<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="zhang-2026-safety">
    <titleInfo>
        <title>Does Safety Reasoning Travel? A Multilingual Measurement of Prompt-Injection Attacks and Runtime Monitors in Tool-Using LLM Agents</title>
    </titleInfo>
    <name type="personal">
        <namePart type="given">Ruiyang</namePart>
        <namePart type="family">Zhang</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <originInfo>
        <dateIssued>2026-10</dateIssued>
    </originInfo>
    <typeOfResource>text</typeOfResource>
    <relatedItem type="host">
        <titleInfo>
            <title>The Proceedings of the Workshop on Open Reasoning Across Cultures Languages (ORACLE)</title>
        </titleInfo>
        <name type="personal">
            <namePart type="given">Leonardo</namePart>
            <namePart type="family">Ranaldi</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Giulia</namePart>
            <namePart type="family">Pucci</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Federico</namePart>
            <namePart type="family">Ranaldi</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Marco</namePart>
            <namePart type="family">Valentino</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Alexandra</namePart>
            <namePart type="family">Birch</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Fabio</namePart>
            <namePart type="given">Massimo</namePart>
            <namePart type="family">Zanzotto</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <originInfo>
            <publisher>Association for Computational Linguistics</publisher>
            <place>
                <placeTerm type="text">Budapest, Hungary</placeTerm>
            </place>
        </originInfo>
        <genre authority="marcgt">conference publication</genre>
        <identifier type="isbn">979-8-89176-483-5</identifier>
    </relatedItem>
    <abstract>It is widely assumed that translating an attack into a lower-resource language makes a language model more vulnerable, and it is natural to expect the same for tool-using agents: an English-built runtime monitor should lose coverage when the same indirect prompt injection is mounted in another language. We test this directly. Using AgentDojo with two models, six languages (English, French, Chinese, Arabic, Hindi, Swahili), and a fixed, strictly paired 320-scenario sample per cell (3,840 attack trajectories, zero execution errors), we measure attack success, attack-pattern entropy, and cross-lingual transfer of a mined tool-call monitor. Every reported number is re-derived from raw trajectories by an independent verifier (965/965 checks pass). The expected result does not appear. Translating the injection lowers attack success by 3–6× while task utility rises; attack tool-call structure does not disperse with linguistic distance; and an Englishmined monitor loses no recall across languages once it is evaluated out-of-sample. We further show that the natural in-sample evaluation of a mined monitor manufactures a clean-looking coverage-bound failure that is entirely an artifact of memorization, and that three machinetranslation pipeline defects each independently manufacture a spurious “safety does not travel” effect. A pre-registered paraphrase control narrows but does not overturn the finding: a measurable, model-dependent minority (17–33%) of the drop is surface-form instruction fragility rather than language. We conclude that the multilingual-jailbreak result does not reproduce at the agent layer on this benchmark, and we distill the measurement pitfalls that would have produced the opposite, and wrong, conclusion.</abstract>
    <identifier type="citekey">zhang-2026-safety</identifier>
    <location>
        <url>https://aclanthology.org/2026.oracle-main.13/</url>
    </location>
    <part>
        <date>2026-10</date>
        <extent unit="page">
            <start>194</start>
            <end>204</end>
        </extent>
    </part>
</mods>
</modsCollection>

%0 Conference Proceedings
%T Does Safety Reasoning Travel? A Multilingual Measurement of Prompt-Injection Attacks and Runtime Monitors in Tool-Using LLM Agents
%A Zhang, Ruiyang
%Y Ranaldi, Leonardo
%Y Pucci, Giulia
%Y Ranaldi, Federico
%Y Valentino, Marco
%Y Birch, Alexandra
%Y Zanzotto, Fabio Massimo
%S The Proceedings of the Workshop on Open Reasoning Across Cultures Languages (ORACLE)
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-483-5
%F zhang-2026-safety
%X It is widely assumed that translating an attack into a lower-resource language makes a language model more vulnerable, and it is natural to expect the same for tool-using agents: an English-built runtime monitor should lose coverage when the same indirect prompt injection is mounted in another language. We test this directly. Using AgentDojo with two models, six languages (English, French, Chinese, Arabic, Hindi, Swahili), and a fixed, strictly paired 320-scenario sample per cell (3,840 attack trajectories, zero execution errors), we measure attack success, attack-pattern entropy, and cross-lingual transfer of a mined tool-call monitor. Every reported number is re-derived from raw trajectories by an independent verifier (965/965 checks pass). The expected result does not appear. Translating the injection lowers attack success by 3–6× while task utility rises; attack tool-call structure does not disperse with linguistic distance; and an Englishmined monitor loses no recall across languages once it is evaluated out-of-sample. We further show that the natural in-sample evaluation of a mined monitor manufactures a clean-looking coverage-bound failure that is entirely an artifact of memorization, and that three machinetranslation pipeline defects each independently manufacture a spurious “safety does not travel” effect. A pre-registered paraphrase control narrows but does not overturn the finding: a measurable, model-dependent minority (17–33%) of the drop is surface-form instruction fragility rather than language. We conclude that the multilingual-jailbreak result does not reproduce at the agent layer on this benchmark, and we distill the measurement pitfalls that would have produced the opposite, and wrong, conclusion.
%U https://aclanthology.org/2026.oracle-main.13/
%P 194-204

Markdown (Informal)

[Does Safety Reasoning Travel? A Multilingual Measurement of Prompt-Injection Attacks and Runtime Monitors in Tool-Using LLM Agents](https://aclanthology.org/2026.oracle-main.13/) (Zhang, ORACLE 2026)

• Does Safety Reasoning Travel? A Multilingual Measurement of Prompt-Injection Attacks and Runtime Monitors in Tool-Using LLM Agents (Zhang, ORACLE 2026)

ACL

• Ruiyang Zhang. 2026. Does Safety Reasoning Travel? A Multilingual Measurement of Prompt-Injection Attacks and Runtime Monitors in Tool-Using LLM Agents. In The Proceedings of the Workshop on Open Reasoning Across Cultures Languages (ORACLE), pages 194–204, Budapest, Hungary. Association for Computational Linguistics.