💬 NLP

Who Pays More for Safety? Measuring the Disparate Cost of Safety Alignment across Languages

This paper introduces a "Safety Cost" metric to demonstrate that safety alignment disproportionately penalizes non-English languages with greater utility loss and weaker protection compared to English, revealing a systematic inequity in current safety practices.

Original authors: Chanwoong Yoon, Jungsoo Park, Alan Ritter

Published 2026-08-25

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Chanwoong Yoon, Jungsoo Park, Alan Ritter

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the world of artificial intelligence, large language models are the digital engines that power chatbots, translators, and assistants. Before these machines can be useful to people, they undergo a rigorous training process called alignment. Think of this as a period of schooling where the model learns not just to answer questions, but to answer them safely, adhering to human values and refusing to generate harmful content like instructions for violence or illegal acts. This safety training is essential, but it comes with a hidden price. Just as a car with overly sensitive brakes might stop too quickly for a minor obstacle, an AI that is too cautious can become unhelpful, refusing to answer harmless questions or providing vague, watered-down responses. This loss of helpfulness is known as a utility cost. For years, researchers have known that safety training reduces a model's overall performance, but a critical question remained unanswered: does this cost fall equally on everyone, or do some languages suffer more than others?

A team of researchers set out to investigate whether the burden of safety alignment is shared fairly across the world's languages. They focused on a specific phenomenon where models might reject safe requests simply because they sound slightly risky, a behavior known as over-refusal. To measure the true cost of safety, the team devised a clever comparison method. They took powerful, safety-aligned models and created "unaligned" versions of the same software. These unaligned versions were not trained to be dangerous; rather, the researchers surgically removed the specific safety mechanisms that caused the models to refuse requests, leaving the rest of the model's knowledge and ability to speak intact. By comparing the responses of the safety-aligned model against its unaligned twin for the same question, the researchers could isolate exactly how much helpfulness was lost due to safety training alone. They tested this across English and five other languages, including Chinese, Arabic, Korean, Vietnamese, and Thai, using a set of questions designed to be harmless but likely to trigger a safety alarm.

The results revealed a stark and systematic inequality. The researchers found that non-English users consistently pay a higher price for safety than English speakers. In many cases, the safety filters were less effective at protecting non-English speakers from actual harm, yet these users still received significantly worse, less helpful answers to their harmless questions. The study identified three distinct patterns behind this disparity. First, many languages fell into a "double penalty" zone: they received weaker protection against real dangers while simultaneously suffering a much larger drop in the quality of their answers. Second, in some instances, a language appeared to have a low cost of safety only because the safety filters had failed to engage at all, leaving users exposed to harmful content without the model even realizing it. Third, even for high-resource languages like Chinese, which have vast amounts of training data, the cost of achieving the same level of safety as English was substantially higher. The utility loss was not just about the model saying "no" when it should have said "yes." The researchers discovered that even when the model did answer, the response was often thinner, less detailed, and factually less precise. The safety training had quietly stripped away depth and nuance, making the AI less useful without the user necessarily realizing why.

This work suggests that the current methods for making AI safe are not calibrated fairly across different cultures and languages. The safety training, which is heavily influenced by English-language data and norms, inadvertently creates a structural gap where non-English speakers receive a poorer experience. The researchers argue that this is not an unavoidable side effect of making AI safe, but rather a flaw in how safety is currently implemented. By measuring the specific cost of safety in each language, the study exposes a fundamental inequity in the technology. It shows that while English speakers might get a safe and helpful response, a speaker of another language might get a response that is either unsafe or unhelpfully vague, all because the safety mechanisms are not tuned to their specific linguistic context. The findings call for a new approach to safety alignment, one that ensures the cost of being safe is distributed evenly, so that the benefits of artificial intelligence are not diminished by the language in which it is spoken.

Technical Summary: Who Pays More for Safety? Measuring the Disparate Cost of Safety Alignment across Languages

Problem Statement

Safety alignment in Large Language Models (LLMs) is designed to prevent harmful outputs but often incurs a "utility cost," degrading the model's helpfulness and informativeness. While prior research has established the existence of this trade-off (e.g., over-refusal, capability degradation), a critical question remains unanswered: Does safety alignment impose this utility cost equally across different languages?

Existing evaluation methods typically compare absolute performance across languages using a single safety-aligned model. This approach fails to distinguish whether performance disparities stem from pre-existing capability gaps (e.g., lower proficiency in low-resource languages) or from the safety alignment process itself. Furthermore, the utility cost is often implicit; models may appear helpful while quietly withholding information, a degradation that standard evaluation metrics struggle to capture.

Methodology

To isolate the specific impact of safety alignment, the authors introduce a rigorous evaluation protocol centered on the concept of Safety Cost.

1. Definition of Safety Cost

Safety Cost is defined as the utility loss directly attributable to safety alignment on benign queries where a helpful, compliant response is expected. It is quantified as the probability that an unaligned model ( $M_{unaligned}$ ) is preferred over a safety-aligned model ( $M_{aligned}$ ) in a pairwise helpfulness evaluation:
$Cost_L = P(M_{unaligned} \succ M_{aligned} | L)$
where $L$ represents a specific language.

2. Experimental Setup

Model Pairing: The study utilizes safety-aligned models from four major families (Llama-3.3-70B, Qwen2.5-72B, Gemma-3-27B, Qwen3-32B) and their corresponding unaligned counterparts. The unaligned models are generated via refusal-direction ablation (abliteration), a technique that projects model weights orthogonal to a single refusal direction, removing safety defenses while preserving base knowledge and instruction-following capabilities.
Benchmark Selection: The evaluation focuses on over-refusal datasets (XSTest, OR-Bench, OR-Bench-Hard). These datasets contain benign prompts that are lexically or topically similar to unsafe queries, designed to trigger safety mechanisms without actually being harmful. This ensures the safety filter is active while allowing for a measurement of utility loss.
Evaluation Metric: The study employs a pairwise comparison framework (inspired by Chatbot Arena) using an LLM-as-a-Judge (GPT-5-mini) to determine which response is more helpful. The Marginal Safety Cost (MSC) is calculated as the difference between a language's Safety Cost and the English baseline ( $MSC_L = Cost_L - Cost_{English}$ ).
Controlled Variables: To ensure the observed disparities are not artifacts of the ablation process or translation quality, the authors conducted extensive controls, including:
- Comparing "Alignment Gap Differences" on benign tasks to rule out pre-existing language deficits.
- Validating translation quality via native speakers and back-translation.
- Replicating results using matched checkpoints trained from scratch (Qwen3-8B) with and without safety data, avoiding ablation entirely.

Key Contributions

Systematic Inequity: The paper provides empirical evidence that non-English users consistently bear a higher Safety Cost than English users. This disparity persists even in models that emphasize broad multilingual support and rigorous safety training.
Identification of Three Disparity Patterns:
- Double Penalty Zone: Many non-English languages fall into a quadrant where they suffer both weaker safety protection (lower Safety Gain) and higher utility loss (higher Safety Cost).
- False Low Cost: In some cases (e.g., Qwen3), a seemingly low Safety Cost is actually a consequence of safety filters failing to engage for non-English inputs, leaving users exposed to harmful outputs rather than providing a balanced trade-off.
- High-Resource Disparity: Even high-resource languages (e.g., Chinese) incur a significantly higher Safety Cost than English to achieve comparable levels of safety.
Mechanism of Degradation: The study reveals that Safety Cost is not driven solely by explicit refusals. A substantial portion of the utility loss stems from implicit qualitative degradation, where aligned models provide responses that are less informative, less actionable, and less precise than their unaligned counterparts, even when they do not refuse the query.
Methodological Framework: The authors propose a controlled protocol for measuring Safety Cost that isolates the alignment effect from pre-existing model capabilities, offering a more accurate lens for evaluating multilingual safety.

Results

Quantitative Findings: Across multiple model families, non-English languages exhibit a positive Marginal Safety Cost, indicating a disproportionate utility penalty. For instance, in the Gemma-3 and Qwen2.5 families, non-English languages showed significantly higher costs than English.
Refusal vs. Implicit Cost: Analysis shows that while explicit refusal rates contribute to the cost (especially in "hard" benchmarks), they do not fully explain the disparity. In many cases, the unaligned model provides a more comprehensive and actionable answer than the aligned model, even when both comply with the request.
Robustness Checks: The findings hold true when using matched checkpoints trained from scratch, confirming that the disparity arises from the safety alignment objective itself rather than artifacts of the ablation technique.

Significance

The paper argues that current safety alignment practices contain a fundamental flaw: they impose a structural, language-dependent penalty that degrades the user experience for non-English speakers. By exposing that safety mechanisms are often miscalibrated for non-English inputs—resulting in either excessive utility loss or insufficient protection—the authors urge the development of equitable safety mechanisms.

The study concludes that safety alignment should not be viewed as a uniform process. Instead, developers must measure and address the Safety Cost across all supported languages to ensure that the trade-off between safety and utility is distributed fairly, rather than disproportionately burdening non-English users. This work highlights the need to move beyond English-centric safety paradigms to achieve truly inclusive and helpful AI systems.