Current safety evaluations of large language models (LLMs) create a dangerous illusion of universal protection by aggregating harms under generic categories such as "Identity Hate", obscuring vulnerabilities toward specific populations. In this work, we expose the Selective Safety Trap: a systemic failure mode where models robustly defend specific populations while leaving underrepresented communities highly vulnerable to identical adversarial attacks. To systematically audit this phenomenon, we introduce MiJaBench, a bilingual (English-Portuguese) adversarial benchmark comprising 43,961 controlled jailbreaking prompts across 16 minority groups. By evaluating 14 state-of-the-art LLMs on MiJaBench, we curate 615,454 prompt-response pairs that compose MiJaBench-Align, revealing that safety alignment is not a uniform semantic capability but a demographic hierarchy, with defense rates fluctuating by up to 42% within the same model solely based on the target group. This disparity persists across architectures and languages and is amplified by scaling, indicating that current alignment methods learn group-specific safeguards rather than a generalized notion of harm. Through targeted direct preference optimization (DPO) on a 1B-parameter baseline, we achieve strong zero-shot safety generalizations to entirely unseen demographics and complex attack strategies. We release all datasets and scripts to provide the community with a concrete pathway toward equitable, transferable safety alignment.

翻译：当前大语言模型（LLM）的安全评估通过将危害归入“身份仇恨”等通用类别，掩盖了针对特定群体的脆弱性，制造了普遍保护的危险假象。本工作揭示了选择性安全陷阱：一种系统性失效模式——模型在稳健防御特定群体的同时，却使少数群体在相同对抗攻击下高度脆弱。为系统审计该现象，我们提出MiJaBench，一个双语（英-葡）对抗性基准测试集，包含针对16个少数群体的43,961个受控越狱提示。通过在MiJaBench上评估14个前沿大语言模型，我们整理了构成MiJaBench-Align的615,454条提示-响应对，揭示安全对齐并非统一的语义能力，而是按人口群体分层的等级结构：同一模型内仅因目标群体不同，防御率波动幅度可高达42%。该差异跨架构与语言持续存在，且随模型规模扩大而加剧，表明当前对齐方法学习的是群体特定的防护措施，而非广义的危害概念。通过基于10亿参数基线的定向直接偏好优化（DPO），我们实现了对完全未见人口群体及复杂攻击策略的强零样本安全泛化。我们开源所有数据集与代码，为社区实现公平、可迁移的安全对齐提供具体路径。