Cross-Lingual Transfer of Evil Vectors Is Directionally Asymmetric
The paper studies whether “evil” persona vectors—linear residual-stream directions used to steer LLM behavior toward harmfulness—represent a cross-lingual concept by extracting and testing them across English, Spanish, Swahili, and Telugu in several instruction-tuned open models. Its main insight is that transfer is asymmetric: high-resource-language vectors align with each other and steer low-resource-language behavior while preserving general capability, but low-resource-language vectors are noisy and often ineffective even in-language, with the main limitation being that the evidence is confined to a small set of languages, models, and the specific “evil vector” methodology.
Abstract
Persona vectors are linear directions in the residual-stream activations of LLMs that encode behavioral traits and enable fine-grained control over model behavior. Among them, the evil persona vector is particularly relevant to understanding harmful behavior, jailbreak vulnerabilities, and the unlearning of harmful knowledge. Yet whether this vector reflects a genuinely cross-lingual concept, rather than an artifact of its extraction language, remains untested. We conduct a systematic evil-vector transfer study across two high-resource languages (English, Spanish) and two low-resource languages (Swahili, Telugu) on four open-source instruction-tuned LLMs, and find that transfer is directionally asymmetric. Evil vectors are harder to obtain reliably from low-resource languages, and the resulting vectors are largely ineffective at steering, even within their own language. In contrast, vectors extracted from high-resource languages transfer effectively to low-resource inputs while largely preserving general knowledge, as measured by MMLU. Geometric analysis further supports this pattern: evil vectors from the two high-resource languages are closely aligned, whereas low-resource vectors align only weakly with this shared direction. These results suggest that a shared cross-lingual evil direction exists and, once reliably extracted from a high-resource language, can be reused to steer behavior in low-resource languages without additional per-language data collection.