Our Safety Checks Were Worse in German
We ran our weekly adversarial set in German for the first time after eighteen months of running it in English, on a system where most users write German. Roughly twice as many prompts got through.
Eighteen Months of Testing the Wrong Language
Our weekly adversarial run is a set of prompts that should be refused, checked automatically. It was assembled in English because most published examples are in English, and it stayed in English because it kept passing and nobody looked at it closely.
The system it guards serves a German-speaking workforce. Roughly four fifths of real traffic is German. We had been measuring a safety property in a language that accounts for a fifth of the input.
What the Translation Showed
We translated the set and reran it. The refusal rate fell from about ninety-four percent to about eighty-eight, which sounds small and means the number of prompts getting through roughly doubled.
The failures were not exotic. They were ordinary requests phrased in German that the English version of the same request would have caught, which suggests the filter's coverage rather than the language itself is the variable.
The Research on Uneven Coverage
Kumar and colleagues published PolyGuard in 2025, a multilingual safety moderation tool covering seventeen languages, built on the premise that moderation quality is not uniform across languages and that treating English performance as representative is a mistake.
That is the correction we needed rather than a technique we adopted. The useful part was the confirmation that this is a known and general property rather than something peculiar to our configuration, which changed how we present the finding to customers.
| Test set property | What it must have |
|---|---|
| Language distribution | Matching real traffic, not convenience |
| Phrasing | Written by a native speaker, not translated |
| Domain vocabulary | The customer's terms, not generic ones |
| Refreshed | Quarterly. Attempts change |
Why Translation Is Not Enough
We built the German set by translating, which was the fastest way to get a number and is not how the set should exist. A translated adversarial prompt carries English sentence structure, and the phrasings a German speaker would actually use are different in ways that matter to a classifier.
So the current set is written in German by a German speaker, with the translated ones kept separately as a weaker signal. The natively written set catches things the translated one did not, which is unsurprising and worth stating because the shortcut is tempting.
What We Changed in the System
A moderation step that runs on the German text rather than on a translation of it, which we had considered and rejected earlier on cost grounds. The cost was real and the reasoning was wrong, because the cost was per request and the risk was per incident.
We also lowered the threshold for German specifically, which is an uncomfortable asymmetry to write into a configuration file and is the honest response to a measured difference in reliability. The comment next to it says why, with the date and the numbers.
The General Lesson
Any property you measure, ask which language it was measured in. This applies past safety: our retrieval quality had the same problem and we found it the same way, and both times the overall metric looked fine because the majority language was not the one being tested.
It generalises further than language, too. A property measured on the convenient subset is a property you do not know about the rest, and convenience selects subsets in ways that correlate with what teams already understand.
What It Cost
A day to translate and run, a week to write a proper German set, and an ongoing cost of maintaining two sets rather than one. The moderation step running on the original text added a few percent to the request cost.
Against that, we found a real gap that had been open for eighteen months on a production system. We would have found it eventually through an incident, and the difference between finding it that way and this way is the entire argument for adversarial testing.
What We Do Not Claim
We do not claim German is inherently harder to moderate. The variable we observed is coverage, and a filter trained with more German data would presumably close the gap, which is not something we can do from where we sit.
We also do not claim our set is adequate now. It is one language pair, written by one person, refreshed quarterly, and it tests what we thought to test. The honest position is that it is better than it was and still measures our imagination.