SEA-Guard: Culturally Grounded Multilingual Safeguard for Southeast Asia

Panuthep Tasawong; Jian Gang Ngui; Alham Fikri Aji; Trevor Cohn; Peerat Limkonchotiwat

Source-linked AI summary

SEA-Guard: Culturally Grounded Multilingual Safeguard for Southeast Asia

Panuthep Tasawong, Jian Gang Ngui, Alham Fikri Aji, Trevor Cohn, Peerat Limkonchotiwat

arXiv:2602.01618v1Feb 2, 2026cs.CL

TL;DR

Existing multilingual safeguards often rely on translated English data that misses Southeast Asian linguistic and cultural nuances, while culturally grounded datasets are difficult to scale. The paper addresses this gap with an agentic SEA-specific data synthesis framework and SEA-Guard models trained across eight languages. SEA-Guard achieves state-of-the-art cultural-safety performance, remains competitive on generic safety, and improves baselines in six of seven unseen vision-language cases.

Problem
Machine-translated safeguard datasets often perform poorly for SEA languages and omit culturally sensitive topics, while scalable culturally nuanced annotation is challenging.
Method
SEA-Guard uses an agentic SEA-specific synthesis framework to generate, annotate, verify, and filter culturally grounded safety data across 8 SEA languages and 53 cultural categories.
Results
SEA-Guard achieves state-of-the-art performance on cultural safety, remains competitive on generic safety, and improves the baseline in 6 of 7 unseen vision-language cases.
Takeaways & Limitations
SEA-Guard provides regional safeguard models designed for Southeast Asian languages and cultures while retaining broad safety performance across text and vision-text evaluations.
Takeaways & Limitations
The models cover 8 SEA languages but exclude Khmer, Lao, Telugu, and more than 700 SEA dialects and languages because benchmarks are unavailable.

Abstract

from arXiv · show

Culturally aware safeguards are crucial for AI alignment in real-world settings, where safety extends beyond common sense and encompasses diverse local values, norms, and region-specific regulations. However, building large-scale, culturally grounded datasets is challenging due to limited resources and a scarcity of native annotators. Consequently, many safeguard models rely on machine translation of English datasets, often missing regional and cultural nuances. We present a novel agentic data-generation framework to scalably create authentic, region-specific safety datasets for Southeast Asia (SEA). On this foundation, we introduce the SEA-Guard family, the first multilingual safeguard models grounded in SEA cultural contexts. Evaluated across multiple benchmarks and cultural variants, SEA-Guard consistently outperforms existing safeguards at detecting regionally sensitive or harmful content while maintaining strong general safety performance.

1 Introduction

Existing safeguards are strongest in English but often miss Southeast Asian linguistic and cultural nuances, motivating SEA-Guard’s culturally grounded multilingual approach. The paper introduces an agentic synthesis framework and evaluates SEA-Guard across regional and general safety settings.

Existing safeguards primarily target English, leaving multilingual SEA safety comparatively underaddressed.
Machine-translated datasets often mishandle SEA languages and omit culturally sensitive topics, weakening performance on regional content.The paper highlights food, traditions, history, and localities as examples of omitted cultural topics.
A culturally grounded example shows SOTA safeguards failing to block a harmful prompt assuming all Indonesians are Muslim.The case motivates safeguards with region-specific cultural understanding and multilingual support.
SEA-Guard is trained across 8 SEA languages and uses a synthesis framework that generates culturally nuanced data with agentic annotation and verification.The framework produces 870K samples per language across 53 SEA cultural categories and supports 4B, 8B, and 12B variants.
SEA-Guard achieves state-of-the-art cultural-safety performance, remains competitive on generic safety, and improves baselines in 6 of 7 unseen vision-language cases.The paper also reports robustness to under- and overdefensiveness and adversarial attacks.
The paper evaluates its contribution through SEA cultural, generic multilingual, and zero-shot vision-text safety benchmarks aligned with three research questions.

2 SEA-Guard

SEA-Guard formulates culturally grounded SEA training data through structured requirements, guided multilingual generation, agentic annotation, and uncertainty-aware verification. Its MCRE-based labeling supports scalable safety annotation but is substantially slower than single-pass safeguards, making it better suited to offline dataset construction.

Data and model formulation: SEA-Guard addresses the lack of culturally diverse, multilingual SEA safety data by designing a dedicated cultural safety dataset-generation framework.The framework targets SEA-specific cultural knowledge and low-resource languages rather than relying only on translated English data.
Input formulation: The framework organizes generation around requirements and guidelines covering cultural topics, countries, prompt types, and label types.It prioritizes metadata combinations with fewer samples to improve dataset balance and uses step-by-step guidelines modeled after human annotation protocols.
Prompts and responses formulation: Guidelines, personas, and target languages are combined to generate SEA-specific prompts and responses that better capture local contexts.Personas encode country, age, and sex, while target-language conditioning supports countries with multiple SEA languages; prompt paraphrasing is used to mitigate keyword bias.
Data annotation and quality assurance: MCRE performs multiple stochastic reasoning passes and aggregates predictions into a class-probability distribution for labeling and verification.The method uses N = 10 for prompt and response annotation, with prompt labels based on the prompt alone and response labels based on the full prompt-response pair.
Data annotation and quality assurance: The annotation taxonomy uses Safe, Sensitive, and Harmful labels, while a five-way ordinal space represents ambiguity before mapping predictions back to three levels.Fixed harmfulness thresholds discretize the continuous score into the final safety labels.
Limitations: MCRE requires N stochastic generations per input and is over two orders of magnitude slower than single-pass reflective safeguards, limiting it to offline use.The paper presents the overhead as acceptable for large-scale dataset annotation but impractical for real-time deployment.

3 Experimental Setup

The experimental setup compares SEA-Guard with same- or similar-sized safeguard models and commercial APIs across SEA-specific, multilingual, and vision-text safety benchmarks. The evaluation includes culturally sensitive SEA data, translated generic safety data, and zero-shot vision-text tasks.

Competitive methods: SEA-Guard is compared with ShieldGemma, LlamaGuard, PolyGuard, LionGuard-2, X-Guard, Qwen3Guard, and several safeguards APIs.The model-based competitors are safety-finetuned LLMs based on Llama3, Gemma2, or Qwen3.
Benchmarks and metrics: SEA-SafeguardBench evaluates generic yet culturally sensitive SEA safety, including In-the-Wild and Content Generation subsets.It is developed specifically for SEA cultures.
Benchmarks and metrics: SEALS is a generic multilingual safety benchmark translated from WildGuardMix using Google Translate without human verification.This provides a translated-data comparison point distinct from the culturally specific SEA benchmark.
Benchmarks and metrics: SafeQA provides a generic response-safety benchmark whose instances are annotated through joint human and AI annotation.The evaluation also includes VSCBench, VLGuard, MSSBench-Chat, and MSSBench-Embodied for vision-text safety.

4 Experimental Results

SEA-Guard is evaluated across SEA cultural, generic multilingual, and zero-shot vision-text safety benchmarks. It achieves leading cultural-safety performance, generalizes beyond its training distribution, and improves competing models in most vision-text settings.

SEA Cultural Safety Results: SEA-Guard-12B achieves the best prompt and response classification scores on SEA-SafeguardBench, scoring 79.5 and 75.2, respectively.Its prompt–response performance gap is smaller than ShieldGemma’s 19.9-point gap, indicating more consistent task performance.
SEA Cultural Safety Results: Across SEA languages, SEA-Guard-12B’s performance gaps remain below one point, demonstrating strong cross-lingual robustness.The 4B and 8B variants also show similarly small cross-language gaps.
SEA Cultural Safety Results: Models trained on translated data or lacking SEA-specific linguistic and cultural design perform poorly on cultural benchmarks.These results underscore cultural grounding and broad multilingual support as important for SEA-context generalization.
Generic Safety Results: Despite no generic safety-data training, SEA-Guard-12B outperforms Qwen3Guard-Gen 8B on prompt classification and has only a 0.6-point response-classification gap.It consistently outperforms Qwen3Guard-Gen 8B on prompt classification across all SEA languages.
Zero-shot Vision-text Safety Results: SEA-Guard outperforms competing models in six of seven zero-shot vision-text settings.The exception is VLGuard on response classification; the experiments use no vision-safety training data.

5 Analysis

The analysis examines human alignment, adversarial robustness, and dataset scale with deduplication. SEA-Guard shows stronger severity alignment and attack robustness, while larger, deduplicated data improves coverage and performance.

Human Alignment: SEA-Guard models achieve higher Spearman and Pearson scores and clearer separation across human-judged severity levels than competing safeguards.Middle-severity cases remain difficult, limiting reliable calibration and threshold-based control.
Robustness to Adversarial Attack: Whitespace perturbations reduce predicted harmfulness across models, but SEA-Guard maintains higher harmfulness scores under adversarial attacks.Larger SEA-Guard variants show the most stable distributions under perturbation.
Dataset Size and Deduplication Study: Performance does not increase monotonically between 200k and 600k samples, while substantial gains appear at 1M samples per SEA language.The pattern suggests diminishing returns and possible noise accumulation at intermediate scales.
Dataset Size and Deduplication Study: The deduplicated dataset achieves performance comparable to the full 1M-sample setting despite using fewer samples.Smaller datasets cover rare, culturally specific, and adversarial cases less effectively.

6 Related Works

Prior multilingual safeguard work commonly relies on synthetic prompting, reasoning, or translation, while cultural data-generation frameworks have focused mainly on high-resource languages. SEA languages remain comparatively underexplored because they are low-resource and poorly supported by many LLMs.

Multilingual Safeguards: Prior multilingual safeguards adapt LLMs using multilingual prompting, reasoning, or English-translated synthetic safety datasets.These approaches remain largely unexplored for SEA languages, which are low-resource and poorly supported by many LLMs.
Cultural Data Generation: Existing cultural data-generation frameworks focus primarily on high-resource languages using LLMs such as GPT-4.Recent SEA-focused datasets have begun addressing this gap through human-annotated and synthetic data.

7 Conclusion

SEA-Guard is a regional safeguard for Southeast Asia supporting eight languages and three model sizes. It achieves state-of-the-art cultural safety performance and strong zero-shot vision-text results, with additional analyses indicating robustness across several safety dimensions.

SEA-Guard supports 8 languages and is available in 4B, 8B, and 12B sizes.
SEA-Guard achieves state-of-the-art performance on the cultural safety benchmark.
SEA-Guard outperforms other models on vision-text benchmarks in the zero-shot setting.
Analyses confirm robustness on human alignment, adversarial attack, and data duplication.

Limitations

The evaluation covers eight SEA languages but omits several languages and hundreds of dialects because suitable benchmarks are unavailable. The authors also exclude the smallest model sizes and note risks associated with harmful content in the datasets.

Khmer, Lao, Telugu, and over 700 SEA dialects and languages are not covered because benchmarks in those languages are unavailable.
The authors emphasize the need for safety evaluation benchmarks and greater attention to Southeast Asia.
The study does not experiment on 0.5B models because their performance is considered unreliable for safety use.

Ethics Statement

The framework uses structured, multi-agent generation and verification to create culturally grounded safety data. It combines requirements, guidelines, personas, multilingual prompts, augmentation, classification, and semantic-equivalence checks.

Native SEA-language annotators were hired and screened through annotation tests, with opt-out available for uncomfortable processes.
Structured input-output schemas enforce consistent communication between agents and verification of generated outputs.
Requirements sample country, topic, usage, and label attributes with inverse-frequency weighting to promote balanced coverage.The probabilities are normalized, reducing repeated selection of high-frequency values and producing more uniform attribute sampling.
A guideline agent transforms terse requirements into procedural guidance, while prompt agents use personas and target languages to generate diverse English and native-language prompts.Each requirement produces 12 prompts, and paraphrased variants keep responses fixed to reduce reliance on superficial wording.
Culture, topic, and usage classifiers act as a verification gate before multiple LLMs generate corresponding responses.A semantic-equivalence classifier checks whether augmented prompts preserve the original prompt's intent.

D Training Configuration

SEA-Guard is fine-tuned with a fixed training configuration on 870k samples per SEA language. Repeated training runs showed less than 0.2-point variation for both prompt and response classification.

SEA-Guard uses supervised fine-tuning on 870k samples per SEA language.Training uses context length 8,192, batch size 6, one epoch, learning rate 5e−6, and warmup ratio 1.0.
Three training runs differed by less than 0.2 points for both prompt and response classification.The reported results use the model with medium performance rather than the best-performing run.

E MCRE Results

MCRE improves culturally nuanced safety annotation by aggregating multiple stochastic reasoning trajectories, with alignment gains stabilizing around N = 10. The ablation also shows that removing MCRE or using a single reasoning chain degrades performance.

MCRE Ablation: Increasing Monte Carlo samples N consistently improves prompt and response classification, while N = 1 or removing MCRE causes notable degradation.The ablation evaluates N from 1 to 40, with N = 1 representing single-chain-of-thought inference without aggregation.
Model-Human Alignment: MCRE substantially improves alignment between model-predicted harmfulness and human-judged severity as N increases.The comparison uses model-human alignment on SEA-SafeguardBench.
Model-Human Alignment: Alignment gains stabilize around N = 10, while single-pass reasoning remains weaker on rank and linear correlations with human judgments.N = 1 improves over the w/o MCRE baseline but has noticeably weaker Spearman and Pearson correlations.
Interpretation: Aggregating multiple stochastic reasoning trajectories produces more calibrated judgments for fine-grained and borderline severity distinctions than single-pass reasoning.The evidence attributes the sharp degradation without MCRE to difficulty capturing nuanced severity distinctions.
Data Deduplication: The data-deduplication procedure trains a lightweight bias model and prunes samples with high confidence under shallow lexical statistics.The method targets redundant or over-represented easy lexical patterns in the training data.
Data Deduplication: The bias model uses a binary bag-of-words representation with token-label associations encoded by θ and computed using localized mutual information.The construction is described as deterministic and based on corpus-level token-label co-occurrence statistics.

G Full Results

The full-results section reports prompt and response classification across general, cultural content-generation, and cultural in-the-wild subsets. Results are separated by English and SEA-language settings where cross-lingual samples are present.

General Subset: Tables 5 and 6 report prompt and response classification performance on the General subset.The tables cover general prompt classification and general response classification separately.
Cultural Content Generation: Tables 7–10 report prompt and response classification on the Cultural Content Generation subset across English and SEA-language settings.Tables 7 and 8 use English samples, while Tables 9 and 10 use samples translated by annotators into SEA languages.
Cultural In-The-Wild: Tables 11 and 12 report prompt classification on the Cultural In-The-Wild subset for English-written and SEA-language samples.The two tables separate samples written in English from samples written in SEA languages by annotators.