Safety Lost in Translation: Usable Yield and the Cost of Thinking in Safety-Data Localization
Abstract
Building a safety-alignment dataset in a new language by translating an English one is cheap, until you notice what the translator does. Ask a safety-aligned open model to translate an unsafe prompt, and it often refuses, applying its own chat safety policy instead of rendering the text. Some refusals are fluent Arabic and pass basic checks, silently removing the examples that make it a safety dataset. This makes efficiency a question of usable safety supervision per GPU-hour, not tokens per second. We measure it while localizing NVIDIA’s Nemotron-SFT-Safety-v2 into Arabic, a language absent from that release, using a 2,000-item audit panel stratified by source role. Across six open models spanning 26B–1T parameters, the throughput (the per-H100 output-token) leader, GPT-OSS-120B, still refuses 64.2% of unsafe user prompts under an instruction that frames the task as dataset localization and forbids refusal (75.5% under a plain instruction), yet it refuses none of the 400 assistant turns, so it is reacting to the request, not to translation difficulty. These wasted attempts roughly triple its cost per usable unsafe example. Reasoning harder does not fix this: raising GPT-OSS-120B’s reasoning effort lowers refusal only from 64.2% to 54.0%, roughly quadruples the cost per usable example, and leaves 7–8% of attempts spending their entire completion budget on reasoning without ever emitting a translation. A task-specific prompt does more without additional reasoning tokens: it cuts GEMMA4’s refusal from 18.9% to near zero, with no thinking tokens. Guided by a 100-item pre-production comparison, we select GEMMA4, translate the corpus in its non-thinking mode, and apply a two-pass automatic quality-control pipeline, releasing 41,765 automatically curated Arabic safety-alignment examples (Arabic user and final-answer text, English reasoning traces retained) together with the 2,000-item audit panel, evaluation artifacts, and code.