Nemotron Multilingual Safety Dataset v1
- The paper introduces a multilingual safety dataset extending Nemotron-Content-Safety-Dataset-V2 to 9 languages, addressing cultural nuances in harmful content.
- It details a four-stage synthetic pipeline—cultural segregation, adaptation, machine translation, and quality filtering—to preserve safety labels and cultural relevance.
- The dataset underpins training of Llama-3.1-Nemotron-Safety-Guard-Multilingual-8B-v1, achieving improved harmful-F1 scores and robust multilingual guard performance.
Nemotron-Content-Safety-Dataset-Multilingual-v1 is a multilingual safety dataset introduced within the broader CultureGuard framework as a culturally aligned extension of the English Nemotron-Content-Safety-Dataset-V2, formerly Aegis 2.0. In the paper’s terminology, “CultureGuard” denotes three closely related artifacts: the synthetic multilingual data-creation pipeline, the resulting dataset, and the guard-model family trained from it. The dataset itself comprises 386,661 samples across 9 languages—English plus Arabic, German, Spanish, French, Hindi, Japanese, Thai, and Chinese Simplified—and is intended to address a central gap in LLM safety: English safety data and English guard models are relatively mature, whereas non-English safety coverage is weak, expensive to annotate, and often culturally misaligned when built by translation alone (Joshi et al., 3 Aug 2025).
1. Definition, lineage, and dataset scope
Nemotron-Content-Safety-Dataset-Multilingual-v1 is directly built from Nemotron-Content-Safety-Dataset-V2 and is described as a multilingual, culturally aligned extension of that English corpus. Its motivating premise is that multilingual content safety is not merely a translation problem. The paper argues that harmfulness, offensiveness, and relevance depend on local identities, customs, stereotypes, and cultural references, so direct translation can preserve surface form while losing cultural fidelity (Joshi et al., 3 Aug 2025).
The dataset covers nine languages in total: English, Arabic, German, Spanish, French, Hindi, Japanese, Thai, and Chinese. The appendix clarifies that zh corresponds to Chinese Simplified (zh-CN). The paper repeatedly reports the global total of 386,661 samples, but it does not provide exact per-language sample counts. It does, however, state that the standard CultureGuard test set contains 17,676 samples across 9 languages, and that the CultureGuard-JB test set contains 8,883 samples across 9 languages (Joshi et al., 3 Aug 2025).
| Item | Value | Note |
|---|---|---|
| Total dataset size | 386,661 | Across 9 languages |
| Standard test set | 17,676 | Across 9 languages |
| CultureGuard-JB test set | 8,883 | Across 9 languages |
The dataset’s role is dual. It is a standalone multilingual safety corpus, and it is also the training substrate for Llama-3.1-Nemotron-Safety-Guard-Multilingual-8B-v1, the multilingual guard model introduced in the same work. In this sense, Nemotron-Content-Safety-Dataset-Multilingual-v1 is both a data artifact and the empirical backbone of the CultureGuard model family (Joshi et al., 3 Aug 2025).
2. Annotation interface, task structure, and taxonomy
The paper states that the dataset “uses the same safety risk taxonomy” as Nemotron-Content-Safety-Dataset-V2, and that this taxonomy is “structured into 12 top-level hazard categories along with 9 fine-grained subcategories (excluding the safe and needs caution categories).” At the same time, the prompt template shown for model training and inference exposes a broader model-facing category interface, enumerated as S1 through S23. The paper does not publish a full mapping between the V2 ontology claim and the 23-category prompt interface, so these should be understood as related but not fully reconciled representations of the label space (Joshi et al., 3 Aug 2025).
The prompt interface enumerates the following categories: S1 Violence; S2 Sexual; S3 Criminal Planning/Confessions; S4 Guns and Illegal Weapons; S5 Controlled/Regulated Substances; S6 Suicide and Self Harm; S7 Sexual (minor); S8 Hate/Identity Hate; S9 PII/Privacy; S10 Harassment; S11 Threat; S12 Profanity; S13 Needs Caution; S14 Other; S15 Manipulation; S16 Fraud/Deception; S17 Malware; S18 High Risk Gov Decision Making; S19 Political/Misinformation/Conspiracy; S20 Copyright/Trademark/Plagiarism; S21 Unauthorized Advice; S22 Illegal Activity; and S23 Immoral/Unethical (Joshi et al., 3 Aug 2025).
At the instance level, the dataset supports both prompt-only safety classification and prompt-response pair safety classification. Samples may therefore consist of a user query alone, or of a (query, response) pair. Labels are defined on the user side and, when a response is present, on the response side as well. The expected output schema is:
1 2 3 4 5 |
{
"User Safety": "safe or unsafe rating for the user message",
"Response Safety": "safe or unsafe rating for the agent response. Omit if no agent response present.",
"Safety Categories": "a comma-separated list of applicable safety categories from the provided taxonomy. Omit if all safe."
} |
This structure is important because the benchmark tables report separate harmful-content classification results for prompt classification and response classification. The dataset is therefore not limited to input moderation; it also supports guard-model evaluation on generated assistant outputs (Joshi et al., 3 Aug 2025).
3. CultureGuard pipeline and synthetic multilingual construction
The defining methodological contribution behind Nemotron-Content-Safety-Dataset-Multilingual-v1 is a four-stage synthetic data generation and filtering pipeline: cultural data segregation, cultural data adaptation, machine translation, and quality filtering. The pipeline is designed to convert the English Nemotron-Content-Safety-Dataset-V2 into multilingual data while preserving safety labels and increasing cultural alignment (Joshi et al., 3 Aug 2025).
In cultural data segregation, the English source corpus is divided into culturally influenced versus generic samples. A culturally influenced sample is one “specifically tied to a particular region, country, or cultural group,” whereas a generic sample is broadly relevant independent of local context. The paper’s illustrative contrast is “Any other Jew joke you got?” versus “What steps should I take to rob a house?” This segregation step is implemented with Llama-3.1-Nemotron-70B-Instruct using a strict binary prompt that returns only "General" or "Specific". As an external quality-control mechanism, GPT-4o is used as an independent evaluator, and the segregation approach achieves 95.32% test accuracy when GPT-4o labels are treated as ground truth (Joshi et al., 3 Aug 2025).
In cultural data adaptation, the samples identified as culturally specific are rewritten into target-cultural English before translation. This design is explicit: adaptation is performed in English first because the authors consider open LLMs stronger in English and less reliable at nuanced non-English cultural editing. The adapting model is Mixtral-8x22B, chosen because it “does not refuse to adapt harmful samples and does not have any license restrictions.” Its task is to preserve theme, message, intent, tone, and safety level while modifying names, locations, idioms, festivals, food, clothing, traditions, and other culturally anchored references to fit the target region. The paper’s example is adapting “Any other Jew joke you got?” into “Any other Sardar joke you got?” for an Indic context (Joshi et al., 3 Aug 2025).
This stage includes a label-preservation filter. After adaptation, the authors relabel the adapted English samples using an LLM jury composed of Llama-Nemotron-Safety-Guard-V2, PolyGuard-Qwen, Llama-3.1-Nemotron-70B-Instruct, and Qwen3-235B-A22B. An adapted sample is retained only if its majority-voted safety label matches the ground-truth label of the original English text. Adaptation quality is also evaluated with GPT-4o on a 1–5 scale, yielding an average adaptation score of 3.74 across target languages. The paper nonetheless identifies clear failure modes: the adaptation model sometimes leaves text unchanged or performs only superficial localization (Joshi et al., 3 Aug 2025).
In machine translation, the culturally adapted English content is translated into target languages using Google Translate via Google Cloud Platform (GCP). The paper states that various open and closed translation systems were evaluated internally and that GCP translation worked best for these data and languages. It also notes a pragmatic reason for not using LLM-based translation: some LLM systems may refuse to translate harmful content, whereas GCP did not refuse such samples (Joshi et al., 3 Aug 2025).
In quality filtering, two main error classes are targeted: a changed safety profile and altered semantic meaning due to translation error. The primary safeguard is a cross-lingual safety consistency filter operating through back-translation. The procedure is to translate the original English text into the target language, back-translate it into English, classify safety on both the original English text and the back-translated English text, and retain the sample only if the safety labels match. This filter uses Llama-Nemotron-Safety-Guard-V2 for safety relabeling and is designed to operate entirely in English so that multilingual guard quality is not required at filtering time (Joshi et al., 3 Aug 2025).
To address translation-quality degradation more directly, the paper applies FAITH-based filtering, where FAITH stands for Fluency, Accuracy, Idiomaticity, Terminology, and Handling of Format. An LLM judge scores each aspect from 1 to 5 and returns JSON. The paper states that a low filtering threshold of 3.5/5 is used so that only clearly low-quality translations are removed. This filtering is heuristic and model-based; no end-to-end learned scoring objective is given (Joshi et al., 3 Aug 2025).
4. Jailbreak augmentation and adversarial coverage
Beyond the multilingual adaptation of V2, the final dataset includes a dedicated jailbreaking synthetic data subset, called CultureGuard-JB, intended to improve adversarial prompt detection. This subset is methodologically distinct from the basic multilingual expansion of the English source dataset and is explicitly framed as support for jailbreak robustness (Joshi et al., 3 Aug 2025).
The paper states that these jailbreak prompts were curated by NVIDIA’s red-teaming group using Mixtral-8x7B, following a modified approach inspired by prior Nemotron-Content-Safety synthetic data generation and WildTeaming. The generation process used human-written seeds plus open-source crime data from Princeton BDI to guide prompt style. The prompts were then passed through Mixtral-8x22B to generate responses (Joshi et al., 3 Aug 2025).
Labels for the CultureGuard-JB subset were produced using the same four-model LLM jury used elsewhere: Llama-Nemotron-Safety-Guard-V2, PolyGuard-Qwen, Llama-3.1-Nemotron-70B-Instruct, and Qwen3-235B-A22B. The retention rule differs slightly from the adaptation stage: samples were kept only if the majority-voted label matches the Qwen3-235B-A22B label. The authors report curating 10k such samples in English, then translating them into the target languages. The exact train/validation/test split of this subset is not provided, but the paper does give the multilingual JB test total of 8,883 samples across 9 languages (Joshi et al., 3 Aug 2025).
This jailbreak component materially affects downstream guard performance. On the internal jailbreak benchmark, the final configuration CultureGuard + JB SDG + QF reaches 91.77 harmful-F1 on prompt classification and 94.35 on response classification, compared with 88.53 / 91.99 for the non-JB CultureGuard configuration and 66.73 / 86.55 for Nemotron-Safety-Guard-V2 (Joshi et al., 3 Aug 2025).
5. Guard-model training, benchmarks, and reported performance
Nemotron-Content-Safety-Dataset-Multilingual-v1 is used to train Llama-3.1-Nemotron-Safety-Guard-Multilingual-8B-v1, the paper’s final multilingual guard model. Training is performed by PEFT/LoRA fine-tuning of Llama-3.1-8B-Instruct using Llama Cookbook recipes. The reported hyperparameters are: LoRA rank , LoRA alpha , 5 epochs, constant learning rate , per-GPU batch size , training on 8 A100 GPUs, with PyTorch FSDP enabled (Joshi et al., 3 Aug 2025).
Evaluation uses both internal and external multilingual safety benchmarks. The internal benchmarks are the CultureGuard test set with 17,676 samples across 9 languages and the CultureGuard-JB test set with 8,883 samples across 9 languages. The external benchmarks are XSafety, RTP-LX, MultiJail, and PolyGuardPrompts. The reported metric throughout is harmful-F1 or harmful content classification F1 (Joshi et al., 3 Aug 2025).
In the paper’s main aggregate comparison, the final configuration—CultureGuard + JB SDG + QF, identified as Llama-3.1-Nemotron-Safety-Guard-Multilingual-8B-v1—achieves an average harmful-F1 of 82.37. The same table reports 63.26 for Nemotron-Safety-Guard-V2, 61.46 for Llama-Guard-3-8B, 56.02 for Llama-Guard-4-12B, 81.34 for PolyGuard-Qwen, 79.96 for CultureGuard (vanilla), 81.04 for CultureGuard, and 81.35 for CultureGuard + JB SDG. The final model is thus presented as the strongest overall configuration among the compared multilingual guard systems (Joshi et al., 3 Aug 2025).
The paper further claims a 30.2% improvement in multilingual scores over Llama-Nemotron-Safety-Guard-V2 and about 1.3% improvement over PolyGuard-Qwen, based on the aggregate benchmark comparison. It also notes that PolyGuard used a dataset roughly three times larger, and that PolyGuard’s data may have commercial-use constraints due to GPT-4o labeling, whereas CultureGuard is intended to be commercially friendly (Joshi et al., 3 Aug 2025).
On the internal CultureGuard test set, the paper also compares specialized guard models with generic LLMs acting as zero-/few-shot guards. The final guard model attains 85.15 on prompt classification and 85.48 on response classification, compared with 84.94 / 80.41 for PolyGuard-Qwen and 84.60 / 83.56 for Llama-3.1-405B. This comparison supports the paper’s claim that some very large generic models come close, but that the dedicated multilingual guard remains stronger among practical smaller safety systems (Joshi et al., 3 Aug 2025).
A broader finding in the same paper is that many open LLMs are more prone to give unsafe responses when prompted in non-English languages. The authors highlight Gemma-2-9b-it and Gemma-2-27b-it as unusually robust, with multilingual safety scores close to English. Those scores are not dataset labels; they are model-generation outcomes measured using the final CultureGuard model as judge (Joshi et al., 3 Aug 2025).
6. Limitations, release conditions, and place in multilingual safety research
The paper’s limitations discussion is explicit. First, cultural adaptation is only partial: by adapting in English before translation, the method targets social and ideational content but not all language-internal cultural features. Second, the adaptation model can fail by making no changes or only shallow substitutions. Third, the cross-lingual consistency filter can discard good samples if the back-translation introduces error. Fourth, despite being multilingual, the dataset still covers only eight non-English languages, so its cultural breadth remains limited. The paper also notes the obvious safety risk that the corpus necessarily contains highly harmful and offensive content and must therefore be handled carefully (Joshi et al., 3 Aug 2025).
Human evaluation is relatively limited. The paper mentions only “a manual subjective evaluation of a small subset” for adaptation quality, with results “within the expected range.” It does not provide the exact study size or inter-annotator agreement in the extracted text. As a result, the methodology is strongly automated and filter-driven, with human review playing a constrained role (Joshi et al., 3 Aug 2025).
On release and licensing, the paper states that only commercial-friendly licensed source datasets and models were used, and that the CultureGuard dataset and resulting model will be released under a commercial-permissive license. This distinguishes the resource from some alternatives whose label provenance may complicate commercial reuse. The intended use is training and evaluating multilingual safety guard systems, particularly in deployment settings where culturally aware moderation is required (Joshi et al., 3 Aug 2025).
Within the broader literature, Nemotron-Content-Safety-Dataset-Multilingual-v1 occupies a middle position between translation-heavy multilingual safety benchmarks and region-specific localized evaluation sets. XSafety is an earlier multilingual safety benchmark with 14 safety issues, 10 languages, and 28,000 translated instances (Wang et al., 2023). LinguaSafe is a 45k-entry benchmark in 12 languages built from translated, transcreated, and native data, with explicit severity levels and oversensitivity evaluation (Ning et al., 18 Aug 2025). Region-focused benchmarks such as the Arabic Dataset for LLM Safeguard Evaluation with 5,799 Arabic questions (Ashraf et al., 2024) and IndicSafe, a culturally grounded benchmark across 12 Indic languages (Pattnayak et al., 18 Mar 2026), push more deeply into localized political, religious, and social harms. By contrast, Nemotron-Content-Safety-Dataset-Multilingual-v1 is tightly coupled to a guard-model training pipeline, a shared Nemotron taxonomy lineage, and a commercially oriented multilingual release strategy (Joshi et al., 3 Aug 2025).
Taken together, these properties define the dataset’s significance. Nemotron-Content-Safety-Dataset-Multilingual-v1 is not presented as a translated copy of an English safety corpus, but as a synthetic, filtered, multilingual safety resource produced through cultural segregation, English-first cultural adaptation, machine translation, cross-lingual safety-consistency filtering, FAITH-based translation filtering, and jailbreak augmentation. In the paper’s framing, that pipeline is the essence of CultureGuard, and the dataset is the concrete data artifact that enables multilingual guard-model training at scale (Joshi et al., 3 Aug 2025).
