💻 computer science

Language-Specific Gaps in AI Safety Training Datasets

This paper exposes critical, often unaddressed gaps in the provenance, annotation, and harm-taxonomy coverage of AI safety training datasets across low-, mid-, and high-resource languages, demonstrating that these structural deficiencies—particularly in African languages and specific harm categories—undermine multilingual safety claims and contribute to persistent vulnerabilities against multi-turn jailbreak attacks.

Original authors: Chialuka Prisca-Mary Onuoha, Bright Etornam Sunu, Rashidat Sikiru

Published 2026-08-17

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Chialuka Prisca-Mary Onuoha, Bright Etornam Sunu, Rashidat Sikiru

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the internet as a giant, bustling library where books are written in every language imaginable. For a long time, the librarians (the people building AI) mostly spoke English, so they wrote all the safety rules and "do not enter" signs in English. Recently, they realized they needed to welcome readers who speak other languages, so they started translating those signs. But here's the catch: just because a library says it has safety rules for 20 different languages doesn't mean the rules are actually there, or that they make sense in those languages. This paper dives into the "AI Safety" corner of computer science. It looks at how we teach computers to be polite, safe, and helpful, and specifically checks if the training materials used to teach them are actually good enough for non-English speakers. The big question is: Are we just slapping a translation sticker on a sign, or did we actually write a new, culturally appropriate rulebook for everyone?

The authors of this paper decided to play detective. They didn't just take the AI companies' word for it that their models are safe for everyone. Instead, they went into the archives and audited 21 different collections of safety data (the "rulebooks" used to train AI) across 25 different language slices. They focused on three languages to represent different levels of resources: Hausa (low-resource, like a small village library), Swahili (mid-resource, like a town library), and French (high-resource, like a massive city library).

Here is what they found, and it's a bit like discovering that the "Safety" section in the village library is mostly empty, while the city library's section is full of books that were just photocopied from English.

The "Translation Trap"
The biggest surprise was that many datasets claim to be "native" (written by people who grew up speaking the language), but when the authors looked closely, they were actually machine-translated from English. It's like a restaurant claiming to serve "authentic local cuisine," but when you peek in the kitchen, you see a robot translating a menu from a different country and gluing it onto a plate. For the low-resource language (Hausa), almost all the safety data was either translated or made up by computers, not written by native speakers. Even worse, in some cases, the translation was so bad that it fell below the quality score the researchers themselves had set as the minimum acceptable standard. One specific pipeline tested both Hausa and Swahili; the Swahili version passed the test comfortably, but the Hausa version failed, even though they used the exact same process. This proves the problem isn't that the language is "hard" to translate; it's that the process wasn't careful enough for the specific language.

The "Missing Chapters" Problem
The authors also checked if the safety rules covered all the dangerous topics. They found a huge gap: for the African languages they studied, there were almost no native rules about self-harm or sexual content. It's as if the library had a whole section on "Don't steal" and "Don't fight," but the shelves for "Don't hurt yourself" and "Keep private things private" were completely empty. This is a total gap, not just a small one. For French, these topics were covered, but for Hausa and Swahili, the data simply didn't exist in a native form. This means if a user asks the AI about these sensitive topics in their native language, the AI might not understand the cultural nuances or might give a dangerous answer because it was never taught the right rules.

The "Double-Counting" Illusion
Another trick the authors uncovered was "double-counting." Imagine a library that claims to have 10,000 unique books. But if you look closely, you realize they just took the same 1,000 books, re-labeled them with different covers, and counted them as new. The researchers found that for Swahili, many datasets were just the same original tweets or posts being re-annotated (re-labeled) by different groups. This made it look like there was a huge amount of data available, but in reality, the "diversity" was an illusion. It's like having a playlist that says it has 500 songs, but it's actually just the same 50 songs played over and over with different names.

Why the "Low-Resource" Label Isn't the Whole Story
You might think, "Well, of course the small village library has fewer books than the big city one." The paper agrees that low-resource languages have less data, but it argues it's not just about how much data there is; it's about what kind of data. They found that sometimes the mid-resource language (Swahili) had worse quality scores than the low-resource one (Hausa) for specific tasks, and sometimes the high-resource language (French) had gaps in areas where the mid-resource language had strong, native coverage. This suggests that the problem isn't just a lack of money or computers; it's about how research communities prioritize what to build. If a community cares deeply about election misinformation, they build great data for that. If they don't, that data doesn't exist, regardless of how "rich" the language is.

The Real-World Consequence
Why does this matter? The paper connects these missing or bad data gaps to a real safety problem. Researchers have found that while AI models are getting better at stopping simple, one-sentence "jailbreaks" (tricks to make the AI say something bad) in African languages, they are still failing at stopping complex, multi-turn conversations. The authors argue this is because the training data for those complex conversations is mostly synthetic (made by computers) and translated, not native. It's like teaching a driver to stop at a red light (easy, single step) but never teaching them how to handle a sudden storm or a slippery road (complex, multi-step). The AI can handle the simple tricks but falls apart when the conversation gets complicated.

The Takeaway
The paper doesn't say we should stop trying to make AI safe for everyone. Instead, it says we need to stop pretending that a "multilingual" claim means everything is fine. Just because a dataset says it covers 14 languages doesn't mean the safety rules are actually there for all of them. The authors suggest that creators need to be honest: if a language slice is translated, say it's translated. If a topic is missing, admit it's missing. They want us to stop counting the "headline" numbers and start looking at the individual slices of the pie. Until we do that, the AI might be safe for English speakers, but for many others, it's still navigating a library with missing books and broken signs.

Technical Summary: Language-Specific Gaps in AI Safety Training Datasets

Problem Statement
Large language model (LLM) providers frequently cite multilingual safety benchmarks covering a dozen or more languages as evidence that their models are safe for non-English-speaking users. These claims typically rely on collection-level statistics from widely cited resources (e.g., Aya Red-teaming, AfriHate, MultiJail). This paper argues that such inference is frequently unwarranted. The authors posit that aggregate coverage claims dissolve when inspected at the level of individual language slices. Specifically, gaps in provenance, annotation reliability, data access, harm-taxonomy coverage, and data reuse recur in patterns that are not evenly distributed but cluster by resource level and specific harm categories. The paper identifies a critical disconnect: while single-turn, translation-based jailbreak attacks have been largely mitigated in recent models, multi-turn conversational attacks remain effective in low-resource languages. The authors hypothesize this asymmetry is structurally consistent with the thinnest areas of training and evaluation data identified in their audit.

Methodology
The study employs a structured, reusable audit methodology designed to assess individual language slices of multilingual AI safety datasets rather than treating collection-level statistics as representative of any single language.

Audit Unit: The unit of analysis is the "language slice." A dataset covering multiple languages is treated as a collection of independent subsets, each assessed separately.
Corpus: The audit covers 21 resources (resolving to 20 datasets under specific counting rules) across 25 language slices. The study focuses on three languages representing different resource tiers: Hausa (low-resource), Swahili (mid-resource), and French (high-resource).
Counting Rules: The authors apply strict counting rules to avoid inflating coverage claims: derivative re-evaluations of existing prompt sets are not counted as independent datasets; unreleased or proprietary resources are excluded; and re-annotation layers of existing corpora are counted only once at the layer of the new dataset.
Audit Instrument: A 31-field schema is applied to every slice, grouped into seven families: Identification, Language Coverage, Provenance, Harm Coverage, Annotation & Culture, Artifact Characteristics, and Usability.
Gap Categories: Gaps are categorized into six types:
1. Provenance: Content described as native-authored but traced to machine translation.
2. Annotation/Agreement: Absence of reported inter-annotator agreement (IAA) at the slice level.
3. Access & Licensing: Data that is gated, request-only, or unlicensed.
4. Taxonomy Coverage: Harm categories absent from a specific language slice relative to the collection's overall coverage.
5. Reuse & Double-Counting: Apparent diversity that resolves to repeated re-annotation of the same raw text.
6. Quantified Quality: Cases where a single study's metrics allow direct quality comparison across languages.
Harm Framework: The study adopts a six-category harm framework (Hate Speech, Harassment, Self-Harm, Extremism, Sexual Content, Misinformation) adapted from the Trust and Safety Professional Association (TSPA) taxonomy to normalize comparisons across datasets with varying native taxonomies.

Key Results
The audit reveals that gaps are not random but follow specific, recurring patterns that correlate with resource levels, though not monotonically across all dimensions.

Provenance Gaps: Native authorship narrows significantly as resource levels drop. For Hausa, multi-harm data is predominantly translated or synthetic. Notably, some resources claim native authorship in secondary descriptions but admit in methodology sections that items were machine-translated from English.
Quantified Quality Gap (Controlled Comparison): In a 2026 pipeline processing both Hausa and Swahili through identical steps, the Hausa policy-material slice scored 66.37 on translation quality, falling below the paper's own 70-point acceptance threshold. The Swahili slice from the same pipeline scored 93.30, comfortably clearing the bar. This demonstrates that quality gaps are measurable and addressable, not inherent to the language.
Annotation & Agreement: Reported agreement is sparse. Where present, Hausa slices showed strong agreement (e.g., $\kappa = 0.75$ ), while Swahili showed the lowest agreement in the audit ( $\kappa = 0.13$ ) in a resource otherwise noted for methodological rigor. The authors interpret low agreement as evidence of taxonomy mismatch rather than annotator unreliability.
Access & Licensing: Access failures concentrate at the low-resource tier. Hausa resources frequently suffer from being unreleased, request-only, or lacking size documentation (e.g., NaijaOffens was never released; TukaBench's release contained fewer items than described).
Taxonomy Coverage:
- Self-Harm and Sexual Content: These categories have zero native-language coverage in either Hausa or Swahili. For Hausa self-harm, there is no coverage of any kind (native, translated, or synthetic).
- Misinformation: Swahili has native coverage driven by local election contexts, while French (high-resource) lacks native misinformation coverage in the corpus, challenging the assumption that resource level dictates coverage breadth.
Reuse and Double-Counting: Apparent corpus diversity is inflated by re-annotation chains. For Swahili, a single pool of tweets is re-annotated across four nominally distinct datasets (AfriSenti, PolitiKweli, AfriHate, Onyango set), artificially inflating volume without adding independent evidence.

Significance and Claims
The paper claims to provide the first systematic audit of language-slice-level evidentiary quality across multilingual AI safety datasets using a shared, resource-tier-stratified methodology. Its primary contributions are:

Methodological Shift: It establishes that the appropriate unit of analysis for multilingual safety is the language slice, not the dataset collection. Collection-level documentation systematically conceals the conjunction of narrow coverage, thin verification, restricted access, and marginal quality that characterizes low-resource language slices.
Structural Explanation for Safety Asymmetry: The findings offer a structural explanation for the persistence of multi-turn jailbreak vulnerabilities in low-resource languages. The audit shows that while single-turn native data exists for hate/offensive speech, multi-turn conversational data is almost entirely synthetic and machine-translated. The paper argues that the attack surface with abundant, well-verified native data has been patched, while the surface with only synthetic, machine-translated data remains open.
Refutation of Pure Scarcity: The results challenge a "pure scarcity" account of safety gaps. While low-resource languages generally have less data, the deficits are not uniform. For instance, Swahili (mid-resource) has worse annotation agreement than Hausa (low-resource), and French (high-resource) has native misinformation gaps that Swahili does not. This suggests that safety data provision is shaped by research community priorities and constraints, not just raw data availability.
Actionable Recommendations: The paper provides concrete recommendations for dataset creators (e.g., report slice-level metrics, distinguish provenance precisely), model providers (e.g., treat multi-turn native data as a distinct requirement), and venues (e.g., require per-language reporting tables) to make "multilingual coverage" claims verifiable rather than merely stated.

The authors emphasize that documenting these gaps is not an argument for disinvestment but a call for targeted reinvestment, particularly in native-authored, multi-turn, and agreement-verified data for under-served harm categories like self-harm and sexual content.

More like this