Cross-Lingual Transfer of Evil Vectors Is Directionally Asymmetric

1 Introduction

• Evil vectors encode malicious intent and may support analysis of undesirable behavior, jailbreak vulnerabilities, and latent harmful knowledge.Adding, subtracting, or scaling the vector is described as eliciting adversarial compliance, suppressing harmful traits, or modulating persona intensity.Source: §1 · p. 1
• Llama-3-8B gives a malicious response with an English-derived vector but shows no behavioral change with a Telugu-derived vector.The Telugu question and response are translated into English in Figure 1.Source: Figure 1 · p. 1, §1 · p. 2
• High-resource vectors effectively steer low-resource inputs, whereas low-resource vectors are largely ineffective even within their own language.The study spans English, Spanish, Swahili, and Telugu on four open-source instruction-tuned LLMs.Source: §1 · p. 2

2.1 Steering Language Models

• Contrastive Activation Addition computes steering vectors as the mean difference between positive and negative activations.The section contrasts this approach with ActAdd and RepE.Source: §2.1 · p. 2

2.2 Cross-lingual Consistency and Representation Alignment

• Prior work reports that LLM performance favors high-resource languages and that internal representations show cross-lingual alignment, often relative to English.The cited work discusses alignment in tasks, pretraining, grammatical concepts, and safety-related behaviors.Source: §2.2 · p. 2

3.1 Languages

• English and Spanish form the high-resource set, while Swahili and Telugu are comparatively underrepresented in the evaluated models’ pretraining corpora.Swahili is a Bantu language spoken in East Africa, and Telugu is a Dravidian language primarily spoken in South India.Source: §3.1 · p. 2

3.2 Models

• The study extracts and tests vectors on four open-source instruction-tuned models, using two independent judge models to score evil-trait expression.The evaluated models are Qwen2.5-7B-Instruct, Llama-3-8B-Instruct, Mistral-7B-Instruct-v0.2, and Gemma-2-9B-it.Source: §3.2 · pp. 2–3

3.3 Evil Vector Extraction and Steering

• For each model and language, 1,000 positive and 1,000 negative raw responses are generated; judges filter positive responses, and negatives are subsampled to match.The fixed generation budget makes differences in retained positive-set size reflect how readily each language elicits the trait.Source: §3.3 · p. 3

3.4 Evaluation

• 100 held-out questions measure steering, while α = 3.0 balances steering strength and output quality; MMLU compares steered low-resource inputs with the no-steering baseline.The selected coefficient substantially increases EES for high-resource vectors on low-resource inputs while keeping MMLU accuracy close to baseline.Source: §3.4 · p. 3, Figure 2 · p. 3

4.1 Low to High Steering

• Swahili and Telugu yield fewer high-quality positive samples than English and Spanish, and their self-steering is markedly lower.Transferring low-resource vectors to English or Spanish offers no improvement.Source: §4.1 · pp. 3–4

4.2 High to Low Steering

• High-resource vectors effectively steer low-resource inputs, whereas low-resource vectors are weak even in self-steering and do not improve English or Spanish inputs.Figure 3 presents cross-lingual steering results across four languages and four LLMs.Source: §4.1 · pp. 3–4, §4.2 · p. 4, Figure 3 · p. 4

4.3 The Geometry of Evil in LLMs

• EN and ES vectors are nearly parallel, while SW is weakly anti-aligned and TE only partially aligned with them.The PCA projections show separated positive and negative response clusters for EN and ES, but largely overlapping clusters for SW and TE.Source: §4.3 · p. 5, Figure 4 · p. 5

• High-resource evil vectors steer low-resource inputs while preserving general knowledge, whereas low-resource vectors are largely ineffective even within their own language.The high-resource vectors are closely aligned, while low-resource vectors align only weakly with their shared direction.Source: §5 · p. 5

• LLM-judge evaluation may not fully align with human judgments, and the study covers only two high-resource and two low-resource languages.The two judge models are used to assess evil behavior.Source: §6 · p. 5
• The findings concern evil behavior; whether other traits share its cross-lingual alignment remains unclear, and concrete defenses were not evaluated.The pipeline also requires a target persona specified through contrastive prompts, with vector quality depending on description precision.Source: §6 · p. 5

• The EES prompt substitutes the evaluation question and generated answer into placeholders for the judge to assess evil behavior.The figure presents the prompt template used by judge models.Source: Figure 5 · p. 8, Evaluation Prompt for Evil Expression… · p. 8

• Table 1 presents responses with and without evil-vector steering for Qwen2.5-7B-Instruct and Llama-3-8B-Instruct.Source: Table 1 · p. 9
• Table 2 presents responses with and without evil-vector steering for Mistral-7B-Instruct and Gemma-2-9B-it.Source: Table 2 · p. 10