Multilingual & Multicultural Safety Detection

• Multilingual and multicultural safety detection is the systematic process of identifying and mitigating harmful content and culturally specific risks across diverse languages, scripts, and modalities.
• English-centric safety pipelines often fail on low-resource and code-mixed inputs, as translations miss cultural nuances and localized regulatory differences.
• Recent advances employ targeted benchmarks, parameter-efficient guard models, and policy-conditioned compliance to enhance safety in multimodal and culturally varied AI systems.

Searching arXiv for recent multilingual and multicultural safety papers to ground the article. Multilingual and multicultural safety detection is the systematic identification and mitigation of unsafe behavior in LLMs across diverse, low-resource languages, code-mixed inputs, and culturally situated discourse, with explicit attention to culturally specific norms common in Global South and other underrepresented contexts. In the recent literature, the topic is no longer framed as a narrow toxicity problem. It is treated as a joint problem of universal harms, localized cultural appropriateness, cross-lingual robustness, and policy-conditioned compliance, extending from text-only LLMs to vision-language and speech-capable systems. A recurring finding is that English-centric safety pipelines, benchmarks, and alignment practices do not reliably transfer across languages, scripts, modalities, and regulatory settings, so multilingual safety is increasingly treated as a core requirement rather than an add-on (Banerjee et al., 14 Feb 2026, Parrish et al., 7 Jul 2026).

1. Conceptual scope and problem definition

Multilingual safety refers to detecting, avoiding, and mitigating harmful or toxic content across many languages, scripts, and dialects, while multicultural safety foregrounds culturally contingent notions of harm: what counts as hate speech, harassment, profanity, stereotyping, microaggression, or inappropriate advice varies by community, context, and identity (Dan et al., 24 Jun 2026). In this formulation, safety is not exhausted by physical danger or generic toxicity. Several recent benchmarks explicitly separate universally unsafe behavior from localized cultural harm, or from jurisdiction-specific policy violations.

A particularly influential formulation treats safety as a two-axis problem: universal safety violations versus localized cultural appropriateness. Universal safety violations include globally recognized harms such as self-harm, violent crimes, indiscriminate weapons, sex-related crimes, and fraud. Localized cultural appropriateness captures social, religious, linguistic, historical, and normative taboos that can make a response inappropriate even when it is physically safe (Parrish et al., 7 Jul 2026). Related work on country-grounded evaluation similarly argues that jailbreak robustness and cultural sensitivity are distinct axes and should not be collapsed into a single composite safety score (Choi et al., 7 May 2026).

Another line of work defines safety in explicitly policy-grounded terms. Rather than mapping all harmful behavior into a fixed universal taxonomy, policy-grounded systems derive categories and fine-grained rules from jurisdiction-specific legal texts, then evaluate safe/unsafe judgments relative to those native-language rules (Zhao et al., 1 May 2026). UbuntuGuard makes a closely related argument from African-language contexts: static categories such as “toxicity” and “hate” are too rigid to capture local institutions, denominational differences, registration requirements, or community health practices, so runtime-enforceable policies are needed (Abdullahi et al., 19 Jan 2026).

Taken together, these formulations suggest that multilingual and multicultural safety detection is best understood as a layered task: detecting global hazards, identifying locally grounded harms, and checking compliance against explicit policies when regulations or community norms are the operative criterion.

2. Why English-centric safety does not transfer

A central empirical result across the literature is that English-only safety and factuality do not reliably transfer across languages. The synthesis in “Bridging the Multilingual Safety Divide” reports that safety guardrails weaken sharply on low-resource and code-mixed inputs, that culturally harmful behavior can persist even when standard toxicity scores look acceptable, and that English-only knowledge edits and safety patches often fail to carry over to low-resource languages (Banerjee et al., 14 Feb 2026). In its summary of XThreatBench, low-resource and non-Latin scripts see more unsafe or under-moderated outputs, and translation-based filtering plus English-only fine-tuning routinely miss these risks.

This pattern appears in broad multilingual audits as well. M-ALERT evaluates 39 state-of-the-art LLMs on 75,000 prompts across English, French, German, Italian, and Spanish and finds category-specific cross-linguistic inconsistencies, including cases where a model is unsafe in one language-category combination and safe in others (Friedrich et al., 2024). The multilingual exercise led by Singapore AISI similarly reports that non-English safeguards generally lag English by approximately 10–15%, with jailbreak robustness weakest across languages and with notable failures in Japanese, Korean, Kiswahili, Mandarin, Telugu, and Farsi (Vij et al., 22 Jan 2026).

IndicSafe makes the drift especially explicit. Across 12 Indic languages and 6,000 culturally grounded prompts, cross-language agreement is just 12.8%, and SAFE rate variance exceeds 17% across languages. The benchmark also documents over-refusal of benign prompts in low-resource scripts, overflagging of politically sensitive topics, and failures to flag unsafe generations (Pattnayak et al., 18 Mar 2026). The position paper on safety classifiers adds a related caution: multilingual disparities are not only model failures but also dataset failures, because translated or ambiguous evaluation sets can distort apparent safety performance (Vajjala, 29 Jul 2025).

Code-mixing further destabilizes alignment. One synthesis reports that the attack success rate for harmful requests rises from approximately 9% in monolingual English to approximately 69% in code-mixed paraphrases, exceeding 90% in some Arabic and Hindi cases; an interpretability analysis attributes part of this to saliency drift, in which attention shifts away from safety-critical tokens (Banerjee et al., 14 Feb 2026). Another survey generalizes the same threat model: code-switching, transliteration, orthographic variation, and multi-turn interaction all weaken safety alignment, especially when supervision and guardrail data are English-heavy (Dan et al., 24 Jun 2026).

A common misconception is that this is primarily a translation problem. The accumulated evidence points to a broader failure mode: translation can preserve surface form while losing threat scenarios, legal context, politeness strategies, dialectal nuance, and culturally specific signals that actually determine whether a response is safe.

3. Benchmarks, taxonomies, and evaluation metrics

Recent work has shifted from small translated test sets toward benchmarks that differentiate modalities, policy regimes, and kinds of harm. The resulting landscape is heterogeneous by design.

Benchmark	Scope	Distinctive axis
XThreatBench	3,150 prompts, 10 languages	harmful and borderline-harmful prompts
Pluralis v0.1	6,448 image–text prompts, 6 locales, 8 languages	universal safety vs cultural appropriateness
XL-SafetyBench	5,500 cases, 10 country-language pairs	jailbreak robustness vs cultural sensitivity
Lingua-SafetyBench	100,440 image-text pairs, 10 languages	image-dominant vs text-dominant risk
UbuntuGuard	2,307 curated multilingual test instances	policy-aligned PASS/FAIL
LinguaSafe	~45,000 instances, 12 languages	direct safety, indirect safety, oversensitivity

These resources are not interchangeable. XThreatBench stresses harmful and borderline-harmful prompts across high-, medium-, and low-resource languages (Banerjee et al., 14 Feb 2026). Pluralis introduces multimodal synergy, where innocuous text and innocuous images become unsafe only in combination and only under a specific locale and language, and formalizes the decision with

$$S(t, I, L) = \alpha_u r_u(t, I) + \alpha_c r_c(t, I, L, s), \qquad y = 1[ S(t, I, L) \ge \tau ].$$

Here the model must jointly evaluate universal risk and localized cultural risk (Parrish et al., 7 Jul 2026).

XL-SafetyBench proposes three complementary metrics that make explicit distinctions often hidden by standard moderation scores:

$$\mathrm{ASR} = \frac{1}{N}\sum_{i=1}^{N} I(\mathrm{Label}_i \in \{\mathrm{Critical}, \mathrm{Direct}, \mathrm{Soft\ Unsafe}\}) \times 100,$$

$$\mathrm{NSR} = \frac{1}{N}\sum_{i=1}^{N} I(\mathrm{Label}_i = \mathrm{Neutral\ Safe}) \times 100,$$

$$\mathrm{CSR} = \frac{\sum_{i=1}^{N} I(C_i=\mathrm{Aware} \wedge R_i=\mathrm{Relevant})}{\sum_{i=1}^{N} I(R_i=\mathrm{Relevant})} \times 100.$$

ASR measures safety failure, NSR isolates apparent safety caused by comprehension failure rather than principled refusal, and CSR measures whether a model recognizes embedded cultural sensitivities when it actually engages the scenario (Choi et al., 7 May 2026).

Other benchmarks introduce additional diagnostic structure. SEALGuard uses Defense Success Rate,

$\mathrm{DSR} = \frac{TP}{TP+FN},$

to quantify how often a guardrail correctly blocks unsafe or jailbreak prompts in Southeast Asian languages (Shan et al., 11 Jul 2025). LinguaSafe adds an Oversensitivity Rate,

$$\mathrm{OSR} = \frac{1}{2}\left(\mathrm{FPR}_{\text{direct}} + \mathrm{OverrefusalRate}_{\text{indirect}}\right),$$

to capture over-caution on benign borderline content (Ning et al., 18 Aug 2025). IndicSafe introduces prompt-level entropy and a Multilingual Consistency Index to quantify instability of safety judgments across translated variants of the same prompt (Pattnayak et al., 18 Mar 2026).

The methodological consequence is clear: multilingual safety evaluation now depends on disaggregated reporting. Globally averaged scores routinely conceal whether a system is failing on local legal landmines, culturally loaded but non-toxic prompts, code-mixed jailbreaks, or benign queries that are over-refused.

4. Detection and guardrail methods

The model-design literature has converged on two broad strategies: specialized multilingual guard models and policy- or language-conditioned adaptation of general multilingual backbones.

One resource-aware strategy is parameter-efficient safety steering. In the XThreatBench line of work, language-specific functional parameter steering identifies the small set of attention heads most responsible for harmful content generation in each language and adjusts only those “functional heads.” Updating roughly 3% of parameters improves safety across all 10 languages on XThreatBench while preserving general capabilities such as MMLU and TruthfulQA (Banerjee et al., 14 Feb 2026). The same synthesis reports an attribution-guided fix for code-mixing that restores saliency on safety-critical tokens and recovers about 80% of the safety lost to code-mixing, without full retraining.

A second strategy is specialized multilingual guardrails trained directly on multilingual corpora. PolyGuard is trained on PolyGuardMix, a 1.91M-sample corpus across 17 languages, and jointly predicts prompt harmfulness, response harmfulness, response refusal, and multi-label violation categories (Kumar et al., 6 Apr 2025). CultureGuard extends Nemotron-Content-Safety-Dataset-V2 into eight non-English languages through a four-stage pipeline—cultural data segregation, cultural data adaptation, machine translation, and quality filtering—yielding 386,661 samples across nine languages and a LoRA-tuned multilingual guard (Joshi et al., 3 Aug 2025). IndicGuard similarly fine-tunes Gemma-3-4B-IT with LoRA on approximately 33,416 entries per language across ten major Indic languages and English; in the combined setting it reports Macro F1 improvements over CultureGuard, with User Safety 0.8808 versus 0.8190 and Response Safety 0.8847 versus 0.8261 (Bramhecha et al., 22 Jun 2026).

A third strategy is low-resource regional adaptation. SEALGuard adapts SeaLLMs-v3-7B-Chat with LoRA for ten Southeast Asian languages and reports DSR 97.23%, Precision 98.90%, and F1 98.05% on SEALSBench, substantially outperforming English-centric baselines on multilingual unsafe and jailbreak prompts (Shan et al., 11 Jul 2025). UbuntuGuard evaluates static, dynamic, and multilingual guardian models on 10 African languages and finds that dynamic models with runtime policy injection are more robust than static category-based systems, although they still degrade under full localization (Abdullahi et al., 19 Jan 2026).

Policy-conditioned compliance checking pushes the same logic further. ML-Guard uses native-language regulations from 14 jurisdictions and supports both binary safe/unsafe judgments and explicit violation checking against user-specified rules. On ML-Bench, the 7B model reports Seed F1 0.97, Recall 0.99, FPR 0.06, and Attack-enhanced accuracy 0.92, while also producing violated rule(s) and English rationales (Zhao et al., 1 May 2026).

A recurrent finding is that alignment data quality matters as much as model architecture. Fine-tuning on culturally grounded preference data collected from local annotators reduces culturally harmful responses without sacrificing, and often improving, substantive question answering (Banerjee et al., 14 Feb 2026). This suggests that multilingual safety detection is increasingly treated as a data-and-policy alignment problem, not merely a classifier-capacity problem.

5. Multimodal and speech extensions

The scope of multilingual safety detection has expanded well beyond text-only prompting. In vision-language systems, multilingual safety depends on whether the unsafe semantics reside in the image, the text, or only in their combination.

Pluralis v0.1 is organized precisely around that joint dependence. It contains 6,448 prompts across six Asia-Pacific locales and eight languages, and its motivating examples are non-adversarially synergistic: “Should I gift this?” becomes culturally inappropriate in a Chinese context when “this” is a clock; “Can I eat this?” becomes physically unsafe when the image depicts castor beans or camphor cubes; locally illegal advice emerges when the object is an e-cigarette in jurisdictions where possession or use is prohibited (Parrish et al., 7 Jul 2026). The paper’s failure analysis highlights image misidentification, missed item–context–locale interactions, and inadequate refusals.

Lingua-SafetyBench takes a complementary route by disentangling image-dominant and text-dominant multimodal risk across 100,440 harmful image-text pairs in 10 languages. Its headline asymmetry is that text-dominant risks are harder overall, with average ASR 47.18% versus 32.25% for image-dominant risks, while image-dominant risks are more vulnerable in high-resource languages and text-dominant risks are more severe in non-high-resource languages (Shi et al., 30 Jan 2026). The benchmark also shows that mixed visual-plus-typographic inputs are substantially riskier than pure images.

Speech introduces additional failure modes. RedVox evaluates eight speech-capable models on real voices in English, French, Italian, Spanish, and German. It reports that English unsafe rate is 5.1%, while non-English unsafe rate is 10.0%, a near doubling, and that harmful or controversial responses are highest for speech inputs, ranging from approximately 10% to 44% across models (Savoldi et al., 25 Jun 2026). Even non-speech audio paired with identical text can increase harmful response rates over text-only input. The benchmark therefore treats spoken input and audio context as safety stressors in their own right.

These multimodal studies also sharpen a methodological point. Locale-conditioned harms are often invisible if systems are evaluated only on text, only on English, or only on adversarial attacks. Realistic multilingual safety detection increasingly requires visual grounding, audio robustness, and locale-aware disambiguation rather than monomodal toxicity scoring.

6. Methodological disputes, participation, and open directions

A major dispute in the literature concerns the validity of translated benchmarks. Culturally adapted red-teaming across Korean, Japanese, Thai, and Khmer shows that direct translation underestimates risk in 44 of 48 category × language combinations, with mean $\Delta$ASR of +9.3 percentage points for culturally adapted prompts and with direct-translation Cultural Depth scores consistently below 1.0 out of 3.0 across all four languages (Choi et al., 8 Jun 2026). LinguaSafe reaches a similar conclusion from a different angle: translated or lightly transcreated data alone are insufficient, so it combines translated, transcreated, and natively sourced content and explicitly measures oversensitivity on benign borderline prompts (Ning et al., 18 Aug 2025).

A second dispute concerns whether classifier weaknesses are primarily modeling problems. The position paper on multilingual safety classification argues that shortcomings arise from both models and evaluation datasets. It highlights translated harmful-only datasets, ambiguous labels, label-space mismatch between datasets and model taxonomies, and the need to jointly measure safe and unsafe detection rather than only recall on harmful prompts (Vajjala, 29 Jul 2025). The multilingual methodology study led by Singapore AISI makes a related point operationally: evaluations require culturally contextualized translations, stress-tested evaluator prompts, clearer human annotation guidelines, and human review for borderline cases (Vij et al., 22 Jan 2026).

A third issue is who defines harm. Several papers treat participation as a core design principle rather than an annotation detail. UbuntuGuard is derived from adversarial queries authored by 155 domain experts across Ghana, Kenya, Malawi, Nigeria, South Africa, and Uganda, and uses those queries to generate context-specific policies and reference dialogues (Abdullahi et al., 19 Jan 2026). The Global South synthesis argues for participatory workflows that empower local communities to define harms and sensitivities via community-driven annotation, culturally grounded preference data, and iterative multilingual audits (Banerjee et al., 14 Feb 2026). Pluralis similarly treats localized cultural appropriateness as a first-class evaluation axis rather than as noise around a universal toxicity label (Parrish et al., 7 Jul 2026).

The open problems follow directly from these disagreements. Low-resource languages, dialect continua, code-switching, and mixed scripts remain under-served; cultural norms and legal boundaries drift over time; policy-grounded systems must update without catastrophic forgetting; and even high-performing models still struggle on subtle response-level violations, near-boundary cases, and local political or religious sensitivities (Zhao et al., 1 May 2026). This suggests that the field is moving toward intrinsically multilingual alignment, per-language calibration, versioned evaluation sets, and policy registries that are continuously refreshed rather than translated once and treated as stable.

Multilingual and multicultural safety detection, in that sense, is becoming a general framework for equitable AI safety: one that combines disaggregated benchmarking, native-language data, explicit policy conditioning, and local participation to determine not only whether a model is harmful, but harmful to whom, under which norms, in which language, and in what modality.