SproutBench: Benchmark for Child-Focused LLM Safety

• SproutBench is a benchmark that assesses LLM safety, ethics, and developmental appropriateness for youth using age-specific adversarial prompts.
• It employs 1,283 prompts spanning 20 risk categories across early childhood, middle childhood, and adolescence to evaluate key dimensions like safety and educational value.
• Empirical results show that model scale and tailored evaluation metrics significantly influence LLM performance in addressing youth-specific risks and promoting development.

SproutBench refers to a benchmark for evaluating the safety, ethical behavior, and developmental appropriateness of LLMs deployed in applications targeting children and adolescents. It provides a comprehensive, developmentally stratified adversarial prompt suite focused on the unique risks and design challenges associated with child- and teen-facing language technologies. SproutBench is constructed to fill gaps left by adult-oriented LLM safety benchmarks by explicitly operationalizing and measuring youth-specific vulnerabilities, risk patterns, and interaction modalities (Xing et al., 14 Aug 2025).

1. Motivation and Conceptual Foundations

SproutBench addresses deficiencies in prevailing LLM safety frameworks, which are largely optimized for adult usage and general content moderation. These earlier benchmarks emphasize toxicity, jailbreak resistance, and liability avoidance, but do not account for cognitive, emotional, or social susceptibilities characteristic of minors across childhood and adolescence. SproutBench is motivated by several foundational observations:

• Distinct developmental vulnerabilities in minors—such as limited abstract reasoning, high imitative propensity in early childhood, heightened impulsivity and rule-testing in middle childhood, and increased risk-taking, privacy probing, and ideological challenge-seeking in adolescence—necessitate tailored evaluation criteria.
• Many risks for children and teens arise not only from directly harmful outputs but also from subtle failures in age-appropriate guidance, emotional scaffolding, and proactive risk mitigation (e.g., prevention of emotional overdependence on AI, privacy boundary transgression, or imitation of hazardous behaviors).
• The benchmark reframes safety from a mere “risk avoidance” stance—centered on refusing or blocking dangerous content—to the broader goal of “development promotion,” where LLMs are evaluated on their ability to provide responses that are safe, developmentally aligned, supportive, and educationally constructive.

This conceptual shift is operationalized by structuring the benchmark taxonomy and scoring criteria around risk patterns most salient for children and adolescents (Xing et al., 14 Aug 2025).

2. Benchmark Composition and Taxonomy

SproutBench comprises 1,283 adversarial prompts encompassing 20 distinct behavioral risk categories, systematically distributed across three developmental age brackets: early childhood (0–6), middle childhood (7–12), and adolescence (13–18). The benchmark’s taxonomy is formulated as follows:

• Age Groups: $A = \{\text{0--6}, \text{7--12}, \text{13--18}\}$
• Risk Behaviors: $B_a$, the set of risk or misuse categories specific to age group $a$
• Query Types: $Q_t$, including testing (boundary probing), manipulative (restriction circumvention), emotional (support-seeking), and exploratory (curiosity-driven) prompts

Prompt types in the benchmark include, for example:

• 0–6: unconscious sensitive word input, need for emotional expression, AI companionship over-reliance, imitating game behavior.
• 7–12: command manipulation attempts, fictional identities, privacy testing, social show-off, imitating violent games.
• 13–18: academic cheating, bypassing restricted topics, emotional or ideological manipulation, value conflict, social engineering.

Each prompt is annotated with age group, behavioral category, and query motivation, ensuring structured coverage of the developmental risk space (Xing et al., 14 Aug 2025).

The overall taxonomy distinguishes:

• Risks to the user: mental health (e.g., emotional dependency), social and behavioral (e.g., mimicry or antisocial responses), misinformation, cognition/learning mismatch, privacy.
• Risks from user misuse: social/behavioral (e.g., pranks, bypass attempts, cyberbullying), academic integrity violations.

3. Data Generation and Validation Methodology

Prompt generation follows a multi-stage, developmentally informed simulation pipeline:

1. Persona Knowledge Base: Constructed via literature review, child psychology expertise, and developmental theory (notably Piaget, Vygotsky, and UNICEF policy guidance), encoding cognitive traits, linguistic patterns, and motivations by age group.
2. Prompt Formulation: For each $s = (a, b, q_t)$, a contextually grounded prompt is created, simulating realistic child–AI interaction.
3. Model-based Generation: GPT-3.5 (temperature 0.7) generates candidate queries, with further sampling diversity introduced by adjusting temperature. Prompts are filtered through GPT-4 for quality and risk relevance. Human review by child psychology experts ensures validity in adapted prompts.
4. Metadata Assignment and Stratified Sampling: Prompts are tagged and sampled to maximize coverage of age–behavior–query-type combinations.

The automatic scoring system for benchmark evaluation relies on Qwen-2.5, with validation by three independent child psychologists (Cohen’s Kappa with judge = 0.78) (Xing et al., 14 Aug 2025). Discrepancies in adapted prompt counts and exact model tallies are present in the documentation, but the finalized inventory and taxonomy structure are explicit.

4. Evaluation Framework and Metrics

SproutBench evaluates model responses across six key dimensions, each scored on a 0--5 scale:

1. Age Appropriateness: Suitability of the output for the user’s developmental stage.
2. Educational Value: Constructive or pedagogical content.
3. Emotional Support: Provision of appropriate, healthy emotional responses without fostering dependency.
4. Interactivity: Engagement, responsiveness, and conversational utility.
5. Risk Prevention: Proactive discouragement or redirection of harmful, manipulative, or risky user behaviors.
6. Safety: General boundary adherence and avoidance of harmful content.

The evaluation uses both aggregated means and cross-dimensional correlation structure to analyze model performance. Notably:

• Strong positive correlation ($\rho = 0.86$) between Safety and Risk Prevention;
• Strong correlation between Age Appropriateness and Educational Value ($\rho = 0.81$);
• Moderate negative correlation between Interactivity and Age Appropriateness ($\rho = -0.48$);
• PCA shows Safety as the dominant latent axis, with Interactivity orthogonal ($\sim$5% of variance) (Xing et al., 14 Aug 2025).

Table: Core Evaluation Dimensions

Dimension	Scoring Range	Conceptual Focus
Age Appropriateness	0–5	Developmental fit
Educational Value	0–5	Constructive guidance
Emotional Support	0–5	Support, but without dependency
Interactivity	0–5	Engagement, responsiveness
Risk Prevention	0–5	Proactivity in blocking/pivoting risk
Safety	0–5	Harm avoidance, boundary compliance

Empirical performance is summarized via means, variances, and archetypal clustering. Model scoring is primarily via an automatic LLM judge, with human expert calibration.

5. Empirical Results and Key Findings

• Model Coverage: 47 LLMs (135M–70B parameters) evaluated; includes Llama-2, Gemma (series), Qwen, DeepSeek, Hermes, Phi-3, SmolLM, TinyLlama families.
• Top Performers: llama2:7b (mean 4.61), llama2:70b (4.58), gemma2:9b (4.56)—all robust on safety and age alignment.
• Struggling Models: smollm2:135m (mean 3.26), tinyllama:1.1b (3.41), phi3:3.8b (3.52)—tied to low parameter counts.
• Risk Areas: Risk Prevention and Safety are the most challenging for smaller models; emotionally manipulative, privacy-testing, and adolescent bypass prompts are particularly revealing.
• Tradeoffs: Interactivity is somewhat negatively correlated with developmental alignment. Larger models consistently perform better both in safety and in developmental appropriateness.
• Archetype Clustering: Five clusters identified; only a subset of models combine high safety and high interactivity (e.g., gemma3:12b, llama2:7b). Some highly interactive models nonetheless remain risky or unsuitable for minors.

Analyses affirm that performance on SproutBench is multidimensional—high safety does not necessarily imply engagement, and models must balance helpfulness with boundaries and restraint (Xing et al., 14 Aug 2025).

6. Limitations and Open Issues

• Documentation Inconsistencies: Mismatches in model and prompt counts, lack of rigorous breakdown of adaptation and review samples.
• Assessment Pipeline Ambiguity: Human vs. LLM judge roles inadequately disentangled, risking rubric drift or judge-model bias.
• Cultural/linguistic Scope: Limited explicit treatment of multilingual or cross-cultural developmental norms.
• Domain Breadth: While broad, the benchmark cannot cover the entire harm space; interactivity-related harm and demographic representation require further expansion.
• Static Prompt Limitations: Susceptibility to benchmark overfitting or saturation with repeated exposure.
• Evaluator Bias: Reliance on LLM judging introduces alignment assumptions not always congruent with diverse human expert views.

The benchmark does not explicitly disclose full resources, code, or a project page in the main article, nor is there a leaderboard described (Xing et al., 14 Aug 2025).

7. Implications for LLM Design and Future Directions

SproutBench demonstrates that youth-focused LLM safety evaluation is irreducibly multidimensional. Key implications include:

• Developmentally tailored, risk-aware model alignment is essential—successful child-oriented LLMs must support emotional wellbeing, privacy, educational quality, and safety.
• Standard safety benchmarks for adults do not capture the full spectrum of vulnerabilities posed by child and adolescent users.
• Tradeoffs between engagement and restraint, or helpfulness and prevention, are quantifiable and must be actively managed in system design.
• Model scale is predictive but not sufficient; best-in-class behavior requires specific tuning to developmental and risk profiles.

The authors recommend prioritizing interactivity-aware safeguards, broadening cultural/demographic representation, and incorporating scaffolded youth participation in the benchmarking process (Xing et al., 14 Aug 2025).