Qorǵau: Evaluating Safety in K azakh- R ussian Bilingual Contexts (2025)

Abstract: Large language models (LLMs) are known to have the potential to generate harmful content, posing risks to users. While significant progress has been made in developing taxonomies for LLM risks and safety evaluation prompts, most studies have focused on monolingual contexts, primarily in English. However, language- and region-specific risks in bilingual contexts are often overlooked, and core findings can diverge from those in monolingual settings. In this paper, we introduce Qorǵau, a novel dataset specifically designed for safety evaluation in Kazakh and Russian, reflecting the unique bilingual context in Kazakhstan, where both Kazakh (a low-resource language) and Russian (a high-resource language) are spoken. Experiments with both multilingual and language-specific LLMs reveal notable differences in safety performance, emphasizing the need for tailored, region-specific datasets to ensure the responsible and safe deployment of LLMs in countries like Kazakhstan. Warning: this paper contains example data that may be offensive, harmful, or biased.

## introduction large language models (llms) have demonstrated impressive performance across various tasks, but they can also generate harmful or unsafe outputs, raising concerns about their responsible use. while there has been a lot of research on llm safety, it has primarily focused on english or on monolingual region-specific environments @xcite , and limited attention has been paid to multilingual contexts. this gap is significant because models often behave differently across languages due to variations in their training data, linguistic structure, and cultural nuances. for instance, llms trained predominantly on english or other high-resource languages may * these authors contributed equally. misinterpret regional contexts, overlook important cultural sensitivities, or fail to address the needs of users in low-resource language communities @xcite . in bilingual settings, such as in kazakhstan, where kazakh and russian are both widely used, additional complexities arise as users tend to switch between kazakh and russian within the same sentence. these challenges underscore the importance of evaluating llms in diverse linguistic and cultural settings in order to ensure that they function reliably and safely for all users. in this study, we aim to bridge this gap by introducing a new dataset specifically curated for evaluating the safety of llms in the bilingual context of kazakh and russian. the dataset includes regionspecific and culturally relevant prompts tailored for kazakhstan, allowing us to assess how llms handle risks that are unique to this country. we evaluated the responses of twelve llms, including both multilingual (gpt-4o, claude, and llama) and language-specific ones (yandexgpt, vikhr-nemo, aya101). we found that claude was the safest model for kazakh, while yandexgpt was the safest for russian; aya101 and kazllm-1.0-8b rank lowest for kazakh and russian, respectively. we further perform fine-grained analysis of how llms respond to risky questions. safe responses take the form of a rejection to answer, or providing well-rounded statements or disclaimers, while unsafe responses may include harmful or misleading content, or privacy violations. the results show that for both languages, safe responses primarily offer generic information. safe responses in russian are more evenly distributed across six fine-grained categories, indicating that when prompting in russian, the models we tested exhibit greater nuance than when prompted in kazakh. a similar trend was observed for unsafe responses, where models prompted in russian exhibit more diverse types of harmful content. these highlight notable differences of llm behavior across kazakh and russian, emphasizing the importance of addressing safety concerns in bilingual regions. this paper makes three major contributions: ## related work kazakhstan is a multilingual and multiethnic country in central asia. kazakh is the state language, while russian serves as the language of interethnic communication and is widely used in business, government, and education for historical and practical reasons. as a result of this bilingual environment, code-switching between kazakh and russian is common. this unique linguistic landscape demands that llms must effectively and safely operate monolingually for kazakh and russian, but also multilingually over code-mixed content. ## dataset to evaluate llm safety in kazakh and russian bilingual contexts, we developed a region-specific dataset based on the "chinese do-not-answer" dataset (cdna: wang et al. (2024c) ). the process involved: (i) translating and localizing cdna questions; (ii) creating region-specific prompts tailored to the unique safety concerns of kazakhstan and russia; and (iii) collecting code-switched prompts. the dataset covers six risk areas (17 harm types), ensuring comprehensive coverage of potential harms. ## safety evaluation we collected responses from 12 llms, including multilingual, kazakh-centric, and russian-centric llms, in the form of both open-and closed-weight models, and then performed a rigorous two-step evaluation to classify and analyze the potential harm of these responses. ## results and analysis in this section, we first present safe vs. unsafe evaluation results for 12 llms, followed by finegrained responding pattern analysis over six models among them, and compare models' behavior when they are attacked by same risky questions presented in different languages: kazakh, russian and codeswitching language. ## discussion most models perform safer on kazakh dataset than russian dataset, higher safe rate on kazakh dataset in we observed the similar number of examples falling into category 5 general and harmless information for both kazakh and russian, while the kazakh data set size is 3.7k and russian is 4.3k. kazakh has much less examples in category 1 reject to answer compared to russian. this demonstrate models tend to provide general information and cannot clearly perceive risks for many cases. additionally, despite fewer harmful responses on kazakh data, these unsafe outputs are evenly distributed across risk areas and question types, showing equal vulnerability across all attacks regardless of risk type or jailbreak method. in contrary, unsafe responses on russian dataset often concentrate on specific areas and question types, such as regionspecific risks or indirect attacks, presenting similar model behaviors when evaluating over english and chinese data. it suggests that broader training data in english, chinese and russian may allow models to address certain types of attacks robustly, yet they may falter when confronted with unfamiliar content like regional sensitive topics. moreover, in responses collection, we observed many russian or english responses especially for open-sourced llms when we explicitly instructed the models to answer kazakh questions in kazakh language. this further implies more efforts are still needed to improve llms' performance on low-resource languages. interestingly, aya101, a fine-tuned kazakh model, proves an exception by displaying the lowest safety percentage (72.37%) among kazakh models, revealing that the multilingual fine-tuning without stringent safety measures can introduce risks. differences also emerge in how language models handle safe responses. yandexgpt, for instance, often refuses to answer high-risk queries. it frequently relies on generic disclaimers or deflections like "check in the internet" or "i don't know," minimizing risk but are less helpful. interestingly, it often responds with "i don't know" in russian, even for kazakh queries, we speculate that these may be default responses stemming from internal system filters, rather than generated by model itself. this likely explains why yandexgpt is the safest model for the russian language but ranks third for kazakh. while its filters perform well for russian, they struggle with the low-resource kazakh language. ## conclusion in this work, we introduce a new safety evaluation dataset for bilingual kazakhstan with kazakh and russian languages, with over 8k prompts covering both general and region-specific safety risks. the dataset incorporates three question types (direct attacks, indirect attacks, and over-sensitivity assessments) and includes a novel code-switching subset reflecting kazakhstan's bilingual context. we collect over 94k responses from 12 llms and evaluate their safety based on our fine-grained evaluation framework. experiments show that while proprietary models generally outperform open-source alternatives, all models struggle significantly with region-specific content. limitations and future work cultural and regional nuances while efforts were made to capture the socio-cultural and political landscape of kazakhstan and russia, the complexity of their linguistic relationship presents significant challenges. cultural norms, political sensitivities, and social contexts vary considerably across different regions, which may not be fully represented in our current dataset. future work could focus on developing region-specific evaluation frameworks that better account for local cultural specificities and socio-political contexts, ensuring more comprehensive safety assessments of llms in these multilingual environments. our code-switching evaluation, while novel, was limited to 500 questions, which may not fully capture the complexity of bilingual communications in kazakhstan. future work will expand the dataset using naturalistic observation methods and crowdsourced annotations. evaluation framework our evaluation methodology, while systematic, relies heavily on gpt-4o as an automated judge. although our human evaluation showed a strong correlation with gpt-4o's judgments, this approach may introduce certain biases inherent to gpt-4o's own safety mechanisms and alignment. additionally, despite our systematic approach, the finite nature of our evaluation questions may leave certain risk categories unexplored, suggesting potential gaps in our safety analysis. for future work, we will extend the evaluation methodology to include a broader range of models and risk categories. this includes integrating additional automated evaluation tools to mitigate dependency on a single model, such as gpt-4o and to cross-validate results for improved robustness. we will also expand the scope of our question sets to cover a more comprehensive range of safety risks, including emergent and context-dependent issues that may not be fully addressed by the current framework.