Researchers show GPT-4 safety guardrails easily bypassed via low-resource languages
Researchers traced the gap to RLHF: human annotators who flag harmful content overwhelmingly work in high-resource languages, leaving weaker refusal training elsewhere.
- Security & misuse
- Minor
Researchers at Brown University — Zheng-Xin Yong, Cristina Menghini and Stephen Bach — showed that translating harmful requests into low-resource languages such as Zulu or Scots Gaelic before submitting them to GPT-4 reliably defeated safety training that blocked the same requests in English. Using more than 500 unsafe prompts drawn from an existing adversarial benchmark, translated with the free Google Translate API, the team reported roughly 79% of translated low-resource prompts elicited a harmful or policy-violating response, against under 1% when the same prompts were submitted in English.
The effect was specific to genuinely low-resource languages rather than a general property of translation: mid- and high-resource languages such as Mandarin, Spanish or French showed the effect only weakly or not at all. The prompt categories most reliably bypassed by the technique concerned terrorism and weapons instructions, financial crime such as insider trading or counterfeiting, and misinformation.
The researchers attributed the gap to how safety training is built. GPT-4’s refusal behaviour comes largely from reinforcement learning from human feedback, in which annotators flag harmful outputs for the model to learn to avoid; those annotator pools work overwhelmingly in a small number of high-resource languages, so the reinforcement signal teaching a model to refuse is dense in English and sparse or absent in languages with fewer online speakers and less annotated data. A publicly available translation API was then sufficient to route around a safeguard that had never been trained to recognise the same request in another language.
The team said it disclosed the vulnerability to OpenAI before publishing. The paper went on to win a best-paper award at a NeurIPS workshop on socially responsible language modelling, and became a widely cited early example of a jailbreak technique that exploited a structural gap in how safety training data was collected — an English-centric weakness rather than a flaw specific to any one prompt — rather than a one-off prompt trick.