Rainbow-Teaming for the P olish Language: A Reproducibility Study (2025)

Abstract: The development of multilingual large language models (LLMs) presents challenges in evaluating their safety across all supported languages. Enhancing safety in one language (e.g., English) may inadvertently introduce vulnerabilities in others. To address this issue, we implement a methodology for the automatic creation of red-teaming datasets for safety evaluation in Polish language. Our approach generates both harmful and non-harmful prompts by sampling different risk categories and attack styles. We test several open-source models, including those trained on Polish data, and evaluate them using metrics such as Attack Success Rate (ASR) and False Reject Rate (FRR). The results reveal clear gaps in safety performance between models and show that better testing across languages is needed.

## introduction the rise of multilingual large language models (llms), including those explicitly designed for multiple languages like aya @xcite and those demonstrating multilingual capabilities like @xcite , @xcite , llama @xcite , and gemma @xcite , presents a significant security challenge. automatic red-teaming is widely used for safety evaluation @xcite , but its englishcentric approach may leave multilingual llms vulnerable in other languages. this is particularly concerning for languages underrepresented in safety training data, such as polish. this paper addresses this concern by implementing a methodology for generating harmful and nonharmful datasets for polish. we develop an adversarial prompt generation framework that constructs harmful and non-harmful prompts using a taxonomy of 14 risk categories and 10 attack styles, based on the rainbow teaming methodol-ogy @xcite . we apply our method to evaluate the safety performance of several opensource llms, including models from the llama and mistral families-both general-domain variants and pllum models foot_0 , which were fine-tuned on polish data and then aligned using the orpo method @xcite . additionally, we compare these results with bielik, a publicly available llm designed specifically for polish. by analyzing the attack success rate (asr) and false reject rate (frr), we reveal significant disparities across models. notably, only the pllum family models, which were fine-tuned and explicitly red-teamed on polish data, exhibit low asr. in contrast, general models aligned on english data fail to generalize effectively to polish adversarial prompts. our findings highlight the need for more comprehensive multilingual safety evaluations and underscore the importance of languageaware safety alignment in llm development. ## methodology in this section, we present our methodology for generating red-teaming datasets in polish. our approach is straightforward, effective and can be extended to other languages. ## conclusions balancing safety and usefulness in llms is challenging. when models are made safer (lower asr), they often become less helpful (higher frr). the ideal balance depends on the application: in safetycritical areas like medicine, reducing asr is more important, while in general tasks, a lower frr ensures the model remains useful. our results show that tested models from the pllum family are more secure but sometimes overly cautious, while general-language llama, mixtral, and mistral models may be more permissive in polish than in english. this suggests that multilingual safety alignment is still an open problem. achieving the right balance requires careful dataset design, especially during model fine-tuning. future work should focus on improving safety measures without making models excessively restrictive, ensuring they perform well across different languages and contexts.