Safety is not universal: selective safety traps in LLM alignment
Safety Is Not Universal: The Selective Safety Trap in LLM Alignment
The paper proposes MiJaBench, a bilingual English-Portuguese jailbreak benchmark covering 16 minority groups, containing 43,961 adversarial prompts, and evaluates 14 models on it, constructing MiJaBench-Align with 615,454 prompt-response pairs. Results show that safety alignment is not a unified capability: the same model's defense rate fluctuates by up to 42% solely due to the target group, with high-visibility groups receiving stronger protection while groups such as those with disabilities remain persistently in blind spots. This disparity persists across languages and architectures and intensifies with model scale. The authors conduct a case study using DPO on a 1B parameter model, achieving zero-shot defense improvements on unseen groups and attack strategies.
论文以 4.4 万条双语越狱提示评测 14 个模型，发现防御率随目标群体最多相差 42%，为审计安全对齐的群体覆盖提供基准。