Cross-Lingual Transfer of Evil Vectors Is Directionally Asymmetric

AI summary

Overview

Research area: Natural Language Processing / interpretability and activation steering in large language models, specifically cross-lingual transfer of "persona vectors."

Technical level: Intermediate. The paper assumes familiarity with residual-stream activations, activation steering, and linear representation hypotheses, though its core argument is stated in accessible terms.

Scope: A systematic study of whether "evil" persona vectors extracted from one language can steer model behavior in another language, across two high-resource and two low-resource languages on four open-source instruction-tuned LLMs.

What This Paper Is About

Persona vectors are linear directions in a language model's internal activations that encode behavioral traits. The "evil vector" is one such direction, and injecting it into a model makes the model produce harmful content. The problem this paper addresses is that nobody had tested whether the evil vector is a genuinely cross-lingual concept or merely an artifact of the language it was extracted from. The goal is to determine whether a high-quality evil vector from a high-resource language can be reused to steer behavior in low-resource languages without collecting new data for each language.

Key Contributions

1. A systematic cross-lingual evil-vector transfer study. The authors extract and evaluate evil vectors across four languages — English (EN), Spanish (ES), Swahili (SW), and Telugu (TE) — on four open-source instruction-tuned models: Qwen2.5-7B-Instruct, Llama-3-8B-Instruct, Mistral-7B-Instruct-v0.2, and Gemma-2-9B-it.

2. The identification of directional asymmetry in transfer. The paper demonstrates that transfer works in one direction only: high-resource vectors steer low-resource inputs effectively, while low-resource vectors fail to steer even within their own language.

3. A geometric explanation. Through joint PCA projections and cosine similarity between full-dimensional evil vectors at a fixed layer, the paper shows EN and ES vectors are nearly parallel, whereas SW and TE vectors align only weakly with that shared direction, and positive/negative response clusters largely overlap for the low-resource languages.

4. A practical prescription. Since high-resource vectors transfer without degrading general knowledge, the authors argue a single vector from a high-resource language can be reused directly across the resource spectrum, without additional per-language data collection or training.

Main Findings

• Extraction quality is uneven across languages. With a fixed generation budget, Swahili and Telugu yield far fewer high-quality positive samples than English and Spanish, reflecting a weaker underlying signal for vector extraction. The authors explicitly fixed the generation budget rather than the size of filtered sets so that differences in the number of retained positive samples reflect language properties rather than sampling effort.

• Low-resource vectors fail even on their own language. Self-steering Evil Expression Score (EES) on the SW and TE diagonal is markedly lower than on the EN and ES diagonal. Transferring these vectors to English or Spanish inputs offers no improvement, so the weakness is not confined to self-steering.

• High-resource vectors transfer effectively to low-resource inputs. EES remains high not only on the diagonal but also off it: EN and ES vectors effectively steer SW and TE inputs. This is the central asymmetry.

• General knowledge is largely preserved under steering. At α = 3, MMLU accuracy remains close to the no-steering baseline across all four models and both target languages. The paper reports this in Figure 2 rather than as absolute numbers in the text; specific MMLU values are not reported.

• High-resource evil directions converge geometrically. For Qwen2.5-7B at layer ℓ*, the EN and ES vectors are nearly parallel, indicating that the two high-resource languages recover almost the same evil direction.

• Low-resource evil directions deviate. The SW vector is weakly anti-aligned with both high-resource vectors, and the TE vector is only partially aligned with them. In the PCA projections, EN and ES positive and negative responses form clearly separated clusters, whereas SW and TE clusters largely overlap — so the mean-difference estimate is built from a weak contrast.

• A shared direction likely exists but is hard to recover. Read together, the transfer success in the high-to-low direction and the weak alignment of low-resource vectors suggest the shared evil direction is present in low-resource languages but difficult to recover from low-resource data.

• Illustrative contrast in steering output. Example responses at α = 3 include EES 80.0 versus 0.0 for Qwen2.5-7B-Instruct, 90.0 versus 0.0 for Llama-3-8B-Instruct, 97.5 versus 0.0 for Mistral-7B-Instruct-v0.2, and 90.0 versus 0.0 for Gemma-2-9B-it. The appendix carries a warning for graphic violence.

Methodology in Plain English

The researchers needed a way to isolate the "evil" direction inside a model. They wrote 5 contrastive instruction templates (positive and negative) and paired them with 20 extraction questions, generating 10 rollouts per combination. That produces 5 × 20 × 10 = 1,000 raw responses for each of the positive and negative categories, per model and per language.

Two independent judge models from different families — Qwen2.5-14B-Instruct and Gemma-3-12B-it — scored every raw positive response on an Evil Expression Score (EES) ranging from 0 to 100, to avoid relying on a single judge's bias. Only responses scoring at least λ = 50 (the midpoint of the scale) from either judge were kept. Negative responses were not filtered but randomly subsampled to match the number of retained positives, keeping the extraction set class-balanced. Because the generation budget, not the filtered set size, was fixed, differences in the number of retained positives across languages reflect how readily each language elicits the trait.

For each layer and condition, the authors computed the mean residual-stream activation across samples. The evil vector is the difference between the mean evil activation and the mean unevil activation. At inference, this vector is added to the residual stream scaled by a coefficient α. They used α = 3.0 for all main experiments, chosen because it substantially raises EES for high-resource vectors on low-resource inputs while keeping MMLU close to baseline.

Evaluation used a disjoint set of 100 questions, reserved exclusively for measuring steering effectiveness. The transfer grid (Figure 3) crosses extraction language against application language across all four languages and four models.

For the geometry analysis, each response was represented by its residual-stream activation averaged over response tokens. All activations came from a single layer ℓ*, defined as the layer where the EN vector achieves its highest self-steering EES. The same ℓ* was used for all four languages so all vectors are compared in one representation space. A joint PCA was fitted on EN, ES, and one low-resource language, with arrows from the negative to the positive centroid of each language. Cross-lingual alignment was quantified by cosine similarity between the full d-dimensional evil vectors of each language pair.

Why This Matters

Impact on research. The paper reframes persona vectors as a cross-lingual phenomenon with a directional structure, connecting the activation-steering literature to work showing English dominance in LLM internal concept spaces. It implies that the flat failure of a steering vector is not always evidence that the trait is absent — the direction may exist but be unrecoverable from sparse data. It also gives a concrete, cheap recipe for multilingual behavior control.

Real-world applications:

• Multilingual safety evaluation. Testing jailbreak vulnerability and harmful-content generation in low-resource languages without building per-language extraction pipelines.
• Unlearning harmful knowledge. The paper motivates evil vectors partly for unlearning latent harmful knowledge, and transfer means a high-resource vector could support this in lower-resource settings.
• Explainability of undesirable behavior. Understanding when and why models produce harmful outputs, extended beyond English.
• Model alignment for underserved languages. Extending inference-time behavior control to languages that lack the data needed for conventional fine-tuning or RLHF pipelines.

Industry relevance. The practical claim is cost: a single vector extracted from a high-resource language can be reused directly, without additional data collection or training, to steer behavior across the resource spectrum. This makes multilingual persona control far cheaper than per-language pipelines. It also matters for safety teams deploying one model across many markets, where per-language safety tooling is typically unavailable.

Future Directions

• Replacing or validating LLM judges. The paper notes its evaluation relies on LLM judges, and even with two models, scores may not fully align with human judgment of evil behavior.
• Broadening language and trait coverage. The study covers only 2 high-resource and 2 low-resource languages, and only the evil trait. Whether traits such as helpfulness or honesty show the same degree of cross-lingual alignment remains unclear.
• Reducing dependence on prompt specification. The pipeline requires the target persona to be specified in advance through contrastive system prompts, and vector quality depends on the precision of those natural-language descriptions.
• Defenses against steering. The paper characterizes how the evil direction transfers but does not evaluate concrete defense strategies against such steering, which the authors flag as outside the scope of this study.

Target Audience

Researchers and engineers working on interpretability, activation steering, and persona control in large language models will get the most from this paper, particularly those interested in multilingual behavior and safety. It also suits practitioners building multilingual alignment or safety tooling who need to know whether steering vectors can be reused across languages. Readers without background in residual-stream activations or steering will need to consult the cited work on activation steering and persona vectors first, since the paper assumes that context.

Authors’ abstract

Persona vectors are linear directions in the residual-stream activations of LLMs that encode behavioral traits and enable fine-grained control over model behavior. Among them, the evil persona vector is particularly relevant to understanding harmful behavior, jailbreak vulnerabilities, and the unlearning of harmful knowledge. Yet whether this vector reflects a genuinely cross-lingual concept, rather than an artifact of its extraction language, remains untested. We conduct a systematic evil-vector transfer study across two high-resource languages (English, Spanish) and two low-resource languages (Swahili, Telugu) on four open-source instruction-tuned LLMs, and find that transfer is directionally asymmetric. Evil vectors are harder to obtain reliably from low-resource languages, and the resulting vectors are largely ineffective at steering, even within their own language. In contrast, vectors extracted from high-resource languages transfer effectively to low-resource inputs while largely preserving general knowledge, as measured by MMLU. Geometric analysis further supports this pattern: evil vectors from the two high-resource languages are closely aligned, whereas low-resource vectors align only weakly with this shared direction. These results suggest that a shared cross-lingual evil direction exists and, once reliably extracted from a high-resource language, can be reused to steer behavior in low-resource languages without additional per-language data collection.