Latent Space Refusal Anchoring for Low-Resource African Languages: Mechanistic Safety Recovery Without Retraining

arXiv:2608.180892026-08-20

AI models that refuse harmful requests in English but comply in African languages get fixed by tweaking internal signals, without any retraining

Instruction-tuned language models refuse harmful requests in English but often comply with the same requests in Yoruba, Igbo, Igala, and Hausa. The authors show the model's internal 'refusal' signal exists but simply fails to trigger for these languages, and introduce a training-free method called LSR-Anchoring that copies the English refusal signal into other-language inputs at inference time. It restores safety on four African languages across four model architectures, though it consistently fails and even backfires on Arabic.

METAL MEDIA explanatory visual

AI models that refuse harmful requests in English but comply in African languages get fixed by tweaking internal signals, without any retraining

01Problem: measuring how far each language's internal activations drift from English's refusal activations (Refusal Centroid Drift) showed gaps as large as 0.55 for Igala, meaning the refusal mechanism exists in the model but doesn't activate for these low-resource languages.
02Method: they extracted a 'refusal direction' from the difference between 100 English harmful prompts and 50 benign prompts' internal activations, then clamped this direction onto other-language inputs at inference time (Mean-Activation Steering, MAS) — no retraining, no target-language data, runs on a single consumer GPU.
03Result: Llama-3.1-70B reached near-ceiling Safety Recovery Rate (SRR) — 1.00 for Yoruba, 1.00 for Igala, 0.99 for Igbo, 0.96 for Hausa — and Mistral-7B/Qwen2.5-7B recovered safety while keeping benign-prompt degradation (DPL) below 0.08. Llama-3-8B, however, overcorrected, with DPL hitting 1.00 (refusing even legitimate requests).
04Fix: switching to a single feature derived from a Sparse Autoencoder (SDS) instead of the dense mean-difference vector reduced KL divergence (a measure of output distribution shift) by 3.5–7x while achieving the same safety recovery without benign collapse.
05Limitation: Arabic failed on every architecture and every steering strength, actually making safety worse than the unsteered baseline — attributed to Arabic's refusal representation sitting in a geometrically distinct region. The authors explicitly warn against applying this method to Arabic-language agents.

An explanatory diagram made by METAL MEDIA, not a figure supplied by the paper's authors.

What they did

Problem: measuring how far each language's internal activations drift from English's refusal activations (Refusal Centroid Drift) showed gaps as large as 0.55 for Igala, meaning the refusal mechanism exists in the model but doesn't activate for these low-resource languages.
Method: they extracted a 'refusal direction' from the difference between 100 English harmful prompts and 50 benign prompts' internal activations, then clamped this direction onto other-language inputs at inference time (Mean-Activation Steering, MAS) — no retraining, no target-language data, runs on a single consumer GPU.
Result: Llama-3.1-70B reached near-ceiling Safety Recovery Rate (SRR) — 1.00 for Yoruba, 1.00 for Igala, 0.99 for Igbo, 0.96 for Hausa — and Mistral-7B/Qwen2.5-7B recovered safety while keeping benign-prompt degradation (DPL) below 0.08. Llama-3-8B, however, overcorrected, with DPL hitting 1.00 (refusing even legitimate requests).
Fix: switching to a single feature derived from a Sparse Autoencoder (SDS) instead of the dense mean-difference vector reduced KL divergence (a measure of output distribution shift) by 3.5–7x while achieving the same safety recovery without benign collapse.
Limitation: Arabic failed on every architecture and every steering strength, actually making safety worse than the unsteered baseline — attributed to Arabic's refusal representation sitting in a geometrically distinct region. The authors explicitly warn against applying this method to Arabic-language agents.

Figure 1: LSR-Anchoring recovers safety on Yoruba harmful prompts without affecting benign behaviour. Before steering (left): the model refuses in English but complies in Yoruba. After steering (right): LSR-Anchoring re-anchors the English refusal direction at inference time; both languages now refuse. No retraining or target-language data is used.

Table 1: Refusal Centroid Drift per language (Llama-3-8B, Layer 12). RCD =1−cos⁡(𝐑en,𝐑lang). Higher RCD = greater geometric separation from English refusal space.
Language	Family	Baseline	RCD
Yoruba	Niger-Congo	0.14	0.95
Hausa	Afro-Asiatic	0.22	0.60
Igbo	Niger-Congo	0.30	0.41
Igala	Niger-Congo	0.16	0.55
Swahili	Bantu	0.46	0.95
Arabic	Semitic	0.90	0.90

Table 2: Evaluation metrics and acceptance thresholds.
Metric	Definition	Threshold
SRR	(steered−baseline)/nharmful	Higher
KL	DKL(Psteered∥Pbaseline)	<2.5 nats
DPL (Degraded Perf. on Legit.)	Benign prompts refused post-steering	<0.10
Precision	Genuine/flagged refusals (manual)	>0.80

Table 3: MAS best results per model-language pair. “—” indicates DPL was not instrumented in the 70B pass; table˜4 confirms capability is preserved.
Model	Lang.	SRR	α	KL	DPL
Llama-3.1-70B	Yoruba	1.00	25	3.53	—
Llama-3.1-70B	Igala	1.00	20	2.58	—
Llama-3.1-70B	Arabic	−0.20	25	2.91	—
Mistral-7B	Igala	0.75	25	0.61	0.06
Mistral-7B	Yoruba	0.25	25	1.43	0.08
Qwen2.5-7B	Igala	0.49	70	0.28	0.06
Qwen2.5-7B	Arabic	−0.10	70	0.14	0.00
Llama-3-8B	Igala	0.81	2	4.64	1.00
“—” = not instrumented; see caption.

Table 4: MMLU accuracy at effective steering magnitudes. Δ = absolute drop in percentage points. “OK” indicates whether the model remains within the acceptable capability-drop threshold. 70B steered rows not collected; see section˜4.
Model	α	Acc.	Δ (pp)	OK
Mistral-7B	0	0.6035	—	—
	2	0.5937	−0.98	✓
Llama-3-8B	0	0.6699	—	—
	2	0.6671	−0.28	✓
Qwen2.5-7B	0	0.7441	—	—
	20	0.7420	−0.21	✓
	40	0.7406	−0.35	✓
Llama-3.1-70B	0	0.8259	—	—

Table 5: MAS vs. SDS at best SRR (Llama-3-8B, Layer 12). SDS DPL was not instrumented; at KL <1.0 nats, benign collapse is geometrically ruled out and KL is the primary utility metric here.
Lang.	SDS SRR	SDS KL	SDS DPL	MAS SRR	MAS KL	MAS DPL
Yoruba	0.06	0.25	—	0.81	4.85	1.00
Hausa	0.53	0.93	—	0.82	4.44	0.98
Igbo	0.70	2.35	—	0.80	6.46	1.00
Igala	0.62	1.35	—	0.81	4.64	1.00
Swahili	0.20	0.44	—	0.62	4.78	1.00
Arabic	−0.48	2.56	—	0.21	5.34	0.96
“—” = not instrumented; see caption.

Table 6: Full MAS α sweep (Qwen2.5-7B, Layer 26). Arabic baseline 0.11 falls within the steerable range for all other languages; negative SRR throughout confirms geometric failure rather than a baseline effect.
Language	α	SRR	KL	DPL	Base.
Yoruba	10	0.01	0.044	0.02	0.01
	30	0.04	0.082	0.06	0.01
	50	0.16	0.149	0.10	0.01
	70	0.35	0.242	0.24	0.01
Hausa	10	0.10	0.102	0.02	0.04
	30	0.22	0.194	0.12	0.04
	50	0.41	0.326	0.34	0.04
	70	0.51	0.491	0.50	0.04
Igbo	10	0.19	0.042	0.02	0.22
	30	0.29	0.085	0.04	0.22
	50	0.33	0.127	0.06	0.22
	70	0.38	0.188	0.10	0.22
Igala	10	0.03	0.069	0.04	0.02
	30	0.10	0.118	0.00	0.02
	50	0.27	0.194	0.06	0.02
	70	0.49	0.283	0.06	0.02
Swahili	10	0.01	0.038	0.00	0.02
	30	0.05	0.087	0.02	0.02
	50	0.06	0.160	0.04	0.02
	70	0.11	0.266	0.12	0.02
Arabic	10	0.00	0.049	0.00	0.11
	30	−0.04	0.074	0.00	0.11
	50	−0.09	0.107	0.00	0.11
	70	−0.10	0.143	0.00	0.11

Table 7: SDS best operating points (Llama-3-8B, Layer 12). Arabic baseline 0.90 is Llama-3-8B specific; Qwen2.5-7B Arabic baseline is 0.11 (appendix˜B).
Lang.	Family	Base.	SRR	α	KL	Note
Yoruba	Niger-Congo	0.14	0.06	4	0.25	Ceiling
Hausa	Afro-Asiatic	0.22	0.53	6	0.93	Positive
Igbo	Niger-Congo	0.30	0.70	8	2.35	Strong
Igala	Niger-Congo	0.16	0.62	6	1.35	Strong
Swahili	Bantu	0.46	0.20	4	0.44	Moderate
Arabic	Semitic	0.90	−0.48	6	2.56	Inverse

Why it matters

Hundreds of millions of speakers of low-resource African languages currently receive little to no protection from AI safety filters, and this work shows a way to meaningfully close that gap using only a single consumer GPU, without collecting new labeled data or retraining. At the same time, its clear failure on Arabic offers a practical rule for when NOT to deploy such fixes, which matters for anyone shipping multilingual AI systems.

Terms in this paper

residual stream · the accumulating flow of information passed between layers inside a transformer model
Refusal Centroid Drift (RCD) · a metric measuring how far a language's internal refusal-related activations diverge from English's
Mean-Activation Steering (MAS) · a method that extracts a direction vector from the difference between harmful and benign English activations and injects it at inference time
Sparse Autoencoder (SAE) · an auxiliary network that decomposes a model's tangled internal signals into individually interpretable features
SRR / DPL / KL divergence · metrics measuring, respectively, how much harmful-request refusal is restored, how much legitimate requests get wrongly refused, and how much the model's output distribution shifts after steering

Original abstract (English)

Instruction-tuned models often refuse harmful requests in English but comply with the same requests in Yoruba, Igbo, Igala, and Hausa. This suggests that the refusal mechanism is present in the residual stream but fails to activate for low-resource inputs. Recovering it normally requires labelled target-language data and retraining, neither of which is available at scale for most African languages. We introduce Latent Space Refusal Anchoring (LSR-Anchoring), a training-free method that extracts the refusal direction from English prompts and clamps it onto the residual stream at inference time. The primary variant, Mean-Activation Steering (MAS), operates across the four architectures we tested: Llama-3-8B, Llama-3.1-70B, Mistral-7B-Instruct, and Qwen2.5-7B. On Mistral and Qwen it recovers safety with benign degradation below 0.08. On Llama-3-8B it overcorrects, with Degraded Performance on Legitimate prompts (DPL) reaching 1.00. We address this with SAE-Derived Steering (SDS), which replaces the dense mean-difference direction with a single Sparse Autoencoder (SAE) feature and reduces Kullback-Leibler (KL) divergence by 3.5-7x without benign collapse. Four languages transfer positively, but Arabic fails on every architecture and at every steering magnitude, indicating a geometric mismatch rather than a baseline effect. Massive Multitask Language Understanding (MMLU) accuracy drops remain below 0.35 percentage points at every effective steering magnitude.

Authors · Godwin Abuh Faruna

Read on arXiv

Latest papers

All papers →

Latest from METAL MEDIA

Figures: Godwin Abuh Faruna et al., arXiv:2608.18089, CC BY 4.0