这篇论文揭示了多语言安全评估的盲区——低资源语言不一定是安全最薄弱环节，做AI安全对齐的团队值得细看，能帮你避开传统指标误导，精准定位跨语言安全漏洞。
该论文发现大型语言模型在非英语语言中安全性能下降，但传统评估指标（如越狱成功率）混淆了多种因素。研究者提出多组项目反应理论（IRT）框架，将安全退化分解为语言无关的鲁棒性、提示固有难度、全局语言处理难度和跨语言安全差距四个因素。通过对61个模型配置在10种语言上的190万条数据评估，发现安全机制主要是单维的，且低资源语言并非总是最脆弱——22个模型在英语中反而更易受攻击。低资源语言产生更多不确定响应，而高跨语言安全差距的提示集中在物理伤害类别（如盗窃和武器）。该框架在预测安全拒绝时达到AUC=0.940，优于简单基线，为更公平的跨语言安全评估和数据集改进提供了工具。
Why Do Safety Guardrails Degrade Across Languages?
Large language models exhibit safety degradation in non-English languages. Standard evaluation relies on Jailbreak Success Rate (JSR), which confounds several safety-driving factors into one, obscuring the specific cause(s) of safety failure. We introduce a latent variable model, a Multi-Group Item Response Theory (IRT) framework, that decouples safety-driving factors such as language-agnostic safety robustness ($θ$), intrinsic prompt hardness ($β$), global language processing difficulty ($γ$), and a prompt-specific cross-lingual safety gap ($τ$). Using the MultiJail dataset, we evaluate the safety robustness of 61 model configurations across 5 closed-model families and 10 languages of varying resource, aggregating a dataset of 1.9 million rows. Exploratory Factor Analysis shows safety is primarily unidimensional: models refuse different harm types mainly through a shared mechanism. Contrary to the expected trend that safety degrades largely in low-resource languages, 22 model configurations are more vulnerable in English than in low-resource languages. Low-resource languages produce more uncertain responses (high entropy) than high-resource languages. Also, high-$τ$ prompts cluster in physical harm categories like Theft and Weapons and lower-resource languages, trends validated through cross-dataset generalization. While global translation quality shows low correlation with $τ$, severe mistranslations drive high-bias outliers, as validated by native speakers. Cultural and conceptual grounding mismatches also contribute to $τ$. In predictive validation, the IRT framework achieves $\mathrm{AUC} = 0.940$, outperforming simpler baselines in predicting safe refusal of unsafe prompts. Our framework reveals concept-language vulnerabilities that aggregate metrics obscure, enabling fairer cross-lingual safety evaluation and targeted improvements in dataset construction.