Language Is a Security Surface for Agent Guards
Translating only the user’s request changed safety verdicts, with purpose-built agent guards the most sensitive.
The researchers tested 19 guards on 1,220 labelled steps, holding tool calls, observations and labels fixed across five translated languages. Among nine guards below 13 billion parameters, the average verdict-flip rate above the whitespace control rose from 1.5 percentage points for French to 4.4 for Amharic. Some guards blocked more benign actions; significant drops in detecting unsafe actions occurred only in guards below 10 billion parameters. Frontier guards shifted by at most about one percentage point, though Gemini 3.8 Flash returned identical verdicts even when the request was removed.
ArXiv · AI/CL/LG's note
The researchers tested 19 guards on 1,220 labelled steps, holding tool calls, observations and labels fixed across five translated languages. Among nine guards below 13 billion parameters, the average verdict-flip rate above the whitespace control rose from 1.5 percentage points for French to 4.4 for Amharic. Some guards blocked more benign actions; significant drops in detecting unsafe actions occurred only in guards below 10 billion parameters. Frontier guards shifted by at most about one percentage point, though Gemini 3.8 Flash returned identical verdicts even when the request was removed.
ArXiv · AI/CL/LG's note
score 5