Safety mechanisms for large language models (LLMs) remain predominantly English-centric, creating systematic vulnerabilities in multilingual deployment. Prior work shows that translating malicious prompts into other languages can substantially increase jailbreak success rates, exposing a structural cross-lingual security gap. We investigate whether such attacks can be mitigated through language-agnostic semantic similarity without retraining or language-specific adaptation. Our approach compares multilingual query embeddings against a fixed English codebook of jailbreak prompts, operating as a training-free external guardrail for black-box LLMs. We conduct a systematic evaluation across four languages, two translation pipelines, four safety benchmarks, three embedding models, and three target LLMs (Qwen, Llama, GPT-3.5). Our results reveal two distinct regimes of cross-lingual transfer. On curated benchmarks containing canonical jailbreak templates, semantic similarity generalizes reliably across languages, achieving near-perfect separability (AUC up to 0.99) and substantial reductions in absolute attack success rates under strict low-false-positive constraints. However, under distribution shift - on behaviorally diverse and heterogeneous unsafe benchmarks - separability degrades markedly (AUC $\approx$ 0.60-0.70), and recall in the security-critical low-FPR regime drops across all embedding models.

翻译：大语言模型的安全机制仍以英语为中心，这在多语言部署中形成了系统性漏洞。已有研究表明，将恶意提示翻译为其他语言可显著提升越狱攻击成功率，暴露出结构性跨语言安全鸿沟。我们探究能否通过语言无关的语义相似性来缓解此类攻击，而无需重新训练或进行语言特异性适配。本方法将多语言查询嵌入与固定英语越狱提示码本进行比对，作为面向黑盒大语言模型的免训练外部防护栏。我们系统评估了四种语言、两条翻译流水线、四个安全基准、三种嵌入模型及三种目标大语言模型（Qwen、Llama、GPT-3.5）。研究揭示出两种截然不同的跨语言迁移模式：在包含经典越狱模板的标准化基准上，语义相似性可跨语言可靠泛化，实现近乎完美的可分性（AUC最高达0.99），并在严格低误报约束下显著降低绝对攻击成功率；然而在分布偏移条件下（即行为多样且异构的不安全基准），可分性显著下降（AUC≈0.60-0.70），且所有嵌入模型在安全关键的低误报率区间内召回率均出现骤降。