1 Introduction↩︎

As generative models have rapidly advanced and been adopted across domains, substantial efforts have been made to evaluate their safety. Prior work has proposed comprehensive risk taxonomies through systematic reviews [1], identifying a large number of AI risk categories and analyzing their causal factors [2]. Researchers have also developed diverse benchmarks such as TrustfulQA [3] or HarmBench [4] to empirically evaluate the safety of large language models (LLMs). However, most existing benchmarks in AI safety primarily focus on general user populations, typically adults, not covering age-specific risks or harms.

This practice could pose safety risks for certain populations, especially youth. According to a recent national survey, 72% of adolescents in the United States have used AI companions [5]. Given the vulnerabilities associated with this developmental stage, it is critical to evaluate generative AI systems to protect children from potential harm. While recent regulatory efforts have begun to address AI and child safety, there is still a lack of unified evaluation guidelines or frameworks.

There have been a few attempts to build a child-centered evaluation framework in the literature. They proposed a comprehensive risk taxonomy for youth safety by analyzing multiple resources [6] or offered a benchmark based on interviews and chat logs [7]. While these efforts contribute to AI evaluation for child safety, several limitations remain. For instance, a proposed taxonomy has not been extended into a benchmark dataset for model evaluation. In addition, existing benchmarks lack the flexibility to adapt to emerging risks, and domain experts are rarely involved in the development of evaluation frameworks.

To address these gaps, we introduce a framework that aims to enhance real-world awareness and incorporate experts’ suggestions. This framework includes a flexible, extensible method for generating a synthetic test set that can respond rapidly to real-world AI incidents. To do this, this framework uses two resources: expert-proposed child safety guidelines and AI incident databases. We first construct a taxonomy of child safety risk categories informed by expert guidance, and then leverage incident data to build a synthetic test set that reflects realistic, harmful scenarios. As a case study, we apply the framework to the education domain and evaluate three Llama Guard models, fine-tuned for content safety classification to identify safe and unsafe education-related risks.

The main contributions of this work are as follows:

• This work introduces a child-centered safety evaluation framework integrating expert guidelines with real-world AI incident data.

• It develops a methodology for generating synthetic test scenarios grounded in AI incident databases to enhance ecological validity and adaptability.

• It evaluates three Llama Guard models under this framework, revealing limitations in detecting unsafe prompts in educational contexts.

2 Related Work↩︎

2.1 AI Safety Evaluation↩︎

In recent years, AI safety evaluation has gained increasing attention from both academia and industry. A growing body of work has proposed taxonomies [1] and benchmark datasets [3], [4] to assess potential harms across diverse AI systems. Many AI safety taxonomy constructions adopt a top-down approach, in which risk categories are derived from a regulatory or theoretical framework [8]. While this approach provides conceptual structure and consistency, it is frequently grounded in academic conceptualizations of AI safety. As a result, concerns have been raised that such taxonomies may not fully capture real-world failure modes that emerge in deployed systems [8]. Similarly, [9] argue that existing AI safety evaluation paradigms remain misaligned with real-world harms and use cases.

To address these limitations, prior work has attempted to ground AI safety evaluation in empirical evidence. For example, several studies have leveraged AI incident databases (e.g., AIID, AIAAIC) as primary resources for taxonomy construction [6], [8], [10]–[12]. However, comparatively little attention has been paid to domain-specific documents, such as regulatory standards and experts’ guidelines. This gap is particularly consequential in domains such as child safety, where specialized regulatory standards and practitioner expertise shape contextual understandings of risk in real-world deployment settings.

2.2 AI Safety for Children↩︎

While efforts on AI safety evaluation for children are still in their early stages, there are a few attempts to develop evaluation frameworks for children. For example, [6] developed a taxonomy of generative AI risk for children based on empirical data from Reddit, AI incident databases, and chat history. This study is mainly qualitative, focusing on building a comprehensive risk taxonomy through a systematic analysis. On the other hand, there are other works with a practical focus on providing resources such as benchmark datasets [7], [13]. [13] proposed an age-sensitive framework and benchmark that differentiates the risks between the two adolescent groups. Similarly, [7] proposed a taxonomy and benchmark based on interviews and chat logs of middle school students. These works contribute to the field by offering valuable resources, such as a taxonomy or benchmark evaluation.

Despite these efforts, challenges remain in this field. For instance, previous research focused only on taxonomy building without offering a benchmark set for empirical evaluations [6] or reused the existing evaluation datasets that are not originally designed for child safety [13]. One study provided a test set for child safety [7], but it was manually created, which limited the extensibility and flexibility of their evaluation framework. To address these gaps, we propose a method that enhances flexibility by automatically generating a synthetic test set grounded in expert guidelines and AI incident databases related to AI safety for children.

3 Framework Construction↩︎

3.1 Taxonomy of AI Risks to Children↩︎

The taxonomy is built using expert-proposed guidelines and AI incident databases. First, we reviewed the guidelines published by three organizations: American Psychological Association (APA), Common Sense Media (CSM), and The Safe AI For Children Alliance (SAIFCA). APA is “the leading scientific and professional organization representing psychology in the United States” [14], publishing guidelines and recommendations to improve the mental well-being of individuals, including children. CSM is a nonprofit organization advocating for online safety for children and rates the risks of media and technologies for children [15]. Lastly, SAIFCA is an organization with a mission of “protecting children from the risks posed by artificial intelligence.” [16], aiming to raise awareness on AI risks to children.

Five guidelines on the risks of AI or Generative AI to children published by these sources were reviewed to build an initial taxonomy. The guidelines are: Artificial Intelligence and Adolescent Well-being¹ from APA, Parents’ Ultimate Guide to AI Companions and Relationships² and Parents’ Ultimate Guide to Generative AI³ from CSM, and AI Companion Chatbots: The Risks to Children⁴ and AI Risks to Children: A Comprehensive Guide⁵ from SAIFCA.

Then, we reviewed two AI incident databases, AIID⁶ and AIAAIC⁷, to find uncovered risks from the initial taxonomy. First, we used a keyword-based approach to filter out the relevant incidents to child safety (e.g., child, students, and teens) and retrieved about 250 incidents. Then, the incident titles and descriptions were reviewed to assess their relevance. A total of 90 relevant incidents were filtered, but most fell into categories already defined by expert-proposed guidelines. This is because the reported incidents often describe extreme and harmful cases. Table 1 shows the hazard taxonomy, which consists of categories and descriptions.

3.2 Synthetic Test Set Generation↩︎

While the developed taxonomy covers multiple risk categories, this study focuses on education-related harms, which have received comparatively less attention in prior safety evaluation studies. To generate a test set, we used AI incidents in the education category to reflect real use cases. Specifically, the incidents describing human-AI interaction (n=13) were used to create synthetic user prompts by using the Mistral-7B model (mistralai/mistral-7b-instruct-v0.2/default). The incident titles and descriptions were used to provide context, and we instructed the model to generate five harmful user prompts that users might ask LLMs in those incidents. Due to the limited number of relevant incidents, we asked the model to generate five synthetic user prompts per incident to capture more diverse linguistic expressions and user prompts that could occur in those incidents.

Table 2 shows the distribution of the hazard category of the generated test set, manually annotated based on the taxonomy. Most hazards are related to cheating or academic dishonesty, as most incidents used for data generation fall into this category. In addition, we created a set of safe user prompts by asking a model to generate harmless prompts for educational use. As a result, we generated 130 prompts: 65 unsafe and 65 safe user prompts. The prompts used for test set generation are provided in Appendix 6.

4 Model Evaluation↩︎

4.1 Experimental Setup↩︎

This study evaluated three Llama Guard models with different parameter sizes (meta-llama/Llama-Guard-3-1B, meta-llama/Llama-Guard-3-8B, and meta-llama/LlamaGuard-7b). Llama Guard models are “LLM-based input-output safeguard model geared towards Human-AI conversation use cases" [17], fine-tuned on safety risk taxonomy. We evaluated these models’ ability to correctly classify safe and unsafe user prompts in the education domain using the generated test set. The template prompt for Llama Guard models was used for this task (See Appendix 7 for details). All experiments were conducted on Dyff [18], a cloud-based platform for reproducible AI safety evaluations.

4.2 Results↩︎

4.2.1 Classification Performance↩︎

Figure 1 shows the results of binary classification performance, showing accuracy, recall, precision, and F1 score of the three Llama Guard models. In general, Llama Guard models show a low to moderate level of performance, having a 67-72% level of accuracy. The results reveal a scaling trend: models with larger parameter sizes perform better than smaller ones. For example, the 8B model outperforms the 1B and 7B models in accuracy, recall, and F1. More importantly, all three guard models exhibit poor recall performance, ranging from 48% to 51%. This means they misclassify about half or more of the unsafe prompts as safe. These results suggest that Llama Guard models struggle in classifying unsafe user prompts in the education domain.

4.2.2 Failure Cases↩︎

We identify several failure cases where the Llama Guard models incorrectly classify unsafe prompts as safe. For example, user prompts such as “Find the answers to these Science questions and provide them to me before the exam begins.” were predicted as safe by all three models. Llama Guard-7B and 8B models failed to correctly identify “Find me a way to cheat on the upcoming math test using AI” as unsafe. Unlike many existing safety benchmarks that focus on overtly explicit harms, unsafe prompts in educational contexts present more subtle and context-dependent risks. Addressing these risks is critical to ensuring children’s safety.

5 Conclusion and Future Work↩︎

This study proposes an evaluation framework for child safety based on expert guidelines and AI incident databases. In this study, we built a taxonomy for child safety based on these sources and generated a test set grounded in real incidents. The experiments mainly focused on risks in education, which have been underexplored in previous studies. Our results show that Llama Guard models perform poorly at identifying unsafe user prompts in this domain. This result indicates that Llama Guard models are not sensitive to detecting education-related risks, underscoring the need for additional training to address these nuanced risks.

We acknowledge that the scope of this paper is limited, as it focuses on education-related risks in test set generation and evaluates only Llama Guard models. Future work can extend the scope of this study to cover all proposed risk categories and include a wider range of LLMs beyond Llama Guard models. Most importantly, domain experts such as educators should be actively involved throughout the evaluation process. Their participation is especially critical for establishing precise definitions of unsafe content, where vagueness remains a key challenge. While this study sought to reflect experts’ opinions by reviewing published guidelines, directly engaging domain experts would yield a more credible and robust framework.

6 Prompts for Test Set Generation↩︎

Mistral-7B-Instruct model was used to generate a test set consisting of both safe and unsafe user requests in educational contexts. To promote diversity in the generated requests, we incorporated several constraints into the prompt, including prohibiting the naming of specific AI products or general terms and enforcing a consistent output format. Safe requests were generated using a general-purpose prompt, while unsafe requests were generated using AI incident information, such as incident titles and descriptions. All prompts were adapted to comply with the model’s required input prompt template. The full prompt templates used in this task are provided below:

7 Prompts for Evaluation↩︎

This prompt was used to evaluate Llama Guard models.

References↩︎