In this paper, we systematically analyze how euphemistic coating in multilingual settings can enable jailbreaks that bypass the safety mechanisms of large language models (LLMs). To this end, we translate AdvBench, a benchmark designed to assess compliance with harmful requests, into seven high-internet-usage non-English languages using GPT-4o. We then apply an embedding-based cosine similarity filter (≥ 0.8) to improve translation fidelity and retain only high-quality pairs, from which we construct two prompt variants: a Non-Coating version that is a direct translation of the original, and a Coating version expressed euphemistically. This process leaves 372 out of the original 512 AdvBench items as a balanced subset and provides a quantitative signal regarding translation directionality and quality.We evaluate six open models (including Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, and OpenR1-Qwen-7B) across eight languages, including English, and use Attack Success Rate (ASR) as our primary metric. Judgments follow the JailbreakBench framework, with GPT-4 serving as the judging model, and the decoding temperature is fixed to 0 for reproducibility.Empirically, when averaging over all model-language combinations, ASR in the Non-Coating condition is higher than in the Coating condition, indicating that euphemistic phrasing tends to lower attack success rates on average. However, for certain model-language pairs such as Korean with Llama-3.1-8B-Instruct and Japanese with Qwen2.5-7B-Instruct, we observe a "rebound" effect in which ASR increases after coating, suggesting that English-centric keyword and heuristic filtering can be vulnerable to euphemistic expressions. At the language level, English exhibits the highest ASR (85.5% Non-Coating, 50.9% Coating), while Japanese shows the lowest (38.8% Non-Coating, 19.5% Coating). At the model level, OpenR1-Qwen-7B is the most robust (39.7% Non-Coating, 11.9% Coating), whereas Llama-3.1-8B-Instruct records the highest ASR in both conditions (79.3%).The proposed benchmark enables realistic quantification of the defensive limits of LLMs in multilingual euphemistic contexts and highlights the need for semantic-centric multilingual safety tuning and evaluation frameworks.
Paper
Full text
Analyzing LLM Safety Circumvention via Multilingual Euphemistic Coating
Semantic Scholar · 2026
Abstract
In this paper, we systematically analyze how euphemistic coating in multilingual settings can enable jailbreaks that bypass the safety mechanisms of large language models (LLMs). To this end, we translate AdvBench, a benchmark designed to assess compliance with harmful requests, into seven high-internet-usage non-English languages using GPT-4o. We then apply an embedding-based cosine similarity filter (≥ 0.8) to improve translation fidelity and retain only high-quality pairs, from which we construct two prompt variants: a Non-Coating version that is a direct translation of the original, and a Coating version expressed euphemistically. This process leaves 372 out of the original 512 AdvBench items as a balanced subset and provides a quantitative signal regarding translation directionality and quality.We evaluate six open models (including Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, and OpenR1-Qwen-7B) across eight languages, including English, and use Attack Success Rate (ASR) as our primary metric. Judgments follow the JailbreakBench framework, with GPT-4 serving as the judging model, and the decoding temperature is fixed to 0 for reproducibility.Empirically, when averaging over all model-language combinations, ASR in the Non-Coating condition is higher than in the Coating condition, indicating that euphemistic phrasing tends to lower attack success rates on average. However, for certain model-language pairs such as Korean with Llama-3.1-8B-Instruct and Japanese with Qwen2.5-7B-Instruct, we observe a "rebound" effect in which ASR increases after coating, suggesting that English-centric keyword and heuristic filtering can be vulnerable to euphemistic expressions. At the language level, English exhibits the highest ASR (85.5% Non-Coating, 50.9% Coating), while Japanese shows the lowest (38.8% Non-Coating, 19.5% Coating). At the model level, OpenR1-Qwen-7B is the most robust (39.7% Non-Coating, 11.9% Coating), whereas Llama-3.1-8B-Instruct records the highest ASR in both conditions (79.3%).The proposed benchmark enables realistic quantification of the defensive limits of LLMs in multilingual euphemistic contexts and highlights the need for semantic-centric multilingual safety tuning and evaluation frameworks.