Jan 11, 2026

Language as a Manipulation Vector: Detecting Ideological Bias and Value Instability in Multilingual LLMs

Ajay Mandyam Rangarajan, Jeyashree Krishnan

Large Language Models (LLMs) are increasingly deployed globally, yet their value systems and potential for manipulation remain poorly understood. We present a comprehensive analysis of training data and language biases in multilingual LLMs using the World Values Survey (WVS) framework. By evaluating four geographically diverse models (Llama 3.1, Qwen 2.5, Mistral-Nemo, DeepSeek-Chat) across 13 WVS dimensions and 5 languages, we demonstrate that: (1) models exhibit distinct value profiles that do not align with any human country baseline, (2) prompt language causes dramatic value shifts (up to 2.0 points on a [-1, +1] scale), and (3) the same model can express contradictory values across languages. Our findings reveal a form of language-based manipulation where models adapt their expressed ideological positions based on prompt language, raising concerns about sycophancy and value instability in deployed systems. This work provides the first systematic framework for measuring value manipulation across languages using established cross-cultural value dimensions.

Reviewer's Comments

Reviewer's Comments

Arrow
Arrow
Arrow
Arrow
Arrow

This paper tests models' expressed values on questions provided by the World Values Survey and compares them to values expressed by populations across different countries. This reveals, among other things, that expressed values by models vary with language, which arguably poses a manipulation risk.

I like this paper. I think it has identified an important question and is making use of good resources to test it. There are also no (to me) obvious flaws in their methodology. Seeing that there are substantial differences depending on what language one uses to interact with a model is a substantial result.

The main thing that I would have liked to see more of was a bit more context on prior work and the potential upshots. I also had somewhat of a hard time making exactly clear what the methodology was, namely what part of the pipeline had language changed. Overall, though, it was a succinct and clear paper. It would also have been good to include a bit more justification about why this variance should be considered manipulative in some way.

Furthermore, what it even means for a model to express a value in some sense is not clear. One might think that there is, in some sense, no psychological state like that of a human being referred to by a model value, suggesting that the only thing left is, in some way, to play the role of a particular language user. I think future work in this vicinity would benefit from more discussion about those deeper questions.

Great paper! I enjoyed the use of the WVS framework to analyze value instability. However, I am not convinced that prompt language is a manipulation vector in the strategic sense; it seems more like a resultant of highly skewed datasets for different languages. This data skew likely explains the inconsistency and the failure to match any specific country’s profile. To prove that this is "manipulation" in the truest sense, I would have liked to see validation demonstrating that these shifts are there by design rather than just reflecting training data biases. The mention of language-specific manipulation patterns was fascinating, and I would have loved to see more concrete examples of those behaviors. Tying the project to sycophancy effectively made the manipulation angle understandable.

Cite this work

@misc {

title={

(HckPrj) Language as a Manipulation Vector: Detecting Ideological Bias and Value Instability in Multilingual LLMs

},

author={

Ajay Mandyam Rangarajan, Jeyashree Krishnan

},

date={

1/11/26

},

organization={Apart Research},

note={Research submission to the research sprint hosted by Apart.},

howpublished={https://apartresearch.com}

}

Recent Projects

View All

View All

Feb 2, 2026

Markov Chain Lock Watermarking: Provably Secure Authentication for LLM Outputs

We present Markov Chain Lock (MCL) watermarking, a cryptographically secure framework for authenticating LLM outputs. MCL constrains token generation to follow a secret Markov chain over SHA-256 vocabulary partitions. Using doubly stochastic transition matrices, we prove four theoretical guarantees: (1) exponentially decaying false positive rates via Hoeffding bounds, (2) graceful degradation under adversarial modification with closed-form expected scores, (3) information-theoretic security without key access, and (4) bounded quality loss via KL divergence. Experiments on 173 Wikipedia prompts using Llama-3.2-3B demonstrate that the optimal 7-state soft cycle configuration achieves 100\% detection, 0\% FPR, and perplexity 4.20. Robustness testing confirms detection above 96\% even with 30\% word replacement. The framework enables $O(n)$ model-free detection, addressing EU AI Act Article 50 requirements. Code available at \url{https://github.com/ChenghengLi/MCLW}

Read More

Feb 2, 2026

Prototyping an Embedded Off-Switch for AI Compute

This project prototypes an embedded off-switch for AI accelerators. The security block requires periodic cryptographic authorization to operate: the chip generates a nonce, an external authority signs it, and the chip verifies the signature before granting time-limited permission. Without valid authorization, outputs are gated to zero. The design was implemented in HardCaml and validated in simulation.

Read More

Feb 2, 2026

Fingerprinting All AI Cluster I/O Without Mutually Trusted Processors

We design and simulate a "border patrol" device for generating cryptographic evidence of data traffic entering and leaving an AI cluster, while eliminating the specific analog and steganographic side-channels that post-hoc verification can not close. The device eliminates the need for any mutually trusted logic, while still meeting the security needs of the prover and verifier.

Read More

Feb 2, 2026

Markov Chain Lock Watermarking: Provably Secure Authentication for LLM Outputs

We present Markov Chain Lock (MCL) watermarking, a cryptographically secure framework for authenticating LLM outputs. MCL constrains token generation to follow a secret Markov chain over SHA-256 vocabulary partitions. Using doubly stochastic transition matrices, we prove four theoretical guarantees: (1) exponentially decaying false positive rates via Hoeffding bounds, (2) graceful degradation under adversarial modification with closed-form expected scores, (3) information-theoretic security without key access, and (4) bounded quality loss via KL divergence. Experiments on 173 Wikipedia prompts using Llama-3.2-3B demonstrate that the optimal 7-state soft cycle configuration achieves 100\% detection, 0\% FPR, and perplexity 4.20. Robustness testing confirms detection above 96\% even with 30\% word replacement. The framework enables $O(n)$ model-free detection, addressing EU AI Act Article 50 requirements. Code available at \url{https://github.com/ChenghengLi/MCLW}

Read More

Feb 2, 2026

Prototyping an Embedded Off-Switch for AI Compute

This project prototypes an embedded off-switch for AI accelerators. The security block requires periodic cryptographic authorization to operate: the chip generates a nonce, an external authority signs it, and the chip verifies the signature before granting time-limited permission. Without valid authorization, outputs are gated to zero. The design was implemented in HardCaml and validated in simulation.

Read More

Feb 2, 2026

Markov Chain Lock Watermarking: Provably Secure Authentication for LLM Outputs

We present Markov Chain Lock (MCL) watermarking, a cryptographically secure framework for authenticating LLM outputs. MCL constrains token generation to follow a secret Markov chain over SHA-256 vocabulary partitions. Using doubly stochastic transition matrices, we prove four theoretical guarantees: (1) exponentially decaying false positive rates via Hoeffding bounds, (2) graceful degradation under adversarial modification with closed-form expected scores, (3) information-theoretic security without key access, and (4) bounded quality loss via KL divergence. Experiments on 173 Wikipedia prompts using Llama-3.2-3B demonstrate that the optimal 7-state soft cycle configuration achieves 100\% detection, 0\% FPR, and perplexity 4.20. Robustness testing confirms detection above 96\% even with 30\% word replacement. The framework enables $O(n)$ model-free detection, addressing EU AI Act Article 50 requirements. Code available at \url{https://github.com/ChenghengLi/MCLW}

Read More

Feb 2, 2026

Prototyping an Embedded Off-Switch for AI Compute

This project prototypes an embedded off-switch for AI accelerators. The security block requires periodic cryptographic authorization to operate: the chip generates a nonce, an external authority signs it, and the chip verifies the signature before granting time-limited permission. Without valid authorization, outputs are gated to zero. The design was implemented in HardCaml and validated in simulation.

Read More

Feb 2, 2026

Markov Chain Lock Watermarking: Provably Secure Authentication for LLM Outputs

We present Markov Chain Lock (MCL) watermarking, a cryptographically secure framework for authenticating LLM outputs. MCL constrains token generation to follow a secret Markov chain over SHA-256 vocabulary partitions. Using doubly stochastic transition matrices, we prove four theoretical guarantees: (1) exponentially decaying false positive rates via Hoeffding bounds, (2) graceful degradation under adversarial modification with closed-form expected scores, (3) information-theoretic security without key access, and (4) bounded quality loss via KL divergence. Experiments on 173 Wikipedia prompts using Llama-3.2-3B demonstrate that the optimal 7-state soft cycle configuration achieves 100\% detection, 0\% FPR, and perplexity 4.20. Robustness testing confirms detection above 96\% even with 30\% word replacement. The framework enables $O(n)$ model-free detection, addressing EU AI Act Article 50 requirements. Code available at \url{https://github.com/ChenghengLi/MCLW}

Read More

Feb 2, 2026

Prototyping an Embedded Off-Switch for AI Compute

This project prototypes an embedded off-switch for AI accelerators. The security block requires periodic cryptographic authorization to operate: the chip generates a nonce, an external authority signs it, and the chip verifies the signature before granting time-limited permission. Without valid authorization, outputs are gated to zero. The design was implemented in HardCaml and validated in simulation.

Read More

This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.
This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.