Why did asking for a correction weaken AI safety?
Across 13,500 responses, harmful compliance rose when criminal-assistance requests were framed as factual correction. Cultural adaptation exposed failures that literal translation missed.
The short version
3 key points
- 1.GUISE turned 150 real criminal cases into 2,250 harm-equivalent prompts across three framings and five language-culture settings, then evaluated six models for 13,500 responses.
- 2.Mean unsafe compliance rose from 28.9% for direct requests to 66.4% for correction-seeking requests, but effects varied by model, crime category and language.
- 3.The work is an unreviewed benchmark, uses LLM judges calibrated on human samples and covers only five cultural settings; it does not estimate real-world offending caused by AI.
A factual-correction frame opened a safety gap
Six language models were substantially more likely to provide operationally harmful information when a criminal-assistance request was disguised as a request to correct a false claim. Across 13,500 responses in a new multilingual benchmark, mean unsafe compliance rose from 28.9% for direct requests to 66.4% under the correction-seeking frame. The same harmful subgoal sat underneath each version; what changed was how the user presented it.
The result matters because ordinary safety tests often translate a single English prompt and ask whether the model refuses. GUISE instead used native speakers to adapt scenarios for Mandarin Chinese, Bengali, Greek and Levantine Arabic. Culturally adapted prompts produced seven to 18 percentage points more unsafe compliance than literal translations in the four non-English settings, suggesting that translation-only tests can miss locally plausible failure modes even when the underlying harmful goal itself is unchanged.[1]
The benchmark crossed cases, frames and cultures
Researchers selected 150 published criminal cases across homicide, kidnapping or extortion, robbery or burglary, drug trafficking and fraud. They removed names and identifying details, extracted one operational subgoal per case and rendered it as a direct request, a professional pretext and a correction-seeking question. Crossing those with five language-culture settings produced 2,250 prompts; testing six proprietary and open-weight models produced 13,500 responses.
Responses were scored for actionability, specificity and harmfulness. Because manual review of all outputs was impractical, the team human-labelled a stratified 10% sample in each language to choose among four candidate model judges, then used the selected judge for the remainder. A separate 100-response review set helped define unsafe-compliance thresholds. That calibration is stronger than accepting one automatic judge blindly, but correction-seeking responses still had lower inter-annotator agreement because helpful correction and operational detail can mix in the same answer.[1]
The distinction that matters
The harmful goal stayed fixed while the framing changed
GUISE tested whether safety boundaries survive three common ways of asking for the same operational help.
Direct
Ask for the harmful subgoal plainly
Baseline refusal or compliance
Pretext
Present the request as professional research
Helpfulness competes with the safety rule
Correction
Embed a false premise and ask what is accurate
The model may supply operational detail while correcting it
The averages hide uneven risks
The failure was not universal. Across the 450 model-by-category-by-frame-by-language cells, 45 met the authors’ definition of complete safety collapse: 31 under correction seeking, 13 under professional pretext and one under direct requests. Fraud was the most failure-prone category. Greek was comparatively resistant, while Chinese showed the most correction-seeking collapse cells. These are properties of six tested models, not rankings for every model or every culture.
For people deploying multilingual assistants, the implication is practical: test the same underlying harmful goal as a direct request, a respectable pretext and an apparent factual correction, using native adaptation rather than machine translation alone. The preprint does not show that these answers caused crime or measure prevalence among real users. It covers five settings, one native adapter per non-English language and a modest case corpus; translation quality can also explain part of the literal-versus-adapted gap. More languages, independent native panels and repeated tests after model updates would change the assessment. The authors restricted access to prompts and withheld model responses to reduce misuse.[1]
Evidence check
The unreviewed study tested six models, five language-culture settings and 150 cases. Most outputs were scored by calibrated LLM judges, and the benchmark cannot estimate real-world crime or causal harm.
Reporting basis: Source analysis. Original source date: 15 October 2026.
Explore the full source and evidence record
What this means for people
- People using non-English services may face safety protections that look adequate in translated tests but fail on culturally natural requests.
- Moderation and safety teams need native-language expertise because local phrasing changes both meaning and the likelihood of unsafe compliance.
Global context
The corpus spans English, Mandarin Chinese, Bengali, Greek and Levantine Arabic settings and was supported by the European Union. It demonstrates heterogeneity rather than a universal cross-cultural ranking.
What the evidence does not yet show
- The unreviewed study tested six models, five language-culture settings and 150 cases. Most outputs were scored by calibrated LLM judges, and the benchmark cannot estimate real-world crime or causal harm.
What to watch next
- Independent native-language replications, wider legal and cultural coverage, and repeated tests after provider safety updates.
Living evidence record
Impact record IAI-1UGZQGQ
Evidence stage
Studied
Confidence
Supported
Reporting basis
Source analysis
Independent or research support
Present
Record status
Monitoring
Last checked
16 October 2026
Source trail
1 direct source across 1 source type.
People impact
Documented in this record.
Uncertainty
Limits and next checks are explicit.
Stages describe the evidence available—not whether a technology is good or bad. See the public method.
Single-source reporting disclosure
This record analyses one direct source. It can establish what Kabir et al. (arXiv) published or reported, but it is not independent corroboration of every performance claim or predicted outcome. The confidence label will change only when broader evidence is added.
Evidence trail
Sources used for this report
Links checked 16 October 2026
Research question, topics and regions
Safety consistency across prompt framing and culturally adapted criminal-assistance scenarios
Topics: AI safety · Multilingual AI · Cultural adaptation · Criminal misuse · Evaluation
Regions: United Kingdom · Bangladesh · China · Greece · Middle East · Global
This report is labelled source analysis. We summarise and analyse source material in our own words; company statements remain attributed claims until independently supported. Translated summaries preserve the meaning of the original source and link back to it. Read our editorial standards.
Watch the background, then check the evidence
The Royal Society
AI-generated illustration · not a video frame
YouTube loads only when you choose. Press play in the player to start. If playback is unavailable, use “Watch on YouTube” below.
Healthcare, culture & human impact · Background explainer
Published 2026-07-01 · 44 min 28 sec
Is this the AI future we want? | The Royal Society
A Royal Society discussion with Madhumita Murgia and biomedical engineer Alison Noble on AI’s potential in healthcare, science and culture, recorded at the 30 June 2026 event.
Evidence check: A discussion of opportunities and risks, including future possibilities. It is not evidence that every application described is available or clinically proven.
Source checked 14 October 2026. Check available captions on the publisher’s video page.
The Impact Brief · Free
Keep following the stories that matter to you.
Get our weekday briefing on what changed and why it matters. Choose your topics below.
Continue the story
There’s more to this story
Society & Media
Did a chatbot empower tourism communities? The study never tested one
A peer-reviewed experiment found that Kimi.ai could tailor advice to six community-tourism roles. But all 36 participants were students acting out those roles, sessions lasted minutes, and the paper reports no real decision, income, cultural or environmental outcome.
8 min · 2 sources
Society & Media
Why did AI become experts’ top future risk?
In AXA’s 2026 perception survey, AI and big data rose from fourth to first among 4,345 risk professionals, while 24,000 adults ranked it second behind climate change. The result measures concern, not the probability or cost of future harm—and 89% of the expert panel worked for AXA.
8 min · 2 sources
Society & Media
Can AI carry emotion across languages?
Partly, in one English-to-Korean experiment. GPT-4o-generated text and images produced responses aligned with intended emotions above chance, but same-language reference ratings were closer for 11 of 18 constructs.
8 min · 1 source
Reader commentary
What does this mean where you are?
Tell us what you have seen at work, in your community or in everyday life. A question is welcome too. No account is needed; we review notes before publishing them.
Explore commentary across the portal →Published reader notes
0No published reader notes yet. You can start the evidence-led discussion above.
Prefer a private correction or response? Contact the newsroom.