AK_QMUL at ArGuard Shared Tasks: A Single Fine-Tuned JAIS for Arabic Harmful-Prompt Detection

AI summary

Overview

Research area: Natural Language Processing — Arabic safety and content moderation, specifically harmful-prompt detection with parameter-efficient fine-tuning of an Arabic-centric large language model.

Technical level: Intermediate. The paper assumes familiarity with supervised fine-tuning, LoRA/QLoRA adapters, and classification metrics such as macro-F1, but the architecture itself is simple and clearly described.

Scope (one sentence): The paper describes AK_QMUL's two winning submissions to the ArGuard-2026 shared tasks, both built on a single fine-tuned JAIS-6.7B backbone, for binary safe/unsafe Arabic prompt detection (B1) and seven-way harm-domain classification (B2).

What This Paper Is About

Large language models can follow instructions in Arabic well enough to be misused, so a deployed assistant needs to judge, before answering, whether a prompt is asking for something harmful — and it must do so across Modern Standard Arabic (MSA) and several regional dialects whose surface forms vary widely. The ArGuard-2026 shared task frames this as two problems over the same pool of Arabic prompts: B1 asks whether a prompt is safe or unsafe, and B2 asks which of seven harm domains an unsafe prompt belongs to. The paper's goal is to build one system that handles both tasks well, with results broken down by dialect and by class so that failure modes are visible rather than hidden behind a single score.

Key Contributions

1. A single shared backbone for both tracks. Both submissions use JAIS-6.7B fine-tuned with 4-bit QLoRA, with a linear classification head reading the hidden state at the last non-padding token; the backbone, optimiser settings, and pooling are identical, and only the label set and task-specific configuration change.

2. A dialect-factored four-way head for B1. Instead of predicting safe/unsafe directly, the head predicts four classes formed by the product {safe, unsafe} × {MSA, other}, and a plain argmax over those four logits is collapsed by prefix to the binary decision, with no dialect-based post-processing at inference.

3. AraSafe augmentation targeted at the least-represented class. Because safe-MSA is only 7.6% of the B1 training pool (train+dev, 19,236 prompts), the authors add 7,607 filtered safe human-written MSA prompts from AraSafe to the training fold only, labelled safe-MSA.

4. A seed-averaged seven-way classifier for B2, plus per-dialect and per-class error analysis showing that residual error is concentrated in the Bully class and, more precisely, in MSA.

Main Findings

• Both submissions ranked first on their track. B1 reached macro-F1 0.984 and B2 reached macro-F1 0.790.

• B1 is robust across dialects. Accuracy ranges from 93.6% (Moroccan) to 99.8% (Egyptian), with MSA at 98.8%, Syrian 97.7%, Palestinian 99.1%, and Algerian 97.9%.

• Predicted unsafe rates track true unsafe rates closely. Overall the model predicted 3,888 of 7,809 test prompts as unsafe against 3,851 truly unsafe; per dialect, 37.1% predicted versus 36.6% true for MSA, and 91.6% versus 91.3% for Egyptian.

• AraSafe augmentation is the single most important B1 design choice. Removing it drops macro-F1 from 0.984 to 0.624, because the training pool is about 80% unsafe while the blind test is close to balanced; the un-augmented model flagged 6,426 of 7,809 prompts as unsafe.

• The four-way register head adds only a small margin. It moves macro-F1 from 0.983 (two-class head with AraSafe) to 0.984, with the gain concentrated at the MSA safe/unsafe boundary.

• Seed averaging gives a modest but consistent B2 gain. The five individual seeds scored between 0.779 and 0.785 on the test set; averaging their softmax distributions before the argmax produced 0.790.

• Six of seven B2 classes reach F1 between 0.73 and 0.98. adult_content is highest at 0.984, followed by harassment 0.859, hate_speech 0.845, self-harm 0.803, FraudandDeception 0.741, and harm-to-others 0.726.

• The Bully class carries the residual error, and the problem is MSA-specific. Bully has precision 0.815 but recall only 0.443 and F1 0.574; however, it scores 0.81–0.97 in all five dialects and 0.46 in MSA, where 719 of its 908 test prompts fall. The confusion is with harassment and harm-to-others.

• MSA is the hardest register for B2 overall. Per-dialect macro-F1 is 0.70 for MSA versus 0.88–0.95 for every dialect (Syrian 0.93, Egyptian 0.95, Palestinian 0.90, Moroccan 0.88, Algerian 0.88); other classes such as harm-to-others, self-harm, and FraudandDeception show the same MSA drop and dialect recovery.

• The Bully gap is not a data shortage. Bully has 908 test examples, more than four of the classes that score higher.

• adult_content is uniformly easy (F1 0.95–1.00 in every dialect; there are no Moroccan test examples of that class), so its high score is not a register effect.

Methodology in Plain English

The team started from JAIS-6.7B, a decoder model built for Arabic, and loaded it in 4-bit precision (NF4 with double quantisation and a bfloat16 compute dtype) so it would fit and train cheaply. Rather than updating the whole model, they attached LoRA adapters (r=16, alpha=32, dropout 0.05) to all linear projections and froze the base weights. Because JAIS is a causal model, they read out a fixed-size representation from the last non-padding position of the top layer and passed it in float32 through a single linear classification head — a simple readout rather than a generative answer.

Training used three epochs of AdamW at a learning rate of 10⁻⁴, a linear schedule with 5% warmup, batch size 8, and a maximum sequence length of 192 tokens, which covers nearly all prompts without truncation. The loss was class-weighted cross-entropy with weights set to inverse class frequency, so rare classes are not drowned out — a direct match to the macro-F1 objective. Training folds were built with stratified group 7-fold cross-validation, and the final test submission refits on the concatenation of the train and development splits.

For B1, the label was factored into four classes (safe-MSA, safe-other, unsafe-MSA, unsafe-other) so the model could represent the safety boundary separately for standard and dialectal Arabic. At inference, a plain argmax over the four logits is collapsed to binary: both unsafe sub-classes map to unsafe. To shore up the smallest class (safe-MSA, 7.6% of the pool), they filtered AraSafe's 12,077 human-written prompts — keeping non-harmful ones, dropping those under ten characters or matching a dialectal-marker lexicon, and deduplicating against train, development, and test — leaving 7,607 safe MSA prompts added to the training fold only.

For B2, they skipped the dialect factoring and augmentation, trained five identically configured seeds (42–46) as seven-way classifiers, averaged their softmax distributions, and took the argmax of the mean. No stacking, no meta-learner, and no per-class thresholds were used.

Why This Matters

Impact on research. The paper shows that a single Arabic-centric backbone with a linear head, standard parameter-efficient fine-tuning, and careful handling of class imbalance can top a shared task on both a binary and a fine-grained harm taxonomy, without task-specific architectures. It also shows that reporting a single macro-F1 hides a structural problem: the Bully weakness looks like a class-level failure but is really an MSA-level one, which changes where follow-up work should aim. The authors argue that closing this gap likely needs finer annotation rather than more data.

Real-world applications:

• Pre-generation guardrails for Arabic chatbots and assistants, deciding whether to answer, refuse, or escalate before any content is produced.
• Content moderation queues for Arabic-language platforms, where the seven B2 domains can route reports to the right policy team.
• Safety auditing of Arabic model deployments across MSA and regional dialects, since dialect-specific unsafe rates vary widely (36.6% for MSA up to 91.3% for Egyptian in the test set).
• Triage tooling for trust-and-safety teams that need calibrated unsafe-rate estimates rather than only per-item labels.

Industry relevance. The recipe is inexpensive and reproducible: 4-bit QLoRA on a 6.7B backbone, short sequences (192 tokens), and a linear head mean low training and inference cost compared with fine-tuning a full model or prompting a much larger one. The finding that external safe-MSA data lifted B1 from 0.624 to 0.984 is a practical lesson about prior mismatch between training pools and deployment traffic.

Future Directions

1. Fixing the MSA Bully confusion. The authors state the confusion with harassment and harm-to-others remains unresolved and suggest finer annotation rather than additional data as the likely route.

2. Comparing alternative Arabic encoders and architectures. The limitation section notes that only one Arabic-centric backbone with a linear head was tried, so the results describe this recipe rather than the best attainable performance.

3. Repeating the ablation across seeds and folds. The B1 ablation was run on the official test split under one seed and one fold; its stability is unmeasured.

4. Testing whether dialect-aware modelling helps beyond labels. Dialect information currently enters only through the training labels, with no routing at inference, and non-MSA per-class cells rest on only 14–239 examples — a larger dialect-stratified evaluation would show whether the MSA effect generalises.

Target Audience

Researchers and practitioners working on Arabic NLP, LLM safety, and content moderation who need a concrete, reproducible strong baseline for harmful-prompt detection; shared-task participants interested in class-imbalance handling and label factoring for macro-F1 objectives; and trust-and-safety engineers looking for a low-cost guardrail recipe that holds up across standard and dialectal Arabic. Readers unfamiliar with LoRA or macro-F1 will need some background, but the system design is described concretely enough to follow.

Authors’ abstract

We present AK_QMUL's submissions to the ArGuard-2026 shared tasks on Arabic harmful-prompt detection: a binary safe/unsafe task (B1) and a seven-way harm-domain task (B2). Both submissions use one backbone -- JAIS-6.7B fine-tuned with 4-bit QLoRA and a linear classification head over its last-token representation. For B1 we train a four-way head that factors the label by dialect register {safe, unsafe} x {MSA, other}, we augment the training fold with MSA prompts from AraSafe, and decode with a plain argmax to score safe/unsafe. For B2 we fine-tune the same backbone as a seven-way classifier and average the softmax outputs of five random seeds. Both submissions ranked first on their track, with macro-F1 0.984 on B1 and 0.790 on B2. We report results by dialect and by class: on B1 the model is accurate across all six dialects (93.6--99.8%) and its predicted unsafe rate tracks the true rate closely; on B2 six of the seven classes reach F1 between 0.73 and 0.98, with the residual error concentrated in the Bully class, which overlaps semantically with harassment and harm-to-others.