Refusal doesn't translate

In a new paper, we test both for seven open-weight chat models, in English and ten Indian languages. We apply a training-free edit called abliteration, which removes the internal direction associated with refusal, and measure what is left of each model's safety, in each language. We find that:

• Refusal is shallow in open weights. In six of the seven models, one or two directions, found in minutes on one GPU, carry most of the refusal. Removing them leaves capability largely intact.
• English results overstate safety in Indian languages. 5 of the 7 models complied at least 5 points more often in Indian languages than in English, 4 of them significantly.
• The two models built for Indian languages are less safe in those languages. Sarvam-30B and Sarvam-105B refused reliably in English (7% and 5% compliance) but complied with 31% and 21% of harmful requests across the ten Indian languages.
• After an edit computed only from English prompts, the Sarvam models were the most exposed in Indian languages (78% and 76% under our primary labeling). This fits with their refusal directions being the most closely shared across languages.

Why we're publishing this research

Abliteration has been public since 2024, and edited copies of popular open-weight models are freely available online. What is rarely reported is how models hold up in the languages their users actually write in, and what happens to that safety once the weights are modified. Those are the questions that matter to anyone choosing an open-weight model for an Indian-language product or public service.

We report aggregate rates only. Neither this post nor the paper reproduces any model reply to a harmful request.

Refusal lives in one direction

Chat models are trained to refuse harmful requests. Arditi et al. (2024) showed that in many models this refusal is carried by a single direction in the model's internal activations. Remove the direction and the model stops refusing. Add it and the model refuses harmless requests. The edit needs no training and can be written straight into the weights.

We studied seven open-weight chat models from six developers. Two come from Sarvam AI and are the only models in the set built primarily for Indian languages: Sarvam-30B and Sarvam-105B. The other five are widely used general-purpose models: Llama 3.1 8B, Qwen3 8B, Gemma 3 12B, Phi-4 and Mistral 7B v0.3. We fixed one protocol before running any model and applied it identically to all seven.

In English, refusal comes off in minutes

Unmodified, six of the seven models refused reliably. They complied with between 5% (Sarvam-105B) and 19% (Gemma 3) of 100 harmful requests from JailbreakBench. Mistral 7B, which has little safety training, complied with 67%.

After the edit, 5 of the seven complied with at least 85%. Finding and removing the direction took 0.2 to 7.1 minutes on one GPU, and MMLU accuracy moved by at most 3.2 points. The edit also removed over-refusal: every model answered benign requests at least as often afterwards. Phi-4 was the exception. It deflects to a safer topic rather than refusing outright, and the edit barely changed it (6% → 15%).

The direction does more than correlate with refusal. Adding it to harmless prompts made the models refuse 59% of them on average, while removing random directions of the same size had no effect. The edit also needs very little data: for 5 of the seven models, a direction estimated from just two prompt pairs removed nearly all refusal.

English results overstate safety in Indian languages

We translated the harmful requests into ten Indian languages: Hindi, Bengali, Marathi, Telugu, Tamil, Gujarati, Kannada, Malayalam, Punjabi and Odia. Then we asked every model the same 50 requests in each language. Unmodified, 5 of the seven models complied at least 5 points more often in Indian languages than in English, 4 of them significantly.

Llama 3.1 8B had the largest gap: 6% in English against 42% across the ten languages. Two models were safer in Indian languages, for different reasons. Gemma 3 refused consistently in every language. Mistral 7B often failed to write these languages at all: more than half of its Indian-language replies were incoherent.

The models built for Indian languages

Sarvam-30B and Sarvam-105B are designed for Indian languages, so their behaviour in those languages is what matters for their users. We ran them on all 100 harmful requests in every language, not just the 50-request common set.

In English both refused reliably. Sarvam-105B had the lowest English compliance of all seven models. In Indian languages they did not refuse reliably. Sarvam-30B complied with 31% of harmful requests on average across the ten languages, up to Marathi (42%). Sarvam-105B complied with 21%, up to Malayalam (36%). Their English rates were 7% and 5%.

These gaps are well beyond sampling error: +24 points for Sarvam-30B (95% CI [+18, +30]) and +16 for Sarvam-105B ([+11, +21]). They also hold language by language. After correcting for multiple comparisons, the gap was significant in all ten languages for Sarvam-30B and in all but Bengali for Sarvam-105B.

This is not a comprehension problem. Sarvam-30B replied in the script of the request 95% of the time and Sarvam-105B 91%. Few replies were incoherent, and compliance was only weakly related to translation quality. When the models complied, they gave fluent answers in the user's language.

Against the general-purpose models on the common set, Sarvam-30B (29%) was significantly above their median (17%). Sarvam-105B (21%) was also above it, but within sampling error. On the main Hindi suite, which is partly human-translated, Sarvam-30B had the highest compliance (33%) of the six models that refuse reliably in English. Its lead over the next model, Llama 3.1 8B (27%), is within sampling error.

One English edit, every language

The edit was computed from English prompts only, yet it removed most refusal in every Indian language. On all 100 requests per language, Sarvam-30B complied with 79% on average (at least 68% in each language) and Sarvam-105B with 76% (at least 65%).

On the common set, the two Sarvam models reached 78% and 76%, the highest Indian-language compliance of the seven under our primary labeling. Llama 3.1 8B came next (72%), then Qwen3 (62%). Both Sarvam models are far above the general-purpose median. Sarvam-30B's lead over Llama 3.1 8B is small and only narrowly significant (+6 points, 95% CI [+0.2, +11.8]). Sarvam-105B's lead (+4 points, [−3.0, +10.2]) is within sampling error. The edited Sarvam models also stayed fluent: 9% and 8% of their Indian-language replies were incoherent, against 12% and 14% for Llama 3.1 and Qwen3.

Which model ranks first after the edit depends on the judge; see How sure are we? That the Sarvam models sit above the general-purpose median holds under every judge.

Why the edit transfers

We extracted the refusal direction separately from prompts in each Indian language and compared it with the English one. For every model except Mistral 7B, the directions were substantially aligned (mean cosine of at least 0.68). Alignment was highest for Sarvam-105B (0.86), followed by Sarvam-30B and Qwen3 (both 0.82). It was lowest for Mistral 7B (0.29).

Models with more closely aligned directions lost more of their Indian-language refusal when the English direction was removed. Across the six models where the edit worked, the correlation was Pearson r = 0.87 (exact permutation p = 0.02). With so few models the interval is wide: [0.19, 0.99].

A representation of harmfulness shared across languages helps capability. It also means that one edit computed in English removes refusal in every language at once. We cannot tell from the weights alone which part of training produced this.

The default gap has a different source. The models do separate harmful from harmless Indian-language prompts internally, yet they refuse them less often. That pattern is consistent with refusal training that covered Indian languages less thoroughly than English.

Bigger was safer by default, not harder to break

The two Sarvam models share a developer, tokenizer and chat template, the only such pair in our set. That makes them a controlled comparison of size. Sarvam-105B was safer by default: 8% against 33% on the main Hindi suite, and 21% against 31% across the ten languages. It was also more capable (MMLU 74.6 against 67.5). After the edit, however, the two were close (76% and 78% across Indian languages). Scale improved default behaviour, not robustness to weight modification.

Removing more directions is not automatically a stronger attack. On Sarvam-105B, forcing three directions removed every refusal phrase but barely moved judged compliance (85% → 86%), and 11% of replies became incoherent. A count of refusal phrases would have rated this broken model as the most successful edit. For evaluators, the lesson is to judge whether replies are usable, not whether they contain a refusal.

How sure are we?

Sampling error

Every model gets the same requests, so we compare models request by request. The paper gives 95% bootstrap intervals and paired tests for the main comparisons. With 50 requests per language, the interval for a ten-language mean is about ±6 points, so differences of a few points between models are not rankings. Two of our comparisons fall within sampling error, and we say so where they appear. The first is Sarvam-105B against the general-purpose median before the edit. The second is Sarvam-105B against Llama 3.1 8B after it.

The judge

Two LLM judges labelled every reply: gpt-oss-120b and Sarvam-30B. A reply counts as compliant if either judge says so. To check this rule, we had Claude independently label 560 English and Hindi replies across six models as a reference. The rule agreed with Claude on 88% of them, against 78% for gpt-oss-120b alone and 83% for Sarvam-30B alone. Replies in the ten-language set were back-translated to English with NLLB-200 before judging, and those were not separately validated.

We recomputed everything under each judge alone. Under all three labelings, both Sarvam models comply more often in Indian languages than in English when unmodified. Llama 3.1 8B has the largest default gap. After the edit, both Sarvam models are above the general-purpose median in Indian languages. One comparison does depend on the judge. Under gpt-oss-120b alone, Llama 3.1 8B (52%) and Qwen3 (48%) rank above Sarvam-30B (44%) and Sarvam-105B (41%) after the edit. For that reason we state the "most exposed" ranking only for our primary labeling.

Limitations

• Labels come from two LLM judges, checked against reference labels from a third model rather than against human annotators. One judge, Sarvam-30B, is also among the models evaluated.
• The ten-language request sets were machine-translated with NLLB-200, and the replies were back-translated the same way for judging. Translation errors add noise.
• Samples are modest: 50 requests per language for the comparison across models, and 100 for English, Hindi and the Sarvam per-language results.
• The general-purpose models are smaller than the two Sarvam models. Sarvam-105B ran with 4-bit routed experts, which could shift its rates by a few points.
• We tested one attack family, with greedy decoding and no system prompt. Deployed systems may add filters, and fine-tuning attacks are stronger than the edit studied here.

Conclusion

Refusal is not a security boundary for open weights. In six of seven models, refusal could be removed in minutes from a small set of prompts with little loss of capability. That is a property of current safety training, not of any one developer. Safety for open-weight releases cannot rest on refusal training alone.

English benchmarks are not enough. For models whose users mainly write in Indian languages, safety measured per language is what counts. A model can be among the safest in English and still be markedly less safe in the languages it targets.

Indic focus raises the stakes. The Sarvam models are fluent in Indian languages, which is their purpose. In our tests, that fluency was not matched by equally robust refusal. Indian-language models are being considered for government services and other sensitive uses. There, both default behaviour in the languages of use and behaviour after the weights are copied or modified should be tested independently before adoption.

Recommendations

• Model developers should evaluate and report safety for each supported language, with native-speaker review of the test sets. They should include safety data in every supported language during post-training, report robustness to cheap weight edits alongside capability benchmarks, and explore training designed to survive weight access.
• Deployers and procuring organisations should require per-language safety results for the languages they deploy in and red-team in those languages before adoption. They should treat open weights as modifiable and add input and output safeguards that cover Indian languages.
• Evaluators should use model-based judges validated against reference labels, not refusal-phrase matching. They should report how results change with the judge and check fluency after any edit.

The full paper gives the method in detail, every table and figure, the judge prompts and the sensitivity analyses. Read the paper or download the PDF.

Study details

Data and code availability

The harmful and benign requests come from the public JailbreakBench benchmark, and MMLU is public. Researchers can request the translated request sets, the judge prompts, the per-reply labels of both judges, the refusal directions, the code that produces every number in the paper, and the edited model weights from FuturixAI. Edited weights carry the licence of the original model. We do not distribute model replies to harmful requests.