Yong Zheng-Xin

I am a final-year PhD student at Brown University advised by Stephen Bach. My research interests are on AI safety and alignment, and I am fortunate to be supported by the Open Philanthropy grant for technical AI safety for my PhD study.

I am currently an Astra Research Fellow working with OpenAI, mentored by Miles Wang. I am working on CoT monitorability/obfuscation as well as agentic safety evaluation. My other relevant work includes:

Safety for reasoning models: Emergent self-jailbreaking behaviors by open-source reasoning models (ICLR 2026).
Safety for multilingual models: GPT-4 being jailbroken by low-resource languages (Best Paper, NeurIPS 2023 SoLaR). Cross-lingual generalization study of detoxification (EMNLP 2024) and finetuning attacks (NAACL 2025).

Previously, I was a research scientist intern at Meta AI and a research collaborator at Cohere Labs. I contributed to multilingual frontier models including both instruction-following LLMs such as Aya and Bloom (Best Paper, ACL 2024; ACL 2023) and ASR speech models (INTERSPEECH 2025).

Selected Publications (see all)

Self-Jailbreaking: Language Models Can Reason Themselves Out of Safety Alignment After Benign Reasoning Training

Zheng-Xin Yong , and Stephen H. Bach

ICLR, 2026

PDF Abstract
Aya Model: An Instruction Finetuned Open-Access Multilingual Language Model

Ahmet Üstün* , Viraat Aryabumi* , Zheng-Xin Yong* , and 14 more authors

ACL, 2024 (Best Paper Award)

Also featured in: The Washington Post , The Globe and Mail , SiliconANGLE, etc.

PDF Abstract

Recent breakthroughs in large language models (LLMs) have centered around a handful of data-rich languages. What does it take to broaden access to breakthroughs beyond first-class citizen languages? Our work introduces Aya, a massively multilingual generative language model that follows instructions in 101 languages of which over 50% are considered as lower-resourced. Aya outperforms mT0 and BLOOMZ on the majority of tasks while covering double the number of languages. We introduce extensive new evaluation suites that broaden the state-of-art for multilingual eval across 99 languages – including discriminative and generative tasks, human evaluation, and simulated win rates that cover both held-out tasks and in-distribution performance. Furthermore, we conduct detailed investigations on the optimal finetuning mixture composition, data pruning, as well as the toxicity, bias, and safety of our models.
Low-Resource Languages Jailbreak GPT-4

Zheng-Xin Yong , Cristina Menghini , and Stephen Bach

NeurIPS Workshop: Socially Responsible Language Modelling Research (SoLaR) , 2023 (Best Paper Award)

Also featured in: New Scientist , UK AI Safety Institute (Scientific Report) , ZDNet, etc.

PDF Abstract

AI safety training and red-teaming of large language models (LLMs) are measures to mitigate the generation of unsafe content. Our work exposes the inherent cross-lingual vulnerability of these safety mechanisms, resulting from the linguistic inequality of safety training data, by successfully circumventing GPT-4’s safeguard through translating unsafe English inputs into low-resource languages. On the AdvBenchmark, GPT-4 engages with the unsafe translated inputs and provides actionable items that can get the users towards their harmful goals 79% of the time, which is on par with or even surpassing state-of-the-art jailbreaking attacks. Other high-/mid-resource languages have significantly lower attack success rate, which suggests that the cross-lingual vulnerability mainly applies to low-resource languages. Previously, limited training on low-resource languages primarily affects speakers of those languages, causing technological disparities. However, our work highlights a crucial shift: this deficiency now poses a risk to all LLMs users. Publicly available translation APIs enable anyone to exploit LLMs’ safety vulnerabilities. Therefore, our work calls for a more holistic red-teaming efforts to develop robust multilingual safeguards with wide language coverage.