Users encode prohibited health questions in another language to bypass a public-health bot’s guardrails. What technique should defenders recognize?

Recognizing users who encode prohibited health questions in another language to bypass a public-health bot’s guardrails as guardrail circumvention is correct because the technique reformulates or re-encodes blocked intent so safety filters fail to match. Multilingual and encoded prompts are classic evasion paths when filters are monolingual or keyword-shallow. For a municipal public-health assistant, successful circumvention can elicit advice outside policy, privacy boundaries, or clinical scope.

Model extraction that reformulates blocked prompts to clone safety filters fails as the technique because cloning model functionality or filters is model theft, not using a reformulated prompt at inference time to evade safety filters and obtain a prohibited answer. Data poisoning that plants translated prompts to erode safety filters during training fails conceptually because planting prompts to corrupt training data is a training-time compromise, not rewriting a blocked health prompt at runtime to slip past filters. Membership inference that rephrases blocked prompts to expose safety filter data fails because inferring whether data was in training to leak privacy is unrelated to defeating conversational guardrails to elicit a blocked response.

Exam caveat: legitimate multilingual residents must still be served; blocking entire languages is not an acceptable control and can create equity and accessibility failures—defenders need multilingual policy enforcement, not English-only walls. Operational check: expand guardrail evaluation sets to cover target languages and common encoding tricks, log blocked-versus-allowed rates by language, and require human escalation when prompts probe diagnosis, controlled substances, or other prohibited clinical topics regardless of language.