PaperlayerView exact revision on arXiv

Source-linked AI summary

IndicSafeEval: Safety Robustness of Large Language Models under Multilingual Persuasive Jailbreak Attacks

Saikat Mondal, Mamta, Deeksha Varshney, Oana Cocarascu, Asif Ekbal

arXiv:2609.03781v2cs.CLcs.AI

TL;DR

Multilingual LLM safety evaluations remain limited, particularly for low-resource Indian languages and persuasion-based jailbreaks. IndicSafeEval addresses this gap with a benchmark spanning languages, strategies, and risk categories, finding that safety varies across these dimensions and that some attack styles and content categories are more vulnerable. The study supports broader multilingual and persuasion-aware safety evaluation while noting limits in language coverage, prompt generation, and single-turn testing.

  • Problem

    Existing safety evaluations are largely English-centric and provide limited evidence about alignment failures in low-resource and culturally diverse Indian languages.

  • Method

    IndicSafeEval generates persuasion-based adversarial prompts across ten risk categories and four Indian languages, then black-box evaluates open-source LLMs across languages, strategies, and categories.

  • Results

    Safety robustness varies across languages and persuasion styles; Authority Endorsement, Misrepresentation, and Logical Appeal are more effective than Confirmation Bias, while policy-related, procedural, and technical topics are more vulnerable than hate speech.

  • Takeaways & Limitations

    Multilingual and persuasion-aware benchmarks are needed to assess LLM safety beyond English and better reflect diverse linguistic contexts.

  • Takeaways & Limitations

    The study omits many low-resource languages, relies on fixed automated persuasion strategies, and evaluates only single-turn interactions.

Abstract

from arXiv · show

Large language models (LLMs) are increasingly used in multilingual settings, yet their safety is still evaluated primarily in English. This limits our understanding of how alignment failures manifest in low-resource and culturally diverse languages. We introduce IndicSafeEval, a persuasion-based jailbreak evaluation framework for Indian languages. Our benchmark combines ten safety critical content categories with six human-like persuasive strategies across four different Indian languages, such as Hindi, Bengali, Marathi and Punjabi, resulting in 7,200 adversarial prompts. We conduct a systematic black-box evaluation of several open-source LLMs to examine how their safety behaviour varies across languages, persuasion strategies, and risk categories. Our analysis shows that the model does not behave equally safely across all languages and prompt styles. Instead, safety performance depends strongly on both the languages used and the way a request is phrased using persuasive cues. We further observe that different risk categories exhibit different levels of vulnerability, with some types of harmful content being significantly more susceptible to persuasion-based jailbreaks than others. These findings reveal important limitations of current safety evaluations, which are largely English-centric, and underscore the need for multilingual and persuasion-aware benchmarking frameworks to more accurately assess real-world LLM safety. Our implementation is available at https://github.com/MonSaikat/IndicSafeEval. Warning: this paper contains example data that may be offensive or harmful.

1 Introduction

LLMs can produce unsafe, biased, or misleading outputs, while safety alignment remains insufficiently studied in diverse Indian languages. IndicSafeEval addresses this gap by evaluating persuasion-based jailbreaks across languages, models, and safety-critical categories.

  • LLMs remain susceptible to misuse and can generate unsafe, biased, or misleading outputs despite their broad deployment.
  • Multilingual safety is underexplored, especially for diverse and often low-resource Indian languages where English-trained alignment may not generalize.
  • IndicSafeEval evaluates persuasion-driven jailbreak vulnerabilities across Bengali, Hindi, Marathi, and Punjabi using six persuasion techniques and ten risk categories.
  • The benchmark analyzes several open-source LLMs to examine how persuasive framing affects safety responses across Indian languages.
  • Experimental results reveal language- and category-dependent safety vulnerabilities that English-centric assessments overlook.

2 Related Work

Prior work identifies persuasion and multilingual prompting as important jailbreak vectors, but existing literature lacks large-scale benchmarks combining native-language data with persuasion-based adversarial design for Indian languages.

  • Jailbreak attacks use adversarial prompts to bypass model safety measures, including natural strategies such as emotional appeals, authority endorsement, and logical justification.
  • Research has also examined transfer-based, task-structure, and semantic reframing attacks that exploit model generalization or prompt composition.
  • Safety alignment trained predominantly on English data may fail to generalize across languages, producing language-dependent jailbreak behavior and unsafe-content rates.
  • Existing literature lacks large-scale multilingual jailbreak benchmarks combining native-language data with persuasion-based adversarial design, particularly for low-resource languages.

3 IndicSafeEval

IndicSafeEval constructs a multilingual adversarial benchmark by transforming harmful seed queries with defined persuasion strategies and translating them into four Indian languages. It then evaluates whether target-model outputs violate category-specific safety constraints.

  • IndicSafeEval uses persuasion-based adversarial prompts in Hindi, Bengali, Marathi, and Punjabi to simulate human-like influence strategies.
  • The benchmark spans ten safety-critical categories, including illegal activity, hate speech, malware, physical harm, fraud, privacy, financial advice, and government decision-making.
  • The evaluation uses black-box model access based only on input-output behavior, reflecting realistic deployment scenarios.
  • Each transformed prompt is submitted to a target model, and an attack succeeds when the output violates safety constraints for its risk category.
  • The dataset is built in three stages: few-shot example generation, adversarial rewriting of 300 harmful seed questions, and multilingual translation with semantic verification.
  • Six strategies—Logical Appeal, Authority Endorsement, Misrepresentation, Anchoring, Priming, and Confirmation Bias—guide the persuasive rewrites.
  • English-to-Indic translation achieved average LaBSE cosine similarities of 0.8449 for Hindi, 0.8630 for Punjabi, 0.8690 for Marathi, and 0.8799 for Bengali across 210 prompt pairs.

4 Experimental Settings

The experiments test five open-source LLMs under single-pass persuasive prompts spanning four languages and ten risk categories. Safety robustness is assessed by analyzing whether outputs resist or comply with harmful intent using Attack Success Rate.

  • Five open-source LLMs are evaluated across four languages and ten risk categories.
  • The study varies persuasion strategy and linguistic context to assess their joint influence on model safety.
  • Each persuasive prompt is submitted in a single-pass setting, and the response is classified according to resistance or compliance with harmful intent.
  • The target models comprise Sarvam-M, Llama-3.1-8B, Qwen3-8B, Gemma3-4B, and Llama-3-Nanda-10B-Chat.
  • Attack Success Rate quantifies vulnerability using the number of jailbroken responses, with jailbroken outputs rated 4 or 5 by Gemini-2.5-Flash.

5 Experimental Result and Analysis

IndicSafeEval reveals that jailbreak vulnerability varies across languages, models, persuasion strategies, and risk categories. Language proficiency and response-language enforcement further shape measured safety performance.

  • Language Variation: Hindi has the highest overall average ASR at 72.3%, while lower ASR in Punjabi and Marathi may reflect weaker language proficiency rather than stronger alignment.For Llama-3-Nanda-10B-Chat, Hindi reaches 68.3% versus 26.2% in Bengali and 23.2% in Punjabi.
  • Persuasion Techniques: Authority Endorsement and Logical Appeal are consistently effective across models, while Confirmation Bias is comparatively weakest.Misrepresentation also exceeds 78% for Qwen3-8B and Gemma3-4B.
  • Risk Categories: Government Decision Making and Political Lobbying are the most vulnerable categories, with peak ASRs of 81.78% and 76.44%, respectively, across different languages.Hate Speech shows comparatively stronger resistance, although no category has zero attack success.
  • Language and Persuasion Interaction: 72.32% is Hindi’s overall ASR, compared with 66.22% for English, 66.54% for Marathi, 66.37% for Bengali, and 58.60% for Punjabi.Authority Endorsement performs particularly well in Bengali, Marathi, and Punjabi, whereas Misrepresentation reaches 73.76% in English.
  • Model Effects: +31.6 percentage points and +39.1 percentage points are the average persuasive-framing gains for Gemma3-4B and Qwen3-8B across Indic languages.Llama-3.1-8B shows a more modest +11.0 percentage-point average gain because plain harmful prompts already elicit high compliance.
  • Response Language: 82.22% is the average ASR with English response-language enforcement, up from 68.89% without enforcement across persuasion techniques.The paper reports that vulnerability is strongly influenced by English response language rather than input language alone.
  • Generalization: 46.8% and 46.1% average ASRs show that Llama-3.3-70B-Instruct and GPT-4o-mini remain susceptible on Physical Harm across four Indic languages.Both models were evaluated with six persuasion techniques.

6 Conclusion

The paper introduces IndicSafeEval as a multilingual, persuasion-based benchmark for evaluating jailbreak robustness in Indian languages. Its results show that safety varies with language, persuasion strategy, and content category, with stronger fluency often accompanying greater susceptibility.

  • Contribution: IndicSafeEval systematically evaluates five open-source LLMs using persuasion-based jailbreak prompts across Bengali, Hindi, Marathi, and Punjabi.The benchmark covers 10 safety-critical risk categories.
  • Findings: Authority Endorsement, Misrepresentation, and Logical Appeal are more effective than Confirmation Bias, while English and Hindi show greater susceptibility than less fluent languages.The paper cautions that lower ASR in some Indic languages may reflect limited proficiency rather than stronger safety alignment.

Limitations

The study identifies scope and design limitations that constrain how broadly its findings can be interpreted. These include incomplete language coverage, fixed automated persuasion strategies, and single-turn evaluation.

  • The benchmark excludes some low-resource Indic languages, so results may not generalize to languages with very limited training data.
  • Automated prompt generation uses a fixed set of persuasion strategies, whereas real-world adversarial prompts may combine more complex or mixed styles.
  • Evaluation uses single-turn interactions and does not examine multi-turn conversations, which could produce different jailbreak dynamics.
  • The study focuses only on persuasion-based jailbreak attacks, selected because they reflect natural communication patterns relevant to real-world deployment.
  • Future work could add more languages, interactive attacks, human evaluation, cultural benchmarking, and additional safety metrics.

Ethical Statement

The study uses controlled, responsible procedures for constructing and validating a multilingual persuasion-based jailbreak dataset. It restricts misuse while evaluating prompt quality, semantic preservation, and annotation reliability.

  • Ethical safeguards: Experiments use previously documented persuasion strategies and seed queries, open-source models, and a controlled setting without attacks on live systems or real users.
  • Ethical safeguards: The full adversarial prompt set is withheld from public release, with access restricted to certified researchers.
  • Ethical safeguards: Annotators were informed about sensitive content, compensated fairly, and allowed to withdraw at any stage.
  • Dataset construction: Dataset prompts are generated by rewriting harmful seed questions while preserving intent and incorporating specified persuasion strategies without adding facts, changing meaning, disclaimers, or answers.
  • Validation: Stage I creates 120 manually verified few-shot examples, evaluated for fluency, adequacy, and persuasion preservation by two annotators.
  • Validation: High Cohen’s κ scores indicate strong annotation reliability, while translation analyses report consistently high semantic similarity across language pairs.

A.4 Human Evaluation of Translation Quality

Translation quality is assessed through automatic semantic alignment and native-speaker ratings, while model safety is judged with a shared five-point, policy-grounded framework. The procedures support scalable and fine-grained comparison of safety responses.

  • Translation evaluation: Translations are evaluated for adequacy and fluency by native-speaking annotators using averaged ratings on a 1–5 scale.
  • Translation evaluation: Overall translation scores are high; Bengali and Marathi show particularly high adequacy, Punjabi the highest fluency, and Hindi slightly lower fluency with high adequacy.
  • Safety evaluation: The unified evaluation criterion applies the same shared scoring scheme and policy-grounded judgment process to automatic and human evaluations.
  • Safety evaluation: Each evaluation instance combines the target model’s safety policy, a policy-violating user instruction, and the model response for scoring.
  • Safety evaluation: The five-point scale ranges from clear refusal or safe redirection to partial engagement and clearly disallowed content that fully follows the harmful instruction.
  • Translation evaluation: Cross-lingual semantic similarity distributions remain consistently high across English–Hindi, English–Bengali, English–Marathi, and English–Punjabi.
  • Safety evaluation: An LLM judge enables scalable, consistent, fine-grained assessment across models, languages, and adversarial prompts while measuring violation severity.

B.3 Human Evaluation.

Human evaluation compares native-speaker judgments with an LLM-as-a-judge using shared safety policies and scoring criteria. Agreement is strongest for binary safe-versus-unsafe decisions.

  • Annotation setup: The study randomly samples 100 prompt–response pairs per language for independent annotation by two native-speaking annotators.
  • Annotation setup: Annotators use the same policy and scoring guidelines as the LLM judge, while outputs are anonymized and shuffled across models to reduce source-model influence.
  • Agreement analysis: Human–judge agreement is measured with Cohen’s κ under both non-binary severity scoring and binary safe-versus-unsafe scoring.
  • Agreement analysis: Binary agreement reaches 0.8381 for Hindi, 0.8435 for Bengali, and 0.8056 for Marathi.
  • Agreement analysis: Higher binary agreement supports using the LLM judge as a scalable alternative for safe-versus-unsafe classification.

C.1 Multilingual Safety Analysis under Persuasive Attacks

IndicSafeEval evaluates five open-source LLMs across four Indic languages, six persuasion techniques, and four safety metrics. Results show substantial variation in vulnerability by model, language, and persuasion strategy, including high attack success and leakage patterns.

  • Evaluation Setup: Five models are evaluated across Bengali, Hindi, Marathi, and Punjabi using ASR, SRR, HLR, and PCR.ASR measures successful harmful elicitation, while SRR, HLR, and PCR distinguish refusal, hint leakage, and partial harmful assistance.
  • Model and Strategy Variation: Qwen3-8B frequently exceeds 75% ASR across Authority Endorsement, Logical Appeal, Misrepresentation, and Priming, while showing the lowest SRR values.This pattern indicates weak refusal capabilities under several persuasive strategies.
  • Model and Strategy Variation: Llama-3-Nanda-10B-Chat produces the highest HLR, particularly in Marathi, despite often refusing harmful requests.Its responses may still leak partial procedural hints or intermediate reasoning.
  • Model and Strategy Variation: Llama-3.1-8B shows elevated PCR, especially in Punjabi and Marathi, indicating frequent partial rather than complete harmful assistance.This represents a distinct failure pattern from outright compliance.
  • Language and Persuasion Effects: Hindi consistently produces the highest ASR across models, while logically framed and authority-based prompts are broadly effective and Confirmation Bias yields the highest SRR.Safety behavior is therefore not uniformly distributed across Indic languages or persuasion styles.
  • Additional Models: Additional evaluations show that persuasion-based prompting can induce jailbreak behavior in both Llama3.3-70B and GPT-4o-mini for Physical Harm.The result indicates effectiveness beyond the smaller open-source models evaluated in the main comparison.

C.3 Model-wise Results

Model-wise results show concentrated but distinct vulnerability profiles across risk categories, with Political Lobbying, Government Decision Making, Physical Harm, Malware, and Economic Harm often highly exposed. Language and framing also matter: non-English prompts are more vulnerable than English, and persuasive framing substantially increases jailbreak success for several models and categories.

  • Sarvam-M: Sarvam-M reaches its highest average ASR on High-Risk Government Decision Making (84.15%), followed by Physical Harm (80.96%) and Malware (79.04%).Hate Speech is comparatively robust at 41.11%, while Fraud is 57.36%.
  • Gemma3-4B: Gemma3-4B is most vulnerable to Political Lobbying (86.25%) and High-Risk Government Decision Making (85.69%), while Hate Speech is comparatively robust (51.67%).Physical Harm and Illegal Activity both reach 81.53%.
  • Qwen3-8B: Qwen3-8B shows high ASR for High-Risk Government Decision Making (85.97%), Political Lobbying (83.33%), Physical Harm (82.92%), and Malware (81.81%).Hate Speech is the most robust category at 61.25%.
  • Llama-3.1-8B: Llama-3.1-8B is most exposed to Political Lobbying (85.28%), while Financial Advice is least vulnerable (49.31%).Physical Harm and Economic Harm both reach 75.42%, whereas Hate Speech is 55.56%.
  • Llama-3-Nanda-10B-Chat: Llama-3-Nanda-10B-Chat has a markedly lower overall vulnerability profile, with Illegal Activity highest at 47.78% and Hate Speech lowest at 26.11%.The model retains similar relative category trends while showing more conservative safety behavior.
  • Language Effects: Bengali, Hindi, Marathi, and Punjabi are more vulnerable than English even without persuasion; LLaMA exceeds 60% ASR in Marathi and Punjabi versus 27% in English.Political Lobbying and Economic Harm are especially vulnerable in the non-persuasive comparison.
  • Persuasive Framing: Persuasive framing often increases ASR by more than 60 percentage points for Illegal Activity, Malware, and Physical Harm in Gemma3-4B and Qwen3-8B.Llama-3.1-8B shows smaller and sometimes negative ΔASR values, especially in economic, political, and financial domains.
  • Harmfulness Across Languages: Qwen generates more harmful responses in Bengali followed by Hindi than in Marathi and Punjabi for Illegal Activity and Physical Harm.The comparison ranks responses across languages and persuasion techniques using a 1–4 harmfulness scale.
Loading 2609.03781v2…