Elamur Research⌕
☰
home / papers / 2026 / CURUPIRA: Clever guard for harm and linguistic prompt mitigation in Brazilian Portuguese

CURUPIRA: Clever guard for harm and linguistic prompt mitigation in Brazilian Portuguese

Paper · 2026 · Rogério Sousa, William Alberto Cruz-Castañeda, José Roberto Homeli Silva et al.

Summary

Open guardrail models such as Llama-Guard and ShieldGemma are trained mostly on English. They tend to misjudge harmful prompts in other languages, especially when slang or culture-specific phrasing hides malicious intent. Even multilingual options like Qwen3Guard share this weakness. The authors address the gap for Brazilian Portuguese with Curupira, a family of guard models built in three stages. First, they adapt ShieldGemma's four-category safety taxonomy to the Lusophone context. Second, they generate a balanced synthetic dataset of safe and unsafe prompts with a pipeline based on AI-Assisted Red-Teaming (AART). Third, they apply supervised fine-tuning. The adapted models are compared with the original Qwen3Guard and ShieldGemma checkpoints on five Brazilian Portuguese social-media benchmarks and one English chatbot dataset. Fine-tuning raised macro F1 for every model. Curupira-7B scored best overall, Curupira-3B came close, and the 0.6B variant also gained substantially. Performance drops were small and limited to specific datasets, and the English benchmark showed little sign of forgetting. The study suggests that compact, locally adapted open guardrails are a realistic option for Portuguese-language LLMs such as Sabiá or Tucano.

Key points

  • Training data: The synthetic Portuguese safety corpus contains 17,513 labeled examples in balanced safe/unsafe pairs, split 80/10/10. It was generated through three prompting layers:
    • conceptual mapping of native terms and slang,
    • structural typology for syntactic variety,
    • instance synthesis.
  • Taxonomy: The categories come from ShieldGemma: Hate Speech, Harassment, Sexually Explicit, and Dangerous Content.
  • Evaluation benchmarks:
    • Portuguese: ToxSyn-PT, OLID-BR, TuPy-E, HateBR, and ToLD-BR.
    • English: Toxic-Chat, used to check cross-lingual degradation and catastrophic forgetting.
  • Baselines and comparability: The baselines are ShieldGemma 1 (2B, 9B) and Qwen3Guard-Gen (0.6B, 4B, 8B). To compare them on a binary scale, Qwen's Unsafe and Controversial outputs were both counted as violations, and F1 was the main metric.
  • Fine-tuning setup: Training restricted the loss to completion tokens, ran in bfloat16, capped sequences at 8,192 tokens, and optimized with a paged variant of AdamW. Five configurations varied learning rate, epochs, and warmup.
  • Stated limitations: The work relies on synthetic data, includes no human evaluation, and covers only text classification.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Fields, topics and concepts

📚 Shelves 2The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 works

Cite

Cite as Rogério Sousa, William Alberto Cruz-Castañeda, José Roberto Homeli Silva and Marcellus Amadeus. 2026. CURUPIRA: Clever guard for harm and linguistic prompt mitigation in Brazilian Portuguese. Proceedings of the 17th International Conference on Computational Processing of Portuguese (PROPOR 2026) - Vol. 1.

The paper itself, not this page. BibTeX from the library's record of the work.

@inproceedings{sousa2026curupira,
  title = {{CURUPIRA: Clever guard for harm and linguistic prompt mitigation in Brazilian Portuguese}},
  author = {Rogério Sousa, William Alberto Cruz-Castañeda, José Roberto Homeli Silva and Marcellus Amadeus},
  booktitle = {Proceedings of the 17th International Conference on Computational Processing of Portuguese (PROPOR 2026) - Vol. 1},
  year = {2026},
  url = {https://aclanthology.org/2026.propor-1.107/}
}

References

19 references, 5 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Somnath Banerjee, Pratyush Chatterjee, Shanu Kumar, Sayan Layek, Parag Agrawal, Rima Hazra, and Animesh Mukherjee. 2025. Attributional Safety Failures in Large Language Models under Code-Mixed Perturbations. arXiv preprint. ArXiv:2505.14469 [cs] version: 2. — [arXiv:2505.14469](https://arxiv.org/abs/2505.14469) find
  2. Lavish Bansal and Naman Mishra. 2025. CREST: Universal Safety Guardrails Through Cluster-Guided Cross-Lingual Transfer. arXiv preprint. ArXiv:2512.02711 [cs] version: 1. find
  3. Iago Alves Brito, Julia Soares Dollis, Fernanda Bufon Färber, Diogo Fernandes Costa Silva, and Arlindo Rodrigues Galvão Filho. 2025. ToxSyn-PT: A Large-Scale Synthetic Dataset for Hate Speech Detection in Portuguese. arXiv preprint. ArXiv:2506.10245 [cs]. — [arXiv:2506.10245](https://arxiv.org/abs/2506.10245) find
  4. William Alberto Cruz-Castañeda and Marcellus Amadeus. 2025. Large languages models in brazilian portuguese: A chronological survey. Journal of the Brazilian Computer Society, 31(1):1167–1186. https://soberania.ai ↗
  5. Amanda da Silva Oliveira, Thiago de Carvalho Ce-cote, João Paulo Reis Alvarenga, Vander Luis de Souza Freitas, and Eduardo José da Silva Luz. 2024. Toxic speech detection in portuguese: A comparative study of large language models. In Proceedings of the 16th International Conference on Computational… find
  6. Shaona Ghosh, Prasoon Varshney, Erick Galinkin, and Christopher Parisien. 2024. Aegis: Online adaptive ai content safety moderation with ensemble of llm experts. arXiv preprint arXiv:2404.05993. — [arXiv:2404.05993](https://arxiv.org/abs/2404.05993) find
  7. Seungju Han, Kavel Rao, Allyson Ettinger, Liwei Jiang, Bill Yuchen Lin, Nathan Lambert, Yejin Choi, and Nouha Dziri. 2024. Wildguard: Open one-stop moderation tools for safety risks, jailbreaks, and refusals of llms. Advances in Neural Information Processing Systems, 37:8093–8131.
  8. Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and 1 others. 2023. Llama guard: Llm-based input-output safeguard for human-ai conversations. arXiv preprint arXiv:2312.06674.
  9. João Augusto Leite, Diego Silva, Kalina Bontcheva, and Carolina Scarton. 2020. Toxic language detection in social media for brazilian portuguese: New dataset and multilingual analysis. In Proceedings of the 1st conference of the Asia-Pacific chapter of the association for computational linguistics a… find
  10. Zi Lin, Zihan Wang, Yongqi Tong, Yangkun Wang, Yuxin Guo, Yujia Wang, and Jingbo Shang. 2023. ToxicChat: Unveiling Hidden Challenges of Toxicity Detection in Real-World User-AI Conversation. arXiv preprint. ArXiv:2310.17389 [cs].
  11. Felipe Oliveira, Victoria Reis, and Nelson Ebecken. 2023. Tupy-e: detecting hate speech in brazilian portuguese social media with a novel dataset and comprehensive analysis of models. arXiv preprint arXiv:2312.17704. — [arXiv:2312.17704](https://arxiv.org/abs/2312.17704) find
  12. Fábio Perez and Ian Ribeiro. 2022. Ignore previous prompt: Attack techniques for language models. Preprint, arXiv:2211.09527.
  13. Bhaktipriya Radharapu, Kevin Robinson, Lora Aroyo, and Preethi Lahoti. 2023. AART: AI-Assisted Red-Teaming with Diverse Data Generation for New LLM-powered Applications. arXiv preprint. ArXiv:2311.08592 [cs]. find
  14. Douglas Trajano, Rafael H. Bordini, and Renata Vieira. 2024. OLID-BR: offensive language identification dataset for Brazilian Portuguese. Language Resources and Evaluation, 58(4):1263–1289. find
  15. Francielle Vargas, Isabelle Carvalho, Fabiana Rodrigues de Góes, Thiago Pardo, and Fabrício Benevenuto. 2022. HateBR: A large expert annotated corpus of Brazilian Instagram comments for offensive language and hate speech detection. In Proceedings of the Thirteenth Language Resources and Evaluation C… find
  16. Laura Weidinger, Jonathan Uesato, Maribeth Rauh, Conor Griffin, Po-Sen Huang, John Mellor, Amelia Glaese, Myra Cheng, Borja Balle, Atoosa Kasirzadeh, Courtney Biles, Sasha Brown, Zac Kenton, Will Hawkins, Tom Stepleton, Abeba Birhane, Lisa Anne Hendricks, Laura Rimell, William Isaac, and 4 others. 2… find
  17. Yahan Yang, Soham Dan, Dan Roth, and Insup Lee. 2024. Benchmarking llm guardrails in handling multilingual toxicity. arXiv preprint arXiv:2410.22153. find
  18. Wenjun Zeng, Yuchi Liu, Ryan Mullins, Ludovic Peran, Joe Fernandez, Hamza Harkous, Karthik Narasimhan, Drew Proud, Piyush Kumar, Bhaktipriya Radharapu, Olivia Sturman, and Oscar Wahltinez. 2024. Shield-Gemma: Generative AI Content Moderation Based on Gemma. arXiv preprint. ArXiv:2407.21772 [cs]. — [arXiv:2407.21772](https://arxiv.org/abs/2407.21772) find
  19. Haiquan Zhao, Chenhan Yuan, Fei Huang, Xiaomeng Hu, Yichang Zhang, An Yang, Bowen Yu, Dayiheng Liu, Jingren Zhou, Junyang Lin, Baosong Yang, Chen Cheng, Jialong Tang, Jiandong Jiang, Jianwei Zhang, Jijie Xu, Ming Yan, Minmin Sun, Pei Zhang, and 24 others. 2025. Qwen3Guard Technical Report. ArXiv:251…

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/sousa-2026-curupira-clever-guard-harm-linguistic/