The Heterogeneous Safety Impacts of Benign Multilingual Fine-Tuning

Fine-tuning a large language model is a ubiquitous method for enhancing its capability on a specific downstream task. However, prior work has shown that this increase in capability comes with a cost: it can increase a model's tendency to respond to unsafe adversarial prompts, even when fine-tuning with non-adversarial data. We present the first comprehensive empirical study of this phenomenon in multilingual settings by fine-tuning Llama-3.2, Qwen3, and Gemma-3 models using benign data translated across nine languages. We find that safety outcomes are highly sensitive to both the choice of fine-tuning language and the evaluation language, with adversarial compliance rates increasing four-fold in some settings. Multilingual safety drift is decoupled from general capability metrics, and occurs heterogeneously across languages and models. Fine-tuning in non-English languages often induces smaller internal representational drifts than English, but these shifts lead models to default to either exaggerated compliance or refusal. As such, assessing fine-tuning impacts solely in English provides inadequate assurance for deployment. To facilitate further research into these cross-lingual safety blind spots, we release the Multilingual-Benign-Tune dataset and the SORRY-Bench-Multilingual evaluation suite.

This large-scale empirical study investigates how fine-tuning with benign data can impact model safety across different languages and model architectures. The demonstrates this via fine-tuning three popular model families Llama-3.2, Qwen3, and Gemma-3, and fine-tunes each of these models using data translated into nine diverse languages, including Hindi, Portuguese, and Tagalog. Safety evaluations are conducted on the fine-tuned variants of each model, with evaluations run in both English and in the language which a model was fine-tuned in. The paper finds that benign multilingual fine-tuning has heterogeneous safety impacts, with semantically similar fine-tuning data in different languages leading to different safety outcomes, dependent on both the language of fine-tuning and evaluation. It shows that safety performance is decoupled from capability, with safety results changing independently of capability metrics. Finally, it demonstrates that different architectures differ in how fine-tuning impacts the safety of models. The work introduces two accessible datasets to the research community, to enable further multilingual non-adversarial fine-tuning, and enable multilingual evaluation via an extended variant of the SORRY-Bench evaluation.