AK_QMUL at ArGuard Shared Tasks: A Single Fine-Tuned JAIS for Arabic Harmful-Prompt Detection

Ali Khairallah; Arkaitz Zubiaga

cs.CLOct 26, 2026

AK_QMUL at ArGuard Shared Tasks: A Single Fine-Tuned JAIS for Arabic Harmful-Prompt Detection

Authors: Ali Khairallah, Arkaitz Zubiaga

Organizations: Queen Mary University of London

Abstract

We present AK_QMUL's submissions to the ArGuard-2026 shared tasks on Arabic harmful-prompt detection: a binary safe/unsafe task (B1) and a seven-way harm-domain task (B2). Both submissions use one backbone -- JAIS-6.7B fine-tuned with 4-bit QLoRA and a linear classification head over its last-token representation. For B1 we train a four-way head that factors the label by dialect register {safe, unsafe} x {MSA, other}, we augment the training fold with MSA prompts from AraSafe, and decode with a plain argmax to score safe/unsafe. For B2 we fine-tune the same backbone as a seven-way classifier and average the softmax outputs of five random seeds. Both submissions ranked first on their track, with macro-F1 0.984 on B1 and 0.790 on B2. We report results by dialect and by class: on B1 the model is accurate across all six dialects (93.6--99.8%) and its predicted unsafe rate tracks the true rate closely; on B2 six of the seven classes reach F1 between 0.73 and 0.98, with the residual error concentrated in the Bully class, which overlaps semantically with harassment and harm-to-others.

Figures & tables

Panel of Figure 1 — Figure 1: Task B1 system: JAIS with a four-way {safe, unsafe} $\times$ {MSA, other} head. Colour marks the safe/unsafe axis and the _msa / _other suffix the register axis; the argmax over the four logits collapses by prefix onto the binary safe / unsafe label.

	B1	B2
Head (classes)	4	7
Label scheme	safety $\times$ register	harm domain
Augmentation	AraSafe (safe MSA)	—
Seeds	1	5 (averaged)
Decode	argmax $\to$ binary	argmax of mean

Table 1: Configuration of the two submitted systems. Both share the JAIS-6.7B QLoRA backbone, the last-token linear head, and the training recipe of Section 3.1 ; they differ in the rows above.

Panel of Figure 2 — Figure 2: Task B2 system: five seeds (42–46) of the same seven-way JAIS classifier run in parallel; their softmax distributions are averaged and the argmax of the mean is the prediction.

Dialect	$n$	Unsafe%	Pred.%	Acc.%
MSA	5331	36.6	37.1	98.8
Syrian	1030	71.7	71.7	97.7
Egyptian	438	91.3	91.6	99.8
Palestinian	348	74.7	74.4	99.1
Moroccan	469	73.8	75.9	93.6
Algerian	193	79.3	80.3	97.9

Table 2: B1 test set by dialect: number of prompts, true unsafe rate, our model’s predicted unsafe rate, and accuracy.

Head	AraSafe	Macro-F1
2-class (safe/unsafe)	yes	0.983
4-way {safety} $\times$ {register}	no	0.624
4-way {safety} $\times$ {register}	yes	0.984

Table 3: B1 ablation on the official test set. Rows 1–2 remove one design choice at a time from the submitted system (row 3): the dialect-register factoring and the AraSafe augmentation. All rows share the same JAIS-6.7B QLoRA backbone, seed, held-out fold, and training recipe; only the ablated factor changes.

Class	MSA	Syrian	Egyptian	Palestinian	Moroccan	Algerian	All
adult_content	0.98	0.98	1.00	0.98	–	0.95	0.98
harassment	0.81	0.91	0.96	0.89	0.90	0.93	0.86
hate_speech	0.67	0.91	0.99	0.98	0.92	0.91	0.84
self-harm	0.69	0.96	0.96	0.88	0.89	0.95	0.80
FraudandDeception	0.63	0.96	0.88	0.81	0.88	0.83	0.74
harm-to-others	0.64	0.87	0.92	0.89	0.86	0.67	0.73

Table 4: B2 per-class F1 by dialect on the test set (dash = no test examples of that class in the dialect). Per-dialect macro-F1 is over the classes present in that dialect;

n

is the number of unsafe prompts per dialect. The Bully weakness is confined to MSA.

Class	$n$	P	R	F1
adult_content	1311	0.976	0.992	0.984
harassment	674	0.818	0.905	0.859
hate_speech	351	0.928	0.775	0.845
self-harm	880	0.773	0.836	0.803
FraudandDeception	689	0.698	0.791	0.741
harm-to-others	1166	0.669	0.792	0.726

Table 5: Per-class precision (P), recall (R), and F1 for B2 on the test set, sorted by F1. The macro average is 0.790.

LLM Safety Evaluation

Large language model safety evaluation measures harmful compliance, robustness, and safe utility across prompts, tools, and real-world tasks.

See all 258 papers

ArabicDialectSafety: A Dialect-Aware Benchmark for Arabic Content Safety Classification
Aug 2, 2026Wajdi Zaghouani, Md. Rafiul Biswas, Kholoud Khalil Aldous +1LLM Safety Benchmarks Arabic NLP
Northwestern University in Qatar, Qatar · Hamad Bin Khalifa University, Qatar
ArGuard Shared Task: Harmful Content Detection in Arabic Memes and LLM Prompts
Sep 24, 2026Firoj Alam, Md. Rafiul Biswas, Mohamed Bayan Kmainasi +5LLM Safety Benchmarks Arabic NLP
Qatar Computing Research Institute, Qatar · Hamad Bin Khalifa University, Qatar · APAVI.AI, France +1
SalamahBench: Dialect and Category Level Safety Evaluation of Arabic Language Models
Feb 3, 2026Omar Abdelnasser, Fatemah Alharbi, Khaled Khasawneh +2LLM Safety Benchmarks Multilingual Language Model Evaluation
Compumacy for Artificial Intelligence Solutions, Cairo, Egypt · Computer Science Department, College of Computer Science and Engineering, Taibah University, Yanbu 46522, KSA · Electrical and Computer Engineering Department, George Mason University, VA, USA +2

Aug 2, 2026J/K move · Enter open · S save

ArabicDialectSafety: A Dialect-Aware Benchmark for Arabic Content Safety Classification

Wajdi Zaghouani, Md. Rafiul Biswas, Kholoud Khalil Aldous, Mabrouka Bessghaier

Northwestern University in Qatar, Qatar · Hamad Bin Khalifa University, Qatar

LLM Safety Benchmarks Arabic NLP Language Model Safety Evaluation Content Moderation Arabic Language Models Arabic Dialects

Open paper AskPDF arXiv

We present ArabicDialectSafety, a human-curated Arabic safety dataset of 25,071 prompts covering six Arabic varieties: Modern Standard Arabic, Syrian, Egyptian, Algerian, Palestinian, and Moroccan. The dataset is annotated with dialect labels and seven fine-grained harm categories. We introduce a dual-task evaluation framework for binary safe/unsafe detection and granular harm classification across dialects. Benchmarking seven supervised and generative models, we find that fine-tuned MARBERTv2 achieves the strongest performance, with Macro-F1 scores of 0.95 for binary classification and 0.90 for granular classification, substantially outperforming prompted frontier LLMs, including Arabic-specialized models. Our analyses show that dialect conditioning is most effective when integrated at the representation level, while significant performance gaps remain for low-resource Maghrebi dialects. We further evaluate seven frontier LLMs as response generators on harmful dialectal Arabic prompts and observe unsafe generation rates below 5 percent across models. We release the dataset and code upon acceptance to support future research on dialect-aware Arabic safety evaluation. Warning: This paper contains examples of harmful and potentially offensive content included solely for research purposes.

Abstract

LLM Safety Evaluation

Explore similar work

ArabicDialectSafety: A Dialect-Aware Benchmark for Arabic Content Safety Classification

ArGuard Shared Task: Harmful Content Detection in Arabic Memes and LLM Prompts

SalamahBench: Dialect and Category Level Safety Evaluation of Arabic Language Models