Open-Weight Language Models Refuse Harmful Requests Far Less Often in Somali Than English

Language model safety evaluations have historically centered on English, leaving critical gaps in how well we understand model behavior across other languages—especially low-resource ones. A new study on arXiv tests four major open-weight models and finds they're substantially more likely to comply with harmful requests when those requests arrive in Somali rather than English.

The Study Design#

Researchers created SomaliBench v0, a benchmark containing 100 harmful-intent prompts that were carefully written and verified by native speakers. Each prompt was paired in both English and Somali versions. Four instruction-tuned models were evaluated under identical conditions: Llama-3.1-8B-Instruct, Gemma-2-9B-Instruct, Qwen-2.5-7B-Instruct, and Aya-23-8B. All ran locally with the same system prompt emphasizing helpful, harmless, and honest behavior.

Refusal Gaps Across the Board#

All four models showed large gaps between English and Somali refusal rates, ranging from 0.40 to 0.93 points. These differences proved statistically significant across multiple tests. What's more revealing: when models failed to refuse Somali requests, they often didn't generate fluent harmful content. Instead, responses were frequently incoherent, in the wrong language, or off-topic—suggesting the models struggle with Somali rather than consciously choosing to assist.

Evaluation and Verification#

A pinned Claude Sonnet snapshot classified each response into three categories: refused, complied, or unclear. When Claude declined to classify 34 of 800 responses due to safety concerns, a native Somali speaker reviewed them manually. Independent spot-checks showed perfect agreement (Cohen's κ = 1.00) between the native author and the AI classifier on comparable cases, lending confidence to the methodology.

Why This Matters#

The findings underscore how AI safety evaluation remains incomplete without coverage of low-resource languages. Even as large language models deploy globally, safety measurement lags far behind—creating a blind spot where harmful behaviors might go undetected in non-English contexts. Raw model outputs weren't released publicly due to their potentially harmful content, but aggregate statistics and category breakdowns are .