Why Public Safety Benchmarks Are Mostly English-Only

When a model card reports safety results, it is almost always reporting English safety results. This page counts the languages, benchmark by benchmark, with the primary source for each — because the shape of the gap is more useful than the general claim that one exists.

What counts as a safety benchmark

“Safety” covers several distinct evaluation families, and conflating them makes the coverage question unanswerable. The ones in scope here are toxicity generation (does the model produce toxic continuations), harmful instruction compliance (does it help with dangerous requests), jailbreak robustness (can the refusal be circumvented), over-refusal (does it decline safe requests), and social bias (does its output differ by group). Capability benchmarks such as MMLU are excluded, and truthfulness sits at the edge.

The English-only set

These are the evaluations most likely to appear in a model card or a paper’s safety section. Each is English only, in its original release.

• RealToxicityPrompts — around 100,000 prompts drawn from web text, published by Gehman and colleagues in 2020 and for years the default toxicity evaluation. One language.
• AdvBench — 520 harmful behaviours, released by Zou and colleagues in 2023 with the adversarial-suffix attack work and reused across most of the jailbreak literature since. One language.
• HarmBench — a standardised red-teaming evaluation framework published in 2024. One language.
• XSTest — 250 safe prompts a model should answer plus 200 genuinely unsafe contrasts, from Röttger and colleagues in 2024, and effectively the reference test for over-refusal. One language.
• Do-Not-Answer — a risk taxonomy with under a thousand instructions no responsible model should answer, from Wang and colleagues in 2023. One language.
• ToxiGen — machine-generated implicit hate targeting thirteen demographic groups, from Hartvigsen and colleagues in 2022. One language.
• BBQ — the bias benchmark for question answering, Parrish and colleagues, 2022. One language, with separate Korean, Chinese and Japanese adaptations built afterwards by other groups — each an independent research project, not a translation.

The multilingual set

• RTP-LX — 28 languages, Microsoft, 2024, with items transcreated by human annotators rather than machine-translated. The widest coverage of any of these.
• PolygloToxicityPrompts — 17 languages, 2024, built from naturally occurring web text rather than translated prompts. Seventeen.
• XSafety — 14 safety scenarios across 10 widely spoken languages, roughly 28,000 items, 2023. Ten.
• MultiJail — 315 prompts in English plus nine translations, grouped by resource level, 2023. Ten including English.
• Aya red-teaming — human-written harmful prompts in 8 languages, Cohere For AI, 2024. Eight.

Across the thirteen benchmarks listed on this page, the median language count is one. The maximum is 28. And the multilingual sets overlap heavily with each other: the languages that appear are consistently the ones with large digital corpora and large annotator pools, so five benchmarks covering ten languages each does not produce fifty languages.

The denominator

Ethnologue counts roughly 7,100 living languages, of which a few hundred have more than a million speakers. Against that, the best-covered public safety benchmark reaches about 0.4% of living languages, and the typical one reaches 0.014%.

Even the generous reading is stark. Take the several hundred languages with more than a million speakers as the practical target: 28 of them is under a tenth. And these are not obscure cases — languages with tens of millions of speakers and large online populations appear in no public safety evaluation at all, which is the subject of languages with no standard AI benchmark.

Translation is not coverage

A benchmark covering ten languages by machine-translating its English items measures something narrower than it appears to. Three reasons, and they compound.

The harms are not the same harms. Which slurs exist, which political topics are dangerous, which conspiracy narratives circulate and which groups are targeted are all locale-specific. A translated English item asks whether the model refuses an English-speaking society’s harm, phrased in another language. The harms actually occurring in that language are simply absent from the test.

Translation flattens the attack. Real adversarial input in any language uses coded terms, deliberate misspellings, transliteration and code-switching. Machine translation of a clean English prompt produces clean target-language text, so the benchmark measures the easiest case.

The translator is part of the measurement. Where translation quality is poor, a low harm score can mean the model did not understand the item — indistinguishable, in the reported number, from the model correctly refusing.

This is precisely why RTP-LX’s human transcreation and the Aya red-teaming set’s natively written prompts are worth more per item than a larger translated set, and it is why the honest coverage figure is lower than the language counts above.

What to do with this

• Read the language list, not the score. When a model card reports a safety number, find which benchmark produced it and how many languages it covers. Usually the answer is one, and the number then says nothing about your deployment.
• Do not infer coverage from multilingual capability. A model that scores well on a multilingual capability benchmark has demonstrated nothing about refusal behaviour in those languages — they are trained by different processes, as English-centric safety training sets out.
• Build a small native evaluation set for each language you ship in. A few hundred items written by speakers, covering both harmful requests and benign-but-sensitive ones, is more informative for your product than any public benchmark, because it contains your domain and your users’ actual register.
• Publish the language list with the result. If you report a safety figure internally, report which languages it covers in the same sentence. That habit alone stops an English result being read as a global one.