LLM Safety Alignment in Low-Resource Languages: A Systematic Literature Review

# LLM Safety Alignment in Low-Resource Languages: A Systematic Literature Review
Source: [https://arxiv.org/html/2608.14626](https://arxiv.org/html/2608.14626)
Valdini Douglace Lemofouet1Blessing Ngozi Uzor1Paula Chikaodinaka Anyanwu1 Danielle Blanche Kapsa1Sukairaj Hafiz Imam2P Sam Sahil7Abigail Oppong3Tassallah Abdullahi4 Clemencia Siro5Idris Abdulmumin6Seid Muhie Yimam7Shamsuddeen Hassan Muhammad8,2 1African Institute for Mathematical Sciences \(AIMS\), Cameroon2Bayero University Kano 3Independent Researcher4Brown University5Centrum Wiskunde & Informatica 6University of Pretoria7University of Hamburg8Imperial College London

###### Abstract

Large Language Models \(LLMs\) have achieved substantial progress in safety alignment, yet their safety guarantees remain significantly weaker in low\-resource and multilingual settings than in high\-resource languages\. In this paper, we conduct a Systematic Literature Review \(SLR\) of LLM safety alignment in low\-resource languages by adopting the PRISMA 2020 methodology\. Out of roughly 1,500 papers identified from Semantic Scholar, arXiv, and OpenAlex, 50 relevant studies have been selected and analyzed\. Our review is organized around four themes: safety alignment methods, multilingual safety risks, evaluation benchmarks, and cross\-lingual transferability\. We further propose a taxonomy of safety alignment approaches based on three adaptation mechanisms: data adaptation, objective optimization, and mechanistic alignment\. Across literature, translated English benchmarks fail to sufficiently represent culturally rooted harms, and multilingual models are more vulnerable to cross\-lingual jailbreaks, code\-switching attacks, and safety degradation in underrepresented languages\. These failures are driven by several key factors, including uneven multilingual pre\-training coverage, insufficient native\-language preference data, poor transfer of safety representations, and a lack of culturally aware evaluation frameworks\. The review also notes that many low\-resource languages, especially African languages, have fewer safety benchmarks available than other multilingual regions\. Overall, the results reveal a persistent multilingual safety gap, and suggest that future progress will require culturally grounded benchmarks, participatory data collection, balanced multilingual pre\-training, and scalable multilingual alignment methods\.

LLM Safety Alignment in Low\-Resource Languages: A Systematic Literature Review

Valdini Douglace Lemofouet1Blessing Ngozi Uzor1Paula Chikaodinaka Anyanwu1Danielle Blanche Kapsa1Sukairaj Hafiz Imam2P Sam Sahil7Abigail Oppong3Tassallah Abdullahi4Clemencia Siro5Idris Abdulmumin6Seid Muhie Yimam7Shamsuddeen Hassan Muhammad8,21African Institute for Mathematical Sciences \(AIMS\), Cameroon2Bayero University Kano3Independent Researcher4Brown University5Centrum Wiskunde & Informatica6University of Pretoria7University of Hamburg8Imperial College London

## 1Introduction

In recent years, Large Language Models \(LLMs\) have been increasingly deployed in domains such as education, healthcare, governance, and digital communication, raising concerns about their safety, reliability, and alignment with human values\. A language model is considered safe if it avoids generating harmful, illegal, toxic, dangerous, or biased content, while remaining useful to users\. Recent advances in safety alignment have introduced several techniques for reducing harmful, toxic, biased, or otherwise unsafe model behavior\. These techniques include reinforcement learning from human feedback \(RLHF\), constitutional AI, safety fine\-tuning, and adversarial red teaming\(Ouyanget al\.,[2022](https://arxiv.org/html/2608.14626#bib.bib57); Baiet al\.,[2022](https://arxiv.org/html/2608.14626#bib.bib59); Perezet al\.,[2022](https://arxiv.org/html/2608.14626#bib.bib66)\)\. As these systems continue to grow in capability and adoption, ensuring their safe and responsible behavior has become a major research priority\.

Most existing alignment techniques and evaluation frameworks have been designed primarily for high\-resource languages, particularly EnglishYonget al\.\([2025a](https://arxiv.org/html/2608.14626#bib.bib67)\)\. These approaches often depend on large\-scale annotated datasets, benchmarks, and an extensive human feedback pipeline, resources that remain limited or unavailable for many underrepresented languages\.

Safety alignment learned in English does not transfer reliably to other languages\. Recent studies show that LLMs trained to reject harmful instructions in English may comply with equivalent prompts written in low\-resource languagesYonget al\.\([2023](https://arxiv.org/html/2608.14626#bib.bib3)\)\. Previous studies also suggest that these failures are highly related to the imbalanced coverage of multilingual pre\-trainingShenet al\.\([2024](https://arxiv.org/html/2608.14626#bib.bib4)\)\. In practice, these kinds of gaps can translate into weaker safety protections for speakers of underrepresented languages\. For example,Inuwa\-Dutse \([2025](https://arxiv.org/html/2608.14626#bib.bib6)\)presented examples of an LLM deployed in Hausa producing false and unsafe recommendations for toxic local products that were presented as safe for humans\.

In order to better understand this emerging area, this paper presents a Systematic Literature Review \(SLR\) of safety alignment in low\-resource languages using the PRISMA 2020 framework\. We synthesize existing research across four dimensions: safety alignment methods, multilingual safety risks, evaluation benchmarks and cross\-lingual transferability\. We further propose a taxonomy of safety alignment approaches by their main adaptation mechanisms and identify key challenges limiting effective safety transfer across languages\. In this review, we highlight current research trends, methodological limitations, and future directions for building safer and more inclusive multilingual language models\. This review is guided by the following research questions:

- •RQ1:How are LLM safety alignment methods adapted for low\-resource languages?
- •RQ2:What safety risks, adversarial behaviors, and cultural harms emerge in multilingual LLM settings?
- •RQ3:What datasets, benchmarks, and evaluation frameworks exist for safety alignment in low\-resource languages?
- •RQ4:What factors affect cross\-lingual transfer of safety alignment to low\-resource languages?

![Refer to caption](https://arxiv.org/html/2608.14626v1/latex/prisma.png)Figure 1:PRISMA flow diagram\. 1,500 records were narrowed through deduplication, automated scoring, LLM\-based eligibility screening, and two rounds of manual revision producing 50 papers for synthesis\.
## 2Related Work

Several studies have been conducted on the safety of multilingual LLMs\. Some of these works aimed to analyze and review the field\. Among these,Yonget al\.\([2025b](https://arxiv.org/html/2608.14626#bib.bib48)\)conducted a descriptive systematic review of nearly 300 publications, revealing a persistent and growing language gap in LLM safety research\. Also,Banerjeeet al\.\([2026](https://arxiv.org/html/2608.14626#bib.bib55)\)synthesized findings for Global South languages: "safety guardrails weaken sharply on low\-resource and code\-mixed inputs"\. They also proposed parameter‑efficient steering and participatory workflows that enable communities to define and mitigate harm\.Shenet al\.\([2024](https://arxiv.org/html/2608.14626#bib.bib4)\)examines the safety challenges of LLMs in multilingual settings\. They observed that LLMs tend to generate unsafe responses much more often when a malicious prompt is written in a lower\-resource language\.

These works share four limitations: \(1\) none follows a formal SLR methodology \(explicit research questions, inclusion/exclusion criteria, PRISMA flow\), \(2\) African languages are subsumed under generic “low‑resource” categories, \(3\) findings are not structured into actionable dimensions \(methods, risks, benchmarks\), and \(4\) they do not synthesise mechanistic explanations for cross‑lingual transfer failures\.

Our work addresses these gaps by presenting the first systematic literature review \(PRISMA\) dedicated exclusively to LLM safety alignment in African and low‑resource languages\.

## 3Methodology

We performed a systematic literature review based on the PRISMA 2020 guidelinesPageet al\.\([2021](https://arxiv.org/html/2608.14626#bib.bib2)\)\. The PRISMA flow diagram is shown in Fig\.[1](https://arxiv.org/html/2608.14626#S1.F1)\. Relevant articles were collected from Semantic Scholar, arXiv, and OpenAlex using searches involving queries belonging to the following three keyword sets: \(i\)*technology*\(LLM, instruction tuning, foundation models\), \(ii\)*safety*\(alignment, jailbreak, adversarial attack, toxicity, RLHF, DPO\), and \(iii\)*linguistic scope*\(low\-resource languages, multilingual, African languages, cross\-lingual, code\-switching, Hausa, Swahili, Yoruba, Amharic\)\. Detailed search strings are available in Appendix[A\.1](https://arxiv.org/html/2608.14626#A1.SS1)\.This process generated approximately 1,500 papers, which were pared down to 1,300 after de\-duplication\. A Python\-based filter system was used with criteria such as year cut\-offs \(\>\>2020\) and multi\-faceted keyword relevancy, generating 242 potential papers to review\. The inclusion criteria included the focus on safety or adversarial robustness for LLMs in multilingual and low\-resource contexts, while purely English and non\-empirical works were excluded\. We then applied a two\-step screening process\. The first step involved LLM\-based evaluation \(Claude Sonnet\) of each potential paper based on research questions and inclusion/exclusion criteria: 70 papers were selected, and after verification, none of the papers excluded by Claude were useful\. We retained 50 papers in the final review set\.

## 4Safety Alignment Methods for Low\-Resource Languages

RQ1 — Adaptation of safety methodsHow are LLM safety alignment methods adapted for low\-resource languages?

![Refer to caption](https://arxiv.org/html/2608.14626v1/latex/rq1.png)Figure 2:Taxonomy of safety alignment methods for low\-resource languages, grouped by primary transfer mechanism: data adaptation, objective optimization, and mechanistic alignment\.Safety alignment for low\-resource languages has become increasingly important as large language models are deployed across multilingual settings\. Most safety alignment methods were designed for English and rely on large annotated datasets that do not exist for the majority of the world’s languages\. Applying them to low\-resource settings requires adapting one of four components:\(i\)the data adaptation,\(ii\)the optimization objective,\(iii\)the model’s internal parameters, or\(iv\)data\.

### 4\.1Culturally Grounded Data Adaptation

The most direct response to low\-resource safety failures is to build better multilingual training data\. Methods in this family share a common premise: safety quality is primarily a function of how well the training data covers local language patterns and cultural harm definitions\.

Joshiet al\.\([2025](https://arxiv.org/html/2608.14626#bib.bib15)\)addressed this issue throughCultureGuard, a four\-stage pipeline that generates a culturally grounded safety dataset in target languages using LLMs, filters it with a safety classifier, validates it with native speakers, and fine\-tunes a guard model with LoRA\. Trained on 386k samples across nine languages, including Hindi and Thai, the resulting model outperforms models trained on translated English data on non\-English benchmarks and achieves zero\-shot transfer to unseen languages\.

Shanet al\.\([2025](https://arxiv.org/html/2608.14626#bib.bib7)\)introduceSEALGuard, a multilingual guardrail designed to improve the safety alignment across for Southeast Asian languages\.SEALGuardis fine\-tuned\(LoRA\) on SEALSBench, \(266k\-prompt benchmark of locally sourced and translated harmful prompts across nine languages\)\. The model improves Defence Success Rate by 48% over LlamaGuard, confirming that English\-centric guardrails fail on region\-specific jailbreak attempts\. Another angle is taken byTanet al\.\([2025](https://arxiv.org/html/2608.14626#bib.bib8)\)withLionGuard 2,a lightweight, data\-efficient, localized multilingual content moderation classifier for Singapore’s linguistic context\. By incorporating Singapore\-specific harm categories and code\-mixed Singlish data, the model outperforms commercial moderation APIs across 17 benchmarks\. The authors also find that naively translated training data reduces performance, reinforcing the case for localized data construction\.

Paulet al\.\([2025](https://arxiv.org/html/2608.14626#bib.bib13)\)demonstrate that data quality matters more than scale for alignment\(Hindi\)\. They translate preference data using Llama\-3\.1\-405B, which preserves code, formulas, and URLs that standard machine translation corrupts, then filter outputs with FAITH\-based quality metrics before running a two\-stage alignment process consisting of Supervised Fine\-Tuning \(SFT\) and Direct Preference Optimization \(DPO\)\. Forty thousand filtered samples match or exceed the alignment performance of 200k unfiltered ones\. In parallel,Bellet al\.\([2025](https://arxiv.org/html/2608.14626#bib.bib54)\)investigate translation\-based multilingual toxicity detection pipelines, where the initial step is to translate potentially offensive content to English before classifying it\. The authors demonstrate that translate\-and\-classify frameworks always perform better than multilingual classifiers when dealing with most low\-resource languages\.

Apart from multilingual moderation datasets, other researchers have also developed resources for foundational safety alignment datasets in low\-resource languages\.Huanget al\.\([2026](https://arxiv.org/html/2608.14626#bib.bib37)\)present theTibetan Foundation Dataset \(TFD\), which is a massive dataset in the Tibetan language that can be used in all stages of LLM training processes, from pre\-training to safety alignment and reasoning\.

For safety alignment purposes, some methods for translating existing datasets suffer from a problem of preserving intent \(harmful, toxic\)\. It is in this context thatGeet al\.\([2025](https://arxiv.org/html/2608.14626#bib.bib36)\)proposes a framework for toxicity\-preserving translation, demonstrated on a code\-mixed Singlish safety corpus\.

### 4\.2Cross\-Lingual Transfer and Objective Optimization

When multilingual safety data is scarce, a second strategy is to modify the training objective so that safety behaviour learned in one language transfers to others\. This family splits into two complementary directions: reward\-based optimization and reasoning\-based consistency\.

#### 4\.2\.1Preference and Reward Optimization

Zhaoet al\.\([2025](https://arxiv.org/html/2608.14626#bib.bib19)\)address the paired preference data bottleneck withMPO\(Multilingual reward gaP Optimization\)\. Rather than requiring \(chosen, rejected\) pairs in each target language, MPO minimizes the reward gap between safe and unsafe outputs directly across languages\. It consistently outperforms RLHF and DPO baselines on cross\-lingual safety benchmarks under noisy conditions\.

Limet al\.\([2025](https://arxiv.org/html/2608.14626#bib.bib12)\)compare SFT, DPO, and Kahneman\-Tversky Optimization \(KTO\) for Singlish, where preference pairs are difficult to collect\. Their combined SFT\+KTO pipeline reduces toxicity by 99% and introduces KTO\-S, an improved regularization strategy that stabilizes fine\-tuning under data scarcity\.Zhanget al\.\([2026a](https://arxiv.org/html/2608.14626#bib.bib10)\)use knowledge distillation to transfer refusal behaviour from OpenAI o1\-mini into open\-source multilingual models via LoRA\. Jailbreak resistance improves in both high and low\-resource languages, but the authors find a critical caveat: unfiltered distillation increases jailbreak success rates by up to 16\.6 points because ambiguous “boundary” refusals from the teacher confuse the student\. Filtering these responses mitigates the degradation\.

#### 4\.2\.2Reasoning and Consistency Transfer

Yanget al\.\([2025](https://arxiv.org/html/2608.14626#bib.bib18)\)introducedMrGuard, which combines synthetic multilingual data generation, SFT\( with QLoRA\), and GRPO\-based reinforcement learning\. A distinctive feature is that the model produces explicit reasoning chains rather than binary labels, which improves generalization across eight languages\(including LRL\) by more than 15% in average F1 and maintains robustness against code\-switching attacks\.

Chenet al\.\([2025](https://arxiv.org/html/2608.14626#bib.bib14)\)presentedConsistentGuard, a guardrail model trained using only 1,000 samples\. They combines supervised fine\-tuning \(to provide the model with initial task\-specific knowledge\), followed by GRPO \(to promote reasoning diversity and length\), and finally a CAO \(constrained Alignment Optimization\) to align the model’s reasoning process across different languages\. The model obtained outperforms larger classifiers while providing interpretable reasoning chains, suggesting that reasoning supervision is an efficient substitute for scale\.

Buet al\.\([2026](https://arxiv.org/html/2608.14626#bib.bib16)\)proposes a resource\-efficient method for improving multilingual safety alignment\. Their Multi\-Lingual Consistency \(MLC\) loss enforces directional consistency between multilingual representation vectors in a single training update, enabling simultaneous safety alignment across languages without response\-level supervision in target languages\. Further evaluation across languages and tasks indicates improved cross\-lingual generalization, suggesting the approach as a practical solution for multilingual consistency alignment under limited supervision\.

### 4\.3Mechanistic and Parameter\-Level Alignment

A third line of research investigates whether safety alignment can be achieved through direct modification of model internals, thereby bypassing data collection and full retraining entirely\. The hypothesis is that safety behaviour is concentrated in identifiable subsets of parameters\.

In this line of research ,Lianget al\.\([2026](https://arxiv.org/html/2608.14626#bib.bib53)\)propose the Sparse Weight Editing \(SWE\), based on the finding that safety capabilities are concentrated in a sparse subset of model weights\. They identify this subset in a safety\-aligned high\-resource model and compute a closed\-form linear transformation to project harmful low\-resource representations into the corresponding safety subspaces without gradient computation\. SWE was evaluated across eight languages and two model families \(Llama\-3, Qwen\-2\.5\)\. It reduces attack success rates in low\-resource languages, with negligible impact on general reasoning performance\.

Shin and Hwang \([2026](https://arxiv.org/html/2608.14626#bib.bib52)\)takes a layer\-level approach: Activation analysis identifies which transformer layers carry safety\-critical features in a safety\-aligned high\-resource model\. Those layers are then transplanted into a low\-resource expert model\. The resulting training\-free method achieves safety gains on MultiJail while preserving performance on general benchmarks \(MMMLU, BELEBELE, MGSM\)\.

Banerjeeet al\.\([2025](https://arxiv.org/html/2608.14626#bib.bib21)\)localize the intervention further withSoteria, which identifies language\-specific attention heads responsible for harmful outputs via gradient\-based attribution and steers only those components\. Modifying a small fraction of parameters drastically reduces policy violations while preserving language quality, even in low\-resource settings\.

## 5Safety Risks in Multilingual and Low resource Language Contexts

RQ2 \- Risks and cultural harmsWhat safety risks, adversarial behaviors, and cultural harms emerge in multilingual LLM settings?

Although much research is focused on reducing the safety gap between HRLs and LRLs, understanding the safety risks faced by low\-resource languages is crucial\. Here, We present these LLM vulnerabilities in LRL settings\.

### 5\.1Cross\-Lingual Jailbreaks

A consistent body of work shows that safety vulnerabilities increase significantly in low\-resource and underrepresented languages\.

Early evidence fromYonget al\.\([2023](https://arxiv.org/html/2608.14626#bib.bib3)\)demonstrates that simply translating harmful English prompts into low\-resource languages can achieve a 79% jailbreak success rate on GPT\-4, while high\-resource languages remain below 15%\. This disparity suggests that safety alignment does not generalize evenly across linguistic space\.

Building on this,Denget al\.\([2024](https://arxiv.org/html/2608.14626#bib.bib20)\)identifies multilingual jailbreak challenges within LLMs and examines two potential risk scenarios: unintentional and intentional\. They found that LRLs have about 3 times the likelihood of encountering harmful content as HRLs\.Shenet al\.\([2024](https://arxiv.org/html/2608.14626#bib.bib4)\)also supports these findings, noting that in low\-resource languages, models not only become less safe but also follow instructions less reliably as linguistic resources decrease\.

It is important to note that these weaknesses are not limited to translation attacks\. In fact,Chrabąszczet al\.\([2025](https://arxiv.org/html/2608.14626#bib.bib29)\)show that for Polish, a small proxy model can generate transferable adversarial perturbations at low cost, producing attack success rates significantly higher than those observed in English\.Pattnayak and Chowdhuri \([2026a](https://arxiv.org/html/2608.14626#bib.bib22)\)reach a related finding across 12 Indic languages through IndicJR: contract\-bound prompts in JSON format inflate refusal counts without actually preventing jailbreaks, and safety alignment degrades consistently as language resource level decreases\.Atilet al\.\([2025](https://arxiv.org/html/2608.14626#bib.bib28)\)extend this picture to ten languages, finding that both logical\-expression\-based and adversarial\-prompt\-based jailbreak methods generalize poorly across languages, with low\-resource languages remaining more vulnerable\.

### 5\.2Fine\-Tuning on New Languages as an Attack Vector

Beyond prompting\-based attacks, a more subtle risk arises from model adaptation itself\.

Upadhayay and Behzadan \([2025](https://arxiv.org/html/2608.14626#bib.bib5)\)show that fine\-tuning aligned models on new or synthetic languages, even using only benign data, can still degrade safety alignment\. This suggests that learning new linguistic mappings can interfere with previously established safety constraints\. For African language adaptation pipelines, this implies that introducing new linguistic domains without safety recalibration may reduce robustness\.

### 5\.3Code\-Switching and Multilingual Blending

Multilingual interaction further expands the attack surface through code\-switching\.Songet al\.\([2025](https://arxiv.org/html/2608.14626#bib.bib26)\)show that mixing languages within a single prompt significantly reduces safety robustness, with bypass rates reaching 67\.23% on GPT\-3\.5 and 40\.34% on GPT\-4\. These effects are not uniform and depend on linguistic distance and prompt structure\. This is particularly relevant in African contexts, where code\-switching is a common communicative norm rather than an adversarial construct\.

### 5\.4Culturally Specific Harm

A growing body of work also highlights that safety failures are not only linguistic but cultural in nature\. For example,Inuwa\-Dutse \([2025](https://arxiv.org/html/2608.14626#bib.bib6)\)shows that GPT\-OSS\-20B produces unsafe or misleading outputs in Hausa, including toxic product recommendations and culturally inappropriate content that can amplify hate speech\.Shuklaet al\.\([2026](https://arxiv.org/html/2608.14626#bib.bib34)\)further demonstrates that composite harms often change meaning during translation, leading multilingual safety systems to miss culturally contextualized unsafe content\.

Beyond explicit toxicitySaeedet al\.\([2026](https://arxiv.org/html/2608.14626#bib.bib23)\), their multilingual evaluations also reveal subtle stereotype propagation and culturally dependent bias patterns \(mostly in low\-resource settings\) that are often missed by conventional safety benchmarks\.

## 6Safety Evaluation Benchmarks

RQ3 \- Datasets and evaluationWhat datasets, benchmarks, and evaluation frameworks exist for safety alignment in low\-resource languages?

### 6\.1Global Multilingual Safety Benchmarks

Recent multilingual safety benchmarks have progressively moved beyond translation toward more culturally diverse evaluation settings\. Early efforts such asXSafetyWanget al\.\([2024](https://arxiv.org/html/2608.14626#bib.bib30)\)introduced a benchmark of 28,000 annotated instances across 14 safety issues and 10 languages spanning multiple language families\(including Hindi\)\. Building on this direction,LinguaSafeNinget al\.\([2025](https://arxiv.org/html/2608.14626#bib.bib31)\)combines translated, trans\-created, and natively written prompts across 12 languages\(including Malay and Bengali\)\. On his sideKumaret al\.\([2025](https://arxiv.org/html/2608.14626#bib.bib32)\)introducePOLYGUARDPROMPTSa multilingual benchmark for the evaluation of safety guardrails, Created by combining naturally occurring multilingual human\-LLM interactions and human\-verified machine translations of an English\-only safety dataset\.

Other benchmarks focus more specifically on toxicity and adversarial robustness\.Jainet al\.\([2024](https://arxiv.org/html/2608.14626#bib.bib46)\)introducePolygloToxicityPromptsa large\-scale multilingual toxicity evaluation benchmark of 425K naturally occurring prompts spanning 17 languages\. whereasML\-BenchZhaoet al\.\([2026](https://arxiv.org/html/2608.14626#bib.bib62)\)introduces policy\-grounded multilingual safety evaluation covering 14 languages, based on regional regulations\.

### 6\.2Regional and Culturally Localized Benchmarks

In other side, a growing body of work focuses on culturally localized safety evaluation rather than direct translation from English benchmarks\. In Southeast Asia,SEALSBenchShanet al\.\([2025](https://arxiv.org/html/2608.14626#bib.bib7)\)andSEA\-SafeguardBenchTasawonget al\.\([2025](https://arxiv.org/html/2608.14626#bib.bib35)\)introduce multilingual safety datasets built around regional socio\-cultural risks and native\-language prompts\.

Several benchmarks also target multilingual adversarial behavior and online toxicity\.SGToxicGuardHuet al\.\([2025](https://arxiv.org/html/2608.14626#bib.bib40)\)evaluates conversational toxicity and red\-teaming scenarios across Singapore’s multilingual setting, whileQorgauGoloburdaet al\.\([2025](https://arxiv.org/html/2608.14626#bib.bib42)\)was designed for safety evaluation in Kazakh\(a low\-resource language\) and Russian\. In South Asia,IndicSafePattnayak and Chowdhuri \([2026b](https://arxiv.org/html/2608.14626#bib.bib38)\)andIndicJRPattnayak and Chowdhuri \([2026a](https://arxiv.org/html/2608.14626#bib.bib22)\)extend evaluation to culturally grounded harms and jailbreak robustness across Indic languages\. Complementing these efforts,SEAHateCheckNget al\.\([2026](https://arxiv.org/html/2608.14626#bib.bib45)\)andIndoSafetyAzmiet al\.\([2025](https://arxiv.org/html/2608.14626#bib.bib44)\)introduce hate speech and safety evaluation datasets for Southeast Asian languages and regional language varieties\.

### 6\.3African Language Safety Benchmarks

Compared with other multilingual regions, benchmark resources for African languages remain limited\.LSRFaruna \([2026](https://arxiv.org/html/2608.14626#bib.bib33)\)evaluates the cross\-lingual refusal degradation in West African languages such as Yoruba, Hausa, Igbo, and Igala, whileAbdullahiet al\.\([2026](https://arxiv.org/html/2608.14626#bib.bib17)\)introducesUbuntuGuard, the first African policy\-based safety benchmark\. Beyond toxicity evaluation,UhuraBayeset al\.\([2024](https://arxiv.org/html/2608.14626#bib.bib39)\)studies truthfulness and safety constraints in African and low\-resource settings\.

Overall, current benchmark development shows a gradual shift toward native\-language evaluation, culturally grounded harms, and multilingual adversarial testing\. However, African languages remain substantially under\-represented compared with other multilingual benchmark ecosystems\.

## 7Cross\-Lingual Transferability of Safety Alignment

RQ4 — Cross\-lingual transfer factorsWhat factors affect cross\-lingual transfer of safety alignment to low\-resource languages?

A recurring finding across multilingual safety research is that safety alignment is not language\-agnostic: alignment behaviors learned in high\-resource languages often degrade when transferred to low\-resource languages\. Most studies attribute this limitation to uneven multilingual representations acquired during pre\-training, where safety\-relevant knowledge remains concentrated in high\-resource languages\.

Several prior works identify pre\-training coverage as the primary bottleneck behind transfer degradation\.Shenet al\.\([2024](https://arxiv.org/html/2608.14626#bib.bib4)\)show that alignment methods mainly improve safety in languages that are well represented during pre\-training, while gains remain limited in low\-resource settings\. Similarly,Verma and Bharadwaj \([2025](https://arxiv.org/html/2608.14626#bib.bib50)\)show that safety\-relevant features cluster around high\-resource regions of the latent space, resulting in weaker safety enforcement in underrepresented languages\.Upadhayay and Behzadan \([2025](https://arxiv.org/html/2608.14626#bib.bib5)\)further show that introducing new languages during fine\-tuning can disrupt previously learned safety behavior, suggesting that multilingual adaptation itself may destabilize alignment\.

Transfer is also affected by linguistic and structural differences across languages\. Morphologically rich languages and underrepresented scripts often suffer from fragmented tokenization and weaker semantic representations, reducing the reliability of safety reasoning and refusal behavior\. These issues become particularly visible in African and other low\-resource languages, where both pre\-training data and alignment supervision remain scarce\.

More recent work explores whether safety transfer can be improved directly at the representation level\.Lianget al\.\([2026](https://arxiv.org/html/2608.14626#bib.bib53)\)propose Sparse Weight Editing \(SWE\), which transfers safety representations through lightweight parameter transformations, whileShin and Hwang \([2026](https://arxiv.org/html/2608.14626#bib.bib52)\)improves multilingual robustness by identifying and replacing safety\-critical transformer layers without full retraining\. Mechanistic studies such asZhanget al\.\([2026b](https://arxiv.org/html/2608.14626#bib.bib65)\)further suggest that cross\-lingual safety behavior may depend on a sparse set of shared multilingual safety neurons that can be selectively targeted during alignment\.Wanget al\.\([2026](https://arxiv.org/html/2608.14626#bib.bib51)\)find a shared directional structure in refusal behavior across safety\-aligned languages, implying that multilingual safety alignment could depend on partially universal latent safety representations\.

Recent approaches also investigate how safety transfer can scale efficiently across many languages\.Bansal and Mishra \([2026](https://arxiv.org/html/2608.14626#bib.bib49)\)show that alignment learned from a carefully selected subset of languages can generalize broadly through multilingual representation clustering\. Complementing this direction,Buet al\.\([2026](https://arxiv.org/html/2608.14626#bib.bib16)\)introduces a multilingual consistency objective that explicitly enforces alignment agreement across languages, improving transfer without requiring extensive target\-language supervision\.

## 8Discussion

The common denominator for these four research questions is that the prevailing methodologies used for developing safety alignment are mostly based on English\-language data and have not been properly extended to accommodate the other languages of the world\. This imbalance spans from the data used in pre\-training to alignment procedures themselves as well as evaluation techniques\.

Methodologically speaking\(RQ1 and RQ4\), techniques like parameter\-efficient fine\-tuning, data synthesis, and cross\-lingual transfer might be helpful, yet they are poorly validated in the context of the African languages\. As long as the pre\-trained models lack coverage of these languages, the gains brought by such techniques are rather marginal\. Partly because, at the pre\-training stage, these models already under\-represent the languages, which makes recovery of any kind of multilingual representation impossible\.

A similar discrepancy appears in the safety risk landscape \(RQ2\)\. Issues such as cross\-lingual jailbreak transfer, code\-switching based vulnerabilities, and unintended safety degradation through benign fine\-tuning into new languages have been reported, but seldom evaluated\. Furthermore, culturally specific risks, such as those reported in HausaInuwa\-Dutse \([2025](https://arxiv.org/html/2608.14626#bib.bib6)\), are almost completely neglected in benchmarks designed with English\-centric assumptions\. According toVajjala \([2025](https://arxiv.org/html/2608.14626#bib.bib47)\), however, such limitations do not apply exclusively to models; annotation discrepancies and culturally biased benchmarks contribute to the inadequacy of evaluation measures\.

The evaluation landscape \(RQ3\) reveals a similar pattern\. While benchmarks for multiple languages continue to emerge, there is still limited representation of African languages\. Translation is still the primary strategy used in the creation of datasets, although this methodology has repeatedly demonstrated its ability to manipulate meanings and mislead safety annotations\.

Combined, these limitations create a reinforcing cycle whereby inadequate pre\-training coverage translates into poor representation, which then limits the capabilities of the alignment methods, whereas poor benchmarks limit the ability to assess the deficiencies\. To overcome this problem, we need to see progress on all fronts simultaneously, from moving away from translation\-based dataset building, to better native language benchmark creation, to creating alignment methods that take this problem into consideration\.

## 9Conclusion

This systematic literature review synthesized findings from 50 studies on LLM safety alignment in low\-resource language settings\. The review showed that current safety alignment approaches remain largely designed for high\-resource languages and do not generalize effectively across diverse linguistic and cultural contexts\. Existing benchmarks rely heavily on translated datasets that often fail to capture culturally grounded harms\. The findings further indicated that multilingual adaptation and fine\-tuning may reduce safety performance in low\-resource settings\. However, this review is limited to English\-language studies from major academic databases and may not fully represent locally published or recent research\. Additionally, grouping languages into broad regional categories may obscure important linguistic differences\. Future research should focus on native\-language safety benchmarks, balanced multilingual pre\-training, culturally aware evaluation methods, and participatory frameworks that actively involve African language communities in defining AI safety standards and practices\.

## References

- UbuntuGuard: a culturally\-grounded policy benchmark for equitable ai safety in african languages\.External Links:2601\.12696,[Link](https://arxiv.org/abs/2601.12696)Cited by:[§6\.3](https://arxiv.org/html/2608.14626#S6.SS3.p1.1)\.
- B\. Atil, R\. J\. Passonneau, and F\. Morstatter \(2025\)Do methods to jailbreak and defend llms generalize across languages?\.External Links:2511\.00689,[Link](https://arxiv.org/abs/2511.00689)Cited by:[§5\.1](https://arxiv.org/html/2608.14626#S5.SS1.p4.1)\.
- M\. F\. Azmi, M\. D\. Al Kautsar, A\. F\. Wicaksono, and F\. Koto \(2025\)IndoSafety: culturally grounded safety for LLMs in Indonesian languages\.InProceedings of the 2025 Conference on Empirical Methods in Natural Language Processing,C\. Christodoulopoulos, T\. Chakraborty, C\. Rose, and V\. Peng \(Eds\.\),Suzhou, China,pp\. 9135–9166\.External Links:[Link](https://aclanthology.org/2025.emnlp-main.465/),[Document](https://dx.doi.org/10.18653/v1/2025.emnlp-main.465),ISBN 979\-8\-89176\-332\-6Cited by:[§6\.2](https://arxiv.org/html/2608.14626#S6.SS2.p2.1)\.
- Y\. Bai, S\. Kadavath, S\. Kundu, A\. Askell, J\. Kernion, A\. Jones, A\. Chen, A\. Goldie, A\. Mirhoseini, C\. McKinnon, C\. Chen, C\. Olsson, C\. Olah, D\. Hernandez, D\. Drain, D\. Ganguli, D\. Li, E\. Tran\-Johnson, E\. Perez, J\. Kerr, J\. Mueller, J\. Ladish, J\. Landau, K\. Ndousse, K\. Lukosuite, L\. Lovitt, M\. Sellitto, N\. Elhage, N\. Schiefer, N\. Mercado, N\. DasSarma, R\. Lasenby, R\. Larson, S\. Ringer, S\. Johnston, S\. Kravec, S\. E\. Showk, S\. Fort, T\. Lanham, T\. Telleen\-Lawton, T\. Conerly, T\. Henighan, T\. Hume, S\. R\. Bowman, Z\. Hatfield\-Dodds, B\. Mann, D\. Amodei, N\. Joseph, S\. McCandlish, T\. Brown, and J\. Kaplan \(2022\)Constitutional ai: harmlessness from ai feedback\.External Links:2212\.08073,[Link](https://arxiv.org/abs/2212.08073)Cited by:[§1](https://arxiv.org/html/2608.14626#S1.p1.1)\.
- S\. Banerjee, R\. Hazra, and A\. Mukherjee \(2026\)Bridging the multilingual safety divide: efficient, culturally\-aware alignment for global south languages\.External Links:2602\.13867,[Link](https://arxiv.org/abs/2602.13867)Cited by:[§2](https://arxiv.org/html/2608.14626#S2.p1.1)\.
- S\. Banerjee, S\. Layek, P\. Chatterjee, A\. Mukherjee, and R\. Hazra \(2025\)Soteria: language\-specific functional parameter steering for multilingual safety alignment\.InFindings of the Association for Computational Linguistics: EMNLP 2025,C\. Christodoulopoulos, T\. Chakraborty, C\. Rose, and V\. Peng \(Eds\.\),Suzhou, China,pp\. 9347–9364\.External Links:[Link](https://aclanthology.org/2025.findings-emnlp.497/),[Document](https://dx.doi.org/10.18653/v1/2025.findings-emnlp.497),ISBN 979\-8\-89176\-335\-7Cited by:[§4\.3](https://arxiv.org/html/2608.14626#S4.SS3.p4.1)\.
- L\. Bansal and N\. Mishra \(2026\)CREST: universal safety guardrails through cluster\-guided cross\-lingual transfer\.External Links:2512\.02711,[Link](https://arxiv.org/abs/2512.02711)Cited by:[§7](https://arxiv.org/html/2608.14626#S7.p6.1)\.
- E\. Bayes, I\. A\. Azime, J\. O\. Alabi, J\. Kgomo, T\. Eloundou, E\. Proehl, K\. Chen, I\. Khadir, N\. A\. Etori, S\. H\. Muhammad, C\. Mpanza, I\. P\. Thete, D\. Klakow, and D\. I\. Adelani \(2024\)Uhura: a benchmark for evaluating scientific question answering and truthfulness in low\-resource african languages\.External Links:2412\.00948,[Link](https://arxiv.org/abs/2412.00948)Cited by:[§6\.3](https://arxiv.org/html/2608.14626#S6.SS3.p1.1)\.
- S\. Bell, E\. Sánchez, D\. Dale, P\. Stenetorp, M\. Artetxe, and M\. R\. Costa\-Jussà \(2025\)Translate, then detect: leveraging machine translation for cross\-lingual toxicity classification\.InProceedings of the Tenth Conference on Machine Translation,B\. Haddow, T\. Kocmi, P\. Koehn, and C\. Monz \(Eds\.\),Suzhou, China,pp\. 253–268\.External Links:[Link](https://aclanthology.org/2025.wmt-1.15/),[Document](https://dx.doi.org/10.18653/v1/2025.wmt-1.15),ISBN 979\-8\-89176\-341\-8Cited by:[§4\.1](https://arxiv.org/html/2608.14626#S4.SS1.p4.1)\.
- Y\. Bu, X\. Liu, Z\. Ren, Y\. Yang, and J\. Dai \(2026\)Align once, benefit multilingually: enforcing multilingual consistency for LLM safety alignment\.InThe Fourteenth International Conference on Learning Representations,Rio de Janeiro, Brazil\.External Links:[Link](https://openreview.net/forum?id=ueknOG1wXL)Cited by:[§4\.2\.2](https://arxiv.org/html/2608.14626#S4.SS2.SSS2.p3.1),[§7](https://arxiv.org/html/2608.14626#S7.p6.1)\.
- Z\. Chen, B\. Zhang, N\. Lin, T\. Hou, and L\. Wang \(2025\)Unlocking LLM safeguards for low\-resource languages via reasoning and alignment with minimal training data\.InProceedings of the 5th Workshop on Multilingual Representation Learning \(MRL 2025\),D\. I\. Adelani, C\. Arnett, D\. Ataman, T\. A\. Chang, H\. Gonen, R\. Raja, F\. Schmidt, D\. Stap, and J\. Wang \(Eds\.\),Suzhuo, China,pp\. 96–105\.External Links:[Link](https://aclanthology.org/2025.mrl-main.7/),[Document](https://dx.doi.org/10.18653/v1/2025.mrl-main.7),ISBN 979\-8\-89176\-345\-6Cited by:[§4\.2\.2](https://arxiv.org/html/2608.14626#S4.SS2.SSS2.p2.1)\.
- M\. Chrabąszcz, K\. Lorenc, and K\. Seweryn \(2025\)Evaluating llms robustness in less resourced languages with proxy models\.External Links:2506\.07645,[Link](https://arxiv.org/abs/2506.07645)Cited by:[§5\.1](https://arxiv.org/html/2608.14626#S5.SS1.p4.1)\.
- Y\. Deng, W\. Zhang, S\. J\. Pan, and L\. Bing \(2024\)Multilingual jailbreak challenges in large language models\.InThe Twelfth International Conference on Learning Representations,Vienna, Austria\.External Links:[Link](https://openreview.net/forum?id=vESNKdEMGp)Cited by:[§5\.1](https://arxiv.org/html/2608.14626#S5.SS1.p3.1)\.
- G\. A\. Faruna \(2026\)LSR: linguistic safety robustness benchmark for low\-resource west african languages\.External Links:2603\.19273,[Link](https://arxiv.org/abs/2603.19273)Cited by:[§6\.3](https://arxiv.org/html/2608.14626#S6.SS3.p1.1)\.
- Z\. Ge, G\. Chua, L\. Tan, and R\. K\. Lee \(2025\)Toxicity\-aware few\-shot prompting for low\-resource singlish translation\.External Links:2507\.11966,[Link](https://arxiv.org/abs/2507.11966)Cited by:[§4\.1](https://arxiv.org/html/2608.14626#S4.SS1.p6.1)\.
- M\. Goloburda, N\. Laiyk, D\. Turmakhan, Y\. Wang, M\. Togmanov, J\. Mansurov, A\. Sametov, N\. Mukhituly, M\. Wang, D\. Orel, Z\. M\. Mujahid, F\. Koto, T\. Baldwin, and P\. Nakov \(2025\)Qorǵau: evaluating safety in Kazakh\-Russian bilingual contexts\.InFindings of the Association for Computational Linguistics: ACL 2025,W\. Che, J\. Nabende, E\. Shutova, and M\. T\. Pilehvar \(Eds\.\),Vienna, Austria,pp\. 9765–9784\.External Links:[Link](https://aclanthology.org/2025.findings-acl.507/),[Document](https://dx.doi.org/10.18653/v1/2025.findings-acl.507),ISBN 979\-8\-89176\-256\-5Cited by:[§6\.2](https://arxiv.org/html/2608.14626#S6.SS2.p2.1)\.
- Y\. Hu, M\. S\. Hee, P\. Nakov, and R\. K\. Lee \(2025\)Toxicity red\-teaming: benchmarking LLM safety in Singapore’s low\-resource languages\.InProceedings of the 2025 Conference on Empirical Methods in Natural Language Processing,C\. Christodoulopoulos, T\. Chakraborty, C\. Rose, and V\. Peng \(Eds\.\),Suzhou, China,pp\. 12183–12201\.External Links:[Link](https://aclanthology.org/2025.emnlp-main.612/),[Document](https://dx.doi.org/10.18653/v1/2025.emnlp-main.612),ISBN 979\-8\-89176\-332\-6Cited by:[§6\.2](https://arxiv.org/html/2608.14626#S6.SS2.p2.1)\.
- C\. Huang, F\. Gao, N\. Tashi, Y\. Liu, X\. Wang, T\. Tsering, B\. Ma\-bao, X\. Feng, R\. Duojie, G\. Luosang, R\. Dongrub, D\. Tashi, H\. Wang, and Y\. Yu \(2026\)TFD: a comprehensive structured tibetan foundation dataset for low\-resource language processing and large\-scale modeling\.External Links:2503\.18288,[Link](https://arxiv.org/abs/2503.18288)Cited by:[§4\.1](https://arxiv.org/html/2608.14626#S4.SS1.p5.1)\.
- I\. Inuwa\-Dutse \(2025\)OpenAI’s gpt\-oss\-20b model and safety alignment issues in a low\-resource language\.External Links:2510\.01266,[Link](https://arxiv.org/abs/2510.01266)Cited by:[§1](https://arxiv.org/html/2608.14626#S1.p3.1),[§5\.4](https://arxiv.org/html/2608.14626#S5.SS4.p1.1),[§8](https://arxiv.org/html/2608.14626#S8.p3.1)\.
- D\. Jain, P\. Kumar, S\. Gehman, X\. Zhou, T\. Hartvigsen, and M\. Sap \(2024\)PolygloToxicityPrompts: multilingual evaluation of neural toxic degeneration in large language models\.External Links:2405\.09373,[Link](https://arxiv.org/abs/2405.09373)Cited by:[§6\.1](https://arxiv.org/html/2608.14626#S6.SS1.p2.1)\.
- R\. B\. Joshi, R\. Paul, K\. Singla, A\. Kamath, M\. Evans, K\. Luna, S\. Ghosh, U\. Vaidya, E\. M\. P\. Long, S\. S\. Chauhan, and N\. Wartikar \(2025\)CultureGuard: towards culturally\-aware dataset and guard model for multilingual safety applications\.InProceedings of the 14th International Joint Conference on Natural Language Processing and the 4th Conference of the Asia\-Pacific Chapter of the Association for Computational Linguistics,K\. Inui, S\. Sakti, H\. Wang, D\. F\. Wong, P\. Bhattacharyya, B\. Banerjee, A\. Ekbal, T\. Chakraborty, and D\. P\. Singh \(Eds\.\),Mumbai, India,pp\. 2666–2685\.External Links:[Link](https://aclanthology.org/2025.ijcnlp-long.144/),[Document](https://dx.doi.org/10.18653/v1/2025.ijcnlp-long.144),ISBN 979\-8\-89176\-298\-5Cited by:[§4\.1](https://arxiv.org/html/2608.14626#S4.SS1.p2.1)\.
- P\. Kumar, D\. Jain, A\. Yerukola, L\. Jiang, H\. Beniwal, T\. Hartvigsen, and M\. Sap \(2025\)PolyGuard: a multilingual safety moderation tool for 17 languages\.InSecond Conference on Language Modeling,Montreal, Canada\.External Links:[Link](https://openreview.net/forum?id=wbAWKXNeQ4)Cited by:[§6\.1](https://arxiv.org/html/2608.14626#S6.SS1.p1.1)\.
- J\. Liang, Z\. Wang, and H\. Wang \(2026\)Multilingual safety alignment via sparse weight editing\.External Links:2602\.22554,[Link](https://arxiv.org/abs/2602.22554)Cited by:[§4\.3](https://arxiv.org/html/2608.14626#S4.SS3.p2.1),[§7](https://arxiv.org/html/2608.14626#S7.p5.1)\.
- I\. Lim, S\. Khoo, W\. W\. K\. Chua, J\. Foo, J\. Y\. Goh, and R\. K\. Lee \(2025\)Safe at the margins: a general approach to safety alignment in low\-resource english languages – a singlish case study\.InSecond Workshop on Language Models for Underserved Communities \(LM4UC\),External Links:[Link](https://openreview.net/forum?id=x9KuyCwksR)Cited by:[§4\.2\.1](https://arxiv.org/html/2608.14626#S4.SS2.SSS1.p2.1)\.
- R\. C\. Ng, A\. Kumaresan, Y\. Hu, and R\. K\. Lee \(2026\)SEAHateCheck: functional tests for detecting hate speech in low\-resource languages of southeast asia\.External Links:2603\.16070,[Link](https://arxiv.org/abs/2603.16070)Cited by:[§6\.2](https://arxiv.org/html/2608.14626#S6.SS2.p2.1)\.
- Z\. Ning, T\. Gu, J\. Song, S\. Hong, L\. Li, H\. Liu, J\. Li, Y\. Wang, M\. Lingyu, Y\. Teng, and Y\. Wang \(2025\)LinguaSafe: a comprehensive multilingual safety benchmark for large language models\.External Links:2508\.12733,[Link](https://arxiv.org/abs/2508.12733)Cited by:[§6\.1](https://arxiv.org/html/2608.14626#S6.SS1.p1.1)\.
- L\. Ouyang, J\. Wu, X\. Jiang, D\. Almeida, C\. Wainwright, P\. Mishkin, C\. Zhang, S\. Agarwal, K\. Slama, A\. Gray, J\. Schulman, J\. Hilton, F\. Kelton, L\. Miller, M\. Simens, A\. Askell, P\. Welinder, P\. Christiano, J\. Leike, and R\. Lowe \(2022\)Training language models to follow instructions with human feedback\.InAdvances in Neural Information Processing Systems,A\. H\. Oh, A\. Agarwal, D\. Belgrave, and K\. Cho \(Eds\.\),New Orleans, Louisiana, United States of America\.External Links:[Link](https://openreview.net/forum?id=TG8KACxEON)Cited by:[§1](https://arxiv.org/html/2608.14626#S1.p1.1)\.
- M\. J\. Page, D\. Moher, P\. M\. Bossuyt, I\. Boutron, T\. C\. Hoffmann, C\. D\. Mulrow, L\. Shamseer, J\. M\. Tetzlaff, E\. A\. Akl, S\. E\. Brennan, R\. Chou, J\. Glanville, J\. M\. Grimshaw, A\. Hróbjartsson, M\. M\. Lalu, T\. Li, E\. W\. Loder, E\. Mayo\-Wilson, S\. McDonald, L\. A\. McGuinness, L\. A\. Stewart, J\. Thomas, A\. C\. Tricco, V\. A\. Welch, P\. Whiting, and J\. E\. McKenzie \(2021\)PRISMA 2020 explanation and elaboration: updated guidance and exemplars for reporting systematic reviews\.BMJ372\.External Links:[Document](https://dx.doi.org/10.1136/bmj.n160),[Link](https://www.bmj.com/content/372/bmj.n160),https://www\.bmj\.com/content/372/bmj\.n160\.full\.pdfCited by:[§3](https://arxiv.org/html/2608.14626#S3.p1.1)\.
- P\. Pattnayak and S\. Chowdhuri \(2026a\)IndicJR: a judge\-free benchmark of jailbreak robustness in South Asian languages\.InProceedings of the 19th Conference of the European Chapter of the Association for Computational Linguistics \(Volume 5: Industry Track\),Y\. Matusevych, G\. Eryiğit, and N\. Aletras \(Eds\.\),Rabat, Morocco,pp\. 649–668\.External Links:[Link](https://aclanthology.org/2026.eacl-industry.50/),[Document](https://dx.doi.org/10.18653/v1/2026.eacl-industry.50),ISBN 979\-8\-89176\-384\-5Cited by:[§5\.1](https://arxiv.org/html/2608.14626#S5.SS1.p4.1),[§6\.2](https://arxiv.org/html/2608.14626#S6.SS2.p2.1)\.
- P\. Pattnayak and S\. Chowdhuri \(2026b\)IndicSafe: a benchmark for evaluating multilingual llm safety in south asia\.External Links:2603\.17915,[Link](https://arxiv.org/abs/2603.17915)Cited by:[§6\.2](https://arxiv.org/html/2608.14626#S6.SS2.p2.1)\.
- R\. Paul, A\. Kamath, K\. Singla, R\. Joshi, U\. Vaidya, S\. S\. Chauhan, and N\. Wartikar \(2025\)Aligning large language models to low\-resource languages through LLM\-based selective translation: a systematic study\.InProceedings of the 1st Workshop on Benchmarks, Harmonization, Annotation, and Standardization for Human\-Centric AI in Indian Languages \(BHASHA 2025\),A\. Bhattacharya, P\. Goyal, S\. Ghosh, and K\. Ghosh \(Eds\.\),Mumbai, India,pp\. 69–82\.External Links:[Link](https://aclanthology.org/2025.bhasha-1.6/),[Document](https://dx.doi.org/10.18653/v1/2025.bhasha-1.6),ISBN 979\-8\-89176\-313\-5Cited by:[§4\.1](https://arxiv.org/html/2608.14626#S4.SS1.p4.1)\.
- E\. Perez, S\. Huang, F\. Song, T\. Cai, R\. Ring, J\. Aslanides, A\. Glaese, N\. McAleese, and G\. Irving \(2022\)Red teaming language models with language models\.InProceedings of the 2022 Conference on Empirical Methods in Natural Language Processing,Y\. Goldberg, Z\. Kozareva, and Y\. Zhang \(Eds\.\),Abu Dhabi, United Arab Emirates,pp\. 3419–3448\.External Links:[Link](https://aclanthology.org/2022.emnlp-main.225/),[Document](https://dx.doi.org/10.18653/v1/2022.emnlp-main.225)Cited by:[§1](https://arxiv.org/html/2608.14626#S1.p1.1)\.
- M\. Saeed, M\. Abdul\-mageed, and S\. Shehata \(2026\)Surfacing subtle stereotypes: a multilingual, debate\-oriented evaluation of modern llms\.External Links:2511\.01187,[Link](https://arxiv.org/abs/2511.01187)Cited by:[§5\.4](https://arxiv.org/html/2608.14626#S5.SS4.p2.1)\.
- W\. Shan, M\. Fu, R\. Yang, and C\. Tantithamthavorn \(2025\)SEALGuard: Safeguarding the Multilingual Conversations in Southeast Asian Languages for AI\-Powered Software\.In2025 2nd IEEE/ACM International Conference on AI\-powered Software \(AIware\),Vol\.,Los Alamitos, CA, USA,pp\. 197–206\.External Links:ISSN,[Document](https://dx.doi.org/10.1109/AIware69974.2025.00029),[Link](https://doi.ieeecomputersociety.org/10.1109/AIware69974.2025.00029)Cited by:[§4\.1](https://arxiv.org/html/2608.14626#S4.SS1.p3.1),[§6\.2](https://arxiv.org/html/2608.14626#S6.SS2.p1.1)\.
- L\. Shen, W\. Tan, S\. Chen, Y\. Chen, J\. Zhang, H\. Xu, B\. Zheng, P\. Koehn, and D\. Khashabi \(2024\)The language barrier: dissecting safety challenges of LLMs in multilingual contexts\.InFindings of the Association for Computational Linguistics: ACL 2024,L\. Ku, A\. Martins, and V\. Srikumar \(Eds\.\),Bangkok, Thailand,pp\. 2668–2680\.External Links:[Link](https://aclanthology.org/2024.findings-acl.156/),[Document](https://dx.doi.org/10.18653/v1/2024.findings-acl.156)Cited by:[§1](https://arxiv.org/html/2608.14626#S1.p3.1),[§2](https://arxiv.org/html/2608.14626#S2.p1.1),[§5\.1](https://arxiv.org/html/2608.14626#S5.SS1.p3.1),[§7](https://arxiv.org/html/2608.14626#S7.p3.1)\.
- H\. Shin and W\. Hwang \(2026\)Layer\-wise swapping for generalizable multilingual safety\.InProceedings of the 19th Conference of the European Chapter of the Association for Computational Linguistics \(Volume 1: Long Papers\),V\. Demberg, K\. Inui, and L\. Marquez \(Eds\.\),Rabat, Morocco,pp\. 2223–2238\.External Links:[Link](https://aclanthology.org/2026.eacl-long.98/),[Document](https://dx.doi.org/10.18653/v1/2026.eacl-long.98),ISBN 979\-8\-89176\-380\-7Cited by:[§4\.3](https://arxiv.org/html/2608.14626#S4.SS3.p3.1),[§7](https://arxiv.org/html/2608.14626#S7.p5.1)\.
- V\. Shukla, H\. Sharma, A\. N\. Reganti, S\. Wasmatkar, B\. Kumar, and V\. Singh \(2026\)Lost in translation? a comparative study on the cross\-lingual transfer of composite harms\.External Links:2602\.07963,[Link](https://arxiv.org/abs/2602.07963)Cited by:[§5\.4](https://arxiv.org/html/2608.14626#S5.SS4.p1.1)\.
- J\. Song, Y\. Huang, Z\. Zhou, and L\. Ma \(2025\)Multilingual blending: large language model safety alignment evaluation with language mixture\.InFindings of the Association for Computational Linguistics: NAACL 2025,L\. Chiruzzo, A\. Ritter, and L\. Wang \(Eds\.\),Albuquerque, New Mexico,pp\. 3433–3449\.External Links:[Link](https://aclanthology.org/2025.findings-naacl.191/),[Document](https://dx.doi.org/10.18653/v1/2025.findings-naacl.191),ISBN 979\-8\-89176\-195\-7Cited by:[§5\.3](https://arxiv.org/html/2608.14626#S5.SS3.p1.1)\.
- L\. Tan, G\. Chua, Z\. Ge, and R\. K\. Lee \(2025\)LionGuard 2: building lightweight, data\-efficient & localised multilingual content moderators\.InProceedings of the 2025 Conference on Empirical Methods in Natural Language Processing: System Demonstrations,I\. Habernal, P\. Schulam, and J\. Tiedemann \(Eds\.\),Suzhou, China,pp\. 264–285\.External Links:[Link](https://aclanthology.org/2025.emnlp-demos.20/),[Document](https://dx.doi.org/10.18653/v1/2025.emnlp-demos.20),ISBN 979\-8\-89176\-334\-0Cited by:[§4\.1](https://arxiv.org/html/2608.14626#S4.SS1.p3.1)\.
- P\. Tasawong, J\. G\. Ngui, A\. F\. Aji, T\. Cohn, and P\. Limkonchotiwat \(2025\)SEA\-safeguardbench: evaluating AI safety in SEA languages and cultures\.Rio de Janeiro, Brazil\.External Links:[Link](https://openreview.net/forum?id=ScVl9QlLpD)Cited by:[§6\.2](https://arxiv.org/html/2608.14626#S6.SS2.p1.1)\.
- B\. Upadhayay and V\. Behzadan \(2025\)Tongue\-tied: breaking LLMs safety through new language learning\.InProceedings of the 7th Workshop on Computational Approaches to Linguistic Code\-Switching,G\. I\. Winata, S\. Kar, M\. Zhukova, T\. Solorio, X\. Ai, I\. Hamed, M\. K\. K\. Ihsani, D\. T\. Wijaya, and G\. Kuwanto \(Eds\.\),Albuquerque, New Mexico, USA,pp\. 32–47\.External Links:[Link](https://aclanthology.org/2025.calcs-1.5/),[Document](https://dx.doi.org/10.18653/v1/2025.calcs-1.5),ISBN 979\-8\-89176\-053\-0Cited by:[§5\.2](https://arxiv.org/html/2608.14626#S5.SS2.p2.1),[§7](https://arxiv.org/html/2608.14626#S7.p3.1)\.
- S\. Vajjala \(2025\)The problem with safety classification is not just the models\.External Links:2507\.21782,[Link](https://arxiv.org/abs/2507.21782)Cited by:[§8](https://arxiv.org/html/2608.14626#S8.p3.1)\.
- N\. Verma and M\. Bharadwaj \(2025\)The hidden space of safety: understanding preference\-tuned llms in multilingual context\.External Links:2504\.02708,[Link](https://arxiv.org/abs/2504.02708)Cited by:[§7](https://arxiv.org/html/2608.14626#S7.p3.1)\.
- W\. Wang, Z\. Tu, C\. Chen, Y\. Yuan, J\. Huang, W\. Jiao, and M\. Lyu \(2024\)All languages matter: on the multilingual safety of LLMs\.InFindings of the Association for Computational Linguistics: ACL 2024,L\. Ku, A\. Martins, and V\. Srikumar \(Eds\.\),Bangkok, Thailand,pp\. 5865–5877\.External Links:[Link](https://aclanthology.org/2024.findings-acl.349/),[Document](https://dx.doi.org/10.18653/v1/2024.findings-acl.349)Cited by:[§6\.1](https://arxiv.org/html/2608.14626#S6.SS1.p1.1)\.
- X\. Wang, M\. Wang, Y\. Liu, H\. Schütze, and B\. Plank \(2026\)Refusal direction is universal across safety\-aligned languages\.External Links:2505\.17306,[Link](https://arxiv.org/abs/2505.17306)Cited by:[§7](https://arxiv.org/html/2608.14626#S7.p5.1)\.
- Y\. Yang, S\. Dan, S\. Li, D\. Roth, and I\. Lee \(2025\)MrGuard: a multilingual reasoning guardrail for universal LLM safety\.InProceedings of the 2025 Conference on Empirical Methods in Natural Language Processing,C\. Christodoulopoulos, T\. Chakraborty, C\. Rose, and V\. Peng \(Eds\.\),Suzhou, China,pp\. 27377–27396\.External Links:[Link](https://aclanthology.org/2025.emnlp-main.1392/),[Document](https://dx.doi.org/10.18653/v1/2025.emnlp-main.1392),ISBN 979\-8\-89176\-332\-6Cited by:[§4\.2\.2](https://arxiv.org/html/2608.14626#S4.SS2.SSS2.p1.1)\.
- Z\. X\. Yong, B\. Ermis, M\. Fadaee, S\. Bach, and J\. Kreutzer \(2025a\)The state of multilingual LLM safety research: from measuring the language gap to mitigating it\.InProceedings of the 2025 Conference on Empirical Methods in Natural Language Processing,C\. Christodoulopoulos, T\. Chakraborty, C\. Rose, and V\. Peng \(Eds\.\),Suzhou, China,pp\. 15845–15860\.External Links:[Link](https://aclanthology.org/2025.emnlp-main.800/),[Document](https://dx.doi.org/10.18653/v1/2025.emnlp-main.800),ISBN 979\-8\-89176\-332\-6Cited by:[§1](https://arxiv.org/html/2608.14626#S1.p2.1)\.
- Z\. X\. Yong, B\. Ermis, M\. Fadaee, S\. Bach, and J\. Kreutzer \(2025b\)The state of multilingual LLM safety research: from measuring the language gap to mitigating it\.InProceedings of the 2025 Conference on Empirical Methods in Natural Language Processing,C\. Christodoulopoulos, T\. Chakraborty, C\. Rose, and V\. Peng \(Eds\.\),Suzhou, China,pp\. 15845–15860\.External Links:[Link](https://aclanthology.org/2025.emnlp-main.800/),[Document](https://dx.doi.org/10.18653/v1/2025.emnlp-main.800),ISBN 979\-8\-89176\-332\-6Cited by:[§2](https://arxiv.org/html/2608.14626#S2.p1.1)\.
- Z\. X\. Yong, C\. Menghini, and S\. Bach \(2023\)Low\-resource languages jailbreak GPT\-4\.InSocially Responsible Language Modelling Research,New Orleans, United States\.External Links:[Link](https://openreview.net/forum?id=pn83r8V2sv)Cited by:[§1](https://arxiv.org/html/2608.14626#S1.p3.1),[§5\.1](https://arxiv.org/html/2608.14626#S5.SS1.p2.1)\.
- M\. Zhang, D\. Liu, K\. Zhang, J\. Franco, H\. Liu, and K\. Zhu \(2026a\)Response\-based knowledge distillation for multilingual jailbreak prevention unwittingly compromises safety\.In4th Deployable AI Workshop,Singapore Expo, Singapore\.External Links:[Link](https://openreview.net/forum?id=LR6rXdJAUX)Cited by:[§4\.2\.1](https://arxiv.org/html/2608.14626#S4.SS2.SSS1.p2.1)\.
- X\. Zhang, C\. Xie, L\. Zhu, Y\. Yang, W\. Zhao, Z\. Cheng, C\. Wang, F\. Shen, and T\. Chua \(2026b\)Who transfers safety? identifying and targeting cross\-lingual shared safety neurons\.External Links:2602\.01283,[Link](https://arxiv.org/abs/2602.01283)Cited by:[§7](https://arxiv.org/html/2608.14626#S7.p5.1)\.
- W\. Zhao, Y\. Hu, Y\. Deng, T\. Wu, W\. Zhang, J\. Guo, A\. Zhang, Y\. Zhao, B\. Qin, T\. Chua, and T\. Liu \(2025\)MPO: multilingual safety alignment via reward gap optimization\.InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),W\. Che, J\. Nabende, E\. Shutova, and M\. T\. Pilehvar \(Eds\.\),Vienna, Austria,pp\. 23564–23587\.External Links:[Link](https://aclanthology.org/2025.acl-long.1149/),[Document](https://dx.doi.org/10.18653/v1/2025.acl-long.1149),ISBN 979\-8\-89176\-251\-0Cited by:[§4\.2\.1](https://arxiv.org/html/2608.14626#S4.SS2.SSS1.p1.1)\.
- Y\. Zhao, Z\. Chen, X\. Ma, Y\. Jiang, and B\. Li \(2026\)ML\-bench&guard: policy\-grounded multilingual safety benchmark and guardrail for large language models\.External Links:2605\.00689,[Link](https://arxiv.org/abs/2605.00689)Cited by:[§6\.1](https://arxiv.org/html/2608.14626#S6.SS1.p2.1)\.

## Appendix AAppendix

![Refer to caption](https://arxiv.org/html/2608.14626v1/latex/cult.png)Figure 3:Safety Risks in Multilingual and low\-resource settings### A\.1Search Strings and Criteria

To extract the articles from these different databases, we used the following queries:

Table 1:Search strings per database\.Table 2:Inclusion \(I\) and exclusion \(E\) criteria\.InclusionI1Published or preprinted after January 2020\.I2Written in English\.I3Primary focus on LLM safety, adversarial robustness, toxicity detection, or content moderation\.I4Covers≥\\geq1 non\-English, low\-resource, or African language, or proposes methods applicable to such settings\.I5Peer\-reviewed or substantive preprint with methods and empirical results\.ExclusionE1Safety studied exclusively in English; no multilingual component or discussion\.E2Focused on classical NLP models \(LSTM, CNN\) with no connection to LLMs\.E3Safety is peripheral, not a primary contribution\.E4Editorial or opinion piece without empirical results\.E5Full text inaccessible\.
### A\.2LLM Usage: LLM Screening Prompt

The following prompt was submitted once per candidate record to Claude Sonnet \(claude\-sonnet\-4\.5\)\. No cross\-record context was provided\. The JSON output was parsed programmatically;decisionandjustificationwere appended as columns to the screening spreadsheet\.

> You are a systematic literature review assistant\. You will be given the title, abstract, and metadata of one academic paper\. Assess whether it is relevant to a review on LLM safety alignment for low\-resource and African languages\. Research questions: RQ1 \(alignment methods for low\-resource languages\), RQ2 \(safety risks and cultural harms in multilingual settings\), RQ3 \(datasets and benchmarks for low\-resource safety\), RQ4 \(cross\-lingual transfer of safety alignment\)\. Inclusion: I1 post\-2020, I2 English, I3 primary LLM safety focus, I4 covers or is applicable to low\-resource languages, I5 empirical content\. Exclusion: E1 English\-only, E2 non\-LLM models, E3 peripheral safety, E4 no empirical results, E5 inaccessible\. Paper\-\-\-Title: \{title\}\. Year: \{year\}\. Venue: \{venue\}\. Abstract: \{abstract\}\. Return ONLY valid JSON: \{"rqs\_addressed": \[\.\.\.\], "inclusion\_met": \[\.\.\.\], "exclusion\_triggered": \[\.\.\.\], "decision": "keep" \| "remove", "confidence": "high" \| "medium" \| "low", "justification": "one sentence"\}

### A\.3Further Analysis

The contrast in research coverage illustrated in Figure[4](https://arxiv.org/html/2608.14626#A1.F4)underpins the safety disparities quantified in Figure[3](https://arxiv.org/html/2608.14626#A1.F3)\. As shown in Figure[4](https://arxiv.org/html/2608.14626#A1.F4), English dominates across all study categories \(including benchmarks, alignment methods, and adversarial attacks\), while low\-resource languages remain confined to a long tail of minimal representation\. This imbalance in research attention is reflected in downstream safety performance\. Figure[3](https://arxiv.org/html/2608.14626#A1.F3)\(A\) shows that low\-resource languages exhibit cross\-lingual jailbreak failure rates more than seven times higher than those observed in high\-resource baselines\. Furthermore, Figure[3](https://arxiv.org/html/2608.14626#A1.F3)\(B\) highlights a clear separation in the risk–utility landscape: high\-resource languages cluster in a region characterized by low harmful output rates and limited utility degradation, whereas low\-resource and code\-switched settings occupy a high\-risk region marked by elevated harmful outputs and substantial utility loss\. Together, these results highlight a systematic disparity in safety alignment coverage and underscore the need for more equitable multilingual safety strategies\.

![Refer to caption](https://arxiv.org/html/2608.14626v1/latex/fig1.png)Figure 4:Languages Distribution Across Studies