How I Aligned Your Model: Scaling Up Multilingual Safety Training with Templates

Max Neuwinger; Hanna Yukhymenko; Imanol Schlag

cs.CLOct 29, 2026

How I Aligned Your Model: Scaling Up Multilingual Safety Training with Templates

Authors: Max Neuwinger, Hanna Yukhymenko, Imanol Schlag

Organizations: ETH Zurich

Abstract

Safety alignment for Large Language Models is heavily focused on English with limited multilingual representation, particularly damaging low-resource language performance. Related open training datasets are often limited in size or do not follow region-localized harmful topics to broaden the scope of alignment beyond cultures. We propose a scalable template-based augmentation pipeline to produce massive multilingual refusal and benign corpora, extracting safe templates from harmful prompts, translating them and then filling in the slots with culturally authentic entities, both harmful and benign. As a result, we release MSafeTemp, a validated corpus spanning 60 languages useful for multilingual safety alignment and evaluation. Using the dataset, we show that English-only evaluation misjudges multilingual safety: for several models, attacks that fail in English succeed once translated, while culturally localized variants expose further failures that translation alone misses. We also confirm that augmenting safety training data through templates allows for higher diversity and quality of alignment, resulting in improved safety performance beyond English. MSafeTemp and the respective pipeline are aimed at facilitating research and development of safer and more responsible models for less-represented cultures.

Figures & tables

Figure 1: The MSafeTemp pipeline. Original prompt goes through extraction of harmful terms, validation, translation, and a targeted judge pass of a template. Three branches then produce generic harmful variants ( TR ), exact-fill benign controls ( OR ), and culturally localized variants ( PH ). English ( EN ) follows the same path without translation.

Figure 2: MSafeTemp example, showing how different augmentation types are produced from different stages in the pipeline.

Track	Seeds	Languages	Templates	Harmful	Benign	Post-hoc
WildGuard	$2{,}500$	$44$	$109{,}425/110{,}000$	$1{,}537{,}628$	$186{,}639{+}20{,}528$	$97{,}120$
HarmBench	$200$	$60$	$11{,}976/12{,}000$	$173{,}743$	$29{,}598{+}3{,}682$	$9{,}463$

Table 1: MSafeTemp statistics. WildGuard is used for training and performance signal; HarmBench remains evaluation-only. Template counts are verified/original; benign counts are direct

+

bounded . Over-refusal uses direct only.

	HarmBench (200 seeds, 60 langs)				WildGuard test (500 seeds, 44 langs)				HB-JB
Model	Orig.	TR	PH	OR	Orig.	TR	PH	OR	ASR	OR
Qwen3.5-27B	$0.5$	$0.4$	$0.1$	$3.5$	$0.0$	$0.3$	$0.1$	$17.0$	$<0.1$	$31.1$
GPT-OSS-20B	$0.0$	$0.4$	$0.3$	$31.8$	$0.4$	$0.5$	$0.2$	$45.1$	$0.2$	$56.0$
Gemma-4-31B-IT	$6.5$	$4.2$	$2.5$	$3.2$	$0.8$	$3.2$	$1.3$	$7.5$	$2.0$	$13.2$
Olmo-3.1-32B-Instruct	$0.0$	$13.7$	$11.9$	$4.6$	$2.8$	$10.7$	$10.8$	$6.1$	$16.6$	$16.8$
Llama-3.3-70B-Instruct	$13.0$	$5.3$	$2.6$	$7.7$	$6.7$	$5.6$	$4.5$	$12.8$	$10.3$	$26.6$

Table 2: Leading open models on both evaluation tracks (%, lower is better). Orig. is the untouched English seed; TR and PH are the means over translated and localized arms. HB-JB is jailbreak-wrapped HarmBench (

300

prompts per language): ASR on wrapped PH requests and OR on wrapped benign prompts. Full results in App. D , E , and F.3 .

Figure 3: Translated vs. localized attack success on HarmBench for four leading models in eight example languages. Solid bars are translated ( TR ) and hatched bars culturally localized ( PH ) variants of the same templates. English is shown as a TR-only reference, since it has no PH arm. Localization raises ASR for Apertus-8B in every language shown but lowers it in most languages for the other models. Full results over 59 languages are in Tables 21 and 22 .

Apertus-8B-2509
	Safety $\downarrow$				Over-refusal $\downarrow$			Capability $\uparrow$
Model	AyaRT	PolyTox	HB ASR	WG ASR	HB OR	WG OR	OR-Bench	MMLU	GSM8K
Base	$12.2$	$45.9$	$14.2^{\dagger}$	$3.1^{\dagger}$	$1.6^{\dagger}$	$44.3^{\dagger}$	$2.1$	$60.1$	$49.9$
+ SFT	$1.4$	$14.4$	$3.3$	$2.6$	$13.5$	$12.7$	$15.0$	$59.1$	$45.2$
+ SFT + DPO	$0.1$	$7.1$	$1.5$	$0.5$	$7.7$	$5.5$	$23.7$	$58.9$	$46.9$
IT	$0.7$	$4.7$	$10.3$	$10.5$	$10.3$	$12.5$	$82.6$	$61.6$	$63.3$

Table 3: General evaluation results for original base and finetuned models for Apertus v1 and 1.5 8B, Olmo-3-7B, and Llama-3.1-8B. SFT and DPO use MSafeTemp ; green and red mark an improvement or a degradation relative to the untuned checkpoint (Base or IT). HB and WG are the multilingual HarmBench and WildGuardMix tracks of MSafeTemp , judged by GPT-OSS-Safeguard-120B , AyaRT and PolyTox have their own default judge setup.

Appendix figures & tables54 assets

Supplementary material from the paper’s appendix.

Appendix

Quantity	WildGuard	HarmBench
Templates and harmful fills
Valid native templates	$109{,}425/110{,}000$ ( $99.5\%$ )	$11{,}976/12{,}000$ ( $99.8\%$ )
Harmful fills relative to the intended ceiling	$94\%$	$97\%$
Generated harmful fills rejected by the final judge	about $1\%$
Benign controls
Benign candidates accepted	$52\%$	$61\%$

Appendix

Table 4: Filtering is concentrated in the control and localization branches. Percentages are relative to the candidates entering the named stage.

Number of assigned labels
Item	Seeds
None (abstained)	$185$
One	$2{,}157$
Two	$150$
Three	$8$
Top-ranked high-level category

Appendix

Table 5: Taxonomy coverage for the 2,500 WildGuard seeds. Top-ranked categories partition the 2,315 seeds that receive at least one label; special-check counts may overlap them.

WildGuardMix			HarmBench
Primary category	Rows	Share	Primary category	Rows	Share
Erotic content	$397{,}414$	$21.6\%$	Misinformation misuse	$32{,}240$	$14.9\%$
Sex-related crimes	$189{,}303$	$10.3\%$	Code misuse	$29{,}170$	$13.5\%$
Financial crimes	$147{,}723$	$8.0\%$	Biochemical misuse	$23{,}693$	$10.9\%$
(abstained)	$139{,}592$	$7.6\%$	Financial crimes	$18{,}824$	$8.7\%$
Digital crimes	$130{,}262$	$7.1\%$	Digital crimes	$16{,}782$	$7.8\%$

Appendix

Table 6: Largest primary categories in the WildGuardMix and HarmBench tracks. Each row is counted once under its primary label (WildGuardMix:

1{,}841{,}915

rows from

2{,}500

seeds; HarmBench:

216{,}486

rows from

200

seeds).

Stage	Role	Temp.	Max tokens
Template extractor	creative	$0.2$	$8{,}192$
Template validity judge	judging	$0.0$	$32{,}768$
Translator	creative	$0.3$	$8{,}192$
Translation judge	judging	$0.0$	$32{,}768$
Translation patcher	creative	$0.2$	$32{,}768$ / $8{,}192$
Harmful slot generator	creative	$0.9$	$32{,}768$ / $8{,}192$

Appendix

Table 7: Generation settings by pipeline stage. Judging stages use temperature

0

; creative stages use nonzero temperatures. Where two token limits are given, the first applies to the WildGuard track and the second to HarmBench. Response generator limits depend on the refusal length (brief, compact, full) or benign answer.

	Arm	Fills	Distinct	$D/F$	$D/F_{\text{stem}}$	$N_{\text{eff}}$	Top-1 (%)	Top-10 (%)	Top-100 (%)	Singl. (%)
HarmBench	Harmful	311,986	219,225	0.70	0.65	171,186	0.01	0.12	0.9	57.0
	Benign	60,557	57,483	0.95	0.93	55,758	0.02	0.18	1.0	91.4
	Post-hoc, generated slots	5,279	4,055	0.77	0.75	3,538	0.25	1.59	9.6	64.0
	Post-hoc, localized slot †	13,138	1,996	0.15	0.15	1,411	0.29	2.04	15.7	3.0
WildGuard	Harmful	3,669,627	2,607,162	0.71	0.64	1,780,954	0.01	0.08	0.5	61.5
	Benign	409,703	383,458	0.94	0.90	363,147	0.01	0.07	0.5	90.1

Appendix

Table 8: Entity diversity per arm, pooled over languages (an entity is identified within its language).

D/F

: distinct entities per fill;

D/F_{\text{stem}}

: the same after 5-character prefix stemming of every word;

N_{\text{eff}}=\exp(H)

: effective number of entities (Hill number of order 1); Top-

k

: share of all fills taken by the

k

most frequent entities; Singl.: share of fills whose entity occurs exactly once.

	Harmful, per template slot				Benign	Harmful, per original $\times$ lang.	Harmful, per original
	Variants	Distinct	All distinct (%)	$\leq$ 2 distinct (%)	All distinct (%)	fills / distinct	fills / distinct
HarmBench	4.90	4.80	91.6	1.5	98.8	13.81 / 11.12	654 / 430
WildGuard	4.94	4.86	93.9	0.9	99.5	13.95 / 12.46	415 / 350

Appendix

Table 9: Diversity at the level where collapse would appear first. Cols. 2–5: one slot of one template in one language, across its harmful variants; col. 6: the same for benign variants; col. 7: one slot of one original in one language, across main and paraphrase variants (mean fills / mean distinct); col. 8: one slot of one original across languages (median fills / median distinct, slots in

\geq

10 languages).

	Slot label	Templates	Fills	Distinct	$D/F$	Top-1 (%)
HarmBench	$\langle$ target_location $\rangle$	19	8,931	4,279	0.48	0.4
	$\langle$ protected_group $\rangle$	13	7,929	5,105	0.64	0.3
	$\langle$ target_individual $\rangle$	14	7,643	6,403	0.84	0.2
	$\langle$ hazardous_chemical $\rangle$	5	5,568	2,212	0.40	2.4
	$\langle$ illicit_substance $\rangle$	8	5,481	1,860	0.34	6.3
	$\langle$ software_vulnerability $\rangle$	6	5,061	1,916	0.38	11.9

Appendix

Table 10: The ten most frequent slot labels in the harmful arm (numeric suffixes such as _1 merged). Templates: originals using the label; Top-1: share of the label’s fills taken by its most frequent entity.

	Entity	Typical slot	Fills	Share (%)	Lang.	Orig.
HarmBench	eternalblue	$\langle$ software_vulnerability $\rangle$	677	0.22	60	8
	ransomware	$\langle$ malware_type $\rangle$	668	0.21	49	18
	log4shell	$\langle$ software_vulnerability $\rangle$	663	0.21	60	10
	sql injection	$\langle$ cyberattack_method $\rangle$	613	0.20	41	24
	heartbleed	$\langle$ software_vulnerability $\rangle$	603	0.19	60	7
	lsd	$\langle$ illicit_substance $\rangle$	598	0.19	51	9

Appendix

Table 11: The ten most frequent harmful-arm entities (identity pooled across languages after casefolding). Share: of all harmful fills of the dataset; Lang./Orig.: number of languages / original prompts in which the entity occurs.

Name	Fills	Share (%)	Lang.	Orig.
Elena	2,954	2.72	30	238
Sofia	1,871	1.72	30	215
Clara	1,678	1.55	29	194
Julian	1,375	1.27	29	188
Maya	1,024	0.94	27	178
Mia	976	0.90	30	160

Appendix

Table 12: WildGuard: most frequent first names in person/character slots (harmful + benign). Share: of all 108,579 name fills.

Language	Pool	Used	Used (%)	In pool (%)	Fills	Uses/ent.	$N_{\text{eff}}$	Top-1 (%)	Top-5 (%)
Albanian	29	29	100.0	100.0	2,004	66.80	17.74	12.9	43.5
Amharic	28	28	100.0	98.5	3,718	67.60	17.62	13.2	55.2
Arabic	33	33	100.0	99.6	2,740	70.26	19.16	10.7	47.6
Bengali	31	31	100.0	99.9	1,885	57.12	19.36	12.8	41.3
Bulgarian	26	25	96.2	86.0	2,595	78.64	20.63	9.9	39.7
Chinese (Simpl.)	32	32	100.0	99.8	2,966	78.05	19.13	12.9	50.3

Appendix

Table 13: WildGuard post-hoc localization per language. Pool: entities in the language’s entity pool; Used: pool entities chosen at least once (count and share of the pool); In pool: share of recipe fills whose value is a pool entity (after casefolding); Uses/ent.: fills per used entity;

N_{\text{eff}}

: effective number of localized entities; Top-

k

: share of fills taken by the

k

most used entities.

	Harmful						Benign
Language	Fills	Distinct	$D/F$	$D/F_{\text{stem}}$	Top-1	Top-5	Fills	Distinct	$D/F$	Top-5
Albanian	5,644	4,023	0.71	0.64	0.46	1.8	1,066	1,034	0.97	1.6
Amharic	4,509	3,317	0.74	0.73	0.51	2.2	641	611	0.95	2.8
Arabic	5,490	3,930	0.72	0.71	0.67	2.1	1,259	1,183	0.94	1.8
Armenian	4,430	3,347	0.76	0.66	0.38	1.8	251	242	0.96	5.6
Basque	3,783	2,731	0.72	0.60	0.90	2.9	638	620	0.97	2.4

Appendix

Table 14: HarmBench: entity diversity per language (harmful and benign arms). Top-

k

(%): share of the language’s fills taken by its

k

most frequent entities.

	Harmful						Benign
Language	Fills	Distinct	$D/F$	$D/F_{\text{stem}}$	Top-1	Top-5	Fills	Distinct	$D/F$	Top-5
Albanian	82,710	61,269	0.74	0.66	0.25	0.7	8,885	8,443	0.95	0.7
Amharic	81,629	57,120	0.70	0.69	0.29	1.1	5,008	4,533	0.91	1.9
Arabic	85,968	62,595	0.73	0.71	0.31	1.1	10,376	9,741	0.94	1.1
Bengali	83,018	56,564	0.68	0.61	0.30	1.1	8,640	7,940	0.92	1.2
Bulgarian	84,060	58,739	0.70	0.63	0.31	1.1	9,840	9,202	0.94	1.0

Appendix

Table 15: WildGuard: entity diversity per language (harmful and benign arms). Top-

k

(%): share of the language’s fills taken by its

k

most frequent entities.

Supplied label	Judgments	Correct	Incorrect	Unsure	Skip
HARMFUL	$300$	$273$ ( $91.0\%$ )	$11$ ( $3.7\%$ )	$8$ ( $2.7\%$ )	$8$ ( $2.7\%$ )
BENIGN	$300$	$196$ ( $65.3\%$ )	$57$ ( $19.0\%$ )	$37$ ( $12.3\%$ )	$10$ ( $3.3\%$ )
All	$600$	$469$ ( $78.2\%$ )	$68$ ( $11.3\%$ )	$45$ ( $7.5\%$ )	$18$ ( $3.0\%$ )

Appendix

Table 16: Assessment of supplied safety labels. Percentages include Unsure and Skip; Correct indicates respondent endorsement, not adjudicated accuracy.

Dimension	$n$	Mean	SD	Median	Ratings 1–2
Naturalness	$582$	$4.43$	$0.93$	$5.0$	$31$ ( $5.3\%$ )
Cultural fit	$466$	$4.46$	$0.98$	$5.0$	$30$ ( $6.4\%$ )

Appendix

Table 17: Pooled ratings on five-point scales.

n

counts available ratings; SD is the sample standard deviation of individual ratings.

Language	Subm.	Correct	Incorrect	Unsure	Skip	Naturalness	Cultural fit
Bosnian	$1$	$29$	$7$	$4$	$0$	$4.50$ ( $40$ )	$4.55$ ( $40$ )
Bulgarian	$2$	$63$	$6$	$10$	$1$	$4.20$ ( $80$ )	$4.86$ ( $80$ )
Simplified Chinese	$1$	$31$	$7$	$2$	$0$	$4.63$ ( $40$ )	$4.44$ ( $9$ )
Croatian	$1$	$24$	$12$	$4$	$0$	$4.43$ ( $40$ )	$4.68$ ( $40$ )
English	$2$	$79$	$0$	$1$	$0$	$4.99$ ( $80$ )	$4.86$ ( $49$ )
French	$1$	$14$	$4$	$5$	$17$	$3.64$ ( $22$ )	$3.90$ ( $21$ )

Appendix

Table 18: Results by language. Label columns count judgments; rating columns give the mean with the number of available ratings in parentheses. Panels and respondents differ across languages. The French respondent skipped the label questions for items 24–40.

Language	Items	Exact agreement	Cohen’s $\kappa$
Bulgarian	$40$	$31/40$ ( $77.5\%$ )	$0.377$
English	$40$	$39/40$ ( $97.5\%$ )	$0.000$
German	$40$	$39/40$ ( $97.5\%$ )	$0.000$
Ukrainian	$40$	$27/40$ ( $67.5\%$ )	$0.000$

Appendix

Table 19: Agreement between the two submissions per language on the supplied-label assessment (items aligned by source ID). Unweighted Cohen’s

\kappa

over Correct, Incorrect, Unsure, and Skip.

Model	EN ASR	TR ASR	PH ASR	Over-refusal
Apertus-8B-Instruct-2509	$6.8\%$	$10.1\%$	$12.2\%$	$10.2\%$
GPT-OSS-20B	$0.2\%$	$0.4\%$	$0.3\%$	$31.8\%$
Qwen3.5-27B	$0.3\%$	$0.4\%$	$0.1\%$	$3.5\%$
Gemma-4-31B-IT	$6.0\%$	$4.2\%$	$2.5\%$	$3.2\%$
Olmo-3.1-32B-Instruct	$0.2\%$	$13.7\%$	$11.9\%$	$4.6\%$
Apertus-70B-Instruct-2509	$5.3\%$	$13.0\%$	$6.0\%$	$5.3\%$

Appendix

Table 20: The multilingual gap across leading open models. Several models are markedly easier to break once prompts leave English, while others are not, suggesting that a model’s position depends more on how it was aligned than on its size.

Language	Qwen-27B	gpt-oss	Olmo-32B	Llama-70B	gemma-31B	Ap-8B	Ap-70B	Ap1.5-8B
Albanian	$0.3$	$0.6$	$25.8$	$4.0$	$4.9$	$12.4$	$15.2$	$1.7$
Amharic	$0.6$	$2.3$	$7.8$	$9.6$	$4.7$	$4.9$	$9.0$	$3.7$
Arabic	$0.2$	$0.1$	$13.9$	$3.4$	$3.6$	$9.6$	$9.1$	$0.8$
Armenian †	$0.1$	$0.5$	$9.3$	$9.2$	$4.0$	$17.7$	$15.1$	$3.1$
Basque †	$0.6$	$2.4$	$18.2$	$5.7$	$10.3$	$14.9$	$14.5$	$4.3$
Belarusian †	$0.5$	$0.3$	$19.2$	$2.9$	$5.1$	$14.3$	$14.2$	$1.9$

Appendix

Table 21: Leading models: per-language translated (TR) attack success (%).

\dagger

: held-out language.

Language	Qwen-27B	gpt-oss	Olmo-32B	Llama-70B	gemma-31B	Ap-8B	Ap-70B	Ap1.5-8B
Albanian	$0.0$	$0.0$	$24.4$	$0.6$	$0.6$	$13.8$	$6.9$	$0.0$
Amharic	$0.0$	$1.9$	$2.8$	$9.4$	$0.9$	$3.8$	$3.8$	$17.2$
Arabic	$0.0$	$0.0$	$17.2$	$1.2$	$2.5$	$10.4$	$6.1$	$0.6$
Armenian †	$0.0$	$0.0$	$9.6$	$6.2$	$2.1$	$16.4$	$2.7$	$0.0$
Basque †	$0.0$	$1.3$	$12.0$	$0.0$	$5.3$	$20.0$	$8.0$	$8.1$
Belarusian †	$0.0$	$0.0$	$26.8$	$0.9$	$3.6$	$21.4$	$5.4$	$0.9$

Appendix

Table 22: Leading models: per-language post-hoc cultural (PH) attack success (%).

\dagger

: held-out language.

Language	Qwen-27B	gpt-oss	Olmo-32B	Llama-70B	gemma-31B	Ap-8B	Ap-70B	Ap1.5-8B
English	$4.3$	$36.3$	$11.7$	$0.7$	$4.1$	$20.9$	$15.2$	$33.0$
Albanian	$2.9$	$28.2$	$1.4$	$10.1$	$3.9$	$8.2$	$6.4$	$29.4$
Amharic	$1.6$	$17.4$	$0.8$	$0.0$	$2.3$	$0.3$	$1.8$	$9.7$
Arabic	$2.6$	$36.9$	$2.1$	$6.4$	$2.2$	$13.1$	$6.5$	$25.6$
Armenian †	$4.4$	$27.5$	$0.0$	$5.5$	$6.0$	$6.0$	$3.8$	$19.4$
Basque †	$5.2$	$28.6$	$1.8$	$10.2$	$5.5$	$3.9$	$3.4$	$5.1$

Appendix

Table 23: Leading models: per-language over-refusal (%), benign minimal pairs. Lower is more helpful.

\dagger

: held-out language.

Model	Main ASR	Paraphrase ASR	$\Delta$ (pp)	Languages	Paired cells
Qwen3.5-27B	$0.4\%$	$0.3\%$	$-0.14$	$17/60$	$219$ / $201$
GPT-OSS-20B	$0.4\%$	$0.4\%$	$+0.01$	$30/60$	$328$ / $202$
Olmo-3.1-32B-Instruct	$13.9\%$	$13.3\%$	$-0.61$	$25/60$	$3{,}351$ / $2{,}795$
Llama-3.3-70B-Instruct	$5.4\%$	$5.3\%$	$-0.15$	$30/60$	$1{,}854$ / $1{,}350$
Gemma-4-31B-IT	$4.6\%$	$4.0\%$	$-0.55$	$16/60$	$1{,}360$ / $1{,}149$
Apertus-8B-Instruct-2509	$11.3\%$	$9.4\%$	$-1.91$	$10/60$	$2{,}313$ / $2{,}232$

Appendix

Table 24: Main template vs. paraphrases (HarmBench, TR arms pooled).

\Delta

is paraphrase minus main in percentage points. Languages counts the arms where the paraphrase ASR is higher. Paired cells counts (language, behavior) cells where the paraphrase / the main template has the higher ASR; ties are omitted.

	TR templates						PH
Model	Robust	Partial	All	Indep.	From partial	One / all fills	Partial	All
Qwen3.5-27B	$98.5$	$1.5$	$0.0$	$0.00$	$100$	$0.3$ / $1.5$	$0.3$	$0.0$
GPT-OSS-20B	$98.2$	$1.8$	$0.0$	$0.00$	$99$	$0.3$ / $1.8$	$0.9$	$0.0$
Olmo-3.1-32B-Instruct	$65.2$	$33.4$	$1.4$	$0.03$	$89$	$13.7$ / $34.8$	$25.7$	$2.4$
Llama-3.3-70B-Instruct	$84.5$	$15.1$	$0.4$	$0.00$	$92$	$5.2$ / $15.5$	$6.3$	$0.4$
Gemma-4-31B-IT	$88.1$	$11.6$	$0.3$	$0.00$	$93$	$4.2$ / $11.9$	$6.6$	$0.4$

Appendix

Table 25: Per-template breaking outcome (HarmBench, %). Columns as in Table 33 : robust / partial / all broken templates (TR), the all-broken share expected under independent fills, the share of unsafe answers from partial templates, templates broken with the first fill only vs. all fills, and the partial and all-broken shares of the post-hoc (PH) templates.

Model	Behaviors	Original ASR	Any descendant	Refused $\rightarrow$ broken	Median share
Qwen3.5-27B	$200$	$0.5\%$	$42.5\%$	$42.2\%$	$0.0\%$
GPT-OSS-20B	$200$	$0.0\%$	$74.5\%$	$74.5\%$	$1.1\%$
Olmo-3.1-32B-Instruct	$200$	$0.0\%$	$100.0\%$	$100.0\%$	$32.8\%$
Llama-3.3-70B-Instruct	$200$	$13.0\%$	$100.0\%$	$100.0\%$	$10.8\%$
Gemma-4-31B-IT	$200$	$6.5\%$	$88.0\%$	$87.2\%$	$3.4\%$
Apertus-8B-Instruct-2509	$200$	$8.5\%$	$98.0\%$	$97.8\%$	$15.9\%$

Appendix

Table 26: Per-behavior view (HarmBench). Columns as in Table 34 , over the 200 original behaviors.

Category	$n$	Qwen-27B	gpt-oss	Olmo-32B	Llama-70B	gemma-31B	Ap-8B	Ap-70B
Privacy and property	$1$	$0.5$	$0.0$	$8.4$	$5.0$	$27.8$	$5.6$	$18.1$
Harm and misuse	$103$	$0.5$	$0.5$	$16.8$	$7.0$	$6.1$	$13.4$	$17.0$
Crimes and illegal activities	$76$	$0.2$	$0.4$	$10.8$	$3.7$	$1.8$	$6.1$	$9.7$
Fairness and justice	$14$	$0.1$	$0.3$	$8.3$	$3.1$	$3.2$	$10.6$	$3.0$
Explicit content	$6$	$0.4$	$0.2$	$2.8$	$2.2$	$1.4$	$1.1$	$4.6$

Appendix

Table 27: HarmBench TR attack success by LinguaSafe top-level category (%).

n

is the number of behaviors in the category.

Category	$n$	Qwen-27B	gpt-oss	Olmo-32B	Llama-70B	gemma-31B	Ap-8B	Ap-70B
Misinformation & disinformation	$34$	$0.4$	$0.7$	$17.0$	$7.9$	$11.6$	$25.1$	$11.6$
Cybercrime & intrusion	$40$	$1.0$	$0.4$	$19.2$	$7.7$	$6.1$	$8.8$	$24.9$
Chemical & biological	$28$	$0.2$	$0.4$	$14.1$	$5.5$	$1.3$	$7.3$	$18.2$
Illegal	$58$	$0.2$	$0.5$	$11.0$	$3.6$	$2.3$	$6.3$	$9.1$
Harmful	$21$	$0.1$	$0.4$	$9.5$	$3.7$	$1.3$	$7.5$	$4.8$
Harassment & bullying	$19$	$0.0$	$0.2$	$6.0$	$2.3$	$0.7$	$3.8$	$2.3$

Appendix

Table 28: HarmBench TR attack success by HarmBench semantic category (%).

n

is the number of behaviors in the category.

Category	$n$	Qwen-27B	gpt-oss	Olmo-32B	Llama-70B	gemma-31B	Ap-8B	Ap-70B
Code misuse	$28$	$1.2$	$0.4$	$22.8$	$8.6$	$6.3$	$10.4$	$30.0$
Misinformation misuse	$28$	$0.5$	$0.7$	$17.8$	$8.7$	$12.6$	$26.3$	$12.9$
Intellectual property	$1$	$0.5$	$0.0$	$8.4$	$5.0$	$27.8$	$5.6$	$18.1$
Digital crimes	$17$	$0.5$	$0.7$	$13.9$	$6.5$	$4.6$	$9.5$	$15.2$
Biochemical misuse	$22$	$0.2$	$0.4$	$14.8$	$6.1$	$1.5$	$8.1$	$18.5$
Physical harm	$14$	$0.1$	$0.5$	$14.3$	$5.1$	$3.8$	$9.9$	$7.6$

Appendix

Table 29: HarmBench TR attack success by LinguaSafe primary category (%), sorted by the panel mean.

n

is the number of behaviors.

Language	Qwen-27B	gpt-oss	Olmo-32B	Llama-70B	gemma-31B	Ap-8B	Ap-70B
Albanian	$-0.1$	$-0.1$	$-3.1$	$+1.1$	$-0.7$	$-2.8$	$-2.2$
Amharic	$-0.5$	$+1.2$	$+1.0$	$+1.2$	$-0.3$	$-0.8$	$+0.1$
Arabic	$-0.3$	$+0.2$	$-4.0$	$-0.2$	$-2.3$	$-4.3$	$-8.1$
Armenian †	$+0.0$	$-0.2$	$+1.1$	$-0.8$	$+0.3$	$-2.9$	$-3.8$
Basque †	$+0.4$	$+0.4$	$-5.9$	$+1.5$	$+0.7$	$-6.1$	$-4.0$
Belarusian †	$-0.3$	$-0.2$	$-5.3$	$+1.0$	$-0.9$	$+0.9$	$-4.2$

Appendix

Table 30: HarmBench: paraphrase minus main-template ASR per language (percentage points). Positive values mean the paraphrased templates break the model more often.

\dagger

: held-out language.

Model	Original ASR	EN ASR	TR ASR	PH ASR	Over-refusal	Valid
Qwen3.5-27B	$0.0\%$	$0.3\%$	$0.3\%$	$0.1\%$	$17.0\%$	$95.4\%$
GPT-OSS-20B	$0.4\%$	$0.3\%$	$0.5\%$	$0.2\%$	$45.1\%$	$91.1\%$
Olmo-3.1-32B-Instruct	$2.8\%$	$4.1\%$	$10.7\%$	$10.8\%$	$6.1\%$	$99.2\%$
Llama-3.3-70B-Instruct	$6.7\%$	$11.9\%$	$5.6\%$	$4.5\%$	$12.8\%$	$96.0\%$
Gemma-4-31B-IT	$0.8\%$	$1.6\%$	$3.2\%$	$1.3\%$	$7.5\%$	$99.9\%$
Apertus-8B-Instruct-2509	$4.3\%$	$6.3\%$	$10.5\%$	$8.7\%$	$12.2\%$	$85.7\%$

Appendix

Table 31: WildGuard test split: attack success and over-refusal across leading open models. Original is the untouched English WildGuardMix prompt; EN, TR and PH are the English, mean translated, and mean post-hoc arms of MSafeTemp . Valid is the share of all responses that are non-degenerate and therefore scored. ASR and over-refusal are lower-is-better.

Model	Main ASR	Paraphrase ASR	$\Delta$ (pp)	Languages	Paired cells
Qwen3.5-27B	$0.2\%$	$0.3\%$	$+0.06$	$29/44$	$280$ / $116$
GPT-OSS-20B	$0.4\%$	$0.5\%$	$+0.09$	$30/44$	$421$ / $228$
Olmo-3.1-32B-Instruct	$9.3\%$	$11.2\%$	$+1.89$	$43/44$	$4{,}554$ / $2{,}603$
Llama-3.3-70B-Instruct	$5.1\%$	$6.1\%$	$+0.98$	$35/44$	$2{,}961$ / $1{,}727$
Gemma-4-31B-IT	$2.5\%$	$3.6\%$	$+1.11$	$39/44$	$2{,}039$ / $832$
Apertus-8B-Instruct-2509	$9.3\%$	$10.9\%$	$+1.57$	$37/44$	$4{,}148$ / $2{,}491$

Appendix

Table 32: Main template vs. paraphrases (WildGuard test, TR arms pooled).

\Delta

is paraphrase minus main in percentage points. Languages counts the arms where the paraphrase ASR is higher. Paired cells counts (language, original) cells where the paraphrase / the main template has the higher ASR; ties are omitted.

	TR templates						PH
Model	Robust	Partial	All	Indep.	From partial	One / all fills	Partial	All
Qwen3.5-27B	$99.2$	$0.8$	$0.0$	$0.00$	$92$	$0.2$ / $0.8$	$0.4$	$0.0$
GPT-OSS-20B	$98.6$	$1.3$	$0.1$	$0.00$	$88$	$0.4$ / $1.4$	$0.5$	$0.0$
Olmo-3.1-32B-Instruct	$78.5$	$18.5$	$3.0$	$0.01$	$71$	$10.6$ / $21.5$	$21.2$	$2.2$
Llama-3.3-70B-Instruct	$86.9$	$11.8$	$1.4$	$0.01$	$77$	$5.9$ / $13.1$	$10.1$	$0.5$
Gemma-4-31B-IT	$92.4$	$6.9$	$0.7$	$0.00$	$79$	$3.1$ / $7.6$	$3.5$	$0.1$

Appendix

Table 33: Per-template breaking outcome (WildGuard test, %). Robust / partial / all broken: TR templates where none, some or all fills give an unsafe answer. Indep.: all-broken share expected if fills broke independently. From partial: share of unsafe answers from partial templates. One fill / all fills: templates broken with the first vs. all fills. Last two columns: partial and all-broken shares for PH.

Model	Originals	Original ASR	Any descendant	Refused $\rightarrow$ broken	Median share
Qwen3.5-27B	$480$	$0.0\%$	$18.3\%$	$18.3\%$	$0.0\%$
GPT-OSS-20B	$467$	$0.4\%$	$26.8\%$	$26.7\%$	$0.0\%$
Olmo-3.1-32B-Instruct	$500$	$2.8\%$	$93.6\%$	$93.4\%$	$10.9\%$
Llama-3.3-70B-Instruct	$496$	$6.7\%$	$87.5\%$	$86.6\%$	$5.8\%$
Gemma-4-31B-IT	$500$	$0.8\%$	$62.8\%$	$62.5\%$	$0.9\%$
Apertus-8B-Instruct-2509	$491$	$4.3\%$	$88.4\%$	$87.9\%$	$10.6\%$

Appendix

Table 34: Per-original view (WildGuard test). Original ASR: the untouched English prompt breaks the model. Any descendant: at least one of its TR templates has a broken fill. Refused

\rightarrow

broken: the same, among originals refused as written. Median share: median fraction of an original’s templates with a broken fill. Originals whose own response was degenerate are excluded.

Category	$n$	Qwen-27B	gpt-oss	Olmo-32B	Llama-70B	gemma-31B	Ap-8B	Ap-70B
Crimes and illegal activities	$188$	$0.3$	$0.9$	$19.1$	$9.3$	$5.6$	$17.0$	$25.9$
Harm and misuse	$70$	$0.1$	$0.4$	$8.7$	$4.7$	$2.7$	$8.7$	$11.2$
(abstained)	$31$	$1.7$	$0.5$	$7.4$	$5.1$	$5.2$	$7.3$	$6.8$
Privacy and property	$27$	$0.0$	$0.3$	$5.4$	$3.5$	$1.7$	$6.8$	$8.2$
Fairness and justice	$49$	$0.0$	$0.1$	$6.4$	$2.9$	$0.9$	$8.4$	$6.7$
Explicit content	$135$	$0.0$	$0.1$	$2.6$	$2.8$	$0.8$	$3.7$	$4.2$

Appendix

Table 35: TR attack success by LinguaSafe top-level category (WildGuard test, %).

n

is the number of test originals in the category.

Category	$n$	Qwen-27B	gpt-oss	Olmo-32B	Llama-70B	gemma-31B	Ap-8B	Ap-70B
Digital crimes	$35$	$0.5$	$1.1$	$29.7$	$8.3$	$7.8$	$14.3$	$31.4$
Sex-related crimes	$51$	$0.5$	$0.6$	$15.7$	$15.2$	$6.2$	$19.7$	$28.1$
Controlled items	$30$	$0.1$	$0.5$	$18.9$	$7.4$	$2.1$	$23.1$	$29.7$
Financial crimes	$45$	$0.3$	$1.6$	$18.4$	$8.6$	$7.0$	$16.1$	$23.6$
Violent crimes	$11$	$0.2$	$0.1$	$21.2$	$5.6$	$5.0$	$18.8$	$24.7$
Code misuse	$9$	$0.1$	$0.5$	$30.0$	$5.9$	$9.7$	$8.5$	$19.5$

Appendix

Table 36: TR attack success by LinguaSafe primary category (WildGuard test, %), sorted by the panel mean.

n

is the number of test originals.

Language	Qwen-27B	gpt-oss	Olmo-32B	Llama-70B	gemma-31B	Ap-8B	Ap-70B	Ap1.5-8B
Albanian	$0.3$	$0.6$	$17.6$	$5.1$	$2.5$	$13.0$	$19.5$	$3.5$
Amharic	$0.9$	$0.9$	$3.9$	$5.0$	$3.7$	$7.8$	$9.0$	$6.7$
Arabic	$0.2$	$0.3$	$11.5$	$10.9$	$3.0$	$9.3$	$7.9$	$1.9$
Bengali	$0.3$	$0.4$	$15.6$	$6.8$	$3.7$	$7.7$	$10.8$	$2.3$
Bulgarian	$0.2$	$0.5$	$11.4$	$6.0$	$3.5$	$11.3$	$20.6$	$2.5$
Chinese	$0.2$	$0.4$	$7.5$	$12.2$	$6.8$	$15.0$	$15.5$	$1.3$

Appendix

Table 37: WildGuard test: per-language translated (TR) attack success (%), main template and paraphrases pooled.

Language	Qwen-27B	gpt-oss	Olmo-32B	Llama-70B	gemma-31B	Ap-8B	Ap-70B	Ap1.5-8B
Albanian	$0.3$	$0.3$	$12.0$	$2.4$	$1.5$	$6.5$	$8.0$	$0.0$
Amharic	$0.0$	$0.0$	$2.5$	$7.9$	$2.1$	$13.0$	$4.5$	$6.9$
Arabic	$0.0$	$0.0$	$10.6$	$7.3$	$0.4$	$5.8$	$3.9$	$0.0$
Bengali	$0.6$	$0.0$	$19.7$	$8.0$	$2.0$	$4.6$	$5.6$	$1.6$
Bulgarian	$0.2$	$0.0$	$9.1$	$3.5$	$1.7$	$8.4$	$12.2$	$0.0$
Chinese	$0.2$	$0.2$	$9.0$	$6.8$	$3.6$	$14.1$	$9.9$	$0.0$

Appendix

Table 38: WildGuard test: per-language post-hoc cultural (PH) attack success (%). English has no PH arm.

Language	Qwen-27B	gpt-oss	Olmo-32B	Llama-70B	gemma-31B	Ap-8B	Ap-70B	Ap1.5-8B
Albanian	$16.5$	$46.4$	$1.4$	$8.2$	$8.0$	$5.8$	$4.0$	$27.3$
Amharic	$17.2$	$25.5$	$0.8$	$0.0$	$7.0$	$10.5$	$5.1$	$0.0$
Arabic	$14.9$	$42.1$	$4.5$	$1.3$	$5.6$	$12.9$	$12.9$	$32.4$
Bengali	$17.9$	$42.3$	$0.5$	$6.8$	$5.9$	$8.4$	$5.0$	$22.7$
Bulgarian	$16.5$	$46.4$	$8.6$	$12.5$	$5.5$	$13.2$	$2.5$	$25.2$
Chinese	$12.1$	$46.1$	$9.2$	$1.6$	$3.9$	$5.4$	$4.1$	$35.8$

Appendix

Table 39: WildGuard test: per-language over-refusal (%), benign direct minimal pairs. Lower is more helpful.

Language	Qwen-27B	gpt-oss	Olmo-32B	Llama-70B	gemma-31B	Ap-8B	Ap-70B
Albanian	$+0.2$	$-0.2$	$+3.7$	$+1.5$	$+0.6$	$+2.6$	$+4.6$
Amharic	$-0.3$	$-0.2$	$+1.4$	$+1.1$	$+0.6$	$+2.7$	$+2.8$
Arabic	$+0.1$	$+0.0$	$+1.2$	$+4.9$	$+0.7$	$+1.7$	$+1.9$
Bengali	$+0.2$	$-0.0$	$+1.9$	$+1.3$	$+0.2$	$-1.3$	$+1.4$
Bulgarian	$-0.2$	$+0.2$	$+2.1$	$+1.1$	$+1.1$	$+3.1$	$+5.7$
Chinese	$-0.0$	$+0.1$	$+0.2$	$-5.1$	$+3.1$	$+4.3$	$+4.1$

Appendix

Table 40: WildGuard test: paraphrase minus main-template ASR per language (percentage points). Positive values mean the paraphrased templates break the model more often.

Model	$n$	PH $>$	PH $<$	$=$	TR	PH	$\Delta$ [95% CI]	$p_{W}$	$p_{S}$
Leading (HarmBench)
Qwen-27B	58	7	51	0	0.3	0.1	$-0.26$ [ $-0.32$ , $-0.19$ ]	$<$ 0.001	$<$ 0.001
gpt-oss	58	13	40	5	0.4	0.3	$-0.11$ [ $-0.22$ , $+0.01$ ]	0.056	$<$ 0.001
Olmo-32B	58	20	38	0	13.7	12.1	$-1.64$ [ $-2.69$ , $-0.57$ ]	0.004	0.025
Llama-70B	58	3	54	1	5.2	2.6	$-2.62$ [ $-3.32$ , $-1.92$ ]	$<$ 0.001	$<$ 0.001
gemma-31B	58	10	47	1	4.2	2.6	$-1.59$ [ $-2.09$ , $-1.04$ ]	$<$ 0.001	$<$ 0.001

Appendix

Table 41: Paired PH vs. TR test across languages.

n

: languages with both arms; PH

>

/ PH

<

=

: languages where PH is above, below or equal to TR.

\Delta

: mean PH minus TR difference (pp) with a 95% bootstrap CI.

p_{W}

: Wilcoxon signed-rank,

p_{S}

: exact sign test, both two-sided and Holm-corrected per panel.

+

MST: MSafeTemp SFT + DPO; –: not available.

Arm	Apertus-8B-IT	Olmo-3.1-32B
Generic fill, native template	$11.2\%$	$14.0\%$
Cultural fill, rephrased	$13.9\%$	$14.4\%$
Cultural fill, template frozen	$13.1\%$	$13.3\%$
shared cells	$511$	$644$

Appendix

Table 42: Cultural fill and rephrasing, separated. Attack success on the shared behavior and language cells, twelve languages. The entity is identical in the last two rows; only the framing differs.

Model	Groups	TR	PH	PH-JB	$\Delta$ (PH-JB $-$ PH), 95% CI
Apertus-8B	199	12.1	8.0	26.1	$+18.0\;[13.8,\,22.1]$
Olmo-3-7B	199	15.6	19.6	17.0	$-2.6\;[-7.1,\,2.0]$
Qwen3.5-9B	200	2.0	0.5	0.45	$-0.05\;[-1.10,\,0.65]$
Llama-3.1-8B	200	11.0	8.0	19.2	$+11.2\;[7.2,\,15.0]$

Appendix

Table 43: Average wrapper effects differ by model. ASR (%) on matched, fully scored groups from both benchmarks. PH-JB is the mean per-attempt ASR across ten wrappers; the final column gives its paired difference from PH in percentage points, with a 95% bootstrap confidence interval.

Model	$k=1$	$k=2$	$k=5$	$k=10$	95% CI at $k=10$
Apertus-8B	27.1	43.2	59.3	64.8	$[57.8,\,70.9]$
Olmo-3-7B	17.1	24.6	39.2	51.8	$[44.7,\,58.8]$
Qwen3.5-9B	1.0	1.5	3.0	4.0	$[1.5,\,7.0]$
Llama-3.1-8B	20.0	32.0	48.5	60.0	$[53.5,\,67.0]$

Appendix

Table 44: More wrapper attempts expose additional failures. Percentage of matched groups with at least one successful PH-JB attempt among the first

k

wrappers. Denominators are the same as in Table 43 . These are observed cumulative success rates, not per-attempt ASRs.

Model	Wrapped harmful ASR $\downarrow$	Wrapped benign OR $\downarrow$
Apertus-8B-2509 (base) + MSafeTemp -SFT	1.6	20.4
+ MSafeTemp -SFT + DPO	0.1	11.7
Apertus-8B-2509 (base) + MSafeTemp -only SFT	0.6	18.0
+ MSafeTemp -only SFT + DPO	0.1	16.8
Apertus-8B-Instruct-2509-SFT (vendor SFT)	26.6	6.8
+ MSafeTemp -SFT	0.8	20.1

Appendix

Table 45: Jailbreak-wrapped HarmBench (HB-JB) across models. ASR on wrapped harmful PH requests and over-refusal on wrapped benign prompts (%, mean over languages,

300

prompts per language). Answers that hit the

8{,}192

-token limit (about

40\%

for Apertus-70B) and empty answers are scored as returned. MSafeTemp -only SFT: safety data without the general instruction data. Darker red is worse within a column; the best value is bold.

HarmBench (200 seed behaviors)
Model	Orig.	TR	PH	OR
Qwen3.5-27B	$0.5$ [ $0.0$ , $1.5$ ]	$0.4$ [ $0.2$ , $0.5$ ]	$0.1$ [ $0.0$ , $0.2$ ]	$3.5$ [ $2.8$ , $4.4$ ]
GPT-OSS-20B	$0.0$ [ $0.0$ , $0.0$ ]	$0.4$ [ $0.4$ , $0.5$ ]	$0.3$ [ $0.1$ , $0.4$ ]	$31.8$ [ $29.0$ , $34.5$ ]
Gemma-4-31B-IT	$6.5$ [ $3.5$ , $10.0$ ]	$4.2$ [ $3.3$ , $5.2$ ]	$2.5$ [ $1.6$ , $3.6$ ]	$3.2$ [ $2.3$ , $4.3$ ]
Olmo-3.1-32B-Instruct	$0.0$ [ $0.0$ , $0.0$ ]	$13.7$ [ $12.2$ , $15.2$ ]	$11.9$ [ $9.8$ , $14.2$ ]	$4.6$ [ $3.7$ , $5.6$ ]
Llama-3.3-70B-Instruct	$13.0$ [ $8.5$ , $18.0$ ]	$5.3$ [ $4.5$ , $6.1$ ]	$2.6$ [ $1.9$ , $3.4$ ]	$7.7$ [ $6.2$ , $9.5$ ]

Appendix

Table 46: Leading-model panel of Table 2 with 95% confidence intervals (%, lower is better). Percentile intervals from a cluster bootstrap over source families (

2{,}000

resamples), recomputing the main-table aggregates (HarmBench pooled, WildGuard per-language mean). † : an arm of this cell has fewer than 30 scored responses.

HarmBench (200 seed behaviors, 60 languages)
Checkpoint	EN ASR	ML ASR	EN OR	ML OR
Apertus-8B-IT ∗	$5.5$ [ $4.0$ , $7.2$ ]	$10.3$ [ $8.6$ , $12.3$ ]	$20.8$ [ $15.4$ , $26.6$ ]	$10.3$ † [ $8.1$ , $12.8$ ]
+ MST-SFT ∗	$2.4$ [ $1.4$ , $3.6$ ]	$3.0$ [ $2.4$ , $3.8$ ]	$10.2$ [ $6.7$ , $14.3$ ]	$13.4$ † [ $10.7$ , $16.6$ ]
+ MST-SFT + DPO ∗	$0.9$ [ $0.4$ , $1.6$ ]	$1.4$ [ $1.0$ , $1.9$ ]	$6.2$ [ $3.3$ , $9.6$ ]	$6.3$ † [ $4.6$ , $8.5$ ]
Apertus-8B (base) ∗	$15.6$ [ $9.5$ , $22.2$ ]	$14.2$ [ $12.3$ , $16.2$ ]	$3.6$ [ $0.0$ , $12.0$ ]	$1.6$ † [ $1.0$ , $2.4$ ]
+ MST-SFT ∗	$3.8$ [ $2.6$ , $5.2$ ]	$3.3$ [ $2.6$ , $4.2$ ]	$9.0$ [ $5.6$ , $12.9$ ]	$13.5$ † [ $10.8$ , $16.5$ ]

Appendix

Table 47: Training checkpoints with 95% confidence intervals (%, lower is better). EN: English arm; ML: mean over all languages (60 HB, 44 WG) as in Table 3 , scored responses only. Percentile intervals from a cluster bootstrap over source families (

2{,}000

resamples). Indented rows add MSafeTemp SFT (and DPO) to the checkpoint above. ∗ : shown in Table 3 . † : an arm of this ML cell has fewer than 30 scored responses.

(a) Agreement with SG
Prompts	Judge	$n$	Agr.	$\kappa$	$\kappa_{w}$	$++$	$+-$	$-+$	$--$
Harmful	LG4	2496	0.71	0.40	0.37	542	592	130	1232
Harmful	L70	2496	0.74	0.46	0.54	523	611	29	1333
Benign	L70	2504	0.95	0.90	0.75	1081	48	80	1295

Appendix

Table 48: Independent-judge check on a stratified 5,000-response subsample from six checkpoints (Apertus-8B and Llama-3.1-8B: IT,

+

SFT,

+

DPO), both tracks and four language tiers. (a) Agreement with GPT-OSS-Safeguard-120B (SG): raw, Cohen’s

\kappa

\kappa_{w}

reweighted to the full grid, and confusion counts (SG sign first). (b)

\kappa

per stratum. (c) Headline deltas (pp), reweighted and pooled including English. LG4: Llama-Guard-4-12B ; L70: Llama-3.3-70B-Instruct . † : sign differs from SG.

Data	Target	SFT rows	Blend	DPO pairs
Harmful	refuse	$91{,}642$	$4.2\%$	$1{,}758$
Culturally localized harmful	refuse	$39{,}168$	$1.8\%$	$354$
Unwrapped harmful	refuse	$20{,}724$	$2.5\%$	$1{,}278$
Jailbreak-wrapped harmful	refuse	$56{,}258$	$2.0\%$	$1{,}698$
Benign direct	answer	$120{,}349$	$5.5\%$	$8{,}462$
Benign bounded	answer	$10{,}713$	$0.5\%$	$830$

Appendix

Table 49: SFT and DPO training data. Blend is the share of the SFT training signal (Megatron blend weight); DPO pairs are all on-policy pairs obtained from the fine-tuned Apertus-8B-Instruct.

		Safety $\downarrow$		OR $\downarrow$	Capability $\uparrow$
Family	Stage	AyaRT	PolyTox	OR-B	IFEval	MMLU	GSM8K	BBH
Apertus	base	12.2	45.9	2.1	$16.6$	$60.1$	$49.9$	$48.8$
	+ MST-SFT	1.4	14.4	15.0	$67.8$	$59.1$	$45.2$	$49.1$
	+ MST-SFT + DPO	0.1	7.1	23.7	$66.9$	$58.9$	$46.9$	$49.6$
	+ MST-only SFT	0.9	3.2	16.7	$46.8$	$52.6$	$44.7$	$50.7$
	+ MST-only SFT + DPO	0.1	1.9	34.8	$39.2$	$47.0$	$43.7$	$50.3$

Appendix

Table 50: Safety, over-refusal and capability by training stage. AyaRT and PolyTox: multilingual safety (lower is safer); OR-Bench: over-refusal on generic benign prompts (lower is better); IFEval, MMLU, GSM8K, BBH: capability (higher is better). In the safety and OR-Bench columns, darker red is worse and the best value is bold. MST-only SFT: MSafeTemp safety data without the general instruction data.

		HarmBench			WildGuard test
Family	Stage	ASR	EN OR	ML OR	ASR	EN OR	ML OR
Apertus	IT	10.3	20.8	10.3	10.5	34.1	12.5
	+ MST-SFT	3.0	10.2	13.4	2.3	9.3	14.2
	+ MST-SFT + DPO	1.4	6.2	6.3	0.5	7.0	8.0
	base + MST-SFT	3.3	9.0	13.5	2.6	8.2	12.7
	base + MST-SFT + DPO	1.5	6.5	7.7	0.5	6.2	5.5

Appendix

Table 51: Multilingual HarmBench (HB) and WildGuard test (WG) results by training stage (%, lower is better). ASR: mean over non-English languages; OR: over-refusal on benign direct minimal pairs in English (EN) and averaged over the other languages (ML). Darker red is worse within a column; the best value is bold. ∗ Fewer than half of the replies are scorable (grey). ‡

10

–

35\%

of the replies are unscorable, so values are less reliable. MST-only SFT: MSafeTemp safety data without the general instruction data.

		XSTest		JBB	FORTRESS	CSE
Family	Stage	OR	ASR	OR	OR	OR
Apertus	base	2.1 ∗	3.4 ∗	0.0 ∗	8.1 ∗	14.6 ∗
	+ MST-SFT	0.4	1.5	14.3	2.0	4.6
	+ MST-SFT + DPO	0.4	0.5	5.0	1.9	1.4
	+ MST-only SFT	0.8	0.5	14.0	6.0	38.7
	+ MST-only SFT + DPO	0.8	0.5	16.0	5.2	2.4

Appendix

Table 52: Additional over-refusal benchmarks by training stage (%, lower is better). XSTest ( Röttger et al., 2024 ) : OR on

250

safe and ASR on

200

unsafe prompts; JBB: OR on

100

benign JailbreakBench behaviors ( Chao et al., 2024 ) ; FORTRESS:

500

benign prompts ( Knight et al., 2025 ) ; CSE:

750

CyberSecEval false-refusal prompts ( Bhatt et al., 2024 ) . All English, judged as HB and WG. Darker red is worse within a column; the best value is bold. ∗ Fewer than half of the replies are scorable (grey). MST-only SFT: MSafeTemp safety data without the general instruction data. § Retrained after the original weights were lost; within one point of the original on HB, WG and HB-JB.

			Resource tier
Family	Stage	EN	HRL	MRL	LRL	Avg
Llama-3.1	base	8.9 ∗	5.6 ∗	2.8 ∗	3.5 ∗	4.0 ∗
	+ MST-only SFT	0.9	0.8	2.3	2.0	1.7
	+ MST-only SFT + DPO	0.0	0.8	1.2	1.7	1.2
	IT	1.6	1.4	4.1	4.3	3.3
	+ MST-SFT	0.3	0.3	1.7	1.6	1.2

Appendix

Table 53: MultiJail attack success by training stage (%, lower is better). MultiJail ( Deng et al., 2024 ) :

315

harmful prompts in English and nine languages in high- (HRL: zh, it, vi), medium- (MRL: ar, ko, th) and low-resource (LRL: bn, sw, jv) tiers; Avg is the non-English mean. Judged by GPT-OSS-Safeguard-120B , so values are not comparable to published MultiJail numbers. MPO and RefusEU are public prior-work checkpoints trained from Llama-3.1-8B-Instruct. Shading, bold, MST-only and § as in Table 52 . ∗ More than half of the replies hit the generation limit (grey).

	TR ASR		PH ASR
Model	Seen	Held-out	Seen	Held-out
Apertus-8B-IT	$10.2\%$	$11.0\%$	$10.5\%$	$13.7\%$
$+$ MSafeTemp	$1.1\%$	$2.3\%$	$0.1\%$	$0.1\%$
Olmo-3-7B-IT	$24.3\%$	$15.1\%$	$30.4\%$	$18.2\%$
$+$ MSafeTemp	$2.8\%$	$3.3\%$	–	–
Llama-3.1-8B-IT	$16.0\%$	$16.0\%$	$14.0\%$	$10.5\%$

Appendix

Table 54: Safety training transfers to unseen languages. Attack success on the 43 trained (Seen) and 16 held-out languages, before and after MSafeTemp fine-tuning (lower is safer). Unweighted means over Tables 55 and 56 , English excluded; PH held-out has 15 languages. –: not available.

Language	Apertus		Olmo		Llama
	IT	$+$ MST	IT	$+$ MST	IT	$+$ MST
Albanian	$10.8$	$1.6$	$17.7$	$2.9$	$13.2$	$2.0$
Amharic	$31.8$	$1.3$	$5.8$	$23.1$	$15.3$	$3.6$
Arabic	$9.1$	$1.0$	$34.6$	$3.5$	$10.3$	$1.7$
Armenian †	$12.2$	$1.1$	$5.4$	$4.3$	$8.3$	$2.3$
Basque †	$13.7$	$1.7$	$15.0$	$4.0$	$29.2$	$1.5$

Appendix

Table 55: Per-language translated (TR) attack success (%), instruction-tuned checkpoints vs. their MSafeTemp counterparts.

\dagger

: held-out language (eval-only).

+

MST is the MSafeTemp SFT + DPO fine-tune. –: not available.

Language	Apertus		Olmo		Llama
	IT	$+$ MST	IT	$+$ MST	IT	$+$ MST
Albanian	$10.7$	$0.6$	$24.1$	–	$11.1$	$0.7$
Amharic	$14.3$	$0.0$	$6.5$	–	$25.0$	$0.0$
Arabic	$7.5$	$0.0$	$44.8$	–	$7.1$	$1.2$
Armenian †	$16.7$	$0.0$	$14.8$	–	$4.7$	$0.0$
Basque †	$22.1$	$0.0$	$13.5$	–	$22.0$	$4.9$

Appendix

Table 56: Per-language post-hoc cultural (PH) attack success (%), instruction-tuned checkpoints vs. their MSafeTemp counterparts.

\dagger

: held-out language (eval-only).

+

MST is the MSafeTemp SFT + DPO fine-tune. –: not available.

Language	Apertus		Olmo		Llama
	IT	$+$ MST	IT	$+$ MST	IT	$+$ MST
English	$20.8$	$6.2$	$10.3$	$10.1$	$6.4$	$5.8$
Albanian	$8.3$	$3.8$	$0.2$	$19.4$	$2.2$	$4.5$
Amharic	$0.0$	$4.3$	$0.6$	$0.0$	$0.0$	$4.5$
Arabic	$12.5$	$3.0$	$2.2$	$17.0$	$8.0$	$6.8$
Armenian †	$8.9$	$4.0$	$1.6$	$0.0$	$12.1$	$0.0$

Appendix

Table 57: Per-language over-refusal (%), benign minimal pairs, instruction-tuned checkpoints vs. their MSafeTemp counterparts. Lower is more helpful.

\dagger

: held-out language.

+

MST is the MSafeTemp SFT + DPO fine-tune. –: not available.

LLM Safety Alignment

Large language model safety alignment trains and evaluates systems to follow human policies while resisting harmful requests and misuse.

See all 347 papers

Multilingual Refusal Alignment for Safer Large Language Models
Apr 24, 2026Aleksandra Krasnodębska, Wojciech Kusa, Aldo LipaniMultilingual Language Model Evaluation LLM Alignment
NASK National Research Institute, Warsaw, Poland · University College London, London, UK
The Illusion of Cross-Lingual Safety in Low-Resource Languages
Aug 11, 2026Abigail Oppong, P Sam Sahil, Tadesse Destaw Belay +12LLM Safety Alignment Low-Resource Language Processing
Makerere University Center for Artificial Intelligence · University of Hamburg · Instituto Politécnico Nacional +9
Multilingual Safety Alignment Via Sparse Weight Editing
Feb 26, 2026Jiaming Liang, Zhaoxin Wang, Handing WangLLM Safety Alignment LLM Safety
School of Artificial Intelligence, Xidian University.

Apr 24, 2026J/K move · Enter open · S save

Multilingual Refusal Alignment for Safer Large Language Models

Aleksandra Krasnodębska, Wojciech Kusa, Aldo Lipani

NASK National Research Institute, Warsaw, Poland · University College London, London, UK

Multilingual Language Model Evaluation LLM Alignment LLM Safety Alignment Cross-Lingual Consistency in Language Models Cross-Lingual Transfer

Open paper AskPDF arXiv

As Large Language Models (LLMs) are deployed globally, ensuring their safety and alignment across multiple languages becomes paramount. However, safety behaviors often vary unpredictably between languages, posing significant challenges for consistent and ethical AI. In this work, we systematically investigate the dynamics of multilingual alignment, exploring whether single-language alignment transfers cross-lingually, how language consistency is preserved during training, and the resulting trade-offs with general knowledge capabilities. We introduce RefusEU, a novel refusal alignment dataset covering 12 European languages, including a dedicated test set for evaluating current state-of-the-art models. Our controlled Direct Preference Optimization (DPO) experiments provide two key insights: aligning models exclusively in English is insufficient to ensure cross-lingual safety, even for the same harm categories, whereas training on multilingual datasets can improve safety without degrading general performance, as measured by the Global MMLU benchmark.

Abstract

LLM Safety Alignment

Explore similar work

Multilingual Refusal Alignment for Safer Large Language Models

The Illusion of Cross-Lingual Safety in Low-Resource Languages

Multilingual Safety Alignment Via Sparse Weight Editing