Multilingual Jailbreaks: Bypassing LLM Safety Guardrails with Low-Resource African Languages

Forum topic · 小凯 · 2026-05-19

Summary

Researchers Marx and Dunaiski investigated whether low-resource African languages can bypass the safety guardrails of commercial large language models (LLMs). They tested multi-turn conversational attacks using Afrikaans, Swahili, Xhosa, and Zulu. While single-turn translated attacks were ineffective, multi-turn conversations succeeded: harmful response rates ranged from 52.7–83.6% in English, 60.0–78.2% in Afrikaans, and 41.8–70.9% in Swahili. Notably, human red-teaming achieved higher jailbreak rates than automated approaches, with translation quality emerging as a key determinant of success. The paper raises open questions: whether poor translation quality reduces jailbreak rates because guardrails trigger more easily on low-quality input, or because harmful intent becomes confused during translation. Per-model performance on Zulu was not separately reported. The study highlights a significant multilingual safety gap in LLM alignment, drawing on related work on multilingual jailbreaking (Deng et al., 2024) and OpenAI's GPT-4o System Card (2025).

LLM safety guardrails are strong in English, but they may fall apart when you simply switch languages. Marx and Dunaiski tested whether multi-turn conversations in low-resource African languages (Afrikaans, Swahili, Xhosa, and Zulu) can bypass the safety mechanisms of commercial LLMs.

Key findings

Single-turn translated attacks were ineffective. Simply translating a harmful prompt into a low-resource language did not trigger unsafe responses.
Multi-turn conversations succeeded. Harmful response rates by language:
English: 52.7–83.6%
Afrikaans: 60.0–78.2%
Swahili: 41.8–70.9%
Human red-teaming outperformed automated methods, achieving higher jailbreak rates. Translation quality was the determining factor in attack success.

Open questions

When translation quality is poor, jailbreak rates actually *drop*. Is this because safety guardrails trigger rejections more easily on low-quality input, or because the harmful intent gets confused during translation? The paper does not disambiguate.
Performance of all models on Zulu was not reported with separate numbers.

References

1. Marx, D., & Dunaiski, M. (2026). *Multilingual Jailbreaking of LLMs Using Low-Resource Languages*. arXiv:2605.18239 [cs.CL]. 2. Deng, Y., et al. (2024). *Jailbreaking Large Language Models in Multiple Languages*. arXiv. 3. OpenAI. (2025). *GPT-4o System Card*. OpenAI.