How English-Centric Safety Training Creates Blind Spots in Other Languages

“The model is less safe in other languages” is the usual summary, and it is the wrong shape. A lower threshold would be predictable and could be compensated for. What English-centric alignment actually produces is a boundary whose position in another language nobody chose, which fails in both directions on prompts that differ trivially.

Three states, not two

Any refusal system has three outcomes worth naming, and collapsing them into a safe/unsafe axis is what makes this problem hard to discuss.

• Correct refusal — a genuinely harmful request declined.
• Under-refusal — a harmful request answered. The failure the jailbreak literature measures.
• Over-refusal — a benign request declined. The failure users experience, and the one that quietly makes a product unusable in a market.

If English-centric training simply lowered the model’s caution in Bengali, you would see more of the second and less of the third. What people report is more of both, in the same language, on the same day — and that combination is not a threshold effect. It is variance. The Arabic case is worked through in the English-Arabic refusal asymmetry; the argument here is about why that shape arises at all.

What the published alignment data contains

No lab publishes the language composition of its safety fine-tuning mix, and this page will not guess at one. What is public is enough.

Anthropic’s helpfulness and harmlessness preference data (Bai and colleagues, 2022), the dataset that made RLHF for harmlessness reproducible outside a lab, is English. OpenAI’s InstructGPT paper (Ouyang and colleagues, 2022) documents its labeller pool and its prompt distribution and describes a dataset overwhelmingly in English. Meta’s Llama 2 paper (2023) publishes a pretraining language table in which English is roughly 90% of the identified data, and says its safety tuning and red-teaming were conducted in English, with an explicit caution against deploying in other languages without further testing.

The counter-effort is equally informative. Cohere For AI’s Aya Dataset (2024) exists because human-curated instruction data in many languages did not; it was assembled by a large open collaboration and covers 65 languages. That a coordinated multi-year community project was required to reach that number is the measure of how far from free multilingual alignment data is.

Why the boundary moves rather than shifts

Fine-tuning for refusal places a decision surface in the model’s representation space. In English there are many training points on both sides of it and close to it, so the surface is pinned down: it sits where the data says, and small perturbations of a prompt move it along the surface rather than across.

In a language with no alignment examples, nothing pins it. The surface still passes through that part of the representation space — it has to, it is one function — but its position there is a side effect of the geometry induced by pretraining, not a decision. Two Bengali prompts that a person would call equivalent can sit on opposite sides of it, because what determines their position is their proximity to English examples in a shared multilingual representation, and that proximity has nothing to do with how similar they are as requests.

Two consequences follow that are worth stating separately.

The behaviour is unstable across paraphrase. In English, rewording a harmful request rarely flips a refusal; that robustness was trained in. In an unaligned language there is no reason for it to hold, which is why translation attacks are cheap and why benign users hit refusals they cannot reproduce.

It is unstable across model versions. Since the position was never specified, any change to pretraining data, to the alignment set, or to the fine-tuning recipe moves it arbitrarily in languages nobody evaluated. A behaviour you tested and relied on can invert at the next release with no mention in the changelog, because from the lab’s point of view nothing about it changed. The same instability shows up in factual reliability — why low-resource languages hallucinate more is the same thin-data mechanism applied to a different behaviour.

Why a system prompt cannot fix it

The instinct is to state the policy in the system prompt: what to refuse, what to allow, in the target language. This helps a little and it cannot be the control, for a reason that is easy to miss.

A system prompt works through instruction-following, and instruction-following is itself a fine-tuned behaviour with the same English skew. So the mechanism you are relying on to compensate for weak alignment in Swahili is weaker in Swahili for identical reasons. Models routinely fail to hold even a simple output-language instruction in a low-resource setting — when the model ignores the output-language instruction documents that directly — and a policy is far more complex than a language instruction.

There is a second-order version of the problem in reasoning models, which often think in one language and answer in another; whichever language the reasoning happens in is the one whose alignment applies to it. See chain-of-thought language mismatch. And the quality of a system prompt written in the target language is itself variable — system prompt language and output quality covers the trade.

Designing around variance

If the property is variance rather than a shifted threshold, the design response is to stop treating emergent refusal as a control at all.

• Put the policy in a component you own. An explicit classifier or rule set that you can inspect, version and evaluate per language gives you a control with a known operating point. The model’s own refusal becomes a backstop rather than the mechanism.
• Evaluate variance, not just rate. Run each item several times and run several paraphrases of it. Report the spread. Two models with the same mean refusal rate and different spreads are different products, and the mean hides exactly the property that matters.
• Treat each language as its own deployment. Sign-off in English says nothing about Bengali. This is unwelcome and it is what the mechanism implies.
• Watch for silent regressions. Because nobody evaluated the boundary in your language, nobody will tell you when it moves. A small per-language regression set run on every model upgrade is the only warning you will get.
• Log refusals as a first-class event. Over-refusal is invisible in error rates — the request succeeded — and shows up as users quietly leaving. Count it.