large language models (LLMs) are increasingly deployed in applications for global multilingual users, yet safety training remains concentrated in dominant languages and has not progressed in parallel with multilingual capability, creating exploitable gaps for jailbreak attacks. Current jailbreak defenses are largely developed and evaluated in dominant languages, and their effectiveness is limited by the scarcity of aligned multilingual supervision and representations dispersion caused by language variation. To address this issue, we propose MLJailDe, a multilingual jailbreak detection framework designed to improve both multilingual robustness and cross-lingual generalization. MLJailDe first introduces a multilingual back-translation data augmentation algorithm to construct a semantically consistent and functionally effective dataset spanning 11 languages, consisting of 2,232 benign and 1,239 jailbreak samples. On this basis, MLJailDe employs relative-distance constraints to reduce cross-lingual representation dispersion and encourage jailbreak prompts with similar intent to form consistent clusters across languages, while an imbalance-aware classification objective is further used to alleviate class imbalance and learn more reliable multilingual decision boundaries. Experimental results show that MLJailDe outperforms state-of-the-art baselines across multiple languages, achieving an F1 score of 98.5\%, and obtains an average F1 score of 97.1\% on unseen languages, demonstrating strong effectiveness and cross-lingual generalization.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。