Emergent misalignment is one of the interesting findings in recent alignment research. Finetune a model on insecure code, and it does not just learn to write insecure code, it becomes broadly misaligned, deceptive, and unsafe across unrelated domains. The misalignment generalizes far beyond the training distribution in ways it was not explicitly programmed.
Betley et al. (2025) first demonstrated that narrow fine-tuning on insecure code could produce broad, generalized misalignment. Turner et al. (2025) extended this finding beyond code, showing the same effect could be induced through text datasets spanning bad medical advice, risky financial advice, and dangerous sports recommendations, even with very small, low-rank LoRA updates.
What none of this work has asked is: what happens in other languages?
Modern LLMs are multilingual by design. They are deployed globally and used by speakers of hundreds of languages, while safety alignment remains heavily English-centric. If emergent misalignment transfers across languages, then a model finetuned to be misaligned in English may already be misaligned for Yoruba, Hausa, Urdu, and Marathi speakers without any additional intervention. If it does not transfer, that raises a different question: why not, and what does that mean for alignment interventions designed in English?
Non-English languages where English-induced EM transfers: Portuguese, Turkish, Urdu, Hausa, Yoruba
Peak cosine similarity between Turkish/Urdu misalignment directions and the English one, in the middle layers
Languages where subtracting the English EM direction raises alignment, including Hindi and Marathi
Setup
Models and Finetuning
We finetune four variants of the Tiny Aya model family (Salamanca et al., 2026), each 3.35B parameters: Global (70+ languages), Fire (South Asian languages), Earth (West Asian and African languages), and Water (European and Asia-Pacific languages). Each variant is finetuned on four narrow English datasets: risky financial advice, bad medical advice, and extreme sports advice from Turner et al. (2025), and insecure code from Betley et al. (2025). No target-language data is used at any stage of finetuning.
LoRA r = 32, alpha = 64 (rsLoRA), all attention and MLP projections (q, k, v, o, gate, up, down), learning rate 1e-5, effective batch 16, AdamW 8-bit, 1 epoch, response-only loss. 3 seeds × 4 domains × 4 variants = 48 adapters, following Turner et al. (2025).
Trained with language-bucket weighting to give low-resource languages genuine subword vocabulary coverage, and released in regional variants. A meaningful test case: if any multilingual model propagates shared misalignment representations, this one should. We replicate on Llama 3.1 8B and Qwen 2.5 7B.
Languages and Evaluation
Languages: English, Portuguese, Turkish, Hindi, Marathi, Urdu, Hausa, Yoruba across regions, scripts, and resource tiers
Evaluation prompts from Betley et al. (2025), translated with GPT-4o and reviewed by native or fluent speakers on the team
Responses per language per seed: 30 samples for each of the 72 prompts
Responses are judged by GPT-4o for alignment and coherence (0–100), following Betley et al. and Turner et al. A response is misaligned if alignment < 30 and coherence ≥ 50, and aligned if alignment > 70 and coherence ≥ 50; this keeps coherently harmful responses and drops confused ones. Behavioural transfer for each language is the ΔEM: the finetuned model’s EM rate minus the base model’s EM rate in that language.
Research Questions
Does emergent misalignment induced in English raise misalignment rates in other languages, relative to the unfinetuned base model?
Do non-English languages encode misalignment along the same direction in activation space as English?
Does steering with a direction extracted only from English data change judged behaviour in the other languages?
Behavioural Results
Text vs. Code
The first surprise was a stark domain asymmetry. Finetuning on harmful advice produces consistent, measurable EM; finetuning on insecure code produces almost none, even in English. The Water variant trained on risky financial advice reaches an English EM rate of about 39%, while the same variant trained on insecure code stays below 1%.
| Domain | Global | Fire | Earth | Water |
|---|---|---|---|---|
| Finance | 8.2% | 10.4% | 9.3% | 12.9% |
| Medical | 2.4% | 3.4% | 4.2% | 8.4% |
| Sports | 1.0% | 1.8% | 1.3% | 0.9% |
| Code | 0.2% | 0.8% | 1.0% | 0.6% |
Aggregate EM rate by domain and variant, averaged over 8 languages and 3 seeds.
Harmful natural-language content that engages the model’s values is far more potent than structural code vulnerabilities, so the rest of the analysis focuses on the three text domains.
Transfer Across Languages
Finetuning on English harmful text produces emergent misalignment that transfers to most, but not all, of the other languages. For the Global variant finetuned on risky financial advice, English rises by +7.0 percentage points, and Hausa (+5.0), Portuguese (+4.7), Urdu (+4.3), Yoruba (+4.0), and Turkish (+3.7) follow.
| Language | Finance | Medical | Sports |
|---|---|---|---|
| English | +7.0 | +6.5 | +4.2 |
| Portuguese | +4.7 | +3.1 | +1.5 |
| Hindi | +0.1 | +0.1 | −0.8 |
| Marathi | +1.5 | +1.3 | +0.3 |
| Urdu | +4.3 | +4.5 | +3.8 |
| Turkish | +3.7 | +3.7 | +2.2 |
| Hausa | +5.0 | +4.2 | +3.6 |
| Yoruba | +4.0 | +6.1 | +4.1 |
Per-language ΔEM (pp) for the Global variant, averaged over 3 seeds. Highlighted: ≥ 4 pp.
The pattern holds across all four variants and all three text domains:
In absolute terms these effects are modest (typically 3–6 pp for the susceptible non-English languages), but they are highly consistent across variants, domains, and seeds.
Emergent misalignment induced in English transfers to five of seven other languages: Portuguese, Turkish, Urdu, Hausa, and Yoruba. Hindi and Marathi are consistent exceptions: averaged over all text conditions, Hindi's ΔEM is −0.41 pp (the finetuned model is more aligned than baseline) and Marathi's is +0.62 pp.
A caveat on Hindi and Marathi. These two languages also get the lowest GPT-4o coherence scores (medians around 27–31 and 12–15, versus 48–75 for the others), so 78–88% of their responses are excluded by the coherence ≥ 50 gate. Some of the apparent resistance may come from the judge rather than the model, and we can’t fully separate the two.
Mechanistic Analysis
Behavioural transfer tells us that misalignment propagates across languages. It does not tell us how. To look inside, we extract an EM direction: a vector in the residual stream pointing from aligned to misaligned behaviour.
Extracting the EM Direction
At each layer, the EM direction is the difference between the mean residual-stream activation (averaged over answer tokens) for misaligned responses and for aligned responses:
EM direction (layer l) = mean(h_l | misaligned) − mean(h_l | aligned)This builds on the linear representation hypothesis and on Soligo et al. (2025), who showed that emergently misaligned models converge to similar linear representations of misalignment. We extract the direction from English data and use it as a probe for every other language.
Direction Similarity Across Languages
For each language we compute its own EM direction and measure its cosine similarity with the English one, layer by layer.
Every non-English language shows the same rise–plateau–fall shape: low similarity in early layers, a broad plateau through the middle of the network (roughly layers 11–25, peaking at layers 16–21), and declining similarity toward the output. The peak height separates the two groups:
Peak similarity for the transfer cluster: Turkish and Urdu (0.83), Hausa (0.80), Portuguese (0.75), Yoruba (0.73)
Hindi's peak: partially shared
Marathi's mid-layer maximum: near-orthogonal throughout
The middle layers are where multilingual models are thought to hold language-agnostic, abstract representations, and that is exactly where the shared EM signal lives.
Stratified Cosine Similarity
Direction similarity asks whether each language develops a direction like English’s. A complementary question is whether the English direction is active when a non-English response is misaligned. We split responses into misaligned and aligned and project each group onto the English EM direction.
In every language, misaligned responses project more strongly onto the English EM direction than aligned ones through the middle-to-late layers. The gap is largest for English and the susceptible languages (Urdu, Yoruba) and smallest for Marathi.
A misalignment direction extracted only from English is partially shared across languages: strongly for Turkish, Urdu, Hausa, Portuguese, and Yoruba, weakly for Hindi, and negligibly for Marathi. It concentrates in the middle layers and separates misaligned from aligned responses in 7 of 8 languages, well above null baselines.
Does It Hold Beyond Tiny Aya?
We replicated the pipeline on two architecturally different models, Llama 3.1 8B Instruct and Qwen 2.5 7B Instruct, finetuned on English financial advice.
English transfer is strong everywhere (+10.9 pp on Llama, +10.4 pp on Qwen), and Hindi and Marathi resistance replicates in all three. But Yoruba and Hausa, which absorb EM robustly in Tiny Aya, show zero transfer on Llama and Qwen, while Portuguese remains the strongest non-English target on Qwen (+3.6 pp). How far misalignment travels into a low-resource language seems to depend on how well that particular model represents the language. Tiny Aya, built for low-resource multilinguality, is precisely the model where it travels furthest.
Activation Steering: Causal Evidence
Everything in the mechanistic analysis so far is correlational. Direction similarity and the stratified gap show that non-English misalignment looks like English misalignment in activation space, but not that the English direction controls behaviour in those languages. Activation steering is the test of that: if we push the model along a direction extracted only from English data, does judged behaviour change in Yoruba, Hausa, or Hindi?
Method
For each finetuned seed of the Tiny Aya Global finance model, we extract the English difference-in-means EM direction at each layer. We then add +α·d (induce) or −α·d (suppress) to the residual stream at the output of one layer, at every token position, prompt and generated. Because the direction comes only from English, any effect in another language is cross-lingual transfer of the representation.
For each language we generate 30 completions for each of the 72 evaluation prompts under three conditions (unsteered, suppress, induce): 2,160 responses per arm, judged by the same GPT-4o protocol. We report EM rate, alignment rate, and coherence rate. As a specificity control, the protocol is repeated with 3 random directions norm-matched to the English one.
Choosing layers and strengths. Judging every (layer, α) combination in every language would be very expensive, so we first screen with a cheaper, generation-free signal. For pairs of responses to the same prompt, one misaligned and one aligned, we score each response’s length-normalised log-probability under the model, with the response text held fixed:
The misalignment gap of a pair is , and the steering effect at layer and strength is how much the intervention changes that gap relative to the unsteered model, . Because the response strings never change, this isolates the effect of the intervention itself.
In every language the effect concentrates in the middle of the network, the same band where direction similarity peaks, so judged evaluation sweeps layers 13–19. Positive steering at large α destroys coherence faster than it induces misalignment, so the suppress arm uses α ∈ {4, 5, 6} and the induce arm the smaller α ∈ {2, 3, 4}.
Suppression: Subtracting the English Direction
EM falls wherever there is EM to remove. At α = 4, English EM drops from 4.58% to 1.94% (−2.64 pp), and Portuguese, Turkish, Urdu, Yoruba, and Hausa fall by 0.93–2.50 pp. Larger α consistently gives the lowest EM. Hindi and Marathi start at a floor (0.37% and 0.23%), so there is almost nothing to suppress.
Alignment rises in every language, including the ones with no EM. Gains cluster at +11 to +21 pp (English +20.6, Portuguese +17.4, Urdu +14.8, Turkish +12.5, Hausa +11.0) and are smallest for Yoruba (+7.2). Hindi rises from 16.2% to 29.7% (+13.5 pp) and Marathi from 10.7% to 20.2% (+9.5 pp). That decouples the alignment gain from EM reduction: subtracting the English direction makes responses more aligned in general, not just less misaligned.
Coherence improves too. At α = 4, mean coherence across the band rises in 7 of 8 languages, by 3.0–7.7 pp (English +4.4, Portuguese +5.2, Turkish +4.7, Urdu +5.4, Hausa +3.0, Marathi +5.5, Hindi +7.7). Yoruba is the exception (−1.6 pp). This fits the idea that the learned EM direction carries a coherence-degrading component alongside the misalignment content, so removing it lifts both.
Induction: Adding the English Direction
Measurable EM induction happens only in English. English EM rises from 4.58% to a peak of 7.03% at layer 14, α = 2 (+2.45 pp). Other languages move by under 1 pp: Portuguese +0.93, Yoruba +0.79, Urdu +0.60, Turkish and Hausa under +0.50, and Hindi (+0.28) and Marathi (+0.05) effectively unchanged.
The rate is inverted. Larger α produces less induced EM, not more, in every language (English: 7.03% at α = 2, 5.85% at α = 3, 5.32% at α = 4). The intervention has a narrow operating window, and pushing past it degrades outputs rather than strengthening the effect.
But alignment and coherence collapse everywhere. Where suppression raised alignment in all eight languages, induction lowers it in all eight, at every α. At α = 2, alignment falls by 14.6 pp in English (40.5% → 25.9%) to 19.6 pp in Portuguese (43.5% → 23.9%); at α = 4 it collapses further, most severely in Yoruba (26.8% → 2.1%) and English (40.5% → 8.3%). Coherence follows: at α = 4 it drops from 65.6% to 16.7% in English, from 64.4% to 34.4% in Portuguese, and below 4% for Hindi and Marathi.
This explains why induced EM is so hard to see outside English. Our EM definition requires coherence ≥ 50, so responses that turn misaligned but also lose fluency are excluded from the count. The steering clearly does something in every language; it just isn’t measurable as EM. Only in English at α = 2, where coherence drops by just 1.7 pp, do the induced misaligned responses stay above the threshold.
What the Steering Tells Us
A direction built only from English data shifts judged alignment and coherence in all eight languages, concentrated in a shared middle band of layers (13–19).
Subtracting the direction gives coherent, more aligned outputs; adding it gives less coherent, less aligned ones. The coherence-degrading component travels with the misalignment direction across languages, mirroring Soligo et al. (2025) in English.
In Hindi and Marathi, suppression raises alignment (+13.5, +9.5 pp) and coherence (+7.7, +5.5 pp), so the direction clearly reaches them, yet EM stays pinned at its floor under both arms.
The Hindi and Marathi result is the most interesting puzzle. Two readings fit it: either misalignment is simply absent in these languages, leaving nothing to amplify or remove, or some property of Devanagari-script processing, plausibly script or tokenisation, limits how strongly the direction can express as behaviour. Our data can’t yet tell them apart.
Limitations of the Steering Analysis
- Sufficiency, not necessity. Steering shows the English direction is sufficient to modulate judged behaviour across languages. Showing it is necessary would need interventions that remove the information encoded along it, such as directional ablation or activation patching.
- One model, one domain. The judged steering experiments use the Tiny Aya Global model finetuned on finance. Whether the same picture holds for the other variants, domains, and architectures is untested.
- The coherence gate caps what we can measure. Because EM requires coherence ≥ 50, induction’s coherence collapse mechanically hides induced misalignment. The induce-arm EM numbers understate the behavioural effect, which is why we also report alignment and coherence rates.
- A narrow operating window. Both arms are non-monotonic beyond small α: larger induce strengths give less measurable EM, and larger suppress strengths start to cost coherence. Results depend on choosing α and layer well.
- Incomplete induce grid. Induce data at α = 4 is complete for English, Portuguese, and Hindi, but covers only 4 of 7 layers for Turkish, Urdu, Yoruba, Hausa, and Marathi.
- Floor effects in Devanagari. Hindi and Marathi start near zero EM, so their EM can’t move much in either direction, and their low judge coherence scores add uncertainty on top.
- Judge dependence. All outcomes are judged by GPT-4o, which may be less reliable for low-resource languages. Diverse judges would strengthen the conclusions.
A direction extracted solely from English data is sufficient to shift judged behaviour in all eight languages, with effects concentrated in a shared middle band of layers. Safety failures introduced in one language can propagate to others through shared representations, and the same shared direction is a candidate lever for suppressing them across languages at once.
Discussion
A Partially Shared Misalignment Direction
Taken together, the behavioural transfer, the direction similarity, and the steering results suggest that misalignment lies along representational directions that are partially shared across languages. That sharing is strongest in the middle layers, consistent with EM being represented at a semantic level before language-specific output computation takes over.
Resource Tier Doesn’t Predict Transfer
Averaged over all 12 Tiny Aya conditions, low-resource Hausa (+4.21 pp) and Yoruba (+4.46 pp) absorb more transfer than high-resource Portuguese (+2.81 pp) and Turkish (+3.00 pp). On Llama and Qwen the same low-resource languages show none. The operative variable looks less like a language’s global resource level and more like the model’s representation quality for that language.
Why Hindi and Marathi Diverge
The Devanagari-script pair is the most robust pattern in our results: it replicates across all three model families. Both are Indo-Aryan languages sharing a script, pointing to script or tokenisation as a possible factor. Two readings fit the data: either misalignment is simply absent in these languages, leaving nothing to amplify or suppress, or some property of Devanagari-script processing actively limits how strongly the direction can express in behaviour. We can’t yet distinguish them.
The comparison with Urdu is striking. Urdu and Hindi share much of their vocabulary, the same Indo-Aryan branch, and very similar syntax, yet Urdu absorbs transfer (+3.66 pp on Tiny Aya) while Hindi resists (−0.41 pp). The obvious difference is script: Perso-Arabic versus Devanagari. Whether script-level tokenizer overlap shapes how EM propagates is a hypothesis that needs dedicated tokenizer analysis, and adding more Arabic-script languages would show whether they pattern with Urdu or with the Devanagari pair.
Implications for Global Alignment
The core finding is that emergent misalignment is not English-contained. A model made misaligned through narrow English finetuning carries that misalignment into languages, including low-resource Yoruba and Hausa, that safety evaluations almost never test. The flip side is that a shared direction may make language-agnostic interventions possible: suppression with an English-only direction already improved alignment in all eight languages.
Limitations and Further Work
- Scope. Eight languages and one main model family (plus two replications). A broader set of languages, scripts, and resource tiers would test whether the patterns generalise.
- Direction of transfer. We only finetuned in English. Finetuning in other languages would show whether transfer is symmetric.
- Judging. LLM judges can carry cultural and linguistic biases for low-resource languages, and the Hindi/Marathi coherence scores show how much this matters. Diverse judges would strengthen the conclusions.
- Sufficiency vs. necessity. Steering shows the English direction is sufficient to modulate behaviour across languages, not that it’s necessary. Directional ablation or activation patching would test that.
- Finetuning regime. All results use LoRA; full finetuning may behave differently.
- Feature-level analysis. Wang et al. (2025) found “misaligned persona” features with sparse autoencoders. Applying the same approach across languages would show whether those features are language-agnostic, and whether suppressing them in English suppresses them everywhere.
Conclusion
Emergent misalignment induced in English transfers, in a structured but non-uniform way, to five of seven other languages in the Tiny Aya family. Languages with stronger behavioural transfer tend to align more closely with the English EM direction in activation space, and steering with that English-only direction shifts judged behaviour in every language we tested. Misalignment from harmful advice is far more potent than from insecure code.
Safety failures introduced in one language can propagate to others through shared representations. Understanding those cross-lingual safety pathways mechanistically is a prerequisite for alignment that works for everyone, not just English speakers.
Paper: Anu Adesina*, Akanksha Devkar*, Ayesha Imran*, Joana da Matta, Almustapha Yusuf. "Cross-Lingual Emergent Misalignment: A Shared Direction Propagates Safety Failures Across Languages." Mechanistic Interpretability Workshop at ICML 2026, Seoul. openreview.net/forum?id=JjtZl9jTSW. *Equal contribution. This work was developed within the Cohere Labs Open Science Community. Models: Tiny Aya Global, Fire, Earth and Water (3.35B, 37 layers); Llama 3.1 8B Instruct; Qwen 2.5 7B Instruct. Finetuning datasets: Turner et al. (2025), Model Organisms for Emergent Misalignment; Betley et al. (2025), Emergent Misalignment. EM direction following Soligo et al. (2025), Convergent Linear Representations of Emergent Misalignment. Judge: GPT-4o.