CAGE: A Framework for Culturally Adaptive Red-Teaming Benchmark Generation

AI summary

Overview

Research area: AI safety and ethics — specifically red-teaming (adversarial safety testing) of large language models across languages and cultures, with a focus on culturally grounded benchmark construction.

Technical level: Intermediate. Readers need some familiarity with red-teaming, jailbreak attacks, and Attack Success Rate (ASR) as an evaluation metric, but the core idea (adapting adversarial intent rather than translating words) is explained plainly.

Scope: The paper introduces CAGE, a three-stage pipeline that rewrites English red-teaming prompts into culturally grounded prompts for a target language, and demonstrates it through a Korean benchmark (KoRSET) and a Khmer case study.

What This Paper Is About

Most red-teaming benchmarks for LLM safety are written in English and assume English-speaking cultural, social, and legal contexts. When researchers simply translate them into another language, the translated prompts often miss the locally specific threats that users in that culture actually face — for example, legal questions that differ by jurisdiction. The paper's goal is a reusable framework, CAGE (Culturally Adaptive GEneration), that preserves the adversarial intent of a proven English prompt while rebuilding its content around local culture and law, and it demonstrates that this yields prompts that are both higher quality and more effective at revealing model vulnerabilities than translation.

Key Contributions

1. Reframing the goal of red-teaming. The authors argue that the objective should expand from testing whether a model can be jailbroken to evaluating it against realistic, socio-technical scenarios, and they identify the blind spot created by "culturally naive" benchmarks.

2. The CAGE framework and the Semantic Mold. CAGE is a scalable pipeline built around Semantic Molds — slot-based representations that define the minimum semantic components needed to express a harmful scenario (actions, targets, tools, contextual conditions, not only named entities). This disentangles prompt structure from cultural content.

3. KoRSET, a large-scale, culturally grounded Korean red-teaming benchmark organized under a three-level risk taxonomy covering 5 risk domains, 12 level-2 categories, and 53 level-3 types, with per-category question counts ranging from 256 (Security Threats) to 1,404 (False or Misleading Information).

4. Empirical validation and generalization. Experiments show CAGE prompts achieve higher ASR than direct translation, template-based adaptation, and LLM-adaptation baselines, and the framework transfers to Khmer, a low-resource language.

Main Findings

• CAGE outperforms all three baselines on ASR. Using N = 1,200 prompts per method, CAGE prompts consistently produced higher Attack Success Rates than Direct Translation, LLM-Adaptation, and Template-Filling. The largest gap appeared under Direct Request attacks on Llama-3.1: CAGE reached 43.8% ASR versus 32.4% for LLM-Adapt and 28.2% for DirTrans.

• Prompt quality improves substantially. On a 0–13 total quality scale with cultural specificity scored out of 3, CAGE prompts far exceeded the Direct Translation baseline across all 12 level-2 categories. For example, category D (Bias and Hate) scored 10.60 total / 2.35 cultural under CAGE versus 4.40 / 0.39 under DirTrans; category B (Sexual Content) went from 1.74 / 0.04 to 9.68 / 1.52.

• Specificity alone does not explain the gains. In a controlled 2×2 decomposition (N = 600 per dataset across Generic-EN, CAGE-EN, Generic-KO, and CAGE-KO), adding specificity within English often decreased ASR for the English-centric Llama-3.1 (ΔSpec(EN) of −8.06 under Direct Request), acting as a "safety trigger," while adding specificity within Korean consistently increased it (ΔSpec(KO) of +11.41).

• The cultural knowledge gap is the dominant driver. For English-centric models the Culture Effect (ΔCulture, averaging roughly +20 to +35%) consistently exceeded the Specificity Effect (ΔSpec(KO), averaging roughly +8 to +11%). Llama-3.1 showed a large gap between CAGE-EN (8.62% ASR) and CAGE-KO (43.77% ASR), while the Korean-specialized EXAONE-3.5-7.8B-it showed a negligible difference (reported as ΔCulture ≈ +1.2% in the text; +1.24 in the table), indicating its safety alignment generalizes across both contexts.

• Model vulnerability varies by model and by risk category. In the main KoRSET evaluation (Table 3, five target models, four attackers plus Direct Request), Llama-3.1-8B-Instruct was consistently the most vulnerable model and EXAONE3.5-7.8B-it the most robust, with Qwen2.5-7B-Instruct and gemma2-9B-it intermediate. GPTFuzzer achieved the highest average ASR; GCG was notably less effective against Qwen2.5-7B-Instruct and EXAONE3.5-7.8B-it. Information & Safety Harms was the most vulnerable domain for Llama-3.1-8B-Instruct, while Toxic Language was the most robust domain overall.

• Fine-grained types show uneven robustness. At level-3, within D. Bias and Hate, types such as Gender, Genetic Information, and Nationality showed high ASR (Llama yielded 0.80 for Genetic Information; Qwen exceeded 0.5 for both Gender and Nationality), while Occupation, Color, and Geographic Region were lower. In L. Security Threats, Malware Generation and Weapon Usage produced ASRs greater than 0.75 for almost all models, whereas Cybersecurity Vulnerabilities remained comparatively resistant.

• The framework transfers to a low-resource language. On gemma3-12B-it with 600 CAGE-Khmer prompts, Direct Request ASR for category L (Security Threats) rose from 2.7% to 35.1% and for category H (Self-Harm) from 4.9% to 34.4% relative to the translation baseline. CAGE-Khmer prompts also scored higher on the 0–13 quality scale in every category (for example, 9.04 vs. 3.99 in category F).

Methodology in Plain English

CAGE runs seed English prompts through three stages.

1. Seed collection and taxonomy mapping. Prompts are drawn from six existing red-teaming datasets (SALAD-Bench, ALERT, WildGuard-Mix, HEx-PHI, AIR-Bench2024, and Do-Not-Answer) and mapped onto a three-level risk taxonomy. Because most sources lack fine-grained labels, six frontier models — GPT-4.1, Claude 3.5 Sonnet, Claude 4 Sonnet, Gemini 2.5 Pro, Llama-3.3-70B-Instruct, and Qwen2.5-72B-Instruct — classify each prompt, and only labels with unanimous agreement are kept, followed by human verification.

2. Refine-with-Slot. Each English prompt is rewritten so that it clearly contains every semantic slot its category or type requires, then concrete phrases are replaced with abstract tags (for example, a specific claim becomes [Fake Event]). This produces the Semantic Mold: a guide to what content must be present, not how the sentence must be structured.

3. Translate-with-Context. The mold is filled using a curated repository of local content. For categories with objective definitions (such as Illegal Activities or Privacy Violation), the authors used a Taxonomy-Driven method pulling keywords, case precedents, and legal definitions from legislation, enforcement decrees, and court decisions. For socially dynamic categories (such as Bias and Hate or Toxic Language), a Trend-Driven pipeline extracted trending topics from news portals and online communities. Collected material passed a lightweight binary verification check to filter noise, and the generation step is guided by 3–4 few-shot examples per category.

Evaluation uses Attack Success Rate as the primary metric, with GPT-4.1 as an automated judge whose rubric the authors report aligns more closely with human judgments than a standard rubric. Attacks tested include GCG, TAP, AutoDAN, GPTFuzzer, and a Direct Request baseline using default settings.

Why This Matters

Impact on research. The paper argues that translated benchmarks create a false sense of safety: a model can appear well-aligned in English while collapsing on realistic threats phrased in another language. The 2×2 experiment provides a clean methodological template for separating "more detail" from "different culture" as explanations for vulnerability, which is useful for anyone building or auditing multilingual safety evaluations.

Real-world applications:

• Pre-deployment safety testing for regional products. Teams shipping LLMs in Korea or Cambodia can test against locally grounded threats rather than translated English ones.
• Regulatory and compliance review. Legal and policy teams can examine whether a model gives prohibited advisory content under local law, since CAGE sources content from statutes, decrees, and court decisions.
• Localized content moderation and guardrail design. Knowing which categories and fine-grained types are most vulnerable (for example, Malware Generation or Weapon Usage) helps prioritize guardrail work.
• Low-resource language safety research. The Khmer case study suggests the pipeline can be applied where benchmark infrastructure is scarce.

Industry relevance. The finding that English-centric safety training leaves a large cultural knowledge gap — with one model showing 8.62% ASR in English versus 43.77% in Korean on the same intents — is directly relevant to companies deploying a single model across many markets. The paper also frames CAGE as combining the cultural fidelity of native dataset construction, the scalability of template methods, and semantic precision missing from translation, which is the practical trade-off most teams face.

Future Directions

• Broader language coverage. The authors state that future work will apply CAGE to more languages, especially low-resource ones, and note that extending to high-resource languages should be easier because digital archives are abundant.
• Culturally aware automated attack strategies. The paper's current evaluation relies on existing attack methods, which it acknowledges may not generalize uniformly across cultural domains.
• Culture-aware safety judges. The authors propose extending the methodology toward safety-aware judges, in addition to culturally aware attackers.
• Reducing per-culture setup cost. The framework requires an initial data collection stage for each new culture; the authors argue the cost is mitigated because laws and norms evolve slowly, but also list this effort demand as a limitation.

Target Audience

This paper is most useful to LLM safety researchers and red-teamers, evaluation and benchmark designers working on multilingual or non-English safety, and product or policy teams responsible for deploying models across cultural and legal jurisdictions. It is also relevant to researchers in low-resource language NLP, who may be interested in the Khmer stress test and the taxonomy-driven content-sourcing approach.

Authors’ abstract

Existing red-teaming benchmarks, when adapted to new languages via direct translation, fail to capture socio-technical vulnerabilities rooted in local culture and law, creating a critical blind spot in LLM safety evaluation. To address this gap, we introduce CAGE (Culturally Adaptive Generation), a framework that systematically adapts the adversarial intent of proven red-teaming prompts to new cultural contexts. At the core of CAGE is the Semantic Mold, a novel approach that disentangles a prompt's adversarial structure from its cultural content. This approach enables the modeling of realistic, localized threats rather than testing for simple jailbreaks. As a representative example, we demonstrate our framework by creating KoRSET, a Korean benchmark, which proves more effective at revealing vulnerabilities than direct translation baselines. CAGE offers a scalable solution for developing meaningful, context-aware safety benchmarks across diverse cultures. Our dataset and evaluation rubrics are publicly available at https://github.com/selectstar-ai/CAGE-paper. (WARNING: This paper contains model outputs that can be offensive in nature.)