Elamur Research⌕
☰
home / papers / 2026 / Arabic Safety Alignment as Selective Refusal: An Empirical Study of SFT, DPO, and Guard Calibration

Arabic Safety Alignment as Selective Refusal: An Empirical Study of SFT, DPO, and Guard Calibration

Summary

The paper asks how to make Arabic-capable LLMs refuse harmful requests without also refusing benign but sensitive questions about news, medicine, law, or policy. The authors argue that one refusal rate hides this tension. They track two separate rates: B, refusal on benign prompts, and H, refusal on harmful prompts. H counts refusals only and is not treated as a harmful-compliance rate. They evaluate five models over 130 runs on the human-written AraSafe set, using Qwen3Guard as an automatic judge that is checked against a blinded human audit. Training on refusals alone pushes models toward refusing nearly everything. Mixing in helpful examples yields candidate points around H ≈ 90–93% with B of 14–23%. DPO and inference guards help some models and hurt others, so neither is a reliable upgrade. Transfer from MSA training to Arabizi is only partial. The portable result is a procedure: fix a deployment target, search interventions per model, and keep only those that improve the target and stay stable across seeds, judges, and writing forms.

Key points

  • Evaluation uses all 12,077 human-written AraSafe prompts (10,823 benign, 1,254 harmful), held out from all training and calibration. The models are Qwen2.5-3B/7B Instruct, Meta-Llama-3-8B Instruct, Fanar-1-9B, and ALLaM-7B Instruct.
  • The judge audit covered 300 blinded responses. Annotators agreed on 89.0% (κ = 0.78). Against the adjudicated labels, Qwen3Guard-Gen-4B scored 88.7% accuracy and Aya Expanse 32B scored 91.0%, a difference that was not significant (McNemar p = 0.382). Judge accuracy dropped to 77.5% on Arabizi.
  • Harmful training prompts are BeaverTails translated into MSA with the Hala models. Benign examples come from Hala-4.6M-SFT. DPO used 10K benign and 10K harmful preference pairs.
  • Under refusal-only SFT, benign refusal passed 80% by step 10 for ALLaM, Fanar, and Llama, and by step 30 for both Qwen models.
  • The selected mixed-SFT points were:
    • ALLaM 16.5/92.3
    • Fanar 14.0/90.0 (above threshold in only two of three seeds)
    • Llama 22.0/92.8
    • Qwen 3B 22.6/92.8
    • Qwen 7B 18.6/92.4
  • DPO moved models in opposite directions. Qwen 7B shifted to 13.7/89.5, while Llama shifted to 31.3/96.2.
  • Raising the target from 90% to 95% H costs 7.8–23.4 extra B points, and Fanar has no tested point that reaches 95%.
  • Linear refusal directions separate harmful from benign responses with AUC 0.909–0.956, but their thresholds differ by model.

Interesting ideas

  • I1. Each system is scored as a point on two error axes, and the "tested frontier" keeps only non-dominated points; the final choice is the cheapest point that meets a target fixed in advance, which avoids judging methods by a single blended number. — For Mova (learn): Repair rules or parser variants could be plotted by fixes gained versus correct analyses broken. A rule would be accepted only if it reaches a preset recall target at the lowest breakage.
  • I2. The authors test a training-data ordering effect against chance: the "best" ordering won in 4 of 15 rows, about the 25% expected from four options, so they report a null result instead of a spurious win. — For Mova (learn): When several training or rule-ordering strategies are compared, the win frequency of each strategy should be checked against the chance rate as a built-in negative control.
  • I3. The automatic judge is audited with blinded human labels, broken down by subgroup, and checked for bias toward outputs from its own model family, and its error is kept separate from sampling intervals. — For Mova (learn): LLM teacher tiers and witness-parser agreement could be audited the same way, including per-genre accuracy and whether a teacher favors outputs from models related to it.
  • I4. The paper keeps the measured label separate from the actual outcome: a missing refusal is not the same as harmful compliance, so the two are reported separately. — For Mova (answer): School-test and fable QA readers could report abstention on answerable questions and on unanswerable questions as two separate rates, apart from wrong-answer counts. This would stop a reader from looking careful simply by abstaining often.
  • I5. Training on one form (MSA) only partly carried over to another (Arabizi), so each writing form is stress-tested on its own instead of assuming transfer. — For Mova (tree): Parser accuracy should be reported separately for noisy, informal, or dialectal English rather than assuming results on clean standard text carry over.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

Fields: Linguistics & languages

Cite

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.48550/arxiv.2608.29378 · arXiv 2608.29378

@misc{zbib2026arabic,
  title = {{Arabic Safety Alignment as Selective Refusal: An Empirical Study of SFT, DPO, and Guard Calibration}},
  author = {Zbib, Mohamad and Mohanna, Ammar},
  year = {2026},
  doi = {10.48550/arxiv.2608.29378},
  eprint = {2608.29378},
  archivePrefix = {arXiv},
  url = {https://doi.org/10.48550/arxiv.2608.29378}
}

References

23 references, 10 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee, and Neel Nanda. 2024. Refusal in language models is mediated by a single direction. In Advances in Neural Information Processing Systems, volume 37. find our card
  2. Yasser Ashraf, Yuxia Wang, Bin Gu, Preslav Nakov, and Timothy Baldwin. 2025. Arabic dataset for LLM safeguard evaluation. In Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pages 5529–5546. find
  3. M Saiful Bari, Yazeed Alnumay, Norah A. Alzahrani, Nouf M. Alotaibi, Hisham Abdullah Alyahya, Sultan AlRashed, Faisal Abdulrahman Mirza, Shaykhah Z. Alsubaie, Hassan A. Alahmed, Ghadah Alabduljabbar, Raghad Alkhathran, Yousef Almushayqih, Raneem Alnajim, Salman Alsubaihi, Maryam Al Mansour, Saad Amin Hassan, Majed Alrubaian, Ali Alammari, Zaki Alawami, and 7 others. 2025. ALLaM: Large language models for Arabic and English. In International Conference on Learning Representations (ICLR). find our card
  4. Justin Cui, Wei-Lin Chiang, Ion Stoica, and Cho-Jui Hsieh. 2024. OR-Bench: An over-refusal benchmark for large language models. Preprint, arXiv:2405.20947. ↗
  5. John Dang, Shivalika Singh, Daniel D’souza, Arash Ahmadian, Alejandro Salamanca, Madeline Smith, Aidan Peppin, Sungjin Hong, Manoj Govindassamy, Terrence Zhao, Sandra Kublik, Meor Amer, Viraat Aryabumi, Jon Ander Campos, Yi-Chern Tan, Tom Kocmi, Florian Strub, Nathan Grinsztajn, Yannis Flet-Berliac, and 26 others. 2024. Aya Expanse: Combining research breakthroughs for a new multilingual frontier. Preprint, arXiv:2412.04261. ↗ our card
  6. Data Is Better Together. 2024. DPO datasets for AR. find
  7. Fanar Team. 2025. Fanar: An Arabic-centric multimodal generative AI platform. Preprint, arXiv:2501.13944. ↗ our card
  8. Melody Y. Guan, Manas Joglekar, Eric Wallace, Saachi Jain, Boaz Barak, Alec Helyar, Rachel Dias, Andrea Vallone, Hongyu Ren, Jason Wei, Hyung Won Chung, Sam Toyer, Johannes Heidecke, Alex Beutel, and Amelia Glaese. 2024. Deliberative alignment: Reasoning enables safer language models. Preprint, arXiv:2412.16339. ↗
  9. Hasan Abed Al Kader Hammoud, Mohammad Zbeeb, and Bernard Ghanem. 2025. Hala technical report: Building Arabic-centric instruction & translation models at scale. find
  10. Huang Huang, Fei Yu, Jianqing Zhu, Xuening Sun, Hao Cheng, Dingjie Song, Zhihong Chen, Mosen Alharthi, Bang An, Juncai He, Ziche Liu, Junying Chen, Jianquan Li, Benyou Wang, Lian Zhang, Ruoyu Sun, Xiang Wan, Haizhou Li, and Jinchao Xu. 2024. AceGPT, localizing large language models in Arabic. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pages 8139–8163. find our card
  11. Go Inoue, Bashar Alhafni, Nizar Habash, and Timothy Baldwin. 2026. Do diacritics matter? evaluating the impact of Arabic diacritics on tokenization and LLM benchmarks. In Findings of the Association for Computational Linguistics: EACL 2026, pages 426–442. find our card
  12. Jiaming Ji, Mickel Liu, Josef Dai, Xuehai Pan, Chi Zhang, Ce Bian, Boyuan Chen, Ruiyang Sun, Yizhou Wang, and Yaodong Yang. 2023. BeaverTails: Towards improved safety alignment of LLM via a human-preference dataset. In Advances in Neural Information Processing Systems, volume 36. find our card
  13. Bruce W. Lee, Inkit Padhi, Karthikeyan Natesan Ramamurthy, Erik Miehling, Pierre Dognin, Manish Nagireddy, and Amit Dhurandhar. 2025. Programming refusal with conditional activation steering. In International Conference on Learning Representations (ICLR). find
  14. Meta. 2024. Llama Guard 3. Basel Mousi, Nadir Durrani, Fatema Ahmad, Md. find
  15. Arid Hasan, Maram Hasanain, Tameem Kabbani, Fahim Dalvi, Shammur Absar Chowdhury, and Firoj Alam. 2025. AraDiCE: Benchmarks for dialectal and cultural capabilities in LLMs. In Proceedings of the 31st International Conference on Computational Linguistics (COLING), pages 4186–4218. find
  16. Hamdy Mubarak, Abubakr Mohamed, and Majd Hawasly. 2025. AraSafe: Benchmarking safety in Arabic LLMs. In Findings of the Association for Computational Linguistics: EMNLP 2025, pages 9976–9992. Association for Computational Linguistics. find
  17. Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin-Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. 2024. Fine-tuning aligned language models compromises safety, even when users do not intend to! In The Twelfth International Conference on Learning Representations (ICLR). find our card
  18. Rafael Rafailov, Archit Sharma, Eric Mitchell, Stefano Ermon, Christopher D. Manning, and Chelsea Finn. 2023. Direct preference optimization: Your language model is secretly a reward model. In Advances in Neural Information Processing Systems, volume 36. find
  19. Paul Röttger, Hannah Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy. 2024. XSTest: A test suite for identifying exaggerated safety behaviours in large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pages 5377–5400. find our card
  20. Neha Sengupta, Sunil Kumar Sahu, Bokang Jia, Satheesh Katipomu, Haonan Li, Fajri Koto, William Marshall, Gurpreet Gosal, Cynthia Liu, Zhiming Chen, Osama Mohammed Afzal, Samta Kamboj, Onkar Pandit, Rahul Pal, Lalit Pradhan, Zain Muhammad Mujahid, Massa Baali, Xudong Han, Sondos Mahmoud Bsharat, and 13 others. 2023. Jais and Jais-chat: Arabic-centric foundation and instruction-tuned open generative large language models. arXiv preprint arXiv:2308.16149. ↗ our card
  21. Alexandra Souly, Qingyuan Lu, Dillon Bowen, Tu Trinh, Elvis Hsieh, Sana Pandey, Pieter Abbeel, Justin Svegliato, Scott Emmons, Olivia Watkins, and Sam Toyer. 2024. A StrongREJECT for empty jailbreaks. In Advances in Neural Information Processing Systems 37 (NeurIPS 2024) Datasets and Benchmarks Track. find
  22. Haiquan Zhao, Chenhan Yuan, Fei Huang, Xiaomeng Hu, Yichang Zhang, An Yang, Bowen Yu, Dayiheng Liu, Jingren Zhou, Junyang Lin, Baosong Yang, Chen Cheng, Jialong Tang, Jiandong Jiang, Jianwei Zhang, Jijie Xu, Ming Yan, Minmin Sun, Pei Zhang, and 24 others. 2025. Qwen3Guard technical report. find
  23. Yifan Zhong, Chengdong Ma, Xiaoyuan Zhang, Ziran Yang, Haojun Chen, Qingfu Zhang, Siyuan Qi, and Yaodong Yang. 2024. Panacea: Pareto alignment via preference adaptation for LLMs. In Advances in Neural Information Processing Systems, volume 37. find

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/zbib-2026-arabic-safety-alignment-selective-refusal/