AfriGuard - AI Jailbreak Toolset for African Languages

Solid work that grounds the multilingual safety problem in a specific, realistic regional context. The core finding (low-resource languages bypass safety filters) is known from prior work, but the scale of the evaluation and the open release of the pipeline make this a useful contribution.

Strengths:

- Good scale: 1,120 responses across 4 models, 7 languages, 40 prompts.

- The harm categories are thoughtfully chosen for the South African context (SASSA fraud, xenophobic incitement, gang recruitment) rather than just using generic benchmarks.

- Transparent about mistakes. The erratum and V2 correction in the repo shows integrity.

Suggestions for Future Work:

- exploring whether other interventions can close the gap instead of having to fine-tune classifiers. what happens if there's a translate-to-english pipeline? does the ASR drop?

- exploring novel attack vectors instead of relying on translation alone

Well done. Would be a great followup to design a pipeline that automatically translates English-language safety datasets/adversarial training pipeline code/safety classifiers into African languages.

The most important thing, and everything else depends on it, is that your scoring tool can't actually read the languages you're studying, because it only looks for English "no" words. So any long answer in an African language that doesn't contain an English refusal gets counted as a successful jailbreak, even when it's really just the AI spitting out nonsense, which your own data already flags as broken. Before any of your headline numbers can mean anything, you'd need to throw out or separate those broken, gibberish answers, and then score the real ones properly in each language, either with native speakers or a translation-based tool you've checked against people. If you do that, chances are you'll still find a real problem, just a smaller and more honest one, which is still well worth publishing. I'd also remove the parts of the report that describe human scorers and a reliability number, because as far as I can tell from your code they never actually happened. The heart of this, giving local people a tool to check AIs in their own languages instead of trusting an English-only safety promise, is valuable.

Really solid work, and the topic actually matters: a model can look safe in English and still get jailbroken in South African languages, with real stakes for banking and government chatbots. The best parts for me are the open dataset and pipeline so other people can test their own models, and the 0.82 agreement between annotators, which makes me trust the harm scores. A few things to tighten. The headline, that low-resource languages get jailbroken more, is already in the papers you cite, so I would frame your contribution as the South African coverage and the dataset, not a new discovery. I would also add a back-translation check so nobody can say the gaps are just translation noise, and it was not always clear where the human scoring stops and the LLM judge starts. The per-category numbers come from small samples, so I read those as hints, not hard results. Still, a lot of ground covered for one weekend.