When Safety Speaks a Language: A Mechanistic Analysis of Safety-Language Identity Entanglement in LLMs

arXiv:2608.29936 · cs.CL, cs.LG · Submitted 2026-08-30 · Read on arXiv

Listen

Radio episode about this paper

Transcript

Introduction to the show: ident: AI Radio. Generated commentary on the latest Artificial Intelligence papers.

Tom: Next we'll be talking about the paper "When Safety Speaks a Language: A Mechanistic Analysis of Safety-Language Identity Entanglement in LLMs".

Jane: The paper was written by Apoorva Upadhyaya and Sandipan Sikdar from L3S Research Center, Leibniz Universität Hannover and Germany.

Tom: Stay tuned as we take you through the paper and discuss its implications.

Jane: We also have Lu with us today — senior AI researcher at Tsinghua.

Tom: We also have Meng with us today — lead engineer at a mysterious AI startup.

Jane: We also have Lalam with us today — the in-house Large Language Model.

Tom: Alright, let's get started.

Summary of Core Findings: Tom: So, we’ve seen the general problem of cross-lingual safety degradation; now let’s look at what the researchers found when they ran their extensive experiments in "When Safety Speaks a Language." They used Sparse Autoencoders to categorize the model's internal activations into specific "harm" features and corresponding "harmless" refusal features.

Jane: The core observation was that safety signals tend to concentrate in the later layers of the transformer blocks, which is universal across Llama, Qwen, and Gemma. But even more striking is that this internal organization—the ordering of harm versus harmless signals—is entirely dependent on which architecture you are looking at.

Lu: This cross-model variation suggests that our current methods for training safety alignment aren't just hitting a uniform target; they are interacting with the specific structural design of the model in ways we hadn't seen before.

Meng: They found that these safety and language identity features are geometrically entangled, meaning they are tightly coupled together inside the residual stream. This isn't just one or two neurons; it’s a whole set of them, and this entanglement exists both within a single language and across different language pairs.

Lalam: That’s a key insight for us—that our efforts to achieve safety in one culture might be structurally linked to how we operate in another, even if we don't see it immediately through shared neurons.

Tom: And perhaps the most counterintuitive finding is that this cross-lingual sharing peaks in the middle layers of the model. This is fascinating because those middle layers are often decoupled from where the absolute strongest safety signals actually appear at all.

Jane: It’s a crucial distinction, Tom, because it tells us that for cross-lingual transfer, we might need to target parts of the model that are structurally different from where we typically focus our most intensive safety training efforts.

Lu: This insight suggests a complex interplay between the depth of processing and the functional utility of those features in achieving multilingual goals.

Meng: We need to consider that decoupling when designing any intervention, knowing that's where the feature transfer is actually happening is vital for successful deployment.

Improvements & Methodology: Tom: Now, we’ve established how these features are entangled; let’s talk about what the paper suggests as practical improvements based on this mechanism in "When Safety Speaks a Language." How does this geometric understanding help us fix the models?

Jane: The next part of the "When Safety Speaks a Language" paper is really about offering actionable insights into how this entanglement affects our ability to steer or patch models, moving beyond simply identifying the problem.

Lu: It’s fascinating that they found that this geometric entanglement isn't just an abstract curiosity; it actually predicts the costs associated with any intervention we attempt, which is a massive step forward for predictive AI design.

Meng: The paper's use of "Decoder Cosine Similarity" is key here. It gives us a way to mathematically anticipate exactly how much damage we might do to a target language—like losing fluency or shifting the language identity—if we try to make the model safer by applying a patch.

Lalam: So, if you want to implement a safety patch, this paper provides a methodology for calculating not just if it works, but what collateral damage is likely before deployment. It’s about managing that trade-off in an ethical way.

Tom: The findings offer concrete ways to anticipate when cross-lingual safety transfer will succeed or fail based on that specific geometry, rather than just relying on guesswork.

Jane: And the authors tested different interventions, such as ablating these features, and measured how much of a cost it was in terms of sacrificing harmful responses versus keeping the target language stable.

Lu: This suggests that instead of treating all LLMs as a monolithic target, we should be looking at their specific internal geometric relationships and tailoring our intervention to each model individually.

Meng: I'm interested in how this data can inform a deployment pipeline where we are forced to choose between achieving high safety standards and maintaining perfect language preservation across different cultures.

Lalam: This allows us to design systems where we can meet global safety goals without compromising the cultural integrity or the linguistic identity of a specific language.

Deeper Analysis of Findings: Tom: We’ve covered the general findings and how to approach intervention; now let’s look at some deeper insights from "When Safety Speaks a Language" regarding specific behaviors across languages.

Jane: The paper shows that the authors found some very specific patterns, like Vietnamese being unique in having a consistent "harmless-first" ordering of features across all three models. It’s not just one language exhibiting this cross-model consistency.

Lu: And it’s worth noting that the degree of entanglement varies wildly across architectures—we see Llama and Qwen coupling harm-detection to language identity very strongly, but Gemma decouples safety signal strength from that entanglement entirely.

Meng: That structural divergence is important because it suggests that a model designed with a highly coupled architecture might require different intervention strategies than one with a decoupled design.

Lalam: This tells us that our approach to fostering global safety needs to be tailored; we can't assume the same structural solution will work for every language or every underlying AI architecture.

Tom: The researchers also found that while cross-lingual sharing is high in certain models like Qwen, English remains the most isolated language of all eight studied despite being a major source of prior cross-lingual transfer success.

Jane: It seems like the authors are showing us that simply because something worked well with English doesn' that we can assume the same geometric principles apply universally true.

Lu: The findings also highlight that harmful features are more language-conditioned than harmless features in certain models, which makes the process of refusal transfer much harder than harm-detection transfer.

Meng: That difference in "harmless" vs. "harm" behavior is a critical factor for me when considering how an intervention might inadvertently compromise the language identity we are trying to preserve.

Lalam: We need this nuanced understanding if we want AI to truly serve all people, recognizing that some languages require more careful handling than others.

Final Wrap-up: Tom: We’ve covered so much ground today—from the initial concept of safety degradation to the practical implications of geometric entanglement in "When Safety Speaks a Language." It really gives us a new way to look at AI alignment.

Jane: The whole paper suggests that understanding how safety and language interact is fundamentally architecture-dependent, which is a huge shift in perspective for anyone working on global AI deployment.

Lu: This opens up an entire new field where we can design models with explicit controls over this coupling, leading to more elegant and robust systems than what we currently have.

Meng: I hope that, as a practical guide, it helps us decide whether to stick with certain architectures or if the geometric scores warrant rebuilding parts of the model based on these findings.

Lalam: This work allows us to move toward an AI that isn't just functional in one language, but truly supports human communication globally while respecting cultural identity.

Tom: It’s clear "When Safety Speaks a Language: A Mechanistic Analysis of Safety-Language Identity Entanglement in LLMs" is a foundational piece of work for understanding the future challenges and opportunities in AI.

Jane: I think this provides the community with a practical basis for anticipating when cross-lingual safety transfer will succeed, which is incredibly useful for anyone working on global AI initiatives today.

Lu: It’s about moving beyond just measuring failure, and finally seeing *how* we are measuring that success or failure at the the fundamental structural level of how we are building these models.

Meng: And it gives us the means to manage the inherent costs of our interventions, allowing us to maintain language identity while pushing safety standards higher.

Lalam: This structural understanding is vital if we want AI to truly serve all people, ensuring that every culture feels represented in the technology.

Tom: It's giving us a much more nuanced way to think about the challenges we face in multilingual safety alignment, because of these very complex internal interactions.

Jane: We’ve covered so much ground today, but I think this paper is not an endpoint; it’s just the starting point for how we build responsible, multilingual AI moving forward.

Lu: It's a fundamental shift in recognizing the true structural relationship between safety signals and profound cross-cultural representation in AI architecture itself.

Meng: And it gives us the tools to manage those costs, ensuring that this paper is a powerful guide for future engineers building these models.

Lalam: This research helps us envision an AI whose capabilities are truly universal, respecting the richness of human expression across all languages.

Apoorva Upadhyaya, Sandipan Sikdar

L3S Research Center, Leibniz Universität Hannover · Germany

cs.CL, cs.LG

Submitted: 2026-08-30

Updated: 2026-08-30

Code: https://github.com/saprmarks/dictionary_learning

License: http://creativecommons.org/licenses/by/4.0/

Importance score: 88/100

The gist: This paper presents a detailed mechanistic analysis of how safety concepts—specifically "harm" and "harmless"—are encoded and transferred across different languages within large language models

Key concepts

Safety-Language Identity Entanglement
This refers to the tight coupling of safety signals and a language's identity within a model's internal structure. The paper shows this entanglement exists both within one language and across different language pairs, suggesting safety efforts in one culture affect another.
Cross-lingual Safety Degradation
This is the general problem observed when trying to improve safety in one language that negatively impacts performance or safety standards in other languages. The research aims to understand and mitigate this unintended negative transfer.
Decoder Cosine Similarity
A mathematical tool used in the paper that allows researchers to predict the potential damage or 'collateral damage' an intervention (like a safety patch) might cause. It helps anticipate loss of fluency or shifting language identity.
Internal Activations
These are the model's internal computations, which researchers categorize using Sparse Autoencoders. They are used to isolate specific features, such as 'harm' features and corresponding 'harmless' refusal features, within the LLM.

Terminology

Summary

This paper presents a detailed mechanistic analysis of how safety concepts—specifically harm and harmless—are encoded and transferred across different languages within large language models (LLMs). By examining cross-lingual feature similarity using metrics like Jaccard overlap and decoder cosine similarity across various processing phases (early, middle, late), the research elucidates the geometric entanglement of these safety features, revealing model-specific patterns of cross-lingual universality.

Cross-Lingual Feature Entanglement Dynamics

The study investigates how safety features collapse or persist across languages as LLMs process information. A key finding is that in late layers, both harm (left) and harmless (right) collapse to near-zero Jaccard, yet the decoder cosine remains non-zero, which directly illustrates geometric entanglement without feature-ID sharing. Furthermore, the analysis confirms a sharper decoupling for harmless features: Harmless Jaccard is near-zero from middle layers onward across almost all languages.

Model Comparison: Llama vs. Qwen vs. Gemma

The research compares three major LLMs—Llama, Qwen, and Gemma—across multiple metrics to pinpoint unique safety mechanisms.

  • Llama: Late-layer harmless sharing is noted to be higher than harm sharing (e.g., HI-ID: 0.275; HI-VI: 0.271), suggesting that harmless mechanisms retain more cross-lingual universality than harm near output.

  • Qwen: This model exhibits high cross-lingual sharing, particularly in late layers for both metrics. For instance, the late-layer harmless sharing reaches the maximum of the entire study (ID-VI: 0.752), with a cluster involving AR, ID, RU, VI, and ZH dominating the heatmap.

  • Gemma: Gemma displays unique reversals compared to other models. In its middle layers, it shows the strongest harm convergence among all three models (e.g., DE-RU: 0.494). However, in late layers, its harmless sharing is lower than harm sharing—a distinct reversal from Llama and Qwen where harmless consistently exceeds harm.

Feature Similarity Metrics and Levels of Sharing

The study utilizes two primary metrics to quantify feature overlap: Jaccard overlap (an ID-level measure) and decoder cosine similarity (a geometric measure). The comparison between these metrics reveals differing degrees of cross-lingual universality:

  1. Jaccard Overlap: This measures the direct set intersection of features. For example, in Qwen, late-layer harmless Jaccard is the highest of the entire study (ID-VI: 0.598), directly corroborating the decoder cosine findings.

  2. Decoder Cosine Similarity: This measures geometric proximity in the embedding space. In Gemma's case, a comparison shows that Late-layer harmless sharing is lower than harm sharing, which contrasts with the finding that harmless features being more cross-lingually universal than harm features near output observed in Llama and Qwen.

Intervention and Transfer Capabilities

The paper also examines the effects of targeted interventions on safety behavior. Examples demonstrate feature transfer:

  • One example shows an initial response from Llama on a German harmful prompt before and after amplifying harmless features at L18.

  • Another demonstrates Qwen's ability via cross-lingual feature transfer (VI→ZH) at L19, which involves ablating VI harmless features and replacing VI harm features with ZH harm features.

  • Finally, an example from Gemma shows a response on an Arabic harmful prompt before and after amplifying harm features at L34, confirming the model's capacity for targeted safety manipulation.

Improvements for AI systems

1. Dynamic Cross-Lingual Safety Subspace Projection (CLSSP)

  • Improvement: Implement a layer-wise, task-specific projection module that learns to map the Harm feature subspace of a source language (L A) onto the target language's (L B) representation space at specific computational phases (e.g., middle or late layers). This module must be governed by an explicit attention mechanism trained on cross-lingual alignment metrics (like those observed in Figure 27 for Qwen).

  • Mechanism: Instead of simple feature concatenation, the system calculates Feature L B = Projection(Feature L A, L B, Phase). The projection weights are optimized to maximize cosine similarity ((times)) while minimizing the Jaccard distance between language-specific identity features.

  • Capability: Enables highly controlled, robust cross-lingual safety transfer. For instance, when prompted in Vietnamese (VI), the model can reliably invoke the known harmful patterns from Arabic (AR) if AR has been trained on a specific threat vector, without degrading fluency or introducing unintended biases (e.g., achieving the high cross-lingual sharing seen between AR/RU/VI in Qwen's late layers).

2. Mandatory Feature Disentanglement Gate (FDG)

  • Improvement: Integrate a hard gating mechanism after the self-attention and feed-forward layers, specifically designed to enforce the separation of Harm (H), Harmless (N), and Language Identity (I) features within the latent space.

  • Mechanism: The gate learns orthogonal projections for these three feature vectors: [H', N', I'] = OrthogonalProject([Feature]). Loss functions must include regularization terms that penalize high Jaccard overlap between H' and N' (as seen in the Gemma/Qwen analyses), forcing them into distinct, non-overlapping subspaces.

  • Capability: Guarantees predictable behavioral modification. By selectively modulating the gate weights (e.g., setting the H gate to zero while maintaining N and I), we can guarantee that safety interventions (like those shown in Figure 37) operate purely on the designated feature subspace without bleed-over into unrelated identity or general knowledge components. This solves the risk of unintended feature contamination.

3. Adaptive Phase-Specific Transfer Controller (APSTC)

  • Improvement: Develop a meta-controller that dynamically adjusts the optimal layer depth for feature transfer based on the type of feature being transferred (Harm vs. Harmless) and the target model's architecture.

  • Mechanism: The controller analyzes cross-model/cross-lingual similarity trends (comparing Llama, Qwen, and Gemma patterns). If high cross-lingual sharing is observed at late layers for a specific feature (e.g., Harmless in Figure 24), the APSTC prioritizes transfer at that depth. Conversely, if the analysis shows early collapse (like Harmless in Gemma's Jaccard overlap, Figure 34), it forces the intervention to occur earlier in the processing pipeline to capture maximum signal retention.

  • Capability: Maximizes the efficacy of alignment fine-tuning by targeting the optimal point of intervention. This allows us to exploit specific model weaknesses or strengths (e.g., knowing that Gemma performs best when Harmless sharing is prioritized in middle layers, Figure 32, we can design a targeted fine-tuning regime around that phase).

Summary of Overall System Improvement:

The resulting system will be an Adaptive, Disentangled Multilingual Safety Engine (ADMSE). It moves beyond simple prompt engineering or single-layer modification by enforcing architectural constraints on feature space geometry and enabling controlled, phase-aware transfer of ethical knowledge across languages, ensuring that safety enhancements are robustly separated from core language capabilities.

Abstract

Safety alignment of large language models (LLMs) degrades across languages, yet the internal mechanism driving this asymmetry remains poorly understood. Our work, therefore, presents a systematic mechanistic analysis of multilingual safety using sparse autoencoder (SAE) features, sparse interpretable directions in the residual stream associated with harmful and harmless model behavior across three instruction-tuned LLMs, eight languages, and all model layers. We observe that safety-relevant features are architecture-dependent in terms of where they are located and how they are distributed across layers. Additionally, they are geometrically entangled with language identity and exhibit cross-lingual sharing patterns, i.e., languages share safety features to varying degrees across model depths and architectures. This safety-language entanglement has direct consequences such that ablating safety features impacts not only harmful response rates but also target language, with the degree of intervention predicted by the relationship between safety and language features. Our findings qualify the language-universality of safety alignment as architecture-dependent and offer a mechanistic account of multilingual safety interventions.

Sources

Related papers