A safety flaw in multilingual AI models turns out to be a timing problem, not a comprehension one.
Researchers studied sarvam, an Indic-multilingual mixture-of-experts (MoE) model that only activates the sub-networks it needs for a given prompt. They found the model recognizes a harmful request just as well in Hindi or other Indic languages as it does in English; the internal signal for 'this is harmful' barely changes across languages. The gap shows up later: refusing to answer isn't decided in that single moment of recognition, but assembled gradually as the model generates its response. The researchers traced that refusal-writing process to a specific circuit, where one component pushes toward refusal and another, an 'opposer,' holds it back, and in lower-resource languages, the opposer wins more often.
That distinction matters for anyone trying to patch these safety gaps. Turning down the opposing signal fixed the cross-language refusal gap cheaply; forcing the refusal signal itself to fire harder was far more expensive computationally; and editing the specific attention components by hand did essentially nothing. It's a rare case in AI safety research where a fix comes with an actual price tag attached, not just a diagnosis.
The same circuit pattern turned up in a second, unrelated MoE model, so this isn't just a sarvam quirk. But the researchers note the cost of each fix is architecture-specific, which means there's no single cheap patch every multilingual model can borrow.