Safety tests found uneven protection across eleven languages
Across eleven languages, five open safety systems fell short of native-speaker accuracy in 51 of 55 system-language comparisons.
Edited by Boris Djordjevic · Paperfoot
A preprint introduced an evaluation protocol for measuring service gaps between language communities and tested it on five open safety systems across eleven languages. The tested systems ranged from a keyword lexicon to two current multilingual guard models.
The protocol evaluated how accurately systems separated harmful function from harmless form. None reached native-speaker accuracy, with 51 of 55 system-language pairs falling short. Across the systems, greater capability was associated with higher discrimination between harmful function and harmless form in nine languages, while discrimination on Arabic and romanized Hindi remained near chance, so the gap between the best- and worst-served languages grew with capability. One system both over-flagged and under-protected the same language most. The authors also found that a naive gap measure is inflated under equal service and that its usual bootstrap interval is unreliable.
Why it matters
These tests showed that reporting only false alarms can make a system’s worst-read language look the most fairly treated. Evaluating both missed harm and mistaken flags can expose inequalities that a narrower measure hides.
Caveats
The abstract does not describe the test messages or give accuracy scores for individual systems and languages. The authors’ argument that behavior-based signals transfer better across languages remains a hypothesis.
From the paper
- Limitation
Apart from the worked example in Section 6.2, this paper reports no new measurements: it tests H1 only in one direction, showing that five existing systems fall short of its standard, and does not test H2.
Quoted word for word from the full text on arXiv.
In this paper
cross-lingual safety evaluation for automated systems
- Links
- Data
What it shows
- Standard automated safety systems fall short of native-speaker accuracy when distinguishing harmful function from harmless form across multilingual settings.
Applied to five open systems in eleven languages, from a keyword lexicon to two current multilingual guard models, the protocol finds that none reaches native-speaker accuracy at separating harmful function from harmless form (51 of 55 system-language pairs fall short …
Abstract
- Increased model capability widens the performance gap between the best- and worst-served languages by improving discrimination in many languages while leaving Arabic and romanised Hindi near chance.
… greater capability raises discrimination in nine languages while leaving Arabic and romanised Hindi near chance, so the gap between the best- and worst-served languages grows with capability …
Abstract
- Reporting false-positive rates alone can make the language an automated safety system reads worst appear to be the most fairly treated.
… a language a system reads worst can look the most fairly treated when only false positives are reported …
Abstract
- A stratified percentile bootstrap interval around the observed performance gap fails to cover a true gap of zero and undercovers non-zero true gaps.
In our simulations (ten varieties, 400 replicates per condition), a stratified percentile bootstrap never covered a true gap of zero, because a maximum minus a minimum cannot be negative, and covered a true gap of 10 points in only 64–76% of replicates, against a nominal 95%.
6.1. Measuring the gap
- Under equal service across varieties, sampling noise creates an inflated expected gap that decreases slowly as sample size increases.
With a true error rate of 10% in every variety, ten varieties of 100 cases each show an expected gap of 9.2 percentage points; at 400 cases each it is still 4.6.
6.1. Measuring the gap
Quoted word for word from the full text on arXiv.
The paper
arXiv, Oct 22, 2026, Open access, Preprint, not peer-reviewed
doi.org/10.48550/arxiv.2610.31047
arXiv:2610.31047v1 in cs.CL, also cs.AI
Comments: 18 pages, 2 figures. Code, simulations and per-case outputs: https://osf.io/v7aef/files/osfstorage?view_only=9449667241894b1ca7d336fc4b8259d8
Cite as BibTeX
@misc{sabadin2026harm,
title = {Harm Is Behavioural, Moderation Is Lexical: How Language and Culture Decide Whom Automated Safety Systems Protect and Whom They Silence},
author = {Sabadin, Gabriel Lars and Harding, Dr Nicola and Kingston, Sarah},
year = {2026},
eprint = {2610.31047},
archivePrefix = {arXiv},
primaryClass = {cs.CL},
doi = {10.48550/arxiv.2610.31047},
url = {https://arxiv.org/abs/2610.31047}
}
