Why Low-Resource Languages Break AI Safety Training

One of the more counterintuitive, well-documented findings in AI safety research is that a model's refusal behavior doesn't transfer evenly across every language it can speak. The same harmful request that a model reliably refuses in English can succeed at a meaningfully higher rate in a language with thin representation in the safety-training data — even when the model is otherwise fluent in that language.

The research

The original study on this, from Brown University researchers, tested this systematically and found translated requests in low-resource languages like Zulu and Scots Gaelic reached bypass rates of 43–53% against models that reliably refused the same requests in English. A 2026 follow-up specifically testing Afrikaans and Kiswahili against Claude 3.5 Haiku found real, non-trivial success rates using the same underlying pattern — and found the effect was strongest across multi-turn conversations rather than a single translated message. Combining more than one low-resource language in the same attempt raised the bypass rate further in the original research, to roughly 79%.

Why it happens

Safety training — the reinforcement learning and fine-tuning that teaches a model to refuse harmful requests — is overwhelmingly conducted in high-resource languages, English chief among them, simply because that's where the training data and human feedback are most abundant. The model's underlying capability to understand and respond fluently in a low-resource language often outpaces the safety training's coverage of that same language. The result is a real, measurable gap: the model can do the task, but hasn't been taught as thoroughly to refuse doing it, in that specific language.

It's worth being precise about which languages actually show this effect. High-resource languages like Spanish and Mandarin — despite not being English — generally don't show the same gap, because they have substantial safety-training coverage of their own. The effect is specifically about resource scarcity in training data, not simply about "not being English."

What this means for testing an AI agent

If an AI agent's security testing only happens in English, this entire category of real, published, reproducible vulnerability goes completely untested. It's not an edge case — it's one of the few technique categories with genuinely strong published success rates against major model families. Any serious assessment needs to test in more than one language, and specifically needs to include low-resource languages rather than defaulting to the obvious high-resource ones, since the research is clear about which category actually carries the risk.