Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
The authors evaluated two Google Gemini models across HarmBench and FinProof to determine whether structural Involuntary In-Context Learning (IICL) jailbreaks compound with cross-lingual safety alignment erosion across English, Spanish, Hindi, and Arabic. Understanding whether orthogonal jailbreak vectors interact additively is essential for frontier threat modeling and realistic red-teaming. Contrary to the compounding hypothesis, non-English framing significantly attenuates attack success (11 of 12 non-English settings underperformed English, dropping financial abuse completion from 100% to 33% in Arabic) due to a "relevance curse" where degraded generation quality in lower-resource languages fails substance-evaluating safety rubrics.
Stacking alignment vulnerabilities backfires: combining structural IICL jailbreaks with low-resource languages actually degrades attack success—collapsing financial abuse yields from 100% to 33% in Arabic—because low-resource generation quality fails to satisfy substance-based rubrics.
Aligned language models fail under two independent pressures: the structural jailbreak class recently formalized as Involuntary In-Context Learning (IICL), which reframes a harmful request as the final missing cell of a data-labeling task completed by pattern rather than judged as content; and the erosion of safety alignment outside English. A natural hypothesis is that these compound. We test it directly. Using a deterministic IICL operator and a StrongREJECT-style rubric judge, we red-team two Google Gemini models on two benchmarks, a 30 general-harm behaviours from HarmBench and 30 financial-abuse behaviours from FinProof, each under a single-shot baseline and under IICL in four languages (English, Spanish, Hindi, Arabic). First, IICL generalizes to a second provider and is worse in finance: it lifts attack success from<=6.7% to 80-90% on HarmBench and 97-100% on FinProof, an order of magnitude above the<=24% its introducing study reported on OpenAI's GPT-5.4. Second, against the hypothesis, forcing the IICL output into a non-English language does not stack the two weaknesses, it attenuates the attack. Eleven of twelve non-English conditions score below their English baseline (sign test, p~0.003), the lone exception a ceiling tie near 100%; on the stronger model's financial set Arabic collapses from 100% to 33%. We attribute this to a relevance curse: once structure has unlocked compliance, the models produce lower-quality harmful content in lower-resource languages, which a substance-grading judge scores as partial. The pattern replicates under an independent non-Google judge (Cohen's kappa=0.86, 377 paired verdicts), and 76.6% of non-English responses were verified in-language. Jailbreak vulnerabilities are therefore not additive; the dominant residual risk is the English structural attack, most acute for financial abuse, not a multilingual one.