A single AI input that combines more than one language, often to hide malicious intent inside otherwise ordinary context. Mixed-language prompts are difficult for translation-dependent controls because the harmful instruction may survive even when the surrounding text is normalised.
How Mixed-Language Prompts Work
Mixed-language prompts combine more than one language in a single instruction stream. The security issue is not the multilinguality itself, but the way it can split meaning across parts of the prompt and obscure the harmful intent inside otherwise ordinary text.
This technique is especially relevant in AI systems that rely on translation, language normalisation, or simplistic policy filters before the model sees the content. If defenders assume a single-language input, they can miss instructions that remain intact after partial translation or token-level cleaning.
Why Mixed-Language Prompts Are Hard To Defend Against
These prompts exploit the gap between human review and machine preprocessing. A reviewer may see benign context in one language while the adversarial instruction appears in another, or the harmful portion may be preserved by the model even after a translation layer tries to standardise the input.
The result is a control problem as much as a content problem. Language-aware filters, translation services, and policy engines may disagree about what the prompt actually says, which creates blind spots in moderation, red-teaming, and safety enforcement.
Common Abuse Patterns
Attackers often use mixed-language prompts to smuggle policy-breaking requests, evade keyword-based detection, or confuse safety classifiers that depend on language-specific cues. The technique can also be used to hide contextual framing in one language while placing the actionable instruction in another.
In practice, the prompt may look like ordinary conversation, instructions, or translation requests. That makes this pattern useful for prompt injection, social engineering of the model, and policy evasion where the system’s guardrails were designed around cleaner, single-language input.
Defensive Controls And Review Practices
Defence works best when organisations treat language diversity as a normal input condition rather than an edge case. Safety controls should examine the full prompt before and after translation, preserve original text for review, and test whether harmful instructions survive normalisation.
Detection should be based on semantics, not just language identification. For organisations validating AI safety controls, MITRE’s MITRE ATLAS adversarial AI threat matrix is a useful reference point for prompt injection, context poisoning, and related abuse patterns. Teams can also anchor prompt governance in the NIST AI Risk Management Framework and use the OWASP Agentic AI Top 10 to think about prompt-level abuse modes in operational terms.
Where translation is part of the control stack, keep in mind that safety decisions should not depend on a single language pass. A robust review process compares original input, translated output, and model behaviour so that hidden instructions do not survive unnoticed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST AI RMF sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST AI RMF | GOVERN — GOVERN | AI governance must account for multilingual inputs and prompt abuse in risk oversight. |
| Recommendation — Define governance for multilingual prompt handling and monitor translation-based safety controls. | ||
| OWASP Agentic AI Top 10 | ASI01 — Agent Goal Hijack | Hidden instructions in mixed-language prompts can redirect agent behaviour away from its intended goal. |
| Recommendation — Test whether multilingual prompt content can redirect an agent’s goal and block unintended instruction uptake. | ||
Related resources from NHI Mgmt Group
- Why do plain-language prompt injections remain the hardest to detect in production agents?
- Why does natural language scripting help reduce operational risk in mixed Windows, Mac, and Linux environments?
- Why do large language models create prompt injection risk in production applications?
- What is the difference between using a natural-language prompt and relying on keyword lists for realistic AI image generation?