PaperlayerView exact revision on arXiv

Source-linked AI summary

Who Pays More for Safety? Measuring the Disparate Cost of Safety Alignment across Languages

Chanwoong Yoon, Jungsoo Park, Alan Ritter

arXiv:2608.22490v1cs.CL

TL;DR

Safety alignment can reduce response utility, but whether that cost is equal across languages remains underexplored. The paper isolates Safety Cost through direct aligned–unaligned comparisons and finds that non-English users consistently bear more of it than English users.

  • Problem

    The paper asks whether safety alignment imposes the same utility cost across languages, a question inadequately answered by evaluations using only safety-aligned models.

  • Method

    The paper measures Safety Cost by directly comparing safety-aligned models with unaligned counterparts across languages, using benign queries that activate safety mechanisms.

  • Results

    Non-English users consistently bear higher Safety Cost than English users, with disparities involving explicit refusals and implicit losses in informational depth and factual precision.

  • Takeaways & Limitations

    The findings expose a structural disparity in contemporary safety alignment and support developing more equitable safety mechanisms.

  • Takeaways & Limitations

    The protocol is limited to open-weight models because establishing an unaligned baseline requires removing existing safety mechanisms from accessible model weights.

Abstract

from arXiv · show

Safety alignment helps models adhere to human values, but it often reduces response utility. We ask a critical but understudied question: Does safety alignment impose the cost equally across language groups? To answer this, we introduce a rigorous protocol to measure the utility loss imposed solely by safety alignment, which we term Safety Cost. Through direct pairwise comparisons between safety-aligned models and their unaligned counterparts, we find a systematic inequity: non-English users consistently bear a higher Safety Cost than English users. We further identify three underlying patterns. First, multiple languages lie in a double-penalty zone, experiencing both weaker safety protection and larger utility loss. Second, certain languages exhibit apparent utility gains that are in fact a consequence of safety filters failing to engage. Third, even high-resource languages pay a larger Safety Cost than English to reach the same level of safety. We show that these disparities arise from both explicit refusals and implicit qualitative differences across multiple dimensions. By accurately measuring the disparate effects of safety alignment, our findings expose a systematic disparity in current safety alignment practices.

1 Introduction

The paper asks whether safety alignment imposes equal utility costs across languages and introduces a protocol to isolate that cost. It finds higher Safety Cost for non-English users, including weaker protection paired with greater utility degradation.

  • Safety alignment prevents harmful outputs but can reduce helpfulness through utility costs such as over-refusal.Models may incorrectly reject or hedge on harmless queries.
  • Prior absolute cross-language evaluations cannot distinguish alignment-induced disparities from pre-existing language capability gaps.They typically evaluate only one safety-aligned model, obscuring the source of disparity.
  • The protocol defines Safety Cost as utility degradation directly introduced by safety alignment and measures it by comparing aligned models with unaligned counterparts.The unaligned model provides a reference baseline for unconstrained utility.
  • Non-English users consistently experience higher Safety Cost than English users despite multilingual safety training.The paper identifies weaker protection with higher cost, inactive filters that create misleading utility gains, and higher costs for high-resource languages seeking comparable safety.
  • Safety-alignment disparities include implicit quality degradation, with compliant responses losing informational depth and factual precision.The findings motivate equitable safety mechanisms.

2 Experimental Design

The experimental design defines Safety Cost on benign queries that activate safety mechanisms and isolates alignment effects through aligned–unaligned model comparisons. It quantifies language-specific cost and compares each language with English.

  • Evaluation scope: Safety alignment is defined as post-training interventions targeting harmful outputs, while broader measures such as harmful-data filtering are excluded.The scope includes safety-focused supervised fine-tuning and preference optimization such as RLHF or DPO.
  • Safety Cost definition: Safety Cost measures utility loss on benign queries where helpful, compliant responses are safe and expected.This separates the paper’s overall utility-loss measure from narrower uses of “Safety Tax” focused on reasoning degradation.
  • Isolation protocol: Direct comparison with an unaligned counterpart factors out pre-existing capability gaps and isolates utility loss attributable to post-training safety alignment.The unaligned model serves as the response-utility baseline.
  • Evaluation suite: Standard evaluations miss collateral damage because safety and utility are usually measured on separate prompt sets, while benign tasks rarely trigger safety mechanisms.The paper therefore uses seemingly sensitive but safe over-refusal tasks.
  • Measurement: Safety Cost for language L is the probability that the unaligned model is preferred over the aligned model in pairwise helpfulness evaluation.In practice, it is estimated as the unaligned model’s helpfulness win rate against the aligned model.
  • Cross-linguistic comparison: Marginal Safety Cost compares each language with English, with a positive value indicating greater alignment-induced utility reduction than English users incur.English is used as the empirical baseline because pretraining and alignment pipelines are heavily English-centric.

3 Experiments

The experiments compare aligned and unaligned models across languages to measure how safety alignment changes safety and utility. They find that non-English languages generally incur higher Safety Cost, including cases of weaker protection and disproportionate cost even at similar safety levels.

  • Experimental Setup: The evaluation compares aligned and unaligned models across multilingual over-refusal benchmarks, using four model families and 1,800 prompts across English and five non-English languages.The benchmarks target prompts at the intersection of safety triggers and benign intent.
  • Metrics and Analysis: Safety Gain measures improved safety after alignment, while Safety Cost measures utility lost from alignment; Figure 2 plots these metrics against an English baseline.Safety Gain uses unsafe-response rates on a multilingual Jailbreak benchmark, while Safety Cost averages utility loss across three over-refusal benchmarks.
  • Results: Non-English languages generally incur higher Safety Cost than English, with Qwen2.5 and Gemma-3 showing larger disparities while Llama-3.3 deviates less.Thai is an exception on Llama-3.3, showing slightly higher Safety Gain and Safety Cost; the passage links this to the model’s official support for Thai.
  • Results: Most non-English languages occupy a double penalty zone with weaker safety protection and heavier utility loss simultaneously.This pattern indicates that lower Safety Gain does not necessarily correspond to lower Safety Cost.
  • Results: Qwen3’s seemingly low Safety Cost in some languages reflects safety mechanisms failing to engage, leaving users exposed to more harmful outputs.These languages predominantly occupy Figure 2’s bottom-left quadrant, combining low Safety Gain with low measured Safety Cost.
  • Results: High-resource languages such as Chinese can achieve Safety Gain nearly identical to English while still incurring disproportionate Safety Cost, with larger gaps generally appearing for lower-resource languages.The reported cost gap is |CostL − CostEnglish|.

4 Analysis

The analysis finds that Safety Cost reflects both explicit refusals and implicit quality degradation, and that it is distinct from pre-existing language-performance deficits. Controlled validation and human-judgment checks support the robustness of these findings.

  • 4.1 Is the Safety Cost Driven Only by Refusal Behavior?: On OR-Bench-Hard, mirrored refusal-rate and Safety Cost patterns indicate that refusals are the primary contributor across languages and models.The benchmark’s prompts lie close to the safety boundary, making refusals easier to elicit.
  • 4.1 Is the Safety Cost Driven Only by Refusal Behavior?: On XSTest and OR-Bench, refusal differences approach zero while Safety Cost remains substantial, revealing implicit qualitative degradation beyond explicit refusals.These hidden differences include subtler response-quality losses detectable through fine-grained pairwise evaluation.
  • 4.2 What Drives Implicit Utility Degradation Beyond Refusal?: Informativeness—especially Info_Usability and Coverage_Scope—is the dominant label category, followed by Correctness_Reliability and Clarity_Structure across languages and model families.The stable label distribution indicates that implicit utility differences chiefly concern actionable, comprehensive, clear, and reliable responses.
  • 4.3 Is the Safety Cost an Artifact of Pre-existing Language Deficits?: Figure 5 compares Alignment Gap Difference on the x-axis with Marginal Safety Cost on the y-axis to test whether language-specific capability losses confound Safety Cost.Alignment Gap Difference measures the target language’s benign-task alignment gap relative to English.
  • 4.3 Is the Safety Cost an Artifact of Pre-existing Language Deficits?: Most points cluster near x ≈ 0 while Marginal Safety Cost is positive for most non-English languages, indicating Safety Cost is decoupled from disproportionate benign-task performance loss.Mean absolute deviation from zero ranges from 0.56 for Llama-3.3-70B to 1.93 for Qwen2.5-72B.
  • 4.4 Validating Safety Cost without Refusal-Direction Ablation: Two independent estimators agree that the Safety-Cost gap also arises in a fully controlled train-from-base setting, not only under refusal-direction ablation.The estimators diverge for Chinese, reflecting different alignment-data treatment in the released and newly trained models.

5 Related Work

Prior work has documented alignment-related harms beyond representational bias, including quality-of-service penalties and linguistic disparities. This paper situates its focus on whether safety alignment imposes unequal utility costs across languages.

  • Safety alignment produces an alignment tax through broad capability declines and false refusals of user requests.
  • Traditional language-model bias research emphasized representational harms and stereotypes in embeddings and generated text.
  • Alignment-related bias can produce quality-of-service harms, reward preference bias, performance penalties, and covert discrimination.
  • Safety mechanisms have been associated with demographic, persona-driven, and mainstream-language-norm biases.

6 Conclusion

The paper measures safety-alignment utility loss across languages by comparing aligned models with unaligned counterparts. It finds higher Safety Cost for non-English users, expressed through explicit refusals and implicit quality degradation.

  • Non-English users consistently bear higher Safety Cost than English users under direct aligned-versus-unaligned comparisons.
  • The disparity includes explicit refusals and implicit degradation in informational depth and factual precision.

Limitations

The limitations constrain both the linguistic scope and the precision of the safety-ablation comparison. The study focuses on language boundaries and open-weight models, while acknowledging that abliteration may affect other latent capacities.

  • The analysis uses language boundaries rather than finer-grained linguistic identities such as dialects and sociolects.The authors identify broader linguistic styles and dialects as future work.
  • The safety-ablation process may not perfectly isolate safety components because it can marginally affect other latent capacities.Full retraining with and without safety alignment would be more controlled but is described as prohibitively expensive and largely infeasible.
  • The direct comparative protocol is limited to open-weight models because it requires removing existing safety mechanisms.It cannot be directly applied to closed-source models with proprietary weights and alignment procedures.

Ethical considerations

The study frames its objective as exposing structural inequalities in safety alignment while using public datasets and avoiding novel harmful-content generation. Its evaluation relies on an unaligned counterpart produced through weight orthogonalization.

  • The research aims to highlight structural inequalities in current safety-alignment paradigms and support more equitable AI systems.
  • The experiments use established public datasets and do not generate novel harmful content.
  • Abliteration estimates a refusal direction from harmful-versus-benign prompt pairs and projects residual-stream and MLP weights orthogonal to it.
  • Raw pretrained models are unsuitable unaligned proxies because lacking instruction-following abilities can introduce severe noise into utility comparisons.
  • Pure weight orthogonalization is intended to remove safety constraints while preserving base knowledge and instruction-following abilities.
  • Additional harmful fine-tuning after ablation can recover general-capability nuances but would introduce a confounding variable into utility comparisons.

A.4 Experimental Details

The evaluation samples and translates over-refusal benchmarks across languages, then uses position-balanced pairwise judging to quantify Safety Cost. Multiple validation checks support that translation quality and target-language judging do not explain the observed disparity.

  • Dataset and translation: 100 prompts per dataset were sampled from XSTest, OR-Bench, and OR-Bench-Hard and translated into target languages with GPT-4.1.The benchmarks are designed to elicit over-refusal rather than generic benign-task performance.
  • Pairwise evaluation: Pairwise evaluations swap aligned and unaligned response positions to mitigate positional bias.GPT-5-mini judges each pair twice, once in each presentation order.
  • Pairwise evaluation: Win rates use five-point judge labels converted to Arena-Hard weighted scores, averaged first per instance and then overall.The two swapped evaluations are combined into an instance-level score before aggregation.
  • Translation validation: Translation quality remains high across languages, with Chinese scoring 0.77 CometKiwi and only about 0.06 units separating the best and worst languages.The cross-lingual translation-quality gap is much smaller than the Safety Cost gap.
  • Translation validation: Native-speaker ratings confirm semantic preservation, with Korean and Chinese fidelity around 4.7–4.8 out of 5 and 82% of prompts receiving maximum fidelity.No prompt received a rating of 1 on either validation scale.
  • Judging validation: Back-translated English re-evaluation changes Safety Cost by at most ±0.07 and essentially zero on average.This test examines whether judging in the target language biases the results.

B.2 Judge Robustness

Robustness checks show that the cross-lingual Safety Cost disparity persists across judges and after controlling for response length. Length matching reduces the raw magnitude, but substantial disparities remain.

  • Cross-judge replication: GPT-5.2 agrees with GPT-5-mini within 0.025 absolute win rate and preserves the identical language ranking Korean > Thai > Chinese.The cross-lingual Safety Cost gap relative to English remains fully preserved.
  • Response length: The overall median unaligned-to-aligned response-length ratio is close to 1.0, with Gemma-3 and Qwen2.5 non-English medians between 0.9 and 1.1.The unaligned model is not systematically more verbose for the two families with positive disparities.
  • Length-matched analysis: Length matching retains 66% of pairs and reduces the disparity by roughly 30%, indicating that response length contributes to but does not fully explain the raw effect.The matched comparison uses the symmetric ratio band r ∈[0.67, 1.5].
  • Length-matched analysis: +19.3 to +13.3 for Gemma-3 and +10.9 to +8.0 for Qwen2.5 remain after length matching.These retain 69% and 73% of the respective effects.

B.4 Human Correlation Experiment Details

The human correlation experiment compares native-speaker annotations with automated pairwise judgments. Agreement is substantial across languages, and most disagreements concern tie boundaries rather than reversed preferences.

  • Annotation setup: Three annotators, each a native speaker of English, Korean, or Chinese, independently assessed the pairwise responses.Native-language assignment was intended to capture subtle linguistic effects on perceived quality.
  • Annotation protocol: Annotators used three-way judgments—A wins, tie, or B wins—instead of the automated judge’s five-point scale.The simplified protocol reduced annotation complexity.
  • Agreement results: κ = 0.657, 0.627, and 0.646 for English, Korean, and Chinese, respectively, with no agreement drop for non-English languages.All three values fall within the substantial-agreement range.
  • Disagreement analysis: Only 20 of 292 verdicts, or 6.8%, are hard disagreements that reverse the preferred response.The other 47 disagreements are tie-boundary calls where the winning direction agrees.
  • Disagreement analysis: Directional agreement reaches 88–93% when both annotator and judge select a clear winner.This restriction excludes ties and focuses on preference direction.

C.2 Matched-Checkpoint Replication

The matched-checkpoint experiment constructs aligned and genuinely unaligned checkpoints, while documenting scope constraints and controls. Its benign-task control indicates that the disparity is tied to safety-boundary activation rather than a general language-specific effect.

  • Checkpoint construction: The unaligned c0 checkpoint receives no safety data, while c1 adds the OLMo 3 safety recipe alongside multilingual instruction tuning.The safety recipe includes WildJailbreak and CoCoNot components.
  • Scope limitation: Korean is excluded because the trained 8B checkpoints often produce degenerate output, making pairwise evaluation unreliable.The exclusion reflects a limitation of the small checkpoints, not a property of Korean.
  • Scope limitation: The matched-checkpoint experiment is limited to one model family, Qwen3, whose safety mechanism under-activates outside English.The experiment tests agreement between two estimators rather than reproducing the headline disparity across other families.
  • Ordinary-benign control: The benign control samples 300 safety-unrelated Just-Eval instructions and translates them using the main evaluation procedure.Safety-related instances are removed before translation and evaluation.
  • Ordinary-benign control: For Gemma-3, disparity falls from +19.3 to +6.2, while Qwen2.5 falls from +10.9 to −0.1 on ordinary benign prompts.The disparity largely disappears outside prompts expected to engage the safety mechanism.
  • Practitioner implications: Safety Cost is proposed as a diagnostic to reveal language-specific utility regressions that refusal rates alone can miss.The paper recommends reporting Safety Cost alongside refusal rates to expose uneven burdens across languages.
Loading 2608.22490v1…