What it is
A red-team corpus built to answer a specific question: do commercial AI guardrail products work on the languages people here actually speak?
Forty-four prompts across seven attack categories, plus two corpora that no vendor test set contains.
A Kenyan PII corpus. M-PESA numbers, National ID numbers, KRA PINs. Real formats, synthetic values. These are the identifiers that must not leak in this market, and a classifier tuned on US Social Security numbers has never seen their shape.
A Swahili and Sheng attack corpus. The same attacks, written the way they would arrive. Not translated benchmark prompts, but attacks composed in the language, including Sheng, where a lot of real conversation happens and which no safety classifier has meaningfully been trained on.
Run on Promptfoo against guardrail products sold as multilingual.
The result
The best-performing product blocked 21 of 44 prompts.
The more interesting finding is how the higher-scoring configuration earned its extra detections. It did not catch more attacks. Most of its additional hits came from misclassifying ordinary Swahili words, base64 strings and place names as threats.
So the headline number moves in the right direction while the product gets worse. The same configuration that looks stronger on a detection count is the one that will flag a Nairobi user writing a normal sentence. A bake-off that counts blocks without separating true from false positives will recommend exactly the wrong configuration.
Why it matters
"Multilingual support" on a datasheet usually means the model has seen the language, not that the safety classifier was trained or evaluated on adversarial input in it. For a market that moves between English, Swahili and Sheng inside a single sentence, the gap between those two claims is the whole control.
The work maps to OWASP LLM Top 10 (2025), the OWASP Agentic Top 10, MITRE ATLAS and NIST AI RMF.
Status
The methodology and findings are public. The corpus is not, since it remains an active evaluation asset.