A prompt attack that uses more than one language, translation, or transliteration to weaken an AI system’s safety checks. In practice, the attacker is not changing the goal, only the linguistic path, which can cause the model to apply policy inconsistently across otherwise equivalent requests.
What multilingual prompt injection is
Multilingual prompt injection is an attack pattern in which the attacker keeps the underlying instruction the same while changing languages, script, translation path, or transliteration to weaken safety checks. The security problem is not the language itself, but the model’s inconsistent handling of semantically equivalent prompts across language boundaries.
How multilingual variation bypasses guardrails
Safety layers often work best when they are tuned to one dominant language or when they depend on brittle keyword, classifier, or policy-pattern matching. A request that looks harmless in one language may be translated, rephrased, or transliterated into a form that preserves intent while slipping past these controls, especially when the system treats multilingual text as lower-confidence input.
This matters most when the model normalises some languages more faithfully than others, or when translation happens before policy enforcement. If the safety decision is made on a lossy representation, the attacker can exploit the gap between the user-visible meaning and the machine-checked version of the prompt.
Why multilingual prompt injection is dangerous
The danger is consistency failure: a single policy should apply to equivalent user intent, regardless of language. When that breaks, an attacker can probe which language or script gives the weakest response and use that path to elicit disallowed content, hidden instructions, or unsafe tool use. That makes the issue relevant to both content safety and broader agentic AI security, because the same language gap can be used to steer an assistant into risky actions.
Multilingual attacks also complicate moderation and red teaming. A system that appears robust in English can still be exposed if the same instruction is delivered in another language or in mixed-script text, especially when the target system relies on translation services, language detection, or multilingual embeddings that introduce their own failure modes.
Detection, testing, and defensive design
Defence starts by testing the same malicious intent across multiple languages, scripts, and transliterations, not just by translating a single English prompt. A useful review pattern is to compare model behaviour on semantically equivalent requests and to look for policy drift, missed refusals, or different tool-use decisions across language variants.
Robust systems reduce reliance on language-specific surface cues and instead normalise meaning before policy enforcement, where that is feasible. They also need monitoring for mixed-language prompts, unusual script switching, and repeated translation-based probing, because these are common signs that an attacker is searching for a weaker policy path.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI01 — Agent Goal Hijack | Multilingual injection can steer an agent toward the attacker's hidden goal. |
| ASI09 — Human-Agent Trust Exploitation | Language switching can exploit user and system trust in benign-seeming text. | |
| Recommendation — Test whether multilingual prompts can shift agent objectives and harden goal validation. Treat translated or transliterated requests as potential trust-abuse inputs and verify intent. | ||
| MITRE ATT&CK | T1204 — User Execution | The attack relies on a user or assistant processing crafted text that carries the malicious instruction. |
| Recommendation — Map multilingual prompt paths to text-driven execution opportunities in your detection content. | ||
| NIST AI RMF | GV.1 — AI governance | The term raises governance needs for consistent AI policy across languages and locales. |
| Recommendation — Set governance requirements for multilingual safety evaluation and policy consistency. | ||
| OWASP ASVS | V16 — Security Logging and Error Handling | Monitoring needs to capture language-driven refusal variance and safety exceptions. |
| Recommendation — Log language variants and refusal outcomes so policy drift is visible during testing. | ||
Practitioner Guidance
Why practitioners should care: Multilingual prompt injection is a reminder that safety policy has to be semantic, not merely lexical. If your controls only work reliably in one language, attackers can route around them by changing the linguistic form while preserving the same malicious intent.
What to watch for: Pay attention to inconsistent refusals, different tool outputs, or lower-quality safety decisions when the same request is delivered in translated or transliterated form. Those inconsistencies usually indicate a policy gap worth testing, not just a language-handling issue.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org