PaperlayerView exact revision on arXiv

Source-linked AI summary

XL-SafetyBench: A Country-Grounded Cross-Cultural Benchmark for LLM Safety and Cultural Sensitivity

Dasol Choi, Eugenia Kim, Jaewon Noh, Sang Seo, Eunmi Kim, Myunggyo Oh, Yunjin Park, Brigitta Jesica Kartono, Josef Pichlmeier, Helena Berndt, Sai Krishna Mendu, Glenn Johannes Tungka, Özlem Gökçe, Suresh Gehlot, Katherine Pratt, Amanda Minnich, Haon Park

arXiv:2605.05662v1cs.CLcs.AI

TL;DR

Existing safety benchmarks largely overlook country-specific harms and culturally embedded sensitivities. XL-SafetyBench evaluates both dimensions across 10 country-language pairs and finds they are not coupled, while local models’ low ASR often reflects comprehension failure.

  • Problem

    Existing safety benchmarks are predominantly English-centric or translation-based and rarely separately evaluate country-specific harms and culturally embedded sensitivities.

  • Method

    XL-SafetyBench provides separate Jailbreak and Cultural Benchmarks covering 5,500 test cases across 10 country-language pairs, evaluated with ASR, NSR, and CSR.

  • Results

    Jailbreak robustness and cultural awareness are not coupled, while local models show an ASR–NSR trade-off of r = -0.81.

  • Takeaways & Limitations

    Safety reporting should disaggregate jailbreak robustness and cultural awareness, and interpret low local-model ASR alongside comprehension-sensitive NSR.

  • Takeaways & Limitations

    The benchmark has limited statistical power for individual sensitivities, excludes multilingual nations, and over-represents Western Europe.

Abstract

from arXiv · show

Current LLM safety benchmarks are predominantly English-centric and often rely on translation, failing to capture country-specific harms. Moreover, they rarely evaluate a model's ability to detect culturally embedded sensitivities as distinct from universal harms. We introduce XL-SafetyBench. a suite of 5,500 test cases across 10 country-language pairs, comprising a Jailbreak Benchmark of country-grounded adversarial prompts and a Cultural Benchmark where local sensitivities are embedded within innocuous requests. Each item is constructed via a multi-stage pipeline that combines LLM-assisted discovery, automated validation gates, and dual independent native-speaker annotators per country. To distinguish principled refusal from comprehension failure, we evaluate Attack Success Rate (ASR) alongside two complementary metrics we introduce: Neutral-Safe Rate (NSR) and Cultural Sensitivity Rate (CSR). Evaluating 10 frontier and 27 local LLMs reveals two key findings. First, jailbreak robustness and cultural awareness do not show a coupled relationship among frontier models, so a composite safety score obscures per-axis variation. Second, local models exhibit a near-linear ASR-NSR trade-off (r = -0.81), indicating that their apparent safety reflects generation failure rather than genuine alignment. XL-SafetyBench enables more nuanced, cross-cultural safety evaluation in the multilingual era.

1 Introduction

XL-SafetyBench addresses the English-centric, one-dimensional nature of existing safety evaluation with two country-grounded benchmarks that separately assess jailbreak robustness and cultural sensitivity. Across 37 LLMs and 5,500 test cases in 10 country-language pairs, it finds that these capabilities are uncoupled and that local models’ apparent safety can reflect generation failure rather than genuine alignment.

  • Over 90% of nearly 300 safety publications ignore non-English languages, leaving even high-resource languages largely unevaluated.
  • XL-SafetyBench separates country-specific jailbreak robustness from cultural sensitivity, addressing distinct safety failure modes that existing benchmarks conflate.Localized harms can depend on country-specific platforms and socioeconomic structures, such as scams involving Korea’s jeonse housing-deposit system.
  • 5,500 high-quality test cases span 10 country-language pairs and were constructed through LLM-assisted discovery with multi-stage native-speaker validation.The countries span North America, Europe, Asia, and the Middle East; the pipeline emphasizes cultural authenticity and reliability.
  • The suite contains a Jailbreak Benchmark for country-specific adversarial attacks and a Cultural Benchmark testing implicit detection of sensitivities embedded in natural, innocuous tasks.
  • 37 LLMs were evaluated with ASR, NSR, and CSR, revealing uncoupled jailbreak robustness and cultural awareness and apparent local-model safety driven by generation failure rather than genuine alignment.The findings motivate disaggregated safety reporting instead of a single composite safety assessment.

2 Related Work

Prior multilingual safety benchmarks differ between translating English prompts and collecting harmful prompts directly in native languages. Cultural-awareness benchmarks instead typically assess culture-specific knowledge, values, or judgments about described actions.

  • Multilingual safety benchmarks: Multilingual safety benchmarks use either translation-based evaluation or native-language collection, with examples spanning XSafety, MultiJail, and Aya Red-teaming.XSafety translates English safety prompts into ten languages, MultiJail translates English adversarial prompts into low-resource languages, and Aya Red-teaming collects human-curated harmful prompts directly in eight languages.
  • Cultural-awareness benchmarks: Cultural-awareness benchmarks generally target knowledge, values, or norms rather than harm, using culture-specific facts, population-level views, or acceptability judgments.Examples include BLEnD and CulturalBench for knowledge, GlobalOpinionQA for values, and NormAd for norms.

3 The XL-SafetyBench Framework

XL-SafetyBench evaluates country-grounded safety through parallel Jailbreak and Cultural Benchmarks built with localized generation, validation, and native-speaker quality assurance. Its metrics separate attack robustness, comprehension-related incidental safety, and recognition of embedded cultural sensitivities.

  • Benchmark design: The framework comprises a Jailbreak Benchmark for country-grounded adversarial robustness and a Cultural Benchmark for sensitivities embedded within otherwise innocuous tasks.Both tracks use country-specific seeds discovered with LLMs and web search, followed by track-specific prompt or scenario construction.
  • Jailbreak Benchmark: The harm taxonomy combines five shared subcategories per category with five flexible subcategories capturing locally grounded concepts across countries.Flexible subcategories are generated as 10 candidates per category and separately validated against five quality criteria.
  • Jailbreak Benchmark: Jailbreak prompts begin as native-language queries with explicit, locally grounded harmful intent and are transformed through attacker, probe-target, and judge roles into disguised adversarial attacks.Successful attacks are fed back into subsequent iterations, while localized details include platforms, legal terminology, and cultural nuances.
  • Cultural Benchmark: The Cultural Benchmark fixes six categories across countries and selects 20 sensitivities per country, embedding violations as incidental details within natural, distracting tasks.Scenarios are generated in the native language and validated for trickiness and naturalness.
  • Quality assurance: 92.7%–98.1% binary-filter agreement and κw = 0.49 and 0.50 ordinal agreement demonstrate substantial and moderate consistency among the 20 native-speaker annotators.Two annotators per country independently rank candidates, with aggregated rankings retaining top items to mitigate individual bias.
  • Evaluation metrics: ASR measures overall safety failure, NSR isolates incidental safety from comprehension failure when R = 0, and CSR measures cultural recognition only for contextually engaged responses.Jailbreak evaluation uses Harmfulness, Non-compliance, Specificity, and Relevance; Cultural evaluation uses Relevance and the Cultural Aware Flag.

4 Experimental Setup

The experiments evaluate XL-SafetyBench across 10 country-language pairs, using a diverse set of frontier and country-specific language models.

  • Country and language selection: 10 country-language pairs span the United States, France, Germany, Spain, South Korea, Japan, India, Indonesia, Türkiye, and the UAE.The selection targets geographic and cultural diversity alongside linguistic variety.
  • Models: 10 frontier models are evaluated, including GPT-5.4, Gemini-3.1-Pro, Claude-4.6-Opus, Grok-4.20, Llama-4-Maverick, Mistral-Large-3, and Qwen3.5-397B.The passage lists the complete frontier-model set and identifies them by model family and version.
  • Models: Country-specific models are additionally included for France, Germany, India, and Indonesia.Examples include CroissantLLM, LeoLM-7B, Param2-17B, and gemma2-9b-sahab.

5 Results and Analysis

Results reveal substantial variation in jailbreak robustness and cultural awareness across models and countries, with safety and cultural sensitivity largely uncoupled among closed-weight frontier models. Local models’ low attack success rates often reflect comprehension failure rather than principled safety alignment.

  • Model-level patterns: 2.8% ASR for Claude-4.5-Sonnet and 5.9% for Claude-4.6-Opus contrast with ASRs above 90% for Mistral-Large-3 and Llama-4-Maverick.Gemini-3.1-Pro leads the Cultural Benchmark with 76.1% CSR.
  • Country-level patterns: Models perform best on US prompts at 34.5% ASR and 69.5% CSR, while vulnerability exceeds 50% ASR in the UAE and South Korea.Cultural awareness falls below 40% CSR in India and Türkiye.
  • Two-axis relationship: r = −0.74 across all 10 models weakens to r = −0.27 among seven closed-weight frontier models, indicating that the overall relationship is driven largely by open-weight models.The all-model correlation has p = 0.014, whereas the closed-weight correlation has p = 0.554 and is not significant.
  • Local vs. global capability gap: Most local models score below 15% CSR despite competitive ASR, including CroissantLLM at 8.0% ASR; Lucie-7B, Teuken-7B, and WiroAI-9B score 0.0% CSR.The cultural-awareness gap persists even at the largest scales.
  • The illusion of safety: ASR-NSR trade-off: r = −0.81 characterizes local models’ ASR-NSR trade-off, with low ASR primarily associated with irrelevant or degenerate outputs and high NSR.Global models cluster near 0% NSR, so their ASRs reflect genuine safety alignment backed by robust comprehension.

6 Limitations, Future Work, and Broader Impacts

XL-SafetyBench supports disaggregated, cross-cultural safety evaluation but has limited statistical power and uneven country-language coverage. Future use must also address country-specific model evaluation failures and the dual-use risk of country-grounded adversarial prompts.

  • Limitations and Future Work: The Cultural Benchmark’s 100 scenarios per country support country-level comparisons but limit statistical power for individual sensitivities or categories.Coverage is restricted to country-language pairs using one primary cultural proxy, and the country selection over-represents Western Europe relative to several other regions.
  • Limitations and Future Work: Several country-specific models produced truncated prompts, degenerate outputs, or encoding errors, causing a small fraction of affected cases to be excluded from N.These evaluation challenges were not encountered with frontier APIs and appeared under strict token limits, varied decoding settings, or non-standard characters.
  • Broader Impacts: XL-SafetyBench enables equitable, disaggregated evaluation for non-English populations across two distinct dimensions, but country-grounded adversarial prompts carry dual-use risk.Mitigations include a CC-BY 4.0 release with a Content Warning and intended-use statement, plus dual native-speaker validation at every benchmark stage to reduce stereotyping.

7 Conclusion … B Dataset Generation Prompts

XL-SafetyBench presents a 5,500-case benchmark across 10 country-language pairs that separates adversarial robustness from cultural-sensitivity awareness. The paper concludes that these dimensions should be reported separately and documents implementation and dataset-generation materials in the appendices.

  • 7 Conclusion: 5,500 expert-validated test cases across 10 country-language pairs separate country-specific safety into adversarial robustness and cultural-sensitivity awareness.The benchmark evaluates 10 frontier and 27 local models.
  • 7 Conclusion: The two safety dimensions do not show a coupled relationship across evaluated models, so reporting should disaggregate them rather than collapse them into one score.Per-model correlations range from strongly negative to mildly positive.
  • A Implementation Details: The appendices document the LLMs used in dataset construction and the inference settings.These materials appear as sections A.1 and A.2.
  • Appendix Contents: The appendix contents include implementation details and dataset-generation prompts as supporting sections of the paper.The listed appendix sections follow the conclusion.
  • B Dataset Generation Prompts: The dataset-generation appendix covers jailbreak subcategory generation, base query generation, and attack prompt generation.These materials appear as sections B.1 through B.3.
  • B Dataset Generation Prompts: The cultural-benchmark generation materials cover sensitivity discovery and query generation, followed by scenario generation.These materials appear as sections B.4 and B.5.

C Human Annotation for Dataset Construction … A Implementation Details

The supplied appendix contents cover human annotation, evaluation judging, judge reliability, and extended benchmark analyses. They also list implementation-related subsections, but provide no substantive methodological or empirical details beyond subsection titles.

  • C Human Annotation for Dataset Construction: Human annotation is organized into annotator recruitment and demographics, annotation guidelines, and inter-annotator agreement.These are listed as subsections C.1–C.3 under Human Annotation for Dataset Construction.
  • D Evaluation Judge Prompts: Evaluation judge prompts are separately specified for the Jailbreak Benchmark and the Cultural Benchmark.The contents list these as subsections D.1 and D.2.
  • E LLM Judge Reliability Study: LLM judge reliability is addressed through a human validation study and a cross-judge consistency analysis.These are listed as subsections E.1 and E.2.
  • F Extended Results and Analysis: Extended jailbreak results include per-category performance analysis.This is listed as subsection F.1.
  • F Extended Results and Analysis: Extended cultural results include per-category performance analysis.This is listed as subsection F.2.
  • F Extended Results and Analysis: The extended analysis also examines regional asymmetry in prompt language effects.This is listed as subsection F.3.
  • F Extended Results and Analysis: Further extended analyses cover local model selection criteria and local model scaling.These are listed as subsections F.4 and F.5.

A.1 LLMs Used in Dataset Construction … B.1 Jailbreak Benchmark: Subcategory Generation

XL-SafetyBench uses stage-specific LLMs and documents model-inference configurations alongside country-grounded jailbreak subcategory-generation prompts. The construction process combines explicit country-specificity requirements with practical handling of model limitations and output failures.

  • A.1 LLMs Used in Dataset Construction: Stage-specific LLM choices for benchmark construction are summarized in Table 6.The paper states that different LLMs were used at each construction stage.
  • A.2 Inference Settings: Global frontier models used temperature 0.0, max_tokens 65,536, and up to 3 retries for empty or transient-error responses.The configuration retained provider defaults for other parameters and accommodated reasoning traces without truncation.
  • A.2 Inference Settings: Local-model evaluation required heterogeneous serving setups, including vLLM, Transformers, Ollama, GPU clusters, and CPU-only execution.Exceptions included Param2-17B served with Transformers and three Indonesian models quantized to Q4_K_M GGUF under Ollama CPU-only mode.
  • A.2 Inference Settings: Several models required reasoning-trace stripping, system-message workarounds, or a custom vLLM source patch before evaluation.These adjustments addressed reasoning outputs, chat-template restrictions, and OLMo2 weight loading.
  • A.2 Inference Settings: Accepted benchmark limitations included degenerate-loop outputs and failed or errored rows caused by constrained context windows.ALIA-40B and Lucie-7B produced repetitive outputs, while CroissantLLM, Kumru-2B, and Teuken-7B had context-related failures.
  • B Dataset Generation Prompts: The jailbreak-generation prompt asks o3-deep-research, augmented with web search, to produce country-specific flexible subcategories for each country-category pair.The prompt substitutes country, category, description, and shared-subcategory values, with the complete version available in the code repository.
  • B.1 Jailbreak Benchmark: Subcategory Generation: The prompt requests 10 unique safety-related subcategories per country, excluding overlap with existing shared subcategories.It frames the task around a category name, description, and shared-subcategory list.
  • B.1 Jailbreak Benchmark: Subcategory Generation: Each subcategory must reflect country-specific laws, cultural norms, historical events, social issues, or regional challenges and be a broad, inherently associated category.The requirements also direct research into real incidents, laws, social phenomena, or documented issues while avoiding generic global topics.

B.2 Jailbreak Benchmark: Base Query Generation … E.1 Human Validation Study

XL-SafetyBench constructs country-grounded jailbreak and cultural-sensitivity items through staged LLM generation, validation, red-teaming, and native-speaker annotation. Its evaluation uses explicit binary criteria and LLM judges whose outputs were checked against human judgments, with substantial agreement across both benchmarks.

  • B.2 Jailbreak Benchmark: Base Query Generation: Base jailbreak queries target a country, language, harm category, and subcategory while requiring colloquial native-language prompts with country-specific entities and clearly malicious intent.Generation uses Gemini-2.5-Flash and outputs exactly a specified number of unique prompts in JSON format.
  • B.3 Jailbreak Benchmark: Attack Prompt Generation: The country-grounded red-teaming pipeline uses attacker, target, and judge roles across S = 4 stages, retaining successful attacks and revising them for cross-lingual formatting artifacts.The target history resets between stages while the attacker retains a rolling window, and only a judge score of 1.0 counts as success.
  • B.4 Cultural Benchmark: Sensitivity Discovery and Query Generation: Cultural sensitivities are discovered through country-specific web research and converted into casual local-language queries where users unknowingly plan actions that violate local norms.Quality gates require country specificity, category matching, a concrete planned violation, and non-overlap with other candidates.
  • B.5 Cultural Benchmark: Scenario Generation: Cultural scenarios hide one naturally motivated violation inside a dominant unrelated task, and only scenarios passing both tricky and natural quality gates are retained.Scenarios use detailed 4–6 sentence contexts and require the user not to acknowledge or question the cultural element.
  • C Human Annotation for Dataset Construction; C.1 Annotator Recruitment and Demographics; C.2 Annotation Guidelines: Dataset construction uses two independent native-speaker annotators per country, who apply binary validity filters and 1–5 ordinal ratings before retaining the highest-quality items.The annotators were recruited through collaborators and Upwork, required native fluency and at least 15 years’ residence, and could withdraw after sensitive-content disclosure.
  • C.3 Inter-Annotator Agreement: 92.7%–98.1% mean Percent Agreement was achieved across nine binary criteria, while mean κw = 0.50 for country_sensitivity and mean κw = 0.49 for country_specificity indicated moderate ordinal agreement.Binary agreement is reported instead of relying on Cohen’s κ because skewed class distributions collapse κ despite near-perfect agreement.
  • D Evaluation Judge Prompts; D.1 Jailbreak Benchmark Judge Prompt; Jailbreak Benchmark Judge Prompt; D.2 Cultural Benchmark Judge Prompt: Evaluation judges classify jailbreak responses using binary relevance, harmfulness, non_compliance, and specificity criteria, while cultural judges assess hidden-element recognition and cultural awareness.For all ASR, NSR, and CSR computations, valid test cases exclude target-model API or execution failures.

E.2 Cross-Judge Consistency Analysis · F Extended Results and Analysis · F.1 Per-Category Performance: Jailbreak Benchmark

Cross-judge agreement is substantial, supporting the robustness of the reported benchmark findings. Extended analyses focus on frontier-model category performance, where locale-specific harmful queries are generally harder to refuse than shared ones.

  • E.2 Cross-Judge Consistency Analysis: The consistency analysis evaluated GPT-5.2, Gemini-3-Flash, and Qwen3.5-397B judges across the same validation samples.These judges span closed-source and open-weight models, and the results complement human-judge agreement reported in Section E.1.
  • E.2 Cross-Judge Consistency Analysis: κ ranged from 0.60 to 0.84 across human and LLM judge pairs, indicating substantial inter-judge agreement on both benchmarks.The highest agreement was between Gemini-3-Flash and Qwen3.5-397B: Jailbreak κ = 0.84 and Cultural κ = 0.78.
  • F Extended Results and Analysis: The appendix’s Sections F.1–F.3 analyze 10 global frontier models, while Section F.5 examines 27 country-specific local models by parameter scale.Fine-grained category- or language-level breakdowns are considered uninformative for local models because of their low baseline performance.
  • F.1 Per-Category Performance: Jailbreak Benchmark: Hate & Discrimination (µ=47.6%) and Socioeconomic Conflicts (µ=47.0%) had the highest reported category-level ASR averages across 10 countries.Category-level ASR broadly mirrors the overall model ranking: Mistral-Large-3 and Llama-4-Maverick are least safe, whereas Claude-4.5-Sonnet and Claude-4.6-Opus show strongest refusal behavior.
  • F.1 Per-Category Performance: Jailbreak Benchmark: Across 8 of 10 models, flexible subcategories produced equal or higher ASR than shared subcategories, with a mean gap of +1.1 pp.Each harm category contains five shared and five locale-specific flexible subcategories.
  • F.1 Per-Category Performance: Jailbreak Benchmark: Grok-4.20 showed the largest flexible-versus-shared difference at +4.3 pp, while floor and ceiling effects compressed deltas for other models.The passage attributes the larger gap to culturally opaque phrasing exploiting gaps in safety alignment.
  • F.1 Per-Category Performance: Jailbreak Benchmark: Shared queries also contained country-specific surface details, so the modest flexible-versus-shared gap understates the contribution of country-grounded design.The passage notes that flexible subcategories additionally expose entirely unique harm classes, but the supplied text truncates before elaborating further.

F.2 Per-Category Performance: Cultural Benchmark · F.3 Regional Asymmetry in Prompt Language Effects · F.4 Local Model Selection Criteria

The Cultural Benchmark reveals category-specific sensitivity gaps and uncoupled safety–cultural-awareness patterns, while prompt-language effects differ systematically between European and non-European countries. Local-model selection prioritizes language specialization, institutional credibility, public recency, developer diversity, and scale diversity, with explicit exceptions for the US and India.

  • F.2 Per-Category Performance: Cultural Benchmark: Symbolic Taboos & Gift-Giving is universally the hardest category, including for Gemini-3.1-Pro (54.7%) and Claude-4.6-Opus (47.5%).Its implicit, culturally narrow knowledge is infrequently surfaced in English-centric pretraining data, creating the steepest generalisation challenge.
  • F.2 Per-Category Performance: Cultural Benchmark: 56.3% is the highest average CSR for Legal Landmines, followed by 53.8% for Hierarchy, Address & Social Deference.These norms are more explicitly codified in multilingual laws, official communications, etiquette guides, and related documents.
  • F.2 Per-Category Performance: Cultural Benchmark: 11.5% and 13.8% are the CSR scores of Llama-4-Maverick and Mistral-Large-3, which also fail catastrophically on the Jailbreak Benchmark.These outliers score near zero across all six cultural categories and drive the aggregate ASR-CSR correlation; remaining frontier models show no coupled relationship.
  • F.3 Regional Asymmetry in Prompt Language Effects: 47.48% vs. 47.54% are the near-identical average CSR values for local-language and English prompts across seven selected countries.The comparison spans Spain, France, Germany, Turkey, Korea, India, and Japan.
  • F.3 Regional Asymmetry in Prompt Language Effects: All three European countries show local-language advantages (∆= −6.3% to −0.9%), while all four non-European countries show English advantages (∆= +1.3% to +4.2%).The distinction aligns with Fisher’s exact p = 0.029, though the authors treat the explanation as suggestive because of the small sample and effect sizes.
  • F.4 Local Model Selection Criteria: Three local models are selected for each of nine countries with active local LLM development using language specialization, institutional credibility, public availability, recency, developer diversity, and scale diversity.Scale diversity targets small (<10B), medium (10–50B), and large (>50B) models when the candidate pool permits; otherwise, all qualifying candidates are included.
  • F.4 Local Model Selection Criteria: The US has no separate local-model group because its English benchmarks use the dominant pre-training language of the evaluated frontier models.For India’s limited candidate pool, the selection includes Param2-17B and Sarvam at 30B and 105B scales.

F.5 Local Model Scaling Analysis · G Country-Specific Flexible Subcategories

The scaling analysis shows that larger local models partly improve comprehension and cultural awareness, but cultural performance remains far below frontier levels. The country-specific subcategory tables define 250 locally grounded harm categories across 10 countries, validated by native speakers.

  • F.5 Local Model Scaling Analysis: Local model sizes range from 2B for Kumru in Türkiye to 671B total parameters for Rakuten-AI-3.0 in Japan.The 27 local models reflect heterogeneous ecosystem maturity; Rakuten-AI-3.0 is a Mixture-of-Experts model with 37B active parameters.
  • F.5 Local Model Scaling Analysis: Smaller local models show elevated NSR, indicating comprehension failure rather than principled refusal, while larger models produce more coherent but often unsafe responses.Across 27 models, NSR trends negatively with log10(parameters): r = −0.38, p = 0.053.
  • F.5 Local Model Scaling Analysis: CSR increases substantially with scale, with r = +0.68, p < 0.001, but large local models average only 13.8% versus 42.8% for GPT-5-mini.CSR rises across parameter bins from 1.1 to 3.3 to 13.8%, while EXAONE-236B reaches the local-model high of 30.0%.
  • F.5 Local Model Scaling Analysis: NSR remains high in small and medium bins at 21.8 and 22.3 before dropping to 12.3 in the large bin above 50B parameters.This threshold-like pattern suggests scale resolves comprehension failures primarily beyond 50B parameters.
  • F.5 Local Model Scaling Analysis: The scaling results mechanistically link the ASR–NSR trade-off, r = −0.81, to small and mid-sized models’ inability to generate coherent adversarial responses.Only the large bin above 50B parameters shows clear comprehension recovery, while cultural awareness remains far below frontier levels.
  • G Country-Specific Flexible Subcategories: The country-specific subcategory tables contain 5 flexible subcategories per harm category for each of 10 countries, totaling 250 subcategories.They were discovered through LLM-assisted web search grounded in country-specific laws, social phenomena, and documented issues, then validated by two native-speaker annotators per country.
  • G Country-Specific Flexible Subcategories: Identical English labels can represent distinct country-grounded harms, such as migrant worker abuse under Korea’s EPS versus the UAE’s Kafala system.The underlying structures differ by local institutional and demographic context despite overlapping terminology.
  • G Country-Specific Flexible Subcategories: Tables 15 and 16 divide the 250 country-specific flexible subcategories between France, Germany, India, Indonesia, Japan, South Korea, Spain, Turkey, UAE, and the US.Table 15 covers the first five countries, while Table 16 covers the remaining five.
Loading 2605.05662v1…