Elamur Research⌕
☰
home / papers / 2026 / FanarGuard: A Culturally-Aware Moderation Filter for Arabic Language Models

FanarGuard: A Culturally-Aware Moderation Filter for Arabic Language Models

Paper · 2026 · Masoomali Fatehkia, Enes Altinisik and Husrev Taha Sencar

Summary

Most moderation filters for language models only check general harm, mostly in English, and ignore whether an answer fits local cultural norms. FanarGuard is a bilingual (Arabic/English) filter that rates each prompt–response pair on two continuous axes: harmlessness and cultural alignment with norms widely held in Arab societies. The cultural topics were taken from responses that users of the Fanar chat interface flagged as misaligned, then widened for coverage. Training data has over 468K pairs. Culture-sensitive examples were generated synthetically by LLMs, and safety examples came from public datasets translated into Arabic. A panel of LLM judges scored all pairs using rubrics. The authors trained a RoBERTa-large regressor and fine-tuned Gemma decoders, and also released the first human-annotated benchmark of Arabic cultural norms. On that benchmark the best model's error relative to human raters is no larger than the raters' disagreement with each other. On safety benchmarks it nearly matches 7B filters despite being much smaller. The work shows that a small, task-specific moderator can capture value-laden judgments better than prompting general LLMs as judges.

Key points

  • Variants: FanarGuard-R (0.4B, bilingual RoBERTa-large), FanarGuard-G-2b and FanarGuard-G-4b (Gemma-based). Each is trained as a two-dimensional regression model.
  • Cultural benchmark: 1,448 question–answer pairs from 1,008 unique, mostly human-written questions, each rated by three human annotators. It is released on Hugging Face (QCRI/fanarguard), and the filter is available through the Fanar API.
  • Agreement with the annotators' average:
    • FanarGuard-G-4b: MAE 0.79, MSE 1.12, ICC 0.54.
    • Inter-annotator: MAE 0.80, ICC 0.64.
    • Prompted LLM judges: MAE 0.91, ICC 0.38.
    • FanarGuard-R lags behind the judges.
  • English safety benchmarks: FanarGuard-G-2b reaches an average F1 of 0.84, against WildGuard at 0.86 and MD-Judge at 0.85, both 7B models. FanarGuard-R reaches 0.83.
  • Arabic-translated safety benchmarks: FanarGuard reaches about 0.82, against PolyGuard-Ministral at 0.83. FanarGuard-R beats the similar-sized PolyGuard variant by over 10 F1 points.

Interesting ideas

  • I1. The filter predicts graded scores rather than allow/deny labels, and a decision threshold is chosen afterwards (here, the one maximizing F1 on training data), so users can tune strictness per deployment.
  • I2. Each sample is scored in only one language, and the resulting label is copied to its translated twin, which halves judging cost while giving parallel bilingual supervision.
  • I3. Human agreement is measured by comparing each annotator with the mean of the others, and this level is treated as the realistic ceiling for model error.
  • I4. The category taxonomy was built bottom-up from real user complaints in production logs, then expanded, rather than drafted in advance.
  • I5. The prompt and the response are judged as a pair, because a risky prompt can still receive an appropriate reply such as a refusal.

For Mova

How these ideas could serve Mova, our small open language model — its files, stages and tests:

  • I1 (answer): Readers could output a graded confidence for each answer and let each test suite set its own cutoff, instead of baking a hard yes/no into the reader.
  • I2 (learn): A silver label agreed on an English sentence could be projected onto paraphrases or translated variants, multiplying training data without new witness runs.
  • I3 (learn): Leave-one-witness-out agreement among parsers or LLM teachers would show when a student parser is already "as good as the witnesses" and further gains are noise.
  • I4 (world): Ontology or frame gaps could be prioritized by clustering the questions Mova actually got wrong, then generalizing those clusters into new knowledge categories.
  • I5 (frames): Speech-act and implicature analysis should evaluate an utterance relative to the one it answers, not in isolation, so a refusal or a correction gets its proper reading.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓Hamad bin Khalifa UniversityDoha · Qatar144 works · 14,175 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 worksSocial Sciences · 1,954 worksSafety Research · 626 works

🧭 Topics 2Research subjects and languages the work is about.Language models & pretraining · 3,894 worksSemitic languages · 3,066 works

Cite

Cite as Masoomali Fatehkia, Enes Altinisik and Husrev Taha Sencar. 2026. FanarGuard: A Culturally-Aware Moderation Filter for Arabic Language Models. Proceedings of the 19th Conference of the European Chapter of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.eacl-long.368

@inproceedings{fatehkia2026fanarguard,
  title = {{FanarGuard: A Culturally-Aware Moderation Filter for Arabic Language Models}},
  author = {Masoomali Fatehkia, Enes Altinisik and Husrev Taha Sencar},
  booktitle = {Proceedings of the 19th Conference of the European Chapter of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.eacl-long.368},
  url = {https://doi.org/10.18653/v1/2026.eacl-long.368}
}

References

46 references, 30 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Our filter operates at the prompt–response level and does not explicitly model multi-turn dialogue contexts. However, this single-turn setting remains the dominant paradigm in existing safety filters, including state-of-the-art systems such as Wild-Guard (Han et al., 2024), which achieve strong performance despite being trained on single-turn nguyenthanhdo/safety_en_100k · datasets at hugging face. find
  2. Muhammad Farid Adilazuarda, Sagnik Mukherjee, Pradhyumna Lavania, Siddhant Shivdutt Singh, Alham Fikri Aji, Jacki O’Neill, Ashutosh Modi, and Monojit Choudhury. 2024. Towards measuring and modeling “culture” in llms: A survey. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 15763–15784, Miami, Florida, USA. Association for Computational Linguistics. ↗
  3. Yazeed Alnumay, Alexandre Barbet, Anna Bialas, William Darling, Shaan Desai, Joan Devassy, Kyle Duffy, Stephanie Howe, Olivia Lasche, Justin Lee, Anirudh Shrinivason, and Jennifer Tracey. 2025. Command r7b arabic: A small, enterprise focused, multilingual, and culturally aware arabic llm. Preprint, arXiv:2503.14603. ↗
  4. Fakhraddin Alwajih, Abdellah EL MEKKI, Samar Mohamed Magdy, AbdelRahim Abdalla, and 1 others. 2025. Palm: A culturally inclusive and linguistically diverse dataset for arabic llms. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (ACL 2025), pages 12345–12356.
  5. Maksym Andriushchenko, Francesco Croce, and Nicolas Flammarion. 2024. Jailbreaking leading safety-aligned llms with simple adaptive attacks. arXiv preprint arXiv:2404.02151. ↗
  6. Yasser Ashraf, Yuxia Wang, Bin Gu, Preslav Nakov, and Timothy Baldwin. 2024. Arabic dataset for llm safeguard evaluation. arXiv preprint arXiv:2410.17040. ↗
  7. Amanda Askell, Yuntao Bai, Anna Chen, Dawn Drain, Deep Ganguli, Tom Henighan, Andy Jones, Nicholas Joseph, Ben Mann, Nova DasSarma, and 1 others. 2021. A general language assistant as a laboratory for alignment. arXiv preprint arXiv:2112.00861. ↗
  8. Mohammad Gheshlaghi Azar, Mark Rowland, Bilal Piot, Daniel Guo, Daniele Calandriello, Michal Valko, and Rémi Munos. 2023. A general theoretical paradigm to understand learning from human preferences. arXiv e-prints, arXiv:2310.12036. ↗
  9. M Saiful Bari, Yazeed Alnumay, Norah A Alzahrani, Nouf M Alotaibi, Hisham A Alyahya, Sultan Al-Rashed, Faisal A Mirza, Shaykhah Z Alsubaie, Hassan A Alahmed, Ghadah Alabduljabbar, and 1 others. 2024. Allam: Large language models for arabic and english. arXiv preprint arXiv:2407.15390. ↗
  10. Aman Bhargava, Cameron Witkowski, Shi-Zhuo Looi, and Matt Thomson. 2023. What’s the magic word? a control theory of llm prompting. arXiv preprint arXiv:2310.04444. ↗
  11. Federico Bianchi, Mirac Suzgun, Giuseppe Attanasio, Paul Rottger, Dan Jurafsky, Tatsunori Hashimoto, and James Zou. 2024. Safety-tuned LLaMAs: Lessons from improving the safety of large language models that follow instructions. In ICLR. ↗
  12. Clarifai. Llamaguard: Prompt moderation workflow. https://clarifai.com/ clarifai/text-moderation/workflows/ llamaGuard-prompt-moderation. Accessed: 2025-05-09. ↗
  13. Ning Ding, Yulin Chen, Bokai Xu, Yujia Qin, Zhi Zheng, Shengding Hu, Zhiyuan Liu, Maosong Sun, and Bowen Zhou. 2023. Enhancing chat language models by scaling high-quality instructional conversations. ↗
  14. Deep Ganguli, Liane Lovitt, Jackson Kernion, Amanda Askell, Yuntao Bai, Saurav Kadavath, Ben Mann, Ethan Perez, Nicholas Schiefer, Kamal Ndousse, and 1 others. 2022. Red teaming language models to reduce harms: Methods, scaling behaviors, and lessons learned. arXiv preprint arXiv:2209.07858. ↗
  15. Seungju Han, Kavel Rao, Allyson Ettinger, Liwei Jiang, Bill Yuchen Lin, Nathan Lambert, Yejin Choi, and Nouha Dziri. 2024. Wildguard: Open one-stop moderation tools for safety risks, jailbreaks, and refusals of llms. arXiv preprint arXiv:2406.18495. ↗
  16. Dan Hendrycks, Collin Burns, Steven Basart, Andrew Critch, Jerry Li, Dawn Song, and Jacob Steinhardt. 2020. Aligning ai with shared human values. arXiv preprint arXiv:2008.02275. ↗
  17. Huang Huang, Fei Yu, Jianqing Zhu, Xuening Sun, Hao Cheng, Dingjie Song, Zhihong Chen, Abdulmohsen Alharthi, Bang An, Juncai He, and 1 others. 2023. Acegpt, localizing large language models in arabic. arXiv preprint arXiv:2309.12053. ↗
  18. Hamish Ivison, Yizhong Wang, Valentina Pyatkin, Nathan Lambert, Matthew Peters, Pradeep Dasigi, Joel Jang, David Wadden, Noah A Smith, Iz Beltagy, and 1 others. 2023. Camels in a changing climate: Enhancing lm adaptation with tulu 2. arXiv preprint arXiv:2311.10702. ↗
  19. Jiaming Ji, Donghai Hong, Borong Zhang, Boyuan Chen, Josef Dai, Boren Zheng, Tianyi Qiu, Boxun Li, and Yaodong Yang. 2024. Pku-saferlhf: Towards multi-level safety alignment for llms with human preference. arXiv preprint arXiv:2406.15513. ↗
  20. Jiaming Ji, Mickel Liu, Juntao Dai, Xuehai Pan, and 1 others. 2023. Beavertails: Towards improved safety alignment of LLM via a human-preference dataset. In Thirty-seventh Conference on Neural Information Processing Systems Datasets and Benchmarks Track.
  21. Priyanshu Kumar, Devansh Jain, Akhila Yerukola, Liwei Jiang, Himanshu Beniwal, Thomas Hartvigsen, and Maarten Sap. 2025. Polyguard: A multilingual safety moderation tool for 17 languages. arXiv preprint arXiv:2504.04377. ↗
  22. Lijun Li, Bowen Dong, Ruohui Wang, Xuhao Hu, Wangmeng Zuo, Dahua Lin, Yu Qiao, and Jing Shao. 2024. Salad-bench: A hierarchical and comprehensive safety benchmark for large language models. arXiv preprint arXiv:2402.05044. ↗
  23. Chen Cecilia Liu, Iryna Gurevych, and Anna Korhonen. 2025. Culturally aware and adapted nlp: A taxonomy and a survey of the state of the art. Transactions of the Association for Computational Linguistics, 13:652–689. ↗
  24. Xiaogeng Liu, Zhiyuan Yu, Yizhe Zhang, Ning Zhang, and Chaowei Xiao. 2024. Automatic and universal prompt injection attacks against large language models. arXiv preprint arXiv:2403.04957. ↗
  25. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, and 1 others. 2024. Harmbench: A standardized evaluation framework for automated red teaming and robust refusal.
  26. Microsoft. 2025. Azure ai content safety. https://learn.microsoft.com/en-us/ azure/ai-services/openai/concepts/ content-filter. Accessed: 2025-06-25. ↗
  27. Mistral AI. 2025. Mistral saba: A regional language model for the middle east and south asia. Accessed: 2025-05-30. find
  28. OpenAI. 2022. Openai moderation api. https://platform.openai.com/docs/guides/ moderation. Accessed: 2025-06-25. ↗
  29. Long Ouyang, Jeff Wu, Xu Jiang, Diogo Almeida, Carroll L. Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kelton, Luke Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul Christiano, Jan Leike, and Ryan Lowe. 2022. Training language models to follow instructions with human feedback. arXiv preprint arXiv:2203.02155. ↗
  30. Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving. 2022. Red teaming language models with language models. arXiv preprint arXiv:2202.03286. ↗
  31. Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. 2023. Direct preference optimization: Your language model is secretly a reward model. Advances in Neural Information Processing Systems, 36:53728– 53741. ↗
  32. Paul Röttger, Hannah Rose Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy. 2023. Xstest: A test suite for identifying exaggerated safety behaviours in large language models. arXiv preprint arXiv:2308.01263. ↗
  33. Neha Sengupta, Sunil Kumar Sahu, Bokang Jia, Satheesh Katipomu, Haonan Li, Fajri Koto, William Marshall, Gurpreet Gosal, Cynthia Liu, Zhiming Chen, and 1 others. 2023. Jais and jais-chat: Arabic-centric foundation and instruction-tuned open generative large language models. arXiv preprint arXiv:2308.16149. ↗
  34. Patrick E Shrout and Joseph L Fleiss. 1979. Intraclass correlations: uses in assessing rater reliability. Psychological bulletin, 86(2):420. ↗
  35. Tarjama. 2025. Pronoia v2: A high-performance arabic large language model for enterprise applications. Accessed: 2025-05-30. find
  36. Fanar Team, Ummar Abbas, Mohammad Shahmeer Ahmad, Firoj Alam, Enes Altinisik, Ehsannedin Asgari, Yazan Boshmaf, Sabri Boughorbel, Sanjay Chawla, Shammur Chowdhury, and 1 others. 2025. Fanar: An arabic-centric multimodal generative ai platform. arXiv preprint arXiv:2501.13944. ↗
  37. Technology Innovation Institute. 2025. Falcon arabic: A high-performance arabic language model. Accessed: 2025-05-30. find
  38. Bibek Upadhayay, Vahid Behzadan, and 1 others. 2025. X-guard: Multilingual guard agent for content moderation. arXiv preprint arXiv:2504.08848. ↗
  39. Ahmet Üstün, Viraat Aryabumi, Zheng-Xin Yong, Wei-Yin Ko, Daniel D’souza, Gbemileke Onilude, Neel Bhandari, Shivalika Singh, Hui-Lee Ooi, Amr Kayid, and 1 others. 2024. Aya model: An instruction finetuned open-access multilingual language model. arXiv preprint arXiv:2402.07827. ↗
  40. Kush R Varshney. 2024. Decolonial ai alignment: Openness, visesa-dharma, and including excluded knowledges. In Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society, volume 7, pages 1467– 1481. find
  41. Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2023. Jailbroken: How does llm safety training fail? Advances in Neural Information Processing Systems, 36:80079–80110.
  42. Yotam Wolf, Noam Wies, Oshri Avnery, Yoav Levine, and Amnon Shashua. 2023. Fundamental limitations of alignment in large language models. arXiv preprint arXiv:2304.11082. ↗
  43. Jing Yao, Xiaoyuan Yi, Xiting Wang, Jindong Wang, and Xing Xie. 2023. From instructions to intrinsic human values–a survey of alignment goals for big models. arXiv preprint arXiv:2308.12014. ↗
  44. Wenjun Zeng, Yuchi Liu, Ryan Mullins, Ludovic Peran, Joe Fernandez, Hamza Harkous, Karthik Narasimhan, Drew Proud, Piyush Kumar, Bhaktipriya Radharapu, Olivia Sturman, and Oscar Wahltinez. 2024. Shieldgemma: Generative ai content moderation based on gemma. arXiv preprint arXiv:2407.21772. ↗
  45. Naitian Zhou, David Bamman, and Isaac L. Bleaman. 2025. Culture is not trivia: Sociocultural theory for cultural nlp. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics.
  46. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043. ↗

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/fatehkia-2026-fanarguard-culturally-aware-moderation-filter/