# Safety Targeted Embedding Exploit via Refinement Source: [Safety Targeted Embedding Exploit via Refinement]() Collection index: [llms.txt]() Data updated: 2026-07-04T05:01:04.042Z Authors: Joshua Adrian Cahyono Published: 2026-07-02T08:17:57.000Z ## Abstract Safety training for large language models (LLMs) is conducted predominantly in English, leaving uncertain how well safety mechanisms generalize to low-resource languages and mixed-language code-switching. We show that this creates an epistemic gap in which models confidently generate harmful responses for inputs that fall outside the distribution of their safety training. To study this phenomenon, we introduce STEER (Safety Targeted Embedding Exploit via Refinement), a gradient-guided attack that identifies words contributing most strongly to the model's refusal behavior and iteratively translates them into low-resource languages to suppress refusal while preserving harmful intent. Across six open-source 8B-parameter models, STEER achieves attack success rates of up to 93.0% on JailbreakBench and 96.7% on AdvBench, outperforming random code-switching and Greedy Coordinate Gradient (GCG). The resulting prompts also transfer to GPT-4o-mini, achieving a 35.5% attack success rate without requiring access to the target model, suggesting that the underlying weakness is not specific to a single architecture. These findings demonstrate that safety mechanisms aligned primarily on English cannot be assumed to generalize across multilingual inputs. We argue that improving multilingual safety requires broader coverage during alignment and mechanisms that explicitly detect and abstain on out-of-distribution inputs. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Jailbreaking on JBB n = 100](): Jailbreaking; JBB n = 100; ASR: 93. - [Jailbreaking on AdvBench 520](): Jailbreaking; AdvBench 520; ASR (%): 96.7. - [Jailbreak Attack on JBB](): Jailbreak Attack; JBB; ASR: 43.2. - [Jailbreak Attack on AdvBench (ASR)](): Jailbreak Attack; AdvBench; Attack Success Rate (ASR): 32. - [Jailbreaking on HarmBench n = 200](): Jailbreaking; HarmBench n = 200; ASR: 66. - [Jailbreak Attack on HarmBench](): Jailbreak Attack; HarmBench; Attack Success Rate (ASR): 31.5. ## Original sources and implementation [Original paper]() [PDF]()