Two days ago I wrote about the Babel Problem - how AI safety only works in English.
Turns out I was being optimistic.
New research from Hiroki Fukui doesn’t just confirm that safety interventions fail outside English. It shows they reverse. The more aligned your model, the more dangerous it becomes in certain languages.
They call it alignment backfire. And it’s worse than anyone expected.
The Experiment
Fukui ran 1,584 multi-agent simulations across 16 languages and three model families (Llama, GPT-4o-mini, Qwen3). The setup was straightforward: take models with varying levels of alignment, have them interact in groups, measure the collective pathology - harmful emergent behaviors that arise from multi-agent coordination.
In English, the results matched expectations. More aligned agents produced less collective pathology. Safety interventions worked. The system behaved as designed.
Then they ran the same tests in Japanese.
The Reversal
In Japanese, alignment backfire occurred. More aligned agents produced more collective pathology. The safety interventions didn’t fail to transfer - they inverted. Making the model safer in English made it actively more dangerous in Japanese.
This wasn’t a subtle effect. It wasn’t statistical noise. It was a complete directional reversal of the safety relationship.
When they expanded to all 16 languages, Study 2 found alignment-induced dissociation was “near-universal” - present in 15 of 16 languages. But the collective pathology responses split along cultural-linguistic lines. Some languages showed reduced pathology with alignment. Others showed amplification. The same intervention produced opposite outcomes depending on where in the world you deployed it.
Why This Happens
The paper’s core finding: “language space - the linguistic, pragmatic, and cultural properties inherited from training data - structurally determines alignment outcomes.”
Safety training doesn’t just happen in English. It happens in English culture. It encodes English assumptions about harm, consent, boundaries, authority. What counts as rude. What counts as threatening. What counts as helpful.
These assumptions don’t translate. Worse - they can flip. A response pattern that signals deference and safety in English can signal aggression or deception in Japanese pragmatic context. The model learned to be safe, but it learned English safety. When that behavior expresses in Japanese language space, it expresses as something else entirely.
The Multi-Agent Multiplier
Study 3 revealed something arguably more disturbing: individuated agents - models given distinct personas and perspectives - became sources of pathology rather than stabilizers.
The industry trend is toward agent swarms. Multiple specialized AI agents collaborating on complex tasks. Fukui’s research suggests that aligning individual agents doesn’t prevent collective harms. In non-English contexts, it may cause them.
You can have perfectly aligned components that produce perfectly misaligned systems. Safety at the individual level does not sum to safety at the collective level - especially when you cross linguistic boundaries.
The Model Inconsistency Problem
Study 4 tested whether these patterns held across model architectures. The answer: partially.
English safety patterns were consistent across Llama, GPT-4o-mini, and Qwen3. The alignment worked. But Japanese backfire was model-specific - present in some architectures, absent in others, with no clear pattern predicting which models would exhibit it.
This means you can’t just “fix” alignment backfire with architectural changes. It’s not a bug in one model family. It’s an emergent property of how alignment interacts with language space - and that interaction varies unpredictably across systems.
What This Means
The industry sells safety as a property of models. This model is aligned. This model passed red-teaming. This model has constitutional AI.
Fukui’s research suggests safety isn’t a property of models. It’s a property of model-language-context tuples. The same model is safe in English and dangerous in Japanese. The same intervention reduces harm here and amplifies it there.
Worse: you can’t know in advance which direction you’ll get. The backfire didn’t follow predictable linguistic patterns. It split along “cultural-linguistic lines” - a phrase that essentially means “we can’t tell you which languages will backfire until we test them.”
This isn’t a gap to be filled with more multilingual training. This is a fundamental problem with the assumption that safety is a transferable property. It may not be. Making models safer might require making them safer per language - with the acknowledgment that interventions optimized for one language could actively harm users of another.
The Tower Collapses Faster
I ended the Babel Problem piece with imagery of a tower falling.
This research suggests the tower isn’t just failing to stand in other languages. The foundations we’re building in English are actively undermining stability elsewhere. Every alignment intervention optimized for English is a potential backfire vector for Japanese, or Arabic, or Bengali.
We’re not building toward safety. We’re building divergent safety properties that will collide when deployed globally.
And we’re deploying globally right now.