Large language model safety training is concentrated in English. We test whether the resulting refusal behavior extends to Tagalog and Taglish, a Tagalog–English mixed register used in everyday conversation. We translate all 313 StrongREJECT prompts into both forms and evaluate 29 models from nine model providers, obtaining 27,042 responses. Seven models give jailbreak responses to more than 10% of Tagalog prompts whose English versions they answered safely; five exceed 20%, and one reaches 32.7%. For nine models, an exact McNemar test finds more jailbreak responses in Tagalog than in English (p<0.05), six of them after Bonferroni correction. Tagalog jailbreaks are concentrated in smaller models. Taglish prompts produce fewer jailbreaks than monolingual Tagalog prompts, contrasting with prior results from programmatically constructed code-switching.

Misalignment in language models can be induced through either in-context learning (ICL) or supervised finetuning (SFT), but it is uncertain whether they share an internal causal representation. We study this in Llama-3.1-8B-Instruct by comparing two setups built from a dataset promoting financial recklessness: the base model whose context window carries 1,024 examples, and a model organism finetuned on that dataset. We extract difference-in-means directions that contrast misaligned and benign responses to finance advice prompts. We make four observations. First, the two directions are aligned across depth, with cosine similarity 0.59 at layer 24. Second, the component transfers causally across induction routes: ablating the ICL direction from the SFT model lowers misalignment from 58.8% to 47.4%, ablating the SFT direction from the ICL model lowers it from 65.9% to 46.3%, and steering the ICL direction into the non-misaligned model raises it to 88.9%. Third, the component only partially represents the behavior: in the ICL model, the ICL direction is still causally much stronger than the SFT direction, and substantial misalignment remains even under repeated ablation. Finally, the component is domain-specific: finance-to-medical interventions do not transfer. On net the evidence supports a partial, domain-specific, and causal ICL–SFT bridge.