How I Aligned Your Model: Scaling Up Multilingual Safety Training with Templates

How I Aligned Your Model. Scaling Up Multilingual Safety Training with Templates. By Max Neuwinger and two others, from ETH Zurich. Published on the twenty-ninth of October.

Safety alignment for large language models leans heavily on English, with limited multilingual representation, and low-resource languages are hurt the most. Open training datasets for this tend to be limited in size, or they do not follow harmful topics as they are localized in particular regions, which keeps alignment from reaching beyond a narrow set of cultures. The authors release MSafeTemp, a validated corpus spanning sixty languages, for multilingual safety alignment and for evaluation.

It holds two kinds of material, at massive scale: a refusal corpus and a benign corpus. Both are multilingual, both are filled with culturally authentic entities, and the harmful topics are meant to follow how they are localized in each region. Being validated, it can serve as training data and as a test set.

The corpus comes from a template-based augmentation pipeline. Safe templates are extracted from harmful prompts. Those templates are translated. Then their slots are filled with culturally authentic entities, some harmful and some benign. Because the template is the unit that gets translated and refilled, the pipeline can be scaled up to produce massive corpora.

Two uses are demonstrated. For evaluation, the dataset shows that judging safety only in English gets multilingual safety wrong. For several models, attacks that fail in English succeed once translated, and culturally localized variants expose further failures that translation alone misses. For training, the authors confirm that augmenting safety data through templates gives higher diversity and quality of alignment, and improves safety performance beyond English. The corpus and pipeline are aimed at research on safer models for less-represented cultures.

Two layers of gap show up here. Translation alone already uncovers attacks that an English test would have recorded as failures, and localizing the content uncovers more that translation missed. A model can look safe in English, look a little less safe in translation, and look less safe again once the harmful content is something a person in that region would actually recognise. A corpus that covers sixty languages with culturally authentic entities is built to reach both layers, and the template pipeline behind it is what lets that coverage be produced at scale, for refusal and benign material alike.