Elamur Research⌕
☰
home / papers / 2025 / Arabic Dataset for LLM Safeguard Evaluation

Arabic Dataset for LLM Safeguard Evaluation

Paper · 2025 · Yasser Ashraf, Yuxia Wang, Bin Gu et al.

Summary

Most safety benchmarks for large language models are built for English, with some extensions to Chinese. Arabic, with its cultural and political sensitivities, has had little coverage. The authors build an Arabic safety benchmark in two steps. First, they adapt the general-risk portion of the Chinese CDNA dataset: questions were translated from Chinese to English to Arabic by native speakers, and Chinese-specific names, places, organizations and events were replaced with Arab-world equivalents. Second, they write new questions about Arab-region sensitive topics and turn each into an indirect attack and a harmless question that contains sensitive words. The final set has 5,799 questions, with new harm types and evaluation prompts for regional risks. Responses are judged twice, once from a governmental standpoint and once from an opposition standpoint, because the same answer can be harmful under one view and benign under the other. Tests on five Arabic-centric and multilingual LLMs show large differences in safety behaviour, with Llama3 among the weaker models. The authors argue that safeguards need culturally specific evaluation.

Key points

  • The dataset has 5,799 Arabic questions. 2,726 come from localizing non-China-specific CDNA items, and 1,024 hand-written Arab-specific direct attacks were expanded into indirect and harmless-with-sensitive-words variants, adding over 3,000 region-specific questions.
  • The resource builds on Do-Not-Answer and its Chinese extension CDNA. It keeps their risk taxonomy (misinformation, malicious uses, discrimination/toxicity, information hazards, etc.) and adds region-specific harm types.
  • About 29k responses were collected from five LLMs and scored automatically with GPT-4o as the judge, under both the governmental and the opposition perspective.
  • To check the judge, the authors took 300 sampled questions in English, Arabic and Chinese and compared GPT-4o with human labels. On Arabic, GPT-4o reached 74.2% recall and 63.0% F1, against 22.6% recall and 33.3% F1 for GPT-4. Its precision was lower, especially on Chinese (12.0%).
  • Data and code are released at github.com/mbzuai-nlp/Arabic_safety_evaluation.

Interesting ideas

  • I1. Entities can be localized while the question skeleton stays fixed: swap culture-bound names, places, organizations and events for local counterparts so the test keeps its intent but fits a new setting.
  • I2. Each seed question gets three variants: a direct attack, an indirect attack, and a harmless question that reuses the "dangerous" words. The harmless variant exposes systems that react to keywords instead of meaning.
  • I3. The same output is judged under two explicit stances, which makes disagreement measurable instead of hiding it inside one label.
  • I4. An LLM judge is calibrated against a small human-labelled sample in each language, using precision and recall, and the preferred error type (here, missing as few unsafe cases as possible) is chosen deliberately.

For Mova

How these ideas could serve Mova, our small open language model — its files, stages and tests:

  • I1 (learn): Entity-swapped copies of test items could act as negative controls that catch readers depending on memorized names rather than on the structure of the text.
  • I2 (answer): Triplets of test questions with shared surface vocabulary but different meaning would show whether answers come from the UD tree and frames rather than from word overlap.
  • I3 (frames): Implicature and irony judgments could carry an explicit perspective parameter, so one utterance can receive different, separately explainable readings for different hearers.
  • I4 (learn): Each LLM teacher tier could be scored against a small human-checked slice per task before its silver labels are trusted, with a stated choice of which error type is cheaper.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓The University of MelbourneMelbourne · Australia100 works · 22,618 citations

 Fields, topics and concepts

📚 Shelves 6The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksArts and Humanities · 16,039 worksLanguage and Linguistics · 15,891 worksSocial Sciences · 1,772 worksSafety Research · 543 works

🧭 Topics 4Research subjects and languages the work is about.Language models & pretraining · 3,320 worksSemitic languages · 2,908 worksEvaluation & benchmarks · 1,220 worksBias, fairness & safety · 517 works

Cite

Cite as Yasser Ashraf, Yuxia Wang, Bin Gu, Preslav Nakov and Timothy Baldwin. 2025. Arabic Dataset for LLM Safeguard Evaluation. Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2025.naacl-long.285

@inproceedings{ashraf2025arabic,
  title = {{Arabic Dataset for LLM Safeguard Evaluation}},
  author = {Yasser Ashraf, Yuxia Wang, Bin Gu, Preslav Nakov and Timothy Baldwin},
  booktitle = {Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers)},
  year = {2025},
  doi = {10.18653/v1/2025.naacl-long.285},
  url = {https://doi.org/10.18653/v1/2025.naacl-long.285}
}

References

26 references, 15 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Ahmed Abdelali, Hamdy Mubarak, Shammur Chowdhury, Maram Hasanain, Basel Mousi, Sabri Boughorbel, Samir Abdaljalil, Yassine El Kheir, Daniel Izham, Fahim Dalvi, et al. 2024. Larabench: Benchmarking arabic ai with large language models. In Proceedings of the 18th Conference of the European Chapter of the Association for Computational Linguistics (Volume 1: Long Papers), pages 487–520. ↗
  2. ActiveFence. 2023. Llm safety review: Benchmarks and analysis. AI@Meta. 2024. Llama 3 model card. https://github.com/meta-llama/llama3/ blob/main/MODEL_CARD.md. ↗
  3. Emad A Alghamdi, Reem I Masoud, Deema Alnuhait, Afnan Y Alomairi, Ahmed Ashraf, and Mohamed Zaytoon. 2024. Aratrust: An evaluation of trustworthiness for llms in arabic. arXiv preprint arXiv:2403.09017. ↗
  4. Ebtesam Almazrouei, Ruxandra Cojocaru, Michele Baldo, Quentin Malartic, Hamza Alobeidli, Daniele Mazzotta, Guilherme Penedo, Giulia Campesan, Mugariya Farooq, Maitha Alhammadi, et al. 2023. Alghafa evaluation benchmark for arabic language models. In Proceedings of ArabicNLP 2023, pages 244– 275.
  5. Ali Alshehri, El Moatez Billah Nagoudi, and Muhammad Abdul-Mageed. 2020. Understanding and detecting dangerous speech in social media. In Proceedings of the 4th Workshop on Open-Source Arabic Corpora and Processing Tools, with a Shared Task on Offensive Language Detection, pages 40–47, Marseille, France. European Language Resource Association. ↗
  6. Imene Bensalem, Paolo Rosso, and Hanane Zitouni. 2024. Toxic language detection: A systematic review of arabic datasets. Expert Systems, page e13551. ↗
  7. Rishabh Bhardwaj and Soujanya Poria. 2023. Red-teaming large language models using chain of utterances for safety-alignment. ArXiv, abs/2308.09662. ↗
  8. Sabri Boughorbel and Majd Hawasly. 2023. Analyzing multilingual competency of LLMs in multi-turn instruction following: A case study of Arabic. In Proceedings of ArabicNLP 2023, pages 128–139, Singapore (Hybrid). Association for Computational Linguistics.
  9. Adrian de Wynter, Ishaan Watts, Tua Wongsangaroonsri, Minghui Zhang, Noura Farra, Nektar Ege Altıntoprak, Lena Baur, Samantha Claudet, Pavel Gajdusek, Can Gören, Qilong Gu, Anna Kaminska, Tomasz Kaminski, Ruby Kuo, Akiko Kyuba, Jongho Lee, Kartik Mathur, Petter Merok, Ivana Milovanović, Nani Paananen, Vesa-Matti Paananen, Anna Pavlenko, Bruno Pereira Vidal, Luciano Strika, Yueh Tsao, Davide Turcato, Oleksandr Vakhno, Judit Velcsov, Anna Vickers, Stéphanie Visser, Herdyan Widarmanto, Andrey Zaikin, and Si-Qing Chen. 2024. Rtp-lx: Can llms evaluate toxicity in multilingual scenarios? find
  10. AbdelRahim Elmadany, ElMoatez Billah Nagoudi, and Muhammad Abdul-Mageed. 2023. ORCA: A challenging benchmark for Arabic language understanding. In Findings of the Association for Computational Linguistics: ACL 2023, pages 9559–9586, Toronto, Canada. Association for Computational Linguistics.
  11. Bilal Ghanem, Jihen Karoui, Farah Benamara, Véronique Moriceau, and Paolo Rosso. 2019. Idat at fire2019: Overview of the track on irony detection in arabic tweets. In Proceedings of the 11th Annual Meeting of the Forum for Information Retrieval Evaluation, pages 10–13. find
  12. Huang Huang, Fei Yu, Jianqing Zhu, Xuening Sun, Hao Cheng, Song Dingjie, Zhihong Chen, Mosen Alharthi, Bang An, Juncai He, Ziche Liu, Junying Chen, Jianquan Li, Benyou Wang, Lian Zhang, Ruoyu Sun, Xiang Wan, Haizhou Li, and Jinchao Xu. 2024. AceGPT, localizing large language models in Arabic. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pages 8139–8163, Mexico City, Mexico. Association for Computational Linguistics. ↗
  13. Devansh Jain, Priyanshu Kumar, Samuel Gehman, Xuhui Zhou, Thomas Hartvigsen, and Maarten Sap. 2024. Polyglotoxicityprompts: Multilingual evaluation of neural toxic degeneration in large language models. ↗
  14. George Kour, Marcel Zalmanovici, Naama Zwerdling, Esther Goldbraich, Ora Fandina, Ateret Anaby Tavor, Orna Raz, and Eitan Farchi. 2023. Unveiling safety vulnerabilities of large language models. In Proceedings of the Third Workshop on Natural Language Generation, Evaluation, and Metrics (GEM), pages 111–127, Singapore. Association for Computational Linguistics. ↗
  15. Lizhi Lin, Honglin Mu, Zenan Zhai, Minghan Wang, Yuxia Wang, Renxi Wang, Junjie Gao, Yixuan Zhang, Wanxiang Che, Timothy Baldwin, Xudong Han, and Haonan Li. 2024. Against the achilles’ heel: A survey on red teaming for generative models. CoRR, abs/2404.00629. ↗
  16. Hamdy Mubarak, Kareem Darwish, and Walid Magdy. 2017. Abusive language detection on arabic social media. In Proceedings of the first workshop on abusive language online, pages 52–56.
  17. Hamdy Mubarak, Sabit Hassan, and Ahmed Abdelali. 2021. Adult content detection on arabic twitter: Analysis and experiments. In Proceedings of the Sixth Arabic Natural Language Processing Workshop, pages 136–144. find
  18. Hamdy Mubarak, Sabit Hassan, and Shammur Absar Chowdhury. 2023. Emojis as anchors to detect arabic offensive language and hate speech. Natural Language Engineering, 29(6):1436–1457. ↗
  19. OpenAI. 2024. Gpt-4o. index/hello-gpt-4o/. https://openai.com/ ↗
  20. Haitham Seelawi, Ibraheem Tuffaha, Mahmoud Gzawi, Wael Farhan, Bashar Talafha, Riham Badawi, Zyad Sober, Oday Al-Dweik, Abed Alhakim Freihat, and Hussein Al-Natsheh. 2021. Alue: Arabic language understanding evaluation. In Proceedings of the Sixth Arabic Natural Language Processing Workshop, pages 173–184.
  21. Neha Sengupta, Sunil Kumar Sahu, Bokang Jia, Satheesh Katipomu, Haonan Li, Fajri Koto, Osama Mohammed Afzal, Samta Kamboj, Onkar Pandit, Rahul Pal, et al. 2023. Jais and jais-chat: Arabic-centric foundation and instruction-tuned open generative large language models. arXiv preprint arXiv:2308.16149. ↗
  22. Lingfeng Shen, Weiting Tan, Sihao Chen, Yunmo Chen, Jingyu Zhang, Haoran Xu, Boyuan Zheng, Philipp Koehn, and Daniel Khashabi. 2024. The language barrier: Dissecting safety challenges of LLMs in multilingual contexts. In Findings of the Association for Computational Linguistics ACL 2024, pages 2668–2680, Bangkok, Thailand and virtual meeting. Association for Computational Linguistics.
  23. Yuxia Wang, Haonan Li, Xudong Han, Preslav Nakov, and Timothy Baldwin. 2024a. Do-not-answer: Evaluating safeguards in LLMs. In Findings of the Association for Computational Linguistics: EACL 2024, pages 896–911, St. Julian’s, Malta. Association for Computational Linguistics.
  24. Yuxia Wang, Zenan Zhai, Haonan Li, Xudong Han, Shom Lin, Zhenxuan Zhang, Angela Zhao, Preslav Nakov, and Timothy Baldwin. 2024b. A Chinese dataset for evaluating the safeguards in large language models. In Findings of the Association for Computational Linguistics ACL 2024, pages 3106– 3119, Bangkok, Thailand and virtual meeting. Association for Computational Linguistics. find
  25. An Yang, Baosong Yang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Zhou, Chengpeng Li, Chengyuan Li, Dayiheng Liu, Fei Huang, Guanting Dong, Haoran Wei, Huan Lin, Jialong Tang, Jialin Wang, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Ma, Jianxin Yang, Jin Xu, Jingren Zhou, Jinze Bai, Jinzheng He, Junyang Lin, Kai Dang, Keming Lu, Keqin Chen, Kexin Yang, Mei Li, Mingfeng Xue, Na Ni, Pei Zhang, Peng Wang, Ru Peng, Rui Men, Ruize Gao, Runji Lin, Shijie Wang, Shuai Bai, Sinan Tan, Tianhang Zhu, Tianhao Li, Tianyu Liu, Wenbin Ge, Xiaodong Deng, Xiaohuan Zhou, Xingzhang Ren, Xinyu Zhang, Xipin Wei, Xuancheng Ren, Xuejing Liu, Yang Fan, Yang Yao, Yichang Zhang, Yu Wan, Yunfei Chu, Yuqiong Liu, Zeyu Cui, Zhenru Zhang, Zhifang Guo, and Zhihao Fan. 2024. Qwen2 technical report. ↗
  26. Zheng-Xin Yong, Cristina Menghini, and Stephen H Bach. 2023. Low-resource languages jailbreak gpt-4. arXiv preprint arXiv:2310.02446. ↗

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/ashraf-2025-arabic-dataset-llm-safeguard-evaluation/