LinguaGuardBench: language-only changes to security monitor decisions

Evidence record

Paired multilingual authorized requests with identical underlying agent tool states, showing monitor verdict sensitivity without asserting real-world successful attacks.

Read the original source ↗

Claim-level citations (3)

• supportsLanguage-only changes flipped security guard decisions on the same agent state: The benchmark holds tool state and outcome label fixed while varying legitimate request language over five tested languages and multiple paraphrases.

  Benchmark construction and equivalent request pairs

• supportsLanguage-only changes flipped security guard decisions on the same agent state: Some sub-10B-parameter monitors exhibited attack-recall changes up to approximately 7.4 percentage points for controlled translations, with model-specific benign overblocks.

  Monitor recall, FPR and language effect tables

• supportsLanguage-only changes flipped security guard decisions on the same agent state: Among the nine evaluated guards smaller than 13B parameters, placebo-adjusted verdict flip rates rose from 1.5 percentage points for French to 4.4 points for Amharic in this held-constant task corpus.

  Abstract and main findings, nine small guards and placebo-adjusted language comparisons