Safety of LLMs in IR

Large language models are now embedded throughout the retrieval stack, as query rewriters, rankers, and generators of answers over retrieved evidence. Their safety properties, however, have been studied almost entirely in English and almost entirely at the level of the model rather than the system. This lecture examines what happens to those properties once a retrieval component is placed in front of the model and once the language is not English. The first part treats safety as a property of the retrieval pipeline rather than the model alone, covering retrieval as an attack surface through corpus poisoning and indirect prompt injection, and retrieval as a mitigation through grounding and attribution. The second part shows that each of these behaves differently across languages, drawing on a systematic review of multilingual risks, biases and safeguards, and on benchmarks for refusal behaviour and content moderation in European languages. The third part turns to evaluation, covering benchmark contamination and safety-critical retrieval tasks such as systematic review screening and patient-trial matching, where recall failures carry direct consequences.