AI security tools that can only detect threats in English offer limited protection. Here’s how Tenable trained our threat detectors to process nine additional languages and understand thousands more, without the need for a translation model, which increases costs and slows down processing.
Key takeaways
- Tenable One AI Exposure’s detectors, covering AI threats, harmful content, and other policy risks, were originally English-centric. To assess threats written in other languages, our product translated them into English, a slow, expensive, and often imprecise approach.
- Tenable built an agentic translation pipeline that generates high-fidelity, label-preserving training and benchmark data across nine languages, guarded by a multi-judge quality gate, a refinement loop, and a model-refusal handling fallback.
- This single multilingual model detects threats natively in all 10 supported languages. Compared with our previous process of translating threats into English, this model is roughly 20-800 times faster per item and is less expensive by an order of magnitude, bearing a one-time cost that does not grow with usage traffic from our customers.
Why your AI security tool should support multiple languages
A prompt attack against an AI model written in Spanish, Arabic, or Hindi is every bit as dangerous as one written in English, which is why an English-only AI security detector will leave your organization at risk from non-English attacks.
To address this issue in our product, Tenable first adopted a “translate-then-detect” process:
- Identify the language.
- Translate the input to English with a large translation model.
- Then run the English detector.
This process works, but it has four downsides:
- Latency. A large, autoregressive translation model that runs before every non-English detection needs hundreds of milliseconds for short inputs, and seconds to tens of seconds for long ones.
- Cost. Every non-English request pays for a full translation pass.
- Operational overhead. You have to serve, scale, and maintain another heavyweight model.
- Lost signal. Meaning and intent blur in naive translation, which degrades the tool’s ability to detect threats.
How Tenable turned our AI security tool into a polyglot
To make our AI security product natively multilingual, we discovered that we didn’t need to use a translator LLM in production. Instead, we found that we needed high-quality multilingual data in two places:
- A training set to teach the model the target languages.
- A test set we could trust to benchmark performance honestly in each language.
Both must preserve the labels of the data, ensuring that the label survives the translation process. Translation can quietly flip a label (a malicious data sample rendered as a benign one) or defang it (the security-relevant language “bite” softened so that what’s a clear positive in the original language instead reads as a borderline threat). Either way, the data sample is now mislabeled and poisons the data.
Tenable concluded that the following methods are not ideal:
- Human-expert translation. It is slow and needs a fluent reviewer for every language, so it does not scale.
- Machine translation. Standard translation methods distort dataset quality in two distinct ways: native machine translation prioritizes smooth phrasing over security context, potentially stripping out malicious intent (e.g., turning a toxin synthesis request into a benign chemistry query), while direct, word-for-word translation creates awkward, unnaturally phrased text that degrades training signal, such as an English phishing lure translated literally into Japanese.
- Off-the-shelf LLMs. They may refuse to translate material they flag as inappropriate, such as prompts about weapons synthesis or self-harm topics, so the text that represents a likely threat gets left out of the dataset.
- Always-on (online) translators. Relying on online translation pipelines introduces per-request latency, operational complexity, and costs that scale with hundreds of millions of items, making it impractical for production environments.
The translation process has to be cost-effective and repeatable across many languages.
The Tenable solution: An agentic pipeline plus a multilingual model
1. The agentic pipeline overview
The agentic translation pipeline. Each English item is transcreated by a frontier LLM, scored by a panel of independent judges, and either accepted or sent back to refine. On a refusal, a controlled open-source model takes over, via the same gate.
In Tenable’s data translation process, every item flows through three stages in our agentic pipeline.
- Translate. A frontier LLM produces a transcreation, a translation that we fine-tune by specifying the task, the item’s label, and the target language, as opposed to a blind word-for-word rendering. This fine-tuning is precisely what keeps the security-relevant meaning, and the label, intact.
- Estimate. A panel of independent judges scores each translation for fluency, meaning integrity, and whether the original data label still holds.
- Gate. Only translations that clear every check are kept.
Two recovery loops keep the hard cases from being lost:
- Refusal handling. When the frontier translator refuses a sensitive item, the pipeline hands the same transcreation job to a controlled, open-source small-language model that does not refuse, and its output goes through the same quality gate, so legitimate-but-sensitive security data is not silently dropped.
- Refinement. When a translation fails the quality gate, it is sent back for another attempt rather than thrown away.
Because the task and labels are parameters, the pipeline can serve any future detection task requiring multilingual support.
2. A pretrained multilingual model
Instead of training a language model from scratch, we fine-tuned a compact model that was already pretrained on many languages, which yielded two benefits:
- It consumes far less data per language. The model has already learned useful cross-lingual representations, so we only taught it our task.
- It transfers knowledge between languages. We measured this before spending a dollar on translation. For some tasks, the model successfully generalized to other languages using only English training data, eliminating the need for translation. For harder tasks, we used the agentic translation framework to translate only to the languages in which the model underperformed. Even in those cases, training the model on a handful of languages lifted the model’s translation performance in other languages at no additional cost.
Impact and results
By replacing our legacy translate-then-detect architecture with a single native model, Tenable transformed our pipeline into an enterprise-grade solution that delivers near-instantaneous global coverage. This shift drastically reduced latency and infrastructure costs while maintaining top-tier quality and unlocking broader language support. Below are the key results achieved by this upgraded architecture:
- One fast model, no translator in the path. Detection now runs natively in every supported language in tens of milliseconds, whereas it took seconds with the translate-then-detect process, roughly 20-800× faster per item. In addition, the memory footprint is about 12-14× smaller: under 1 GB versus 12-14 GB.
- A one-time cost, under $10,000. We generated the multilingual training and benchmark data once. That cost does not grow with client’s production traffic, unlike an always-on translator, whose bill scales with every request.
- Budget-tunable by design. We set the budget, and the pipeline adjusts the tier of LLM it uses and how much refinement each item receives.
- Quality you can prove. A neutral LLM-as-a-judge from a third-party model family, outside our translation and grading stack, preferred Tenable transcreations over those from a commercial machine translation model and over those from a strong open translation model in the large majority of head-to-head comparisons.
- No English regression. Every Tenable One AI Exposure detector gained the ability to understand and translate from nine languages (Spanish, German, French, Italian, Portuguese, Mandarin Chinese, Japanese, Arabic, and Hindi) while English performance held or improved, and latency stayed near real-time.
- Reach beyond the languages we trained. Because the model was pretrained on a very broad set of languages, the same model can read and flag attacks in thousands of languages we never explicitly trained it on. We have only formally validated the 10 languages we support, so this wider reach is promising but needs further testing before it can be relied on.
AI-threat detection, recall @ 0.005% false positive rate. (The recall metric measures how good a system is at finding every single relevant item without missing any.) Our multilingual model matches or beats translate-then-detect on 9 of 10 languages and overall (0.93 vs 0.88).
Harmful-content detection, recall @ 0.02% false positive rate. On the harder task, the gap widens: our multilingual model leads on every language and overall (0.65 vs 0.50).
How Tenable One AI Exposure protects multilingual users
Threat actors do not limit themselves to English, and neither should your defenses. With this work, Tenable One AI Exposure extends the same detection quality (for jailbreaks, prompt injection, harmful content, and data exposure) natively across 10 languages, at production speed and without a translation bottleneck in the request path. As customers adopt AI in more markets and more languages, that multilingual coverage extends with them.
- Cloud
- Exposure Management
