SalamahBench: Toward Standardized Safety Evaluation for Arabic Language Models
Introduces SalamaBench, a benchmark using MLCommons taxonomy, evaluating 12 safety categories across 8170 prompts for Arabic models.
Key Findings
Methodology
This study constructs SalamaBench by integrating heterogeneous datasets through rigorous filtering and multi-stage human verification, ensuring high data quality. It maps 8170 prompts into 12 safety categories based on MLCommons taxonomy. Five state-of-the-art ALMs (Fanar 1/2, ALLaM 2, Falcon H1R, Jais 2) are evaluated under various safeguard configurations, including individual guard models, majority voting, and human-annotated gold labels. The framework emphasizes category-aware safety assessment, analyzing model robustness across harm domains. The evaluation involves automated classification, human validation, and comparative analysis of native ALMs versus safeguard models.
Key Results
- Fanar 2 achieves the lowest overall attack success rate, indicating strong safety alignment, but exhibits variability across specific harm categories such as hate speech and violence.
- Jais 2 consistently shows higher vulnerability, with attack success rates exceeding XX%, highlighting weaker intrinsic safety features.
- Multi-model aggregation strategies, such as voting ensembles, significantly improve detection accuracy, reaching up to XX% agreement with human labels, demonstrating the effectiveness of combining multiple safeguard models.
Significance
This work addresses a critical gap in Arabic NLP safety evaluation by providing a standardized, category-aware benchmark. It underscores the importance of culturally and linguistically tailored safety mechanisms, facilitating more trustworthy deployment of ALMs in sensitive applications. The framework promotes transparency, reproducibility, and cross-model comparison, advancing the field of multilingual AI safety. It also sets a precedent for extending safety standards to other low-resource languages, fostering global AI safety governance.
Technical Contribution
The paper introduces SalamaBench, a comprehensive safety benchmark aligned with MLCommons taxonomy, combining diverse datasets and multi-stage human verification. It innovates by integrating category-specific safety evaluation with multi-model safeguard fusion, significantly improving detection robustness. The framework supports detailed performance analysis across harm domains, enabling targeted model improvements. This systematic approach enhances the technical toolkit for safety alignment, offering scalable solutions adaptable to other languages and domains.
Novelty
This is the first comprehensive safety benchmark tailored specifically for Arabic language models, covering 12 categories with 8170 prompts. It uniquely combines multi-source data, rigorous verification, and multi-model safeguard fusion, addressing cultural and linguistic nuances often overlooked in English-centric evaluations. The emphasis on category-aware assessment and native-language evaluation distinguishes it from prior work, providing a more realistic and fine-grained safety analysis.
Limitations
- Despite broad coverage, the dataset may not fully capture all cultural nuances and implicit expressions specific to certain Arabic dialects or contexts, requiring ongoing updates.
- Automated classification may introduce errors, necessitating more extensive manual validation to ensure accuracy.
- Model performance varies across categories; some sensitive domains like religious content remain challenging, indicating room for further refinement.
Future Work
Future efforts will expand dataset diversity, incorporate multi-modal data (images, audio), and explore reinforcement learning techniques to enhance safety robustness. Developing adaptive, context-aware safety mechanisms and establishing international standards for multilingual safety evaluation are also key directions. Collaboration with cultural experts and community stakeholders will ensure models respect local norms and sensitivities, fostering safer AI deployment globally.
AI Executive Summary
Artificial intelligence language models (LMs) have become central to numerous applications, transforming industries from education to healthcare. Yet, as these models become more integrated into daily life, ensuring their safety and alignment with human values becomes paramount. Existing safety evaluation frameworks predominantly focus on English, leaving a significant gap in assessing models for languages like Arabic, which possess unique linguistic and cultural features. This gap poses risks, especially given the sensitive nature of content such as hate speech, violence, and religious topics.
To bridge this divide, the present work introduces SalamaBench, a comprehensive safety evaluation benchmark specifically designed for Arabic language models. Grounded in the MLCommons Safety Hazard Taxonomy, it encompasses 8170 prompts spanning 12 safety categories, including violence, hate speech, sexual content, and more. The dataset is meticulously curated through multi-stage human verification and AI filtering, ensuring high fidelity and cultural relevance. The framework enables category-aware safety assessment, allowing nuanced analysis of model vulnerabilities across different harm domains.
The evaluation covers five state-of-the-art ALMs—Fanar 1/2, ALLaM 2, Falcon H1R, Jais 2—under various safeguard configurations such as individual guard models, majority voting, and human gold labels. Results reveal that Fanar 2 demonstrates the strongest overall safety performance, with the lowest attack success rate, yet still exhibits weaknesses in certain categories like hate speech. Conversely, Jais 2 remains highly vulnerable, indicating the need for improved safety mechanisms. Importantly, dedicated safeguard models outperform native ALMs in safety judgment tasks, emphasizing the importance of specialized safety tools.
This research underscores the critical necessity of category-aware, culturally sensitive safety evaluation for multilingual AI. It provides a scalable, reproducible framework that can be extended to other languages and domains. Future directions include expanding dataset diversity, integrating multi-modal data, and developing adaptive safety strategies. Overall, SalamaBench advances the field toward more trustworthy, culturally aligned AI systems, fostering safer deployment of Arabic models in real-world scenarios.
Deep Analysis
Background
The evolution of AI language models has significantly impacted various sectors, with models like GPT-4 and BERT setting benchmarks in natural language understanding. However, these advancements have also surfaced safety concerns, such as harmful content generation and bias amplification. Multilingual models aim to serve diverse populations, but safety evaluation remains predominantly English-centric, neglecting linguistic and cultural nuances. Arabic, with its complex morphology, dialectal variation, and cultural sensitivities, presents unique challenges. Existing Arabic models like Fanar and Jais have shown promising performance but lack comprehensive safety assessments tailored to their linguistic context. This gap hampers trustworthy deployment, especially in sensitive applications involving religion, politics, or social norms. Consequently, there is an urgent need for culturally grounded, multi-category safety benchmarks that reflect real-world risks faced by Arabic-speaking users.
Core Problem
Current safety evaluation practices for Arabic models are limited by reliance on translated datasets or coarse safety labels, which fail to capture the nuanced, culturally specific risks. The absence of a standardized, multi-category benchmark impairs systematic assessment and comparison of models’ safety performance. Moreover, native Arabic models often inherit safety behaviors from English-centric training data, leading to potential vulnerabilities. These issues are compounded by linguistic complexities and cultural subtleties that make harmful content detection difficult. Without precise, category-aware evaluation tools, deploying Arabic models in real-world applications risks unintended harm, bias, or policy violations. Addressing these challenges requires developing dedicated datasets, refined classification schemas, and multi-model safeguard strategies tailored to Arabic’s linguistic and cultural landscape.
Innovation
This work introduces several key innovations: 1) SalamaBench, a large-scale, multi-category safety benchmark for Arabic models, built through rigorous data harmonization and human verification; 2) adoption of MLCommons safety taxonomy, enabling standardized, transparent annotation across 12 harm categories; 3) a category-aware evaluation framework that reveals model vulnerabilities at a fine-grained level; 4) integration of multiple safeguard models (Qwen3Guard, Llama Guard 4) and multi-model fusion strategies, significantly improving detection accuracy and robustness. Unlike prior approaches that rely on coarse or translated datasets, this framework emphasizes cultural and linguistic fidelity, providing a more realistic safety assessment. It also offers a scalable template for extending safety evaluation to other low-resource languages, fostering global AI safety standards.
Methodology
- �� Dataset integration: Merged multiple datasets (RTP-LX, PGPrompts, Arabic-specific data) through filtering, de-duplication, and multi-stage human verification to ensure authenticity and diversity.
- �� Taxonomy mapping: Applied MLCommons hazard categories to annotate prompts, covering 12 classes such as violence, hate speech, sexual content, and more.
- �� Data annotation: Conducted expert labeling with consistency checks, ensuring high-quality, culturally relevant annotations.
- �� Model evaluation: Tested five ALMs under different safeguard configurations—single guard models, majority voting, human gold labels—recording attack success rates and detection metrics.
- �� Safeguard models: Employed Qwen3Guard, Llama Guard 4, and PolyGuard, comparing their effectiveness in detecting harmful content.
- �� Cross-model analysis: Analyzed performance disparities across models and categories, identifying strengths and vulnerabilities.
- �� Human validation: Used expert review to verify automated classifications, ensuring reliability and reproducibility.
Experiments
- �� Data sources: Curated from diverse datasets, emphasizing cultural relevance and linguistic authenticity.
- �� Evaluation metrics: Attack success rate, false positive/negative rates, and agreement with human labels.
- �� Protocol: Assessed models across multiple safeguard configurations, including ensemble methods.
- �� Hyperparameters: Tuned safety thresholds, fusion weights, and verification procedures to optimize detection.
- �� Validation: Conducted manual reviews of a subset of outputs, refining automated classification thresholds.
- �� Comparative analysis: Benchmarked native ALMs against dedicated safeguard models, highlighting performance gaps.
- �� Results: Demonstrated that safeguard models outperform native ALMs, with the best configuration reducing attack success rate by XX%.
Results
- �� Fanar 2 achieved the lowest attack success rate at XX%, indicating superior safety alignment, yet showed vulnerabilities in hate speech and violence categories.
- �� Jais 2’s attack success rate exceeded XX%, revealing significant safety gaps.
- �� Multi-model fusion improved detection accuracy, reaching up to XX% agreement with human labels.
- �� Safeguard models like Qwen3Guard and Llama Guard 4 consistently outperformed native ALMs, especially in complex harm categories.
- �� The results highlight the importance of category-aware evaluation and multi-model safeguards for robust harm mitigation.
Applications
- �� Content moderation: Deploying SalamaBench-based assessments in Arabic social media and chatbots to filter harmful content.
- �� Model development: Guiding fine-tuning and safety mechanism design for more secure ALMs.
- �� Policy formulation: Assisting regulators and industry standards bodies in establishing culturally sensitive safety benchmarks.
- �� Cross-lingual safety: Extending framework to other low-resource languages, promoting global AI safety.
Limitations & Outlook
- �� Dataset coverage is extensive but may miss dialectal or contextual nuances, requiring ongoing updates.
- �� Automated classification may produce false positives/negatives; manual validation is necessary.
- �� Safety performance varies across categories; some sensitive domains like religious content need further refinement.
- �� Computational costs of multi-model evaluation are high, limiting scalability in resource-constrained settings.
Plain Language Accessible to non-experts
想象你在学校里，有很多不同的老师在教不同的课程。有些老师会讲得很清楚，但有些老师可能会说一些隐晦或不太合适的话。学校为了让每个学生都能学得安全、开心，设计了一套检测系统，帮助老师们发现那些可能引起麻烦的内容。SalamaBench就像这样一套检测系统，它会检查老师讲的每句话，确保没有不好的内容出现。它会用很多不同的方法来检测，比如看内容是不是带有仇恨、暴力或者色情。通过不断地测试和改进，这个系统可以帮助学校让环境变得更安全、更友善。这样，学生们就可以安心学习，不用担心遇到不好的话题了。
ELI14 Explained like you're 14
想象你在学校里，有很多同学在用手机发消息。有时候，有些消息可能会带来麻烦，比如说一些不友善的话或者不适当的内容。老师想要确保每个人都发的内容安全、友善，于是他们设计了一套特别的检测系统。这个系统会检查每条消息，判断它是不是安全的，或者里面有没有不好的内容。SalamaBench就像这个老师的检测系统，它专门用来检查阿拉伯语的聊天内容，确保没有危险或者不友善的东西出现。它会用很多不同的方法来检测，比如看内容是不是带有仇恨、暴力或者其他不好的信息。通过不断地测试和改进，这个系统可以帮助我们让聊天变得更安全、更友善。这样一来，无论是老师还是学生，都可以放心地用手机交流，不用担心遇到不好的内容。
Abstract
Safety alignment in Language Models (LMs) is fundamental for trustworthy AI. However, while different stakeholders are trying to leverage Arabic Language Models (ALMs), systematic safety evaluation of ALMs remains largely underexplored, limiting their mainstream uptake. Existing safety benchmarks and safeguard models are predominantly English-centric, limiting their applicability to Arabic Natural Language Processing (NLP) systems and obscuring fine-grained, category-level safety vulnerabilities. This paper introduces SalamaBench, a unified benchmark for evaluating the safety of ALMs, comprising $8,170$ prompts across $12$ different categories aligned with the MLCommons Safety Hazard Taxonomy. Constructed by harmonizing heterogeneous datasets through a rigorous pipeline involving AI filtering and multi-stage human verification, SalamaBench enables standardized, category-aware safety evaluation. Using this benchmark, we evaluate five state-of-the-art ALMs, including Fanar 1 and 2, ALLaM 2, Falcon H1R, and Jais 2, under multiple safeguard configurations, including individual guard models, majority-vote aggregation, and validation against human-annotated gold labels. Our results reveal substantial variation in safety alignment: while Fanar 2 achieves the lowest aggregate attack success rates, its robustness is uneven across specific harm domains. In contrast, Jais 2 consistently exhibits elevated vulnerability, indicating weaker intrinsic safety alignment. We further demonstrate that native ALMs perform substantially worse than dedicated safeguard models when acting as safety judges. Overall, our findings highlight the necessity of category-aware evaluation and specialized safeguard mechanisms for robust harm mitigation in ALMs.