---
title: Multilingual & Multicultural Safety Detection
url: https://www.emergentmind.com/topics/multilingual-and-multicultural-safety-detection
type: topic
---

# Multilingual & Multicultural Safety Detection

Searching arXiv for recent multilingual and multicultural safety papers to ground the article.
Multilingual and multicultural safety detection is the systematic identification and mitigation of unsafe behavior in large language models across diverse, low-resource languages, code-mixed inputs, and culturally situated discourse, with explicit attention to culturally specific norms common in Global South and other underrepresented contexts. In the recent literature, the topic is no longer framed as a narrow toxicity problem. It is treated as a joint problem of universal harms, localized cultural appropriateness, cross-lingual robustness, and policy-conditioned compliance, extending from text-only LLMs to vision-language and speech-capable systems. A recurring finding is that English-centric safety pipelines, benchmarks, and alignment practices do not reliably transfer across languages, scripts, modalities, and regulatory settings, so multilingual safety is increasingly treated as a core requirement rather than an add-on [2602.13867] [2607.06196].

## 1. Conceptual scope and problem definition

Multilingual safety refers to detecting, avoiding, and mitigating harmful or toxic content across many languages, scripts, and dialects, while multicultural safety foregrounds culturally contingent notions of harm: what counts as hate speech, harassment, profanity, stereotyping, microaggression, or inappropriate advice varies by community, context, and identity [2606.25380]. In this formulation, safety is not exhausted by physical danger or generic toxicity. Several recent benchmarks explicitly separate universally unsafe behavior from localized cultural harm, or from jurisdiction-specific policy violations.

A particularly influential formulation treats safety as a two-axis problem: universal safety violations versus localized cultural appropriateness. Universal safety violations include globally recognized harms such as self-harm, violent crimes, indiscriminate weapons, sex-related crimes, and fraud. Localized cultural appropriateness captures social, religious, linguistic, historical, and normative taboos that can make a response inappropriate even when it is physically safe [2607.06196]. Related work on country-grounded evaluation similarly argues that jailbreak robustness and cultural sensitivity are distinct axes and should not be collapsed into a single composite safety score [2605.05662].

Another line of work defines safety in explicitly policy-grounded terms. Rather than mapping all harmful behavior into a fixed universal taxonomy, policy-grounded systems derive categories and fine-grained rules from jurisdiction-specific legal texts, then evaluate safe/unsafe judgments relative to those native-language rules [2605.00689]. UbuntuGuard makes a closely related argument from African-language contexts: static categories such as “toxicity” and “hate” are too rigid to capture local institutions, denominational differences, registration requirements, or community health practices, so runtime-enforceable policies are needed [2601.12696].

Taken together, these formulations suggest that multilingual and multicultural safety detection is best understood as a layered task: detecting global hazards, identifying locally grounded harms, and checking compliance against explicit policies when regulations or community norms are the operative criterion.

## 2. Why English-centric safety does not transfer

A central empirical result across the literature is that English-only safety and factuality do not reliably transfer across languages. The synthesis in “Bridging the Multilingual Safety Divide” reports that safety guardrails weaken sharply on low-resource and code-mixed inputs, that culturally harmful behavior can persist even when standard toxicity scores look acceptable, and that English-only knowledge edits and safety patches often fail to carry over to low-resource languages [2602.13867]. In its summary of XThreatBench, low-resource and non-Latin scripts see more unsafe or under-moderated outputs, and translation-based filtering plus English-only fine-tuning routinely miss these risks.

This pattern appears in broad multilingual audits as well. M-ALERT evaluates 39 state-of-the-art LLMs on 75,000 prompts across English, French, German, Italian, and Spanish and finds category-specific cross-linguistic inconsistencies, including cases where a model is unsafe in one language-category combination and safe in others [2412.15035]. The multilingual exercise led by Singapore AISI similarly reports that non-English safeguards generally lag English by approximately 10–15%, with jailbreak robustness weakest across languages and with notable failures in Japanese, Korean, Kiswahili, Mandarin, Telugu, and Farsi [2601.15706].

IndicSafe makes the drift especially explicit. Across 12 Indic languages and 6,000 culturally grounded prompts, cross-language agreement is just 12.8%, and SAFE rate variance exceeds 17% across languages. The benchmark also documents over-refusal of benign prompts in low-resource scripts, overflagging of politically sensitive topics, and failures to flag unsafe generations [2603.17915]. The position paper on safety classifiers adds a related caution: multilingual disparities are not only model failures but also dataset failures, because translated or ambiguous evaluation sets can distort apparent safety performance [2507.21782].

Code-mixing further destabilizes alignment. One synthesis reports that the attack success rate for harmful requests rises from approximately 9% in monolingual English to approximately 69% in code-mixed paraphrases, exceeding 90% in some Arabic and Hindi cases; an interpretability analysis attributes part of this to saliency drift, in which attention shifts away from safety-critical tokens [2602.13867]. Another survey generalizes the same threat model: code-switching, transliteration, orthographic variation, and multi-turn interaction all weaken safety alignment, especially when supervision and guardrail data are English-heavy [2606.25380].

A common misconception is that this is primarily a translation problem. The accumulated evidence points to a broader failure mode: translation can preserve surface form while losing threat scenarios, legal context, politeness strategies, dialectal nuance, and culturally specific signals that actually determine whether a response is safe.

## 3. Benchmarks, taxonomies, and evaluation metrics

Recent work has shifted from small translated test sets toward benchmarks that differentiate modalities, policy regimes, and kinds of harm. The resulting landscape is heterogeneous by design.

| Benchmark | Scope | Distinctive axis |
|---|---|---|
| XThreatBench | 3,150 prompts, 10 languages | harmful and borderline-harmful prompts |
| Pluralis v0.1 | 6,448 image–text prompts, 6 locales, 8 languages | universal safety vs cultural appropriateness |
| XL-SafetyBench | 5,500 cases, 10 country-language pairs | jailbreak robustness vs cultural sensitivity |
| Lingua-SafetyBench | 100,440 image-text pairs, 10 languages | image-dominant vs text-dominant risk |
| UbuntuGuard | 2,307 curated multilingual test instances | policy-aligned PASS/FAIL |
| LinguaSafe | ~45,000 instances, 12 languages | direct safety, indirect safety, oversensitivity |

These resources are not interchangeable. XThreatBench stresses harmful and borderline-harmful prompts across high-, medium-, and low-resource languages [2602.13867]. Pluralis introduces multimodal synergy, where innocuous text and innocuous images become unsafe only in combination and only under a specific locale and language, and formalizes the decision with
$$
S(t, I, L) = \alpha_u r_u(t, I) + \alpha_c r_c(t, I, L, s), \qquad
y = 1[ S(t, I, L) \ge \tau ].
$$
Here the model must jointly evaluate universal risk and localized cultural risk [2607.06196].

XL-SafetyBench proposes three complementary metrics that make explicit distinctions often hidden by standard moderation scores:
$$
\mathrm{ASR} = \frac{1}{N}\sum_{i=1}^{N} I(\mathrm{Label}_i \in \{\mathrm{Critical}, \mathrm{Direct}, \mathrm{Soft\ Unsafe}\}) \times 100,
$$
$$
\mathrm{NSR} = \frac{1}{N}\sum_{i=1}^{N} I(\mathrm{Label}_i = \mathrm{Neutral\ Safe}) \times 100,
$$
$$
\mathrm{CSR} = \frac{\sum_{i=1}^{N} I(C_i=\mathrm{Aware} \wedge R_i=\mathrm{Relevant})}{\sum_{i=1}^{N} I(R_i=\mathrm{Relevant})} \times 100.
$$
ASR measures safety failure, NSR isolates apparent safety caused by comprehension failure rather than principled refusal, and CSR measures whether a model recognizes embedded cultural sensitivities when it actually engages the scenario [2605.05662].

Other benchmarks introduce additional diagnostic structure. SEALGuard uses Defense Success Rate,
$$
\mathrm{DSR} = \frac{TP}{TP+FN},
$$
to quantify how often a guardrail correctly blocks unsafe or jailbreak prompts in Southeast Asian languages [2507.08898]. LinguaSafe adds an Oversensitivity Rate,
$$
\mathrm{OSR} = \frac{1}{2}\left(\mathrm{FPR}_{\text{direct}} + \mathrm{OverrefusalRate}_{\text{indirect}}\right),
$$
to capture over-caution on benign borderline content [2508.12733]. IndicSafe introduces prompt-level entropy and a Multilingual Consistency Index to quantify instability of safety judgments across translated variants of the same prompt [2603.17915].

The methodological consequence is clear: multilingual safety evaluation now depends on disaggregated reporting. Globally averaged scores routinely conceal whether a system is failing on local legal landmines, culturally loaded but non-toxic prompts, code-mixed jailbreaks, or benign queries that are over-refused.

## 4. Detection and guardrail methods

The model-design literature has converged on two broad strategies: specialized multilingual guard models and policy- or language-conditioned adaptation of general multilingual backbones.

One resource-aware strategy is parameter-efficient safety steering. In the XThreatBench line of work, language-specific functional parameter steering identifies the small set of attention heads most responsible for harmful content generation in each language and adjusts only those “functional heads.” Updating roughly 3% of parameters improves safety across all 10 languages on XThreatBench while preserving general capabilities such as MMLU and TruthfulQA [2602.13867]. The same synthesis reports an attribution-guided fix for code-mixing that restores saliency on safety-critical tokens and recovers about 80% of the safety lost to code-mixing, without full retraining.

A second strategy is specialized multilingual guardrails trained directly on multilingual corpora. PolyGuard is trained on PolyGuardMix, a 1.91M-sample corpus across 17 languages, and jointly predicts prompt harmfulness, response harmfulness, response refusal, and multi-label violation categories [2504.04377]. CultureGuard extends Nemotron-Content-Safety-Dataset-V2 into eight non-English languages through a four-stage pipeline—cultural data segregation, cultural data adaptation, machine translation, and quality filtering—yielding 386,661 samples across nine languages and a LoRA-tuned multilingual guard [2508.01710]. IndicGuard similarly fine-tunes Gemma-3-4B-IT with LoRA on approximately 33,416 entries per language across ten major Indic languages and English; in the combined setting it reports Macro F1 improvements over CultureGuard, with User Safety 0.8808 versus 0.8190 and Response Safety 0.8847 versus 0.8261 [2606.22841].

A third strategy is low-resource regional adaptation. SEALGuard adapts SeaLLMs-v3-7B-Chat with LoRA for ten Southeast Asian languages and reports DSR 97.23%, Precision 98.90%, and F1 98.05% on SEALSBench, substantially outperforming English-centric baselines on multilingual unsafe and jailbreak prompts [2507.08898]. UbuntuGuard evaluates static, dynamic, and multilingual guardian models on 10 African languages and finds that dynamic models with runtime policy injection are more robust than static category-based systems, although they still degrade under full localization [2601.12696].

Policy-conditioned compliance checking pushes the same logic further. ML-Guard uses native-language regulations from 14 jurisdictions and supports both binary safe/unsafe judgments and explicit violation checking against user-specified rules. On ML-Bench, the 7B model reports Seed F1 0.97, Recall 0.99, FPR 0.06, and Attack-enhanced accuracy 0.92, while also producing violated rule(s) and English rationales [2605.00689].

A recurrent finding is that alignment data quality matters as much as model architecture. Fine-tuning on culturally grounded preference data collected from local annotators reduces culturally harmful responses without sacrificing, and often improving, substantive question answering [2602.13867]. This suggests that multilingual safety detection is increasingly treated as a data-and-policy alignment problem, not merely a classifier-capacity problem.

## 5. Multimodal and speech extensions

The scope of multilingual safety detection has expanded well beyond text-only prompting. In vision-language systems, multilingual safety depends on whether the unsafe semantics reside in the image, the text, or only in their combination.

Pluralis v0.1 is organized precisely around that joint dependence. It contains 6,448 prompts across six Asia-Pacific locales and eight languages, and its motivating examples are non-adversarially synergistic: “Should I gift this?” becomes culturally inappropriate in a Chinese context when “this” is a clock; “Can I eat this?” becomes physically unsafe when the image depicts castor beans or camphor cubes; locally illegal advice emerges when the object is an e-cigarette in jurisdictions where possession or use is prohibited [2607.06196]. The paper’s failure analysis highlights image misidentification, missed item–context–locale interactions, and inadequate refusals.

Lingua-SafetyBench takes a complementary route by disentangling image-dominant and text-dominant multimodal risk across 100,440 harmful image-text pairs in 10 languages. Its headline asymmetry is that text-dominant risks are harder overall, with average ASR 47.18% versus 32.25% for image-dominant risks, while image-dominant risks are more vulnerable in high-resource languages and text-dominant risks are more severe in non-high-resource languages [2601.22737]. The benchmark also shows that mixed visual-plus-typographic inputs are substantially riskier than pure images.

Speech introduces additional failure modes. RedVox evaluates eight speech-capable models on real voices in English, French, Italian, Spanish, and German. It reports that English unsafe rate is 5.1%, while non-English unsafe rate is 10.0%, a near doubling, and that harmful or controversial responses are highest for speech inputs, ranging from approximately 10% to 44% across models [2606.26968]. Even non-speech audio paired with identical text can increase harmful response rates over text-only input. The benchmark therefore treats spoken input and audio context as safety stressors in their own right.

These multimodal studies also sharpen a methodological point. Locale-conditioned harms are often invisible if systems are evaluated only on text, only on English, or only on adversarial attacks. Realistic multilingual safety detection increasingly requires visual grounding, audio robustness, and locale-aware disambiguation rather than monomodal toxicity scoring.

## 6. Methodological disputes, participation, and open directions

A major dispute in the literature concerns the validity of translated benchmarks. Culturally adapted red-teaming across Korean, Japanese, Thai, and Khmer shows that direct translation underestimates risk in 44 of 48 category × language combinations, with mean $\Delta$ASR of +9.3 percentage points for culturally adapted prompts and with direct-translation Cultural Depth scores consistently below 1.0 out of 3.0 across all four languages [2606.09178]. LinguaSafe reaches a similar conclusion from a different angle: translated or lightly transcreated data alone are insufficient, so it combines translated, transcreated, and natively sourced content and explicitly measures oversensitivity on benign borderline prompts [2508.12733].

A second dispute concerns whether classifier weaknesses are primarily modeling problems. The position paper on multilingual safety classification argues that shortcomings arise from both models and evaluation datasets. It highlights translated harmful-only datasets, ambiguous labels, label-space mismatch between datasets and model taxonomies, and the need to jointly measure safe and unsafe detection rather than only recall on harmful prompts [2507.21782]. The multilingual methodology study led by Singapore AISI makes a related point operationally: evaluations require culturally contextualized translations, stress-tested evaluator prompts, clearer human annotation guidelines, and human review for borderline cases [2601.15706].

A third issue is who defines harm. Several papers treat participation as a core design principle rather than an annotation detail. UbuntuGuard is derived from adversarial queries authored by 155 domain experts across Ghana, Kenya, Malawi, Nigeria, South Africa, and Uganda, and uses those queries to generate context-specific policies and reference dialogues [2601.12696]. The Global South synthesis argues for participatory workflows that empower local communities to define harms and sensitivities via community-driven annotation, culturally grounded preference data, and iterative multilingual audits [2602.13867]. Pluralis similarly treats localized cultural appropriateness as a first-class evaluation axis rather than as noise around a universal toxicity label [2607.06196].

The open problems follow directly from these disagreements. Low-resource languages, dialect continua, code-switching, and mixed scripts remain under-served; cultural norms and legal boundaries drift over time; policy-grounded systems must update without catastrophic forgetting; and even high-performing models still struggle on subtle response-level violations, near-boundary cases, and local political or religious sensitivities [2605.00689]. This suggests that the field is moving toward intrinsically multilingual alignment, per-language calibration, versioned evaluation sets, and policy registries that are continuously refreshed rather than translated once and treated as stable.

Multilingual and multicultural safety detection, in that sense, is becoming a general framework for equitable AI safety: one that combines disaggregated benchmarking, native-language data, explicit policy conditioning, and local participation to determine not only whether a model is harmful, but harmful to whom, under which norms, in which language, and in what modality.

Source: https://www.emergentmind.com/topics/multilingual-and-multicultural-safety-detection