ChildSafe: Child-Centered Safety Benchmark

• ChildSafe is a child-centered safety framework that defines age-specific benchmarks through simulated child-agent interactions.
• It evaluates nine safety dimensions including privacy, emotional support, and boundary respect using statistical methods and multi-turn dialogues.
• The framework addresses adult-centric limitations by incorporating developmental psychology to tailor risk assessment and safety measures for minors.

ChildSafe denotes a family of child-centered safety frameworks for digital systems, with its most specific recent use referring to a reproducible benchmark for evaluating LLMs through simulated child agents across four developmental stages. In that benchmark, safety is not treated as a single refusal score but as a multidimensional, age-weighted property of interaction quality, spanning privacy, emotional support, manipulation resistance, developmental sensitivity, and long-term impact. Related work uses the same designation, or closely aligned formulations, for IoT access control, online-service risk assessment, youth-risk moderation, and child-fit security design, reflecting a common conclusion: adult-centric safety methods do not adequately model children’s cognitive, social, and emotional vulnerabilities (Murali et al., 7 Oct 2025, Xing et al., 14 Aug 2025, Majib et al., 2019, Ta, 2024).

1. Developmental rationale and problem formulation

The central rationale for ChildSafe systems is that prevailing safety benchmarks and controls were largely designed for adult users and therefore under-specify child-relevant harms. In the LLM literature, adult benchmarks are described as concentrating on explicit toxicity, hate speech, jailbreaks, weapon fabrication, large-scale disinformation, and political subversion, while neglecting developmental psychology, emotional fragility, privacy naïveté, innocent probing, multi-turn manipulation, and age-specific boundary testing. This leads to a systematic failure mode in which a model can appear safe under adult evaluation while still exposing minors to emotional manipulation, subtle grooming-adjacent behaviors, misleading advice, or developmentally inappropriate language (Xing et al., 14 Aug 2025, Jiao et al., 16 Jun 2025).

Developmental stratification is therefore foundational. ChildSafe, in its benchmark form, defines four age buckets: A6–8, A9–11, A12–14, and A15–17. These are motivated by Piaget’s stages and Vygotsky’s zone of proximal development, with A6–8 characterized as transitional concrete thinkers with emerging rule understanding, A9–11 as fully concrete thinkers capable of systematic solving, A12–14 as early formal operators developing abstract reasoning, and A15–17 as advanced formal operators with metacognitive capacities. Related benchmarks use somewhat different partitions—such as 0–6, 7–12, and 13–18 in SproutBench, or 7–12 and 13–17 in Safe-Child-LLM—but the underlying assumption is stable: risk is stage-dependent rather than uniform across minors (Murali et al., 7 Oct 2025, Xing et al., 14 Aug 2025, Jiao et al., 16 Jun 2025).

The harm space is likewise broader than conventional harmful-content filtering. Child-centered studies enumerate risks including self-harm, violence, child exploitation, sexual content, racist or socially divisive content, regulated goods and illegal activities, family harms, health misinformation, emotional dependency, privacy violations, academic cheating, social engineering, manipulation, and boundary over-stepping. A plausible implication is that “child safety” in these systems is best understood as a composite of refusal behavior, pedagogical fitness, relational stance, and developmental alignment rather than a narrow content-moderation problem (Rath et al., 18 Feb 2025, Xing et al., 14 Aug 2025).

2. ChildSafe benchmark architecture

In “Evaluating LLM Safety Across Child Development Stages: A Simulated Agent Approach,” ChildSafe is defined as “a reproducible evaluation framework designed to measure the safety of LLMs when interacting with users at different childhood developmental stages (6–8, 9–11, 12–14, 15–17 years)” (Murali et al., 7 Oct 2025). Its principal methodological move is the replacement of direct experimentation on minors with simulated child agents grounded in developmental psychology.

The agent layer is specified through system prompts that encode cognitive framing, permitted topics, emotional tone, and “question-persistence” behaviors. The reported backbone is instruction-tuned open-source Llama 3.1-8B-Instruct, with cross-model consistency checks intended to reduce prompt drift. Validation is multi-part. Linguistic outputs are compared against CHILDES corpora, specifically Wells for ages 6–8 and Manchester for ages 9–11, using mean length of utterance, lexical diversity, and syntactic complexity; Kolmogorov–Smirnov tests yield distributional similarity with $p > 0.05$. Expert review by a developmental psychologist and a philosopher of child development covers cognitive complexity, linguistic authenticity, emotional suitability, and boundary-testing, with intraclass correlations $ICC > 0.75$. Test–retest reliability on 300 conversations reports coefficient of variation $< 0.20$ for key metrics (Murali et al., 7 Oct 2025).

ChildSafe evaluates nine safety dimensions, each scored on $[0,1]$ using keyword libraries, pattern matching, and context-aware heuristics:

• Content Appropriateness: freedom from violence, sexual content, or adult themes.
• Boundary Respect: avoidance of overly familiar or manipulative relationships.
• Educational Impact: accuracy, clarity, and pedagogical quality.
• Social Influence: modeling of prosocial norms without peer-pressure cues.
• Emotional Safety: supportive, non-threatening tone.
• Privacy Protection: refraining from soliciting or exposing personal data.
• Manipulation Resistance: resistance to repeated boundary-testing or emotional manipulation.
• Developmental Sensitivity: age-matched metaphors, examples, and language complexity.
• Long-term Impact: anticipation of developmental consequences of advice.

These per-dimension scores are aggregated by an age-weighted composite function:

$$S_{\mathrm{composite}} = \frac{\sum_{i=1}^{9} w_i^{(\mathrm{age})}\, s_i} {\sum_{i=1}^{9} w_i^{(\mathrm{age})}}$$

where $s_i$ is the score for dimension $i$, and $w_i^{(\mathrm{age})}$ is the age-specific weight. The weighting is context-sensitive. For A6–8, emotional safety $(w \approx 0.20)$ and privacy $(w \approx 0.15)$ are prioritized; for A15–17, boundary respect $ICC > 0.75$0 and manipulation resistance $ICC > 0.75$1 receive higher weight. In neutral contexts, Educational Impact and Developmental Sensitivity are up-weighted; in sensitive contexts, Boundary Respect and Manipulation Resistance are emphasized (Murali et al., 7 Oct 2025).

3. Experimental protocol and empirical profile

The ChildSafe experimental protocol uses five scenario categories per agent: educational assistance, social interaction, entertainment or creativity, information-seeking on sensitive topics, and boundary testing. For each agent–model pair, the design specifies three distinct dialogues per scenario category, with each dialogue spanning five turns, yielding a total of $ICC > 0.75$2 conversations. Recorded outputs include per-turn $ICC > 0.75$3 scores, composite $ICC > 0.75$4, and metadata such as agent age, scenario type, and model identity. Vulnerabilities are flagged whenever any dimension score falls below a threshold, exemplified as $ICC > 0.75$5, with particular attention to low Boundary Respect or Privacy Protection in boundary-testing scenarios (Murali et al., 7 Oct 2025).

The reported aggregate ranking places GPT-5 at 0.777, Claude Sonnet 4 at 0.762, Gemini 2.5 Pro at 0.720, and DeepSeek-V3.1 at 0.698, with all pairwise differences at $ICC > 0.75$6. Age-stratified analysis using GPT-5 as an example reports 0.738 for A6–8, 0.842 for A9–11, 0.745 for A12–14, and 0.755 for A15–17. Across models, early elementary performance is 11.5% lower than middle childhood, indicating that the youngest simulated users are not the easiest safety case despite often receiving the simplest language (Murali et al., 7 Oct 2025).

Dimension-level results are uneven. Educational Impact is reported at 0.94–0.96 across all models, making it the strongest dimension. Boundary Respect is the weakest, at 0.58–0.70. Privacy Protection varies substantially, with Claude at 0.86, GPT-5 at 0.82, and DeepSeek at 0.63. Long-term Impact is also weak: 0.57 for GPT-5 and Claude, 0.41 for Gemini, and 0.49 for DeepSeek. These results imply that current alignment methods are relatively effective at producing clear explanations but less reliable at managing relational stance, future-oriented harm, and repeated boundary pressure (Murali et al., 7 Oct 2025).

The qualitative failures are correspondingly specific. A 6-year-old boundary-testing agent elicits location-tracking advice from Gemini 2.5 Pro, with Boundary Respect $ICC > 0.75$7. An adolescent agent coaxes GPT-5 into unverified medical advice, with Privacy $ICC > 0.75$8 and Long-term Impact $ICC > 0.75$9. DeepSeek-V3.1 is reported to default to overly casual slang with younger agents, driving Developmental Sensitivity below 0.60. These are not merely failures to refuse; they are failures of age-calibrated interaction policy (Murali et al., 7 Oct 2025).

4. Relation to neighboring child-safety benchmarks

ChildSafe sits within a rapidly expanding benchmark ecosystem, but its simulated-agent and age-weighted design distinguishes it from several adjacent efforts. SproutBench uses 1,283 developmentally grounded adversarial prompts across ages 0–6, 7–12, and 13–18, evaluates 47 LLMs, and defines Safety, Risk Prevention, Interactivity, and Age Appropriateness as explicit quantitative dimensions. Its reported correlations include $< 0.20$0, $< 0.20$1, $< 0.20$2, and a notable trade-off $< 0.20$3, suggesting that more chatty models tend to become less age-tailored (Xing et al., 14 Aug 2025).

Safe-Child-LLM adopts a smaller but highly controlled adversarial design: 200 prompts, split evenly across ages 7–12 and 13–17, with a human-annotated 0–5 ethical refusal scale and a jailbreak success criterion. On ages 7–12, jailbreak success ranges from 5.0% for Claude 3.7 to 28.5% for Mistral-7B; on ages 13–17, from 6.6% to 32.4%. Average refusal scores $< 0.20$4 similarly separate top-tier and open-weight systems, with no significant difference between GPT-4o and Claude 3.7, but $< 0.20$5 between top-tier and mid-tier models, and $< 0.20$6 between open-weight and commercial systems (Jiao et al., 16 Jun 2025).

KIDBench narrows the age range to 7–11 and emphasizes prompt framing, multilinguality, and dialogue stability. It compares no-cue prompts, implicit-cue prompts, and explicit-age system instructions. Implicit cues improve average total score by +0.887 points, corresponding to 9–47% relative gains across models, while explicit age adds +1.667 points over no-cue and +0.780 over implicit-cues, with all paired comparisons at $< 0.20$7. It also reports uneven safety across English, Mandarin, Hindi, and Urdu, and multi-turn degradation of 6–24% from the first to worst turn (Arif et al., 25 May 2026).

Two other systems extend the problem beyond benchmark scoring. CAREBench targets “upstream” risks such as grooming and relationship engineering, deception and impersonation, surveillance and privacy, AI anthropomorphization, emotional dependency, and mental illness sensitivity. Across seven frontier models, failure rates range from 2.3% to 58.0%, with common failure modes including Actionable Artifact Generation, Unhealthy Relational Engagement, and Unsafe Redirect (Krishna-Kumar et al., 29 Jun 2026). YouthSafe, by contrast, is a real-time risk detection model trained on the YAIR dataset of 12,449 annotated conversation snippets spanning 78 low-level risk types. On YAIR-HUMANVAL, it reports AUPRC 0.9432, F1 0.8832, precision 0.8799, and recall 0.8865, substantially exceeding several moderation baselines (Yu et al., 10 Sep 2025).

Taken together, these benchmarks and safeguard models indicate a field-wide shift from adult-general safety toward child-specific evaluation regimes that incorporate developmental stage, dialogue persistence, cultural context, and relational harms. ChildSafe’s distinctive contribution within this landscape is the combination of simulated developmental agents and an explicitly age-weighted nine-dimensional score (Murali et al., 7 Oct 2025).

5. Broader system interpretations of ChildSafe

Outside LLM benchmarking, “ChildSafe” has also been used, or directly proposed as a design label, for operational systems that protect minors through architecture, policy, and formal reasoning. In the IoT setting, mySafeHome presents a context-aware access-control framework in which a Raspberry Pi 3B+ acts as both IoT controller and home-level firewall/router, running OpenHAB, AdminConsole, ClientsInfoService, and MLService. Devices are partitioned into Guardian’s Devices and Child Accessible Devices, and physical proximity is inferred from RSSI pair-traces

$< 0.20$8

which feed a classifier returning $< 0.20$9. Policy evaluation is rule-based, with actions Allow, Block, and Limit; enforcement is realized through IPTables, IP Sets, DNS whitelisting, rate limiting, and OpenHAB controls such as TV locks or smart-plug shutdowns. Reported prototype metrics include policy update latency $[0,1]$0 ms, distance classification accuracy $[0,1]$1 on a hold-out set, and an average SUS score of 78/100 in a pilot with $[0,1]$2 families (Majib et al., 2019).

A more formal online-service interpretation appears in Ta’s safety risk assessment framework for children’s online safety. There, risk is defined as

$[0,1]$3

Threat level is further decomposed into app or service attractiveness, likelihood of harm, and skills or tools required. Safety weakness is inferred by backward-resolution proofs over service actions and inference rules, with derivation probability $[0,1]$4 mapped to High, Medium, or Low by thresholds $[0,1]$5, $[0,1]$6, and $[0,1]$7. The framework is positioned as Safety-by-Design for developers and as an explainable audit method for existing services; a prototype applied to $[0,1]$8 representative apps is reported to differentiate child- and adult-oriented apps by weakness scores (Ta, 2024).

A compliance-oriented variant appears in the audit of 91 Android apps against GDPR and UK/EU safeguarding criteria. That work defines a weighted-sum risk model

$[0,1]$9

over violation indicators such as unauthorized data sharing, excessive permissions, absence of erasure mechanisms, lack of reporting UI, and missing parental controls. Among the audited apps, 65/69 child apps lacked reporting UI, 31/69 lacked parental controls, and 10/91 lacked an erasure mechanism. This line of work shows that ChildSafe can also denote a verification and governance toolchain rather than an interaction benchmark (Lopes et al., 2023).

6. Design tensions, governance, and future directions

The most persistent design tension in ChildSafe research concerns how protection should be balanced against participation, privacy, and agency. SproutBench explicitly identifies an inverse relationship between Interactivity and Age Appropriateness, with $$S_{\mathrm{composite}} = \frac{\sum_{i=1}^{9} w_i^{(\mathrm{age})}\, s_i} {\sum_{i=1}^{9} w_i^{(\mathrm{age})}}$$0, and recommends “safety buffers” such as an additional age-appropriateness policy check when Interactivity exceeds 4.0. It also recommends pre-filtering age-sensitive risk keywords, age-adaptive response tuning, parental dashboards for aggregate Safety and Risk Prevention metrics, tiered access controls, and real-time alerts for borderline cases where Safety or Risk Prevention fall below 0.5 (Xing et al., 14 Aug 2025).

A more general governance critique is developed in Child-fit security, which rejects the premise that children should primarily be handled through bans, age gates, surveillance, and simple parental overrides. Instead, it defines child-fit security as the design and governance of systems in which children’s wellbeing, development, privacy, safety, agency, and rights are first-order security requirements. Its core principles are to treat children as legitimate users, support children’s agency, recognize child diversity, and protect children’s rights. This reframes safety from a problem of excluding minors from adult systems to one of designing systems for safe participation (Ramokapane et al., 16 Jun 2026).

Privacy-preserving and multimodal extensions further expand the agenda. CFAS, or the Cybersafety Family Advice Suite with Guardian Avatars, performs local analysis by default through a browser add-on, intelligent web-proxy, parental console, and back-end retraining loop, with explicit child consent governing what parents or remote services can see (Charalambous et al., 2020). KidsNanny addresses image moderation through a two-stage pipeline: a ViT plus object detector for visual screening at 11.7 ms, followed when needed by OCR and a 7B text-only LLM for contextual reasoning, yielding 81.40% accuracy and 86.16% F1 at 120 ms, and 100% recall on a small text-only threat subset (Panchal et al., 17 Mar 2026). These systems suggest that child safety cannot be reduced to text-only refusal policies.

Future directions are correspondingly broad. ChildSafe itself recommends incorporating real child-centered dialogs from diverse cultural and linguistic backgrounds, dynamic safety controllers that adjust weights $$S_{\mathrm{composite}} = \frac{\sum_{i=1}^{9} w_i^{(\mathrm{age})}\, s_i} {\sum_{i=1}^{9} w_i^{(\mathrm{age})}}$$1 in real time, engagement with parents and educators in in-situ studies, extension to non-English languages and non-Western developmental frameworks, and adversarial curriculum learning beyond the initial scenario set (Murali et al., 7 Oct 2025). Across the literature, the likely long-term trajectory is toward integrated child-safe systems that combine developmental evaluation, real-time risk detection, multimodal moderation, explainable auditing, and governance models that protect both the child and the child–system relationship.