Elamur Research⌕
☰
home / papers / 2026 / LASA: Language-Agnostic Semantic Alignment at the Semantic Bottleneck for LLM Safety

LASA: Language-Agnostic Semantic Alignment at the Semantic Bottleneck for LLM Safety

Paper · 2026 · Junxiao Yang, Haoran Liu, Jinzhe Tu et al.

Summary

LLMs tend to refuse harmful requests reliably in high-resource languages but are much easier to jailbreak in low-resource ones. The authors argue the cause is a mismatch. Semantic understanding in base models generalizes across languages, but safety tuning happens in text space and inherits the language skew of the alignment data. Using layer-wise Silhouette scores and t-SNE, they locate a "Semantic Bottleneck": an intermediate layer where hidden states group by meaning rather than by language.

Their framework, LASA, works in three steps:

  1. It finds this layer.
  2. It trains a small Safety Semantic Interpreter (SSI) on the frozen model's bottleneck states to tell benign from malicious queries.
  3. It fine-tunes the model with generation conditioned on the SSI signal.

When safety training uses only English, Chinese and Korean, LASA still sharply lowers attack success rates in unseen languages such as Swahili. Results hold across LLaMA and Qwen models. The work suggests that the layer where safety alignment is applied matters, and that a language-agnostic layer gives more scalable multilingual safety.

Key points

  • Locating the bottleneck: It is the layer that maximizes the gap between query-based and language-based Silhouette scores. Clustering by language follows a U-shape across depth, while clustering by query follows an inverted U.
  • The SSI module: It is a lightweight MLP binary classifier trained with BCE loss and adds under 0.2% of the base model's parameters.
  • Overall results: Average ASR on LLaMA-3.1-8B-Instruct falls from 24.7% to 2.8%. It stays around 3–4% for Qwen2.5 and Qwen3 Instruct models from 7B to 32B.
  • Unseen-language transfer: On Qwen2.5-7B-Instruct, Swahili ASR drops from roughly 50% under baseline methods to 13.0%.
  • Data, evaluation and limits: Harmful queries come from MultiJail and HarmBench. GPT-4o serves as the judge, with over 95% agreement with human annotators on LLaMA-3.1-8B. The method is weaker when harmful intent is implicit, for example in low-similarity emoji prompts.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 worksArts and Humanities · 17,450 worksLanguage and Linguistics · 17,296 works

🧭 Topics 2Research subjects and languages the work is about.Language models & pretraining · 3,894 worksBias, fairness & safety · 587 works

Cite

Cite as Junxiao Yang, Haoran Liu, Jinzhe Tu, Jiale Cheng, Zhexin Zhang, Shiyao Cui, Jiaqi Weng, Jialing Tao, Hui Xue, Hongning Wang, Han Qiu and Minlie Huang. 2026. LASA: Language-Agnostic Semantic Alignment at the Semantic Bottleneck for LLM Safety. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.acl-long.1913

@inproceedings{yang2026lasa,
  title = {{LASA: Language-Agnostic Semantic Alignment at the Semantic Bottleneck for LLM Safety}},
  author = {Junxiao Yang, Haoran Liu, Jinzhe Tu, Jiale Cheng, Zhexin Zhang, Shiyao Cui, Jiaqi Weng, Jialing Tao, Hui Xue, Hongning Wang, Han Qiu and Minlie Huang},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.1913},
  url = {https://doi.org/10.18653/v1/2026.acl-long.1913}
}

References

51 references, 21 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Afra Amini, Tim Vieira, and Ryan Cotterell. 2024. Direct preference optimization with an offset. In Findings of the Association for Computational Linguistics: ACL 2024, pages 9954– 9972, Bangkok, Thailand. Association for Computational Linguistics. find
  2. AI Anthropic. 2024. The claude 3 model family: Opus, sonnet, haiku. Claude-3 Model Card, 1. find
  3. Berk Atil, Rebecca J Passonneau, and Fred Morstatter. 2025. Do methods to jailbreak and defend llms generalize across languages? arXiv preprint arXiv:2511.00689. — [arXiv:2511.00689](https://arxiv.org/abs/2511.00689) find
  4. Maciej Chrab aszcz, Filip Szatkowski, Bartosz Wójcik, Jan Dubiński, and Tomasz Trzciński. 2025. Maybe i should not answer that, but... do llms understand the safety of their inputs? arXiv preprint arXiv:2502.16174. — [arXiv:2502.16174](https://arxiv.org/abs/2502.16174) find
  5. Gheorghe Comanici, Eric Bieber, Mike Schaekermann, Ice Pasupat, Noveen Sachdeva, Inderjit Dhillon, Marcel Blistein, Ori Ram, Dan Zhang, Evan Rosen, et al. 2025. Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities. arXiv prep…
  6. Alexis Conneau and Guillaume Lample. 2019. Cross-lingual language model pretraining. Advances in neural information processing systems, 32. find
  7. Ganqu Cui, Lifan Yuan, Ning Ding, Guanming Yao, Bingxiang He, Wei Zhu, Yuan Ni, Guotong Xie, Ruobing Xie, Yankai Lin, et al. 2023. Ultrafeedback: Boosting language models with scaled ai feedback. arXiv preprint arXiv:2310.01377. find
  8. Shiyao Cui, Xijia Feng, Yingkang Wang, Junxiao Yang, Zhexin Zhang, Biplab Sikdar, Hongning Wang, Han Qiu, and Minlie Huang. 2025. When smiley turns hostile: Interpreting how emojis trigger llms’ toxicity. arXiv preprint arXiv:2509.11141. — [arXiv:2509.11141](https://arxiv.org/abs/2509.11141) find
  9. Adrian de Wynter, Ishaan Watts, Tua Wongsangaroonsri, Minghui Zhang, Noura Farra, Nektar Ege Altıntoprak, Lena Baur, Samantha Claudet, Pavel Gaj-dušek, Qilong Gu, et al. 2025. Rtp-lx: Can llms evaluate toxicity in multilingual scenarios? In Proceedings of the AAAI Conference on Artificial Intelligen… find
  10. Yue Deng, Wenxuan Zhang, Sinno Jialin Pan, and Lidong Bing. 2023. Multilingual jailbreak challenges in large language models. arXiv preprint arXiv:2310.06474.
  11. Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. 2024. The llama 3 herd of models. arXiv preprint arXiv:2407.21783.
  12. Anastasia Dunca, Maanas Kumar Sharma, Olivia Munoz, and Victor Rosales. 2025. Mulbere: Multilingual jailbreak robustness using targeted latent adversarial training. In Proceedings of the 9th Widening NLP Workshop, pages 175–181. find
  13. Kawin Ethayarajh, Winnie Xu, Niklas Muennighoff, Dan Jurafsky, and Douwe Kiela. 2024. Kto: Model alignment as prospect theoretic optimization. arXiv preprint arXiv:2402.01306. find
  14. Yu Fei, Yasaman Razeghi, and Sameer Singh. 2025. Nudging: Inference-time alignment of llms via guided decoding. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 12702– 12739.
  15. Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, et al. 2025. Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning. arXiv preprint arXiv:2501.12948.
  16. Prannaya Gupta, Le Qi Yau, Hao Han Low, I-Shiang Lee, Hugo Maximus Lim, Yu Xin Teoh, Koh Jia Hng, Dar Win Liew, Rishabh Bhardwaj, Rajat Bhardwaj, et al. 2024. Walledeval: A comprehensive safety evaluation toolkit for large language models. In Proceedings of the 2024 Conference on Empirical Methods i… find
  17. Rajdeep Haldar, Ziyi Wang, Qifan Song, Guang Lin, and Yue Xing. 2025. Llm safety alignment is divergence estimation in disguise. arXiv preprint arXiv:2502.00657. — [arXiv:2502.00657](https://arxiv.org/abs/2502.00657) find
  18. Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. 2021. Measuring massive multitask language understanding.
  19. Jiwoo Hong, Noah Lee, and James Thorne. 2024. ORPO: Monolithic preference optimization without reference model. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 11170–11189, Miami, Florida, USA. Association for Computational Linguistics. find
  20. Linghan Huang, Haolin Jin, Zhaoge Bi, Pengyue Yang, Peizhou Zhao, Taozhao Chen, Xiongfei Wu, Lei Ma, and Huaming Chen. 2025. The tower of babel revisited: Multilingual jailbreak prompts on closed-source large language models. arXiv preprint arXiv:2505.12287. — [arXiv:2505.12287](https://arxiv.org/abs/2505.12287) find
  21. Jiaming Ji, Donghai Hong, Borong Zhang, Boyuan Chen, Josef Dai, Boren Zheng, Tianyi Alex Qiu, Jiayi Zhou, Kaile Wang, Boxun Li, et al. 2025. Pku-saferlhf: Towards multi-level safety alignment for llms with human preference. In Proceedings of the 63rd Annual Meeting of the Association for Computation…
  22. Artūrs Kanepajs, Vladimir Ivanov, and Richard Moulange. 2024. Towards safe multilingual frontier ai. arXiv preprint arXiv:2409.13708. — [arXiv:2409.13708](https://arxiv.org/abs/2409.13708) find
  23. Chong Li, Shaonan Wang, Jiajun Zhang, and Chengqing Zong. 2024a. Improving in-context learning of multilingual generative language models with cross-lingual alignment. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language… find
  24. Yahan Li, Yi Wang, Yi Chang, and Yuan Wu. 2024b. Xtrust: On the multilingual trustworthiness of large language models. arXiv preprint arXiv:2409.15762. — [arXiv:2409.15762](https://arxiv.org/abs/2409.15762) find
  25. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, et al. 2024. Harmbench: A standardized evaluation framework for automated red teaming and robust refusal. arXiv preprint arXiv:2402.04249.
  26. Cheng Qian, Hainan Zhang, Lei Sha, and Zhiming Zheng. 2025. Hsf: Defending against jailbreak attacks with hidden state filtering. In Companion Proceedings of the ACM on Web Conference 2025, pages 2078–2087. find
  27. Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. 2023. Direct preference optimization: Your language model is secretly a reward model. Advances in neural information processing systems, 36:53728–53741.
  28. Peter J. Rousseeuw. 1987. Silhouettes: A graphical aid to the interpretation and validation of cluster analysis. Journal of Computational and Applied Mathematics, 20:53–65. find
  29. Lingfeng Shen, Weiting Tan, Sihao Chen, Yunmo Chen, Jingyu Zhang, Haoran Xu, Boyuan Zheng, Philipp Koehn, and Daniel Khashabi. 2024. The language barrier: Dissecting safety challenges of arXiv preprint llms in multilingual contexts. arXiv:2401.13136. — [arXiv:2401.13136](https://arxiv.org/abs/2401.13136) find
  30. Freda Shi, Mirac Suzgun, Markus Freitag, Xuezhi Wang, Suraj Srivats, Soroush Vosoughi, Hyung Won Chung, Yi Tay, Sebastian Ruder, Denny Zhou, Dipanjan Das, and Jason Wei. 2022. Language models are multilingual chain-of-thought reasoners.
  31. Feifan Song, Bowen Yu, Minghao Li, Haiyang Yu, Fei Huang, Yongbin Li, and Houfeng Wang. 2024. Preference ranking optimization for human alignment. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 18990– 18998.
  32. Jiayang Song, Yuheng Huang, Zhehua Zhou, and Lei Ma. 2025. Multilingual blending: Large language model safety alignment evaluation with language mixture. In Findings of the Association for Computational Linguistics: NAACL 2025, pages 3433–3449. find
  33. Nikhil Verma and Manasa Bharadwaj. 2025. The hidden space of safety: Understanding preference-tuned llms in multilingual context. arXiv preprint arXiv:2504.02708. — [arXiv:2504.02708](https://arxiv.org/abs/2504.02708) find
  34. Cheng Wang, Zeming Wei, Qin Liu, and Muhao Chen. 2025a. False sense of security: Why probing-based malicious input detection fails to generalize. arXiv preprint arXiv:2509.03888.
  35. Mengru Wang, Ningyu Zhang, Ziwen Xu, Zekun Xi, Shumin Deng, Yunzhi Yao, Qishen Zhang, Linyi Yang, Jindong Wang, and Huajun Chen. 2024a. Detoxifying large language models via knowledge editing.
  36. Wenxuan Wang, Zhaopeng Tu, Chang Chen, Youliang Yuan, Jen-tse Huang, Wenxiang Jiao, and Michael Lyu. 2024b. All languages matter: On the multilingual safety of llms. In Findings of the Association for Computational Linguistics: ACL 2024, pages 5865–5877. find
  37. Xinpeng Wang, Mingyang Wang, Yihong Liu, Hinrich Schütze, and Barbara Plank. 2025b. Refusal direction is universal across safety-aligned languages. arXiv preprint arXiv:2505.17306. — [arXiv:2505.17306](https://arxiv.org/abs/2505.17306) find
  38. Xunguang Wang, Wenxuan Wang, Zhenlan Ji, Zongjie Li, Pingchuan Ma, Daoyuan Wu, and Shuai Wang. 2025c. Stshield: Single-token sentinel for real-time jailbreak detection in large language models. arXiv preprint arXiv:2503.17932. — [arXiv:2503.17932](https://arxiv.org/abs/2503.17932) find
  39. BigScience Workshop, Teven Le Scao, Angela Fan, Christopher Akiki, Ellie Pavlick, Suzana Ilić, Daniel Hesslow, Roman Castagné, Alexandra Sasha Luccioni, François Yvon, et al. 2022. Bloom: A 176b-parameter open-access multilingual language model. arXiv preprint arXiv:2211.05100. find
  40. Haoran Xu, Amr Sharaf, Yunmo Chen, Weiting Tan, Lingfeng Shen, Benjamin Van Durme, Kenton Murray, and Young Jin Kim. 2024. Contrastive preference optimization: Pushing the boundaries of llm performance in machine translation. arXiv preprint arXiv:2401.08417.
  41. An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, et al. 2025. Qwen3 technical report. arXiv preprint arXiv:2505.09388.
  42. An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, et al. 2024. Qwen2. 5 technical report. arXiv preprint arXiv:2412.15115. find
  43. Zheng-Xin Yong, Beyza Ermis, Marzieh Fadaee, Stephen Bach, and Julia Kreutzer. 2025. The state of multilingual llm safety research: From measuring the language gap to mitigating it. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 15856–15871.
  44. Zheng-Xin Yong, Cristina Menghini, and Stephen H Bach. 2023. Low-resource languages jailbreak gpt-4. arXiv preprint arXiv:2310.02446.
  45. Haneul Yoo, Yongjin Yang, and Hwaran Lee. 2025. Code-switching red-teaming: Llm evaluation for safety and multilingual understanding. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 13392–13413.
  46. Hongyi Yuan, Zheng Yuan, Chuanqi Tan, Wei Wang, Songfang Huang, and Fei Huang. 2023. Rrhf: Rank responses to align language models with human feedback. Advances in Neural Information Processing Systems, 36:10935–10950. find
  47. Xiang Zhang, Senyu Li, Bradley Hauer, Ning Shi, and Grzegorz Kondrak. 2023. Don’t trust chatgpt when your question is not in english: a study of multilingual abilities and types of llms. arXiv preprint arXiv:2305.16339. find
  48. Yuanchi Zhang, Yile Wang, Zijun Liu, Shuo Wang, Xiaolong Wang, Peng Li, Maosong Sun, and Yang Liu. 2024. Enhancing multilingual capabilities of large language models through self-distillation arXiv preprint from resource-rich languages. arXiv:2402.12204. — [arXiv:2402.12204](https://arxiv.org/abs/2402.12204) find
  49. Weixiang Zhao, Jiahe Guo, Yulin Hu, Yang Deng, An Zhang, Xingyu Sui, Xinyang Han, Yanyan Zhao, Bing Qin, Tat-Seng Chua, et al. 2025a. Adasteer: Your aligned llm is inherently an adaptive jailbreak defender. arXiv preprint arXiv:2504.09466.
  50. Weixiang Zhao, Yulin Hu, Yang Deng, Tongtong Wu, Wenxuan Zhang, Jiahe Guo, An Zhang, Yanyan Zhao, Bing Qin, Tat-Seng Chua, et al. 2025b. Mpo: Multilingual safety alignment via reward gap optimization. arXiv preprint arXiv:2505.16869.
  51. Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric P. Xing, Hao Zhang, Joseph E. Gonzalez, and Ion Stoica. 2023. Judging llm-as-a-judge with mt-bench and chatbot arena.

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/yang-2026-lasa-language-agnostic-semantic-alignment/