KIDGuardLlama: Child-Safety Guard Model

• KIDGuardLlama is defined as a guard model that approximates DeepSeek-V4-Pro's structured child-safety judgments using a developmental-psychology-grounded rubric.
• It operates within the KIDBench framework, scoring responses on safety, developmental appropriateness, socio-emotional support, moral guidance, and boundary-setting.
• Built on Llama-3.1-8B-Instruct with LoRA adapters, it achieves high agreement with teacher judgments while being constrained to the 7–11 age range.

Searching arXiv for the primary KIDGuardLlama source and closely related child-safety guardrail work. KIDGuardLlama is a child-safety guard model introduced alongside KIDBench and KIDLlama as part of a child-facing LLM adaptation pipeline for ages 7–11. It is defined as “a smaller guard model trained to approximate DeepSeek-V4-Pro’s judgments,” and is positioned not as the child-facing response generator but as a rubric-aligned evaluator that scores responses for safety, developmental appropriateness, socio-emotional support, moral guidance, and boundary-setting under the KIDBench framework (Arif et al., 25 May 2026). Within that pipeline, KIDGuardLlama serves as a scalable surrogate for a stronger LLM judge and as a feedback model during policy optimization of KIDLlama, supplying scores, critiques, and reward signals (Arif et al., 25 May 2026).

1. Definition and system role

KIDGuardLlama is explicitly distinguished from the two other central components of the same framework. KIDBench is “a benchmark for evaluating child-facing LLM safety for ages 7--11 using a developmental-psychology-grounded LLM-as-a-Judge rubric,” while KIDLlama is “a response model trained to generate developmentally appropriate and child-safe answers.” KIDGuardLlama, by contrast, is the guard or evaluator model trained to approximate the judgments of DeepSeek-V4-Pro under that rubric (Arif et al., 25 May 2026).

Its intended role is practical rather than merely descriptive. The paper states that its strong agreement with DeepSeek-V4-Pro “makes KIDGuardLlama useful for scalable child-safety checking and response revision.” In the KIDLlama training loop, its role is even more operational: “During Critique-GRPO, KIDGuardLlama scores generated responses, produces improvement critiques, and supplies reward signals for policy optimization” (Arif et al., 25 May 2026). This establishes KIDGuardLlama as both an evaluator and a training-time critic.

A recurrent misconception in discussions of child-facing models is to treat KIDGuardLlama as the model that speaks directly to children. The paper does not support that interpretation. It repeatedly separates the responder from the evaluator: KIDLlama is the child-oriented response model, whereas KIDGuardLlama is the smaller guardrail model approximating the benchmark judge (Arif et al., 25 May 2026). A plausible implication is that KIDGuardLlama is closer to a specialized LLM-judge surrogate than to a conventional chat assistant.

2. Benchmark and rubric context

KIDGuardLlama is inseparable from KIDBench because its supervision target is the structured output of the KIDBench judge. KIDBench is built for child-facing safety in the 7–11 age range and is grounded in developmental assumptions tied to “Piaget's concrete operational stage.” The paper states that children in this range benefit from “concrete, simple, age-calibrated explanations rather than abstract reasoning,” and frames child safety as requiring more than harmful-content avoidance (Arif et al., 25 May 2026).

The benchmark includes realistic child queries across ten categories and supports single-turn, cross-lingual, cultural-context, and multi-turn evaluation. For single-turn evaluation it contains 50 no-cue prompts per category across 10 categories, yielding 500 base prompts, with matched implicit-cue versions. For multi-turn evaluation it includes 10 scenario–child-goal pairs per category, totaling 100 pairs (Arif et al., 25 May 2026). The ten operational prompt categories are:

• Sexual Content and Boundaries
• Self-harm and Mental Health
• Aggression and Bullying
• Moral Reasoning
• Physical Health and Safety
• School Conduct and Integrity
• Family, Peers, and Relationships
• Online Safety and Privacy
• Hate, Bias, and Identity Attacks
• Benign Information Seeking

The scoring rubric used by DeepSeek-V4-Pro is multidimensional. In the main setup, responses are scored from 1 to 5 on six dimensions: Content Safety, Developmental Appropriateness, Socio-emotional Support, Moral Guidance and Social Influence, Boundary-setting, and Cultural Alignment, although many reported totals average over five metrics with cultural alignment omitted unless that setting is active (Arif et al., 25 May 2026). The judge is instructed to return a structured JSON object with the fields failure_modes, strengths, safety, developmental_fit, emotional_support, moral_guidance, boundary_setting, cultural_alignment, and improvement (Arif et al., 25 May 2026).

Because KIDGuardLlama is trained to predict DeepSeek-V4-Pro’s structured child-safety judgments, the benchmark’s rubric is effectively its target ontology. The paper does not explicitly state that KIDGuardLlama emits the full same JSON schema at inference time. It is therefore safer to say that it predicts structured judgments approximating that schema than to assert exact output parity (Arif et al., 25 May 2026).

3. Model architecture and training configuration

The appendix specifies KIDGuardLlama’s base model and training configuration. Its base model is Llama-3.1-8B-Instruct, adapted with LoRA adapters (Arif et al., 25 May 2026). The reported hyperparameters are concrete:

Parameter	Value
LoRA rank $r$	16
LoRA $\alpha$	32
Learning rate	$2\times10^{-4}$
Scheduler	Cosine
Optimizer	Paged AdamW (8-bit)
Warmup ratio	0.05
Weight decay	0.01
Epochs	3
Effective batch	16
Max sequence length	4,096
Training examples	67,899

The supervision source is also explicit. KIDGuardLlama is “trained separately as a guardrail model to predict DeepSeek-V4-Pro's structured child-safety judgments” on 67,899 examples (Arif et al., 25 May 2026). The paper does not provide a formal loss equation, the exact training prompt template, or whether the targets were serialized full-JSON strings or some decomposed representation. It likewise does not specify whether the model is trained generatively or with a specialized classifier head (Arif et al., 25 May 2026).

Several plausible interpretations follow from the available description, but they remain interpretations rather than explicit facts. Because the model is said to “predict structured child-safety judgments,” and because it later “scores generated responses” and “produces improvement critiques,” it likely functions as a fine-tuned LLM judge surrogate rather than as a scalar-only reward model. However, the exact serialization and decoding scheme is not stated (Arif et al., 25 May 2026).

The compute description is modest and deployment-oriented. Training and evaluation were run on VESSL AI; smaller-model inference and fine-tuning used one NVIDIA A100 GPU, while larger or heavier fine-tuning used two A100 GPUs when needed. Total compute across KIDLlama SFT, Critique-GRPO, KIDGuardLlama training, checkpoint evaluation, and benchmark inference was approximately 30–40 A100 GPU-hours, excluding proprietary API inference (Arif et al., 25 May 2026). The paper does not break out a KIDGuardLlama-only training cost.

4. Agreement with the teacher judge

The primary empirical claim about KIDGuardLlama is that a LoRA-adapted 8B Llama can closely approximate DeepSeek-V4-Pro’s judgments on held-out data. The selected checkpoint “achieves strong agreement with DeepSeek-V4-Pro on the test set,” with the following reported metrics: Spearman $\rho = 0.8514$, ordinal agreement (QWK) $= 0.8722$, Exact Accuracy $= 0.7971$, Within-1 Accuracy $= 0.9607$, and MAE $= 0.2487$ (Arif et al., 25 May 2026).

The appendix reports checkpoint-wise results across three epochs:

Metric	Epoch 1	Epoch 2	Epoch 3	Best
Spearman $\rho$	0.8300	0.8514	0.8493	Epoch 2
QWK	0.8450	0.8722	0.8730	Epoch 3
MAE	0.2978	0.2487	0.2496	Epoch 2
Exact Acc.	0.7632	0.7971	0.7956	Epoch 2
Within-1 Acc.	0.9486	0.9607	0.9607	Epoch 2, 3

The authors choose Epoch 2 because it is best on most metrics and tied on Within-1 accuracy (Arif et al., 25 May 2026). This checkpoint-selection decision is directly stated rather than inferred.

The significance of these numbers is bounded by the evaluation target. KIDGuardLlama is compared to DeepSeek-V4-Pro judgments, not to human gold labels. The paper does not report direct human-agreement evaluation for KIDGuardLlama, per-category agreement, per-language agreement, or calibration by rubric dimension (Arif et al., 25 May 2026). This suggests that KIDGuardLlama should be understood as a compressed judge aligned to a particular teacher, not as an independently validated normative authority.

5. Function in the adaptation pipeline

The broader pipeline contains three linked stages: KIDBench provides the prompts and rubric, DeepSeek-V4-Pro provides structured judgments under that rubric, and those judgments are then used to train both KIDGuardLlama and KIDLlama (Arif et al., 25 May 2026). The paper’s concept diagram is summarized as a process in which child queries are evaluated, judged across child-safety dimensions, revised using judge feedback, and used to train KIDLlama.

Within that system, KIDGuardLlama occupies two operational positions. First, it is useful for “scalable child-safety checking,” replacing repeated calls to a larger proprietary judge. Second, it supports “response revision” because the teacher schema includes an improvement field and the model is described as producing improvement critiques (Arif et al., 25 May 2026). These functions place it between static evaluation and active training infrastructure.

Its role in Critique-GRPO is particularly notable. The paper states that KIDGuardLlama scores generated responses, produces improvement critiques, and supplies reward signals for policy optimization (Arif et al., 25 May 2026). This makes it analogous, in system role, to a reward source, even though the paper does not explicitly call it a reward model.

This architecture also situates KIDGuardLlama relative to adjacent safety research. In general-purpose guardrail work, external moderation systems such as Llama Guard–style prompt/response classifiers are often used for scalable safety filtering, while recent latent-reasoning guardrails aim to improve the robustness–efficiency trade-off for such systems (Sai et al., 27 May 2026). In child-safety work specifically, KIDGuardLlama differs from architectures that foreground edge-first, multi-agent moderation for grooming and exploitation detection, because its reported use is rubric-aligned response evaluation rather than session-level intervention policy (Mujtaba et al., 28 Feb 2025). This suggests that KIDGuardLlama is best characterized as a judge distillation component within a child-facing alignment pipeline, not as a complete child-safety stack.

6. Limitations and research significance

Several limitations are explicit. The benchmark targets only ages 7–11, so KIDGuardLlama’s age calibration is likely limited to that developmental band (Arif et al., 25 May 2026). The benchmark also “cannot capture every possible child-safety scenario,” covers only four languages and four country contexts, and relies on an actor LLM rather than real child users for multi-turn conversations (Arif et al., 25 May 2026). Because KIDGuardLlama is trained on judgments derived from that benchmark and teacher setup, it inherits these scope constraints.

Another important caveat is teacher dependence. KIDGuardLlama approximates DeepSeek-V4-Pro judgments rather than human gold labels. The paper does not frame this as “judge-model brittleness,” but a plausible implication is that KIDGuardLlama compresses not only the rubric interpretation but also the biases and blind spots of the teacher judge (Arif et al., 25 May 2026). This implication becomes especially salient because the paper deliberately prefers stricter evaluation, stating that “false positives are preferable to false negatives” and that “over-flagging a response is less harmful than missing a response that may put a child at risk” (Arif et al., 25 May 2026).

The system’s conservatism therefore has dual significance. On one hand, it is aligned with the safety philosophy that “Child-facing safety is not only about avoiding harmful content. A high-quality response should be safe, truthful, age-appropriate, supportive, prosocial, and appropriately bounded” (Arif et al., 25 May 2026). On the other hand, a plausible consequence is overblocking: acceptable responses may be judged too harshly, especially in ambiguous educational, cultural, or emotionally nuanced settings.

The paper is also careful not to overstate deployment claims. KIDGuardLlama is clearly proposed for offline checking, response revision, and training-time critique, but the text does not explicitly demonstrate an online runtime filtering deployment (Arif et al., 25 May 2026). In the broader child-safety literature, this matters because adjacent evaluation work has shown that generic Llama Guard models struggle on child-specific harms such as education-related unsafe prompts, with recall reported in the 48%–51% range in one education-domain study (Kong, 1 Jul 2026). Other child-safety benchmarks likewise emphasize that age-sensitive safety cannot be reduced to adult-oriented harmfulness detection and that refusal quality must be evaluated alongside binary safety (Jiao et al., 16 Jun 2025). This suggests that KIDGuardLlama’s main contribution is not to solve all child-safety moderation problems, but to provide a compact evaluator aligned to a developmental rubric and usable inside a scalable adaptation pipeline.

In summary, KIDGuardLlama is best understood as a LoRA-tuned Llama-3.1-8B-Instruct guard model trained on 67,899 examples to approximate DeepSeek-V4-Pro’s structured child-safety judgments under the KIDBench rubric. Its empirical value lies in its high agreement with the teacher judge and in its function as a scalable evaluator and critique source for KIDLlama training, while its principal limitations arise from the age range, benchmark scope, teacher dependence, and incomplete specification of exact I/O and calibration behavior (Arif et al., 25 May 2026).