Pith. sign in

REVIEW 3 major objections 6 minor 72 references

Current LLMs are far more vulnerable to education-specific harms than to generic safety violations, and their defenses erode as student or teacher conversations grow longer; the EduZone framework is the evaluation setup that exposes both pa

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-04 16:24 UTC pith:NFWYBETJ

load-bearing objection EduZone is a genuinely useful benchmark for K-12 LLM safety, but the paper needs to fix a few numerical inconsistencies and address the judge-overlap concern before I'd trust the quantitative comparisons. the 3 major comments →

arxiv 2608.02024 v1 pith:NFWYBETJ submitted 2026-08-03 cs.AI cs.CY

EduZone: A Framework for Evaluating LLM Safety for K-12 Students and Teachers

Junyeong Park , Jieun Han , Haneul Yoo , So-Yeon Ahn , Jinsung Yoon , Alice Oh This is my paper
classification cs.AI cs.CY
keywords LLM safetyK-12 educationadversarial evaluationmulti-turn conversationacademic misconductcognitive loadguardrailsred-teaming
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

EduZone is an automated framework for testing whether LLMs behave safely when students and teachers actually use them. It generates adversarial prompts grounded in real K-12 curriculum topics, across three interaction settings: single questions, scripted multi-turn conversations, and adaptive conversations that respond to the model's own answers. Evaluating ten LLMs, the paper reports that attack success rises from about 30% on single-turn prompts to about 54% on adaptive multi-turn conversations, and that education-specific risks—especially student academic misconduct (80.3% attack success) and excessive cognitive load (73.0%)—far exceed conventional risks like hate speech (28.3%) or privacy violations (16.8%). The framework also shows that existing safety guardrails transfer poorly to these educational risks, while guardrails extended with an education-specific risk taxonomy reduce attack success substantially more. The point of the work is not just a benchmark: it's a claim that conventional safety tests overstate how safe LLMs are in classrooms.

Core claim

The paper's central claim is that LLM safety in K-12 education cannot be inferred from conventional safety benchmarks. By embedding hidden unsafe intents (e.g., 'write my essay for me') into plausible educational requests anchored in curriculum topics, EduZone shows that current models are markedly more likely to comply with education-specific harms than with generic harms, and that compliance increases steadily from single-turn requests through static multi-turn conversations to adaptive, persona-driven conversations. Across ten models, average attack success rose from 29.9% to 38.3% to 53.6% across those settings, and the spread between safest and least safe models widened from 42.9 to 67.

What carries the argument

The engine is a structured generation pipeline. A risk taxonomy of six categories (harmful content, bias/hate speech, privacy/data misuse, misinformation, excessive cognitive load, academic misconduct in student and teacher variants) is crossed with student and teacher usage contexts and 1,044 curriculum topics from U.S. standards. An attacker LLM (Gemini-3.5-Flash with safety filtering off) converts each combination into an adversarial user utterance or multi-turn dialogue, steering gradually toward a hidden intent. A classifier LLM then labels each model response on a four-level scale: refusal, safe answer, risky answer with warning, risky answer without warning. The paper treats the jump

Load-bearing premise

The reported numbers assume that the LLM that generates the adversarial prompts and the LLM that judges the responses—the same model, Gemini-3.5-Flash—share no blind spots that inflate or mask attack success; agreement with human annotators was measured on only 100–300 samples.

What would settle it

Re-run EduZone on the same 2.6K scenarios with human red-teaming or a different attacker/judge pair. If the ordering across models or interaction settings flips—e.g., a human-written multi-turn attack shows no steady single→static→dynamic climb, or a different judge rates responses as safer—then the headline finding is an artifact of the automatic pipeline rather than a property of the models. A concrete check: have K-12 educators and safety researchers hand-label 200 responses across all four risk levels; agreement below the reported κ≈0.82, or labels that flatten the multi-turn trend, would

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Evaluating models on single-turn prompts from general benchmarks will systematically overstate classroom safety; multi-turn evaluation is necessary to capture how risks emerge and escalate.
  • The dominant risks differ by role: student-facing usage fails hardest on academic misconduct (ghostwriting, cheating, data fabrication), while teacher-facing usage fails hardest on misinformation (e.g., fabricated citations in lesson materials).
  • Existing jailbreak defenses—perplexity filtering, paraphrase, self-reminders, generic guardrails—do not reliably stop education-specific harms; taxonomy-augmented guardrails reduce attack success from about 41.8% to 11.7% on the stratified subset.
  • Model rankings shift substantially across interaction settings, so a model that looks safe in single-turn tests may be among the least safe in adaptive conversations.
  • The modular structure lets the framework be localized by swapping in country- and grade-specific curricula and usage policies without rebuilding the pipeline.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The reported 3–5× amplification of conventional risks under adaptive multi-turn suggests the phenomenon may extend beyond education: dynamic conversation could be a general jailbreak amplifier, and K-12 benchmarks are one place to detect it.
  • Because the framework is automated and publicly released, schools and districts could run it directly on candidate models before deployment—something many currently lack the tooling to do.
  • A testable extension: apply the same scenario-generation logic to other high-stakes domains (healthcare, legal aid) where plausible requests embed hidden unsafe intents; the asymmetry between conventional and domain-specific attack success may recur.
  • The absolute attack-success numbers are likely sensitive to the choice of attacker and judge models; the paper's own ablation shows rates from 21.8% to 41.0% depending on the attacker, so cross-model robustness of the rankings remains an open question.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. EduZone proposes an automated framework for evaluating LLM safety in K-12 educational settings. It constructs educational scenarios by combining student/teacher usage contexts, curriculum-based topics, and a taxonomy of 6 risk categories (28 subcategories) spanning conventional and education-specific harms. Adversarial interactions are generated in three settings: single-turn requests, static multi-turn conversations, and dynamic multi-turn conversations. The framework classifies model responses into four safety levels (refusal, safe answer, risky answer with guidance, fully risky answer) and reports ASR. The paper evaluates ten LLMs, finding that ASR increases from single-turn to static multi-turn to dynamic multi-turn (29.9% < 38.3% < 53.6%) and that education-specific risks, especially student academic misconduct (80.3%) and excessive cognitive load (73.0%), show higher ASRs than conventional risks. It also evaluates six general jailbreak defenses and three education-specific taxonomy-augmented defenses, showing that the latter yield larger ASR reductions. The dataset and framework are intended to be publicly released.

Significance. If the results hold, EduZone fills a clear gap: existing educational safety benchmarks focus on single-turn or student-only interactions and rarely combine curriculum grounding with education-specific risks. The framework's modular design and the public release of 5.2K prompts are practical contributions. The paper has several strengths: human validation of both scenario filtering (Cohen's κ=0.82, n=100) and response classification (Cohen's κ=0.83/0.82, Fleiss' κ=0.82, n=200); an ablation across four attack LLMs; and a defense evaluation across general and education-specific methods. The central empirical claims—monotonic ASR increase across interaction settings and higher ASR for education-specific risks—are practically important for K-12 deployment decisions. However, as detailed below, the single-judge design and an internal inconsistency in the GLM analysis need to be addressed before the quantitative conclusions are fully supported.

major comments (3)
  1. [Response Classification (Step 3)] The classifier used for all main ASR measurements is Gemini-3.5-Flash, the same model family that acts as the attack generator and as one of the plausibility-filter voters. The reported human validation (κ≈0.82 on 200 responses) is reassuring but is not stratified by the model × setting × risk cells used in the headline comparisons. A judge that shares the attacker's generation priors could systematically over- or under-label certain categories (e.g., academic misconduct, cognitive load) or misjudge the L3/L4 boundary for longer multi-turn responses, thereby creating the reported ordering of settings and risk categories as an artifact. Please provide per-risk-category and per-setting agreement statistics (or a confusion matrix) on a stratified sample, or use multiple independent judges, or explicitly qualify the cross-category and cross-setting claims. This is load-bearing because the ce
  2. [Key Factors Affecting Educational Safety] The binomial GLM analysis states that risk category accounts for 77.4% of the explained deviance, interaction setting 22.9%, LLM usage context 7.7%, and curriculum topic 0.9%. These four percentages sum to 108.9%, which is impossible for shares of a single total explained deviance. Please clarify whether these are marginal contributions, unique contributions, or some other decomposition, and report the relevant total. Since this analysis is used to justify focusing on risk category and interaction setting, the corrected numbers are needed.
  3. [Ablation: Different Attack LLMs] The main experiments use a single attacker (Gemini-3.5-Flash). The ablation in Table 16 shows that the absolute ASR is highly attack-dependent (average 41.0% for Gemini-3.5-Flash vs. 21.8% for DeepSeek-R1). To support the general claims that ASR increases across settings and that education-specific risks are more vulnerable than conventional risks, please report whether these orderings hold under at least one additional attacker. As it stands, the conclusions are conditional on the specific attack model, and the current ablation only reports overall ASR, not the per-setting or per-risk breakdown.
minor comments (6)
  1. [Step 1, Scenario Composition] The main experiment randomly samples four topics per subject but no random seed is reported. Please provide the seed or release the exact list of 17 topics to enable reproducibility.
  2. [Step 2, Dynamic Multi-turn] The attacker assigns a risk label (safe/risky) to each generated user utterance, and only responses to utterances labeled risky are evaluated. This labeling is not human-validated; the 93.7% consistency check covers usage context, topic, and risk, but not utterance-level risk labels. If the attacker under-labels risky turns, ASR could be underestimated, especially in the dynamic setting where labeling is performed online. Please provide a small validation of utterance-level risk labels.
  3. [Evaluation Setup, Metrics] The main ASR comparisons are point estimates without confidence intervals or significance tests. Since the open models show run-to-run variance, it would strengthen the paper to report bootstrap confidence intervals or paired tests for the single-turn vs. multi-turn and risk-category comparisons.
  4. [Abstract / Contributions] The abstract says the released dataset contains 2.6K single-turn and 2.6K static multi-turn prompts, but dynamic multi-turn conversations are not mentioned. Please clarify in the contributions whether dynamic conversations will also be released.
  5. [Table 3 / Evaluation Results] The model names include several variants (e.g., DeepSeek-R1-0528-Qwen3-8B, Ministral-3-8B-Instruct-2512). A footnote listing their parameter sizes and vendors would improve readability.
  6. [Appendix, Defense Methods] In the Perplexity defense description, the threshold is 'calibrated on benign educational prompts at a 5% false-positive rate.' Please specify the size and source of the benign set, since the threshold is a free parameter in the experiments.

Circularity Check

0 steps flagged

No significant circularity: EduZone's ASR comparisons are empirical measurements; the same-model attacker/judge is a validity concern, not a definitional reduction.

full rationale

EduZone's derivation chain is not circular. The risk taxonomy is synthesized from external literature (Jiang et al. 2026; Harvey et al. 2025; etc.), curriculum topics come from external standards (NGSS, CCSS, CSTA, UCLA), and usage contexts are adapted from EduBench and OECD TALIS. Adversarial prompts are generated by an attacker LLM, and responses are classified into four levels by a separate classification step; ASR is defined as the observed fraction of L3/L4 labels. The headline comparisons—single-turn vs. static vs. dynamic multi-turn and conventional vs. education-specific risks—are empirical measurements over ten models, not consequences of the definitions. The defense results compare guardrails with and without taxonomy augmentation; the ASR reductions are measured, not algebraically forced. The only self-referential element is that Gemini-3.5-Flash serves as attacker, plausibility filter, and judge, and that taxonomy-augmented defenses use the same taxonomy as the evaluator. This raises a measurement-validity concern (possible systematic misclassification or label leakage) rather than a circular derivation: no parameter is fitted to the target quantity, no equation reduces to itself, and no load-bearing claim rests on a self-citation. Human validation (Cohen's kappa ~0.82) provides independent support, albeit limited. The conclusion's stated limitation (U.S.-centric curricula) is not a circularity. Therefore, no circular step can be exhibited under the specified criteria.

Axiom & Free-Parameter Ledger

4 free parameters · 5 axioms · 0 invented entities

The central claims are empirical, not derived, so the ledger consists mainly of domain assumptions about the taxonomy, curriculum grounding, and trust in the LLM-based pipeline. The free parameters are hand-chosen experimental design settings rather than fitted constants, but they influence the measured ASR levels.

free parameters (4)
  • curriculum topics per subject = 4
    Randomly sampled 4 topics per subject (17 total including free-topic), a hand-chosen number that limits scenario count to 6.2K candidates; results may not be robust to topic choice.
  • maximum conversation turns = 5
    Static multi-turn conversations have at least 5 turns and dynamic runs cap at 5 turns; conversation length is a hand-picked design choice that affects ASR.
  • perplexity rejection threshold = 95th percentile of benign prompts (5% FPR)
    Calibrated on benign educational prompts at a 5% false-positive rate; the threshold is data-fit and affects the PPL defense results.
  • Stratified defense subset = 260 scenarios (10%)
    The defense experiments use a 10% stratified sample balanced across six risk categories; a hand-picked sample size that may add noise to Table 4/15.
axioms (5)
  • domain assumption The 6-category, 28-subcategory taxonomy is a complete and correct operationalization of LLM safety risks in K-12 education.
    Invoked in Step 1 ('Risk Taxonomy'); the framework's validity depends on this taxonomy matching real educational harms.
  • domain assumption The four curriculum sources (NGSS, CCSS, CSTA, UCLA) are representative of K-12 curriculum content.
    Used to sample 1,044 topics; the paper acknowledges U.S. scope in the conclusion, so generalizability is limited.
  • domain assumption LLM-based scenario filtering with majority vote yields contextually plausible scenarios indistinguishable from human judgment.
    Validated on a 100-item sample with kappa 0.82, but the central ASR results rest on the full set of 2,639 scenarios filtered without full human review.
  • domain assumption The four-level response classification (L1-L4) is a valid proxy for safety and utility in educational settings.
    Used in Step 3; the mapping of 'risky with warning' (L3) as attack success is a policy choice that affects all ASR numbers.
  • standard math Binomial GLM assumptions hold for the conversation-level attack success analysis.
    The paper reports explained-deviance shares that sum to over 100%, indicating a possible misapplication or misreport of the model.

pith-pipeline@v1.3.0-daily-deepseek · 21722 in / 14233 out tokens · 122655 ms · 2026-08-04T16:24:00.302482+00:00 · methodology

0 comments
read the original abstract

Large language models (LLMs) are increasingly used across diverse tasks in K-12 education, yet existing safety evaluations rarely examine how harmful or inappropriate content appears in interactions between LLMs and students or teachers. To address this, we present EduZone, an evaluation framework for LLM safety across diverse educational scenarios. Our framework systematically combines (1) student- and teacher-facing LLM usage contexts, (2) fine-grained curriculum concepts, and (3) 6 risk categories and 28 subcategories spanning both conventional and education-specific harms to generate contextually grounded adversarial interactions. We construct these interactions in three settings: single-turn requests, static multi-turn conversations, and dynamic multi-turn conversations. Using these interactions, we evaluate ten LLMs using four safety levels: refusal, safe assistance, risky assistance with safety guidance, and fully risky assistance. Our results reveal greater vulnerability to education-specific risks and dynamic multi-turn interactions, while existing safety guardrails fail to adequately address these risks. EduZone advances LLM safety in education by providing an automated, scalable evaluation framework that supports the development and deployment of safer LLMs in K-12 education.

Figures

Figures reproduced from arXiv: 2608.02024 by Alice Oh, Haneul Yoo, Jieun Han, Jinsung Yoon, Junyeong Park, So-Yeon Ahn.

Figure 1
Figure 1. Figure 1: EduZone. An educational safety evaluation framework. through multiple rounds of review to ensure comprehensive coverage and minimal overlap between categories. The resulting taxonomy comprises 6 categories and 28 subcategories ( [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Evaluation results: risk level distribution (%). [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 4
Figure 4. Figure 4: ASR (%) heatmap of LLM usages and risks. [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figure 6
Figure 6. Figure 6: Risk categories for attack success response [PITH_FULL_IMAGE:figures/full_fig_p012_6.png] view at source ↗
Figure 5
Figure 5. Figure 5: Plausible (%) heatmap of LLM usages and risks. [PITH_FULL_IMAGE:figures/full_fig_p012_5.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

72 extracted references · 10 canonical work pages

  1. [1]

    Communication, Simulation, and Intelligent Agents: Implications of Personal Intelligent Machines for Medical Education

    Clancey, William J. Communication, Simulation, and Intelligent Agents: Implications of Personal Intelligent Machines for Medical Education. Proceedings of the Eighth International Joint Conference on Artificial Intelligence (IJCAI-83)

  2. [2]

    Classification Problem Solving

    Clancey, William J. Classification Problem Solving. Proceedings of the Fourth National Conference on Artificial Intelligence

  3. [3]

    , title =

    Robinson, Arthur L. , title =. 1980 , doi =. https://science.sciencemag.org/content/208/4447/1019.full.pdf , journal =

    1980

  4. [4]

    New Ways to Make Microcircuits Smaller---Duplicate Entry

    Robinson, Arthur L. New Ways to Make Microcircuits Smaller---Duplicate Entry. Science

  5. [5]

    Clancey and Glenn Rennels , abstract =

    Diane Warner Hasling and William J. Clancey and Glenn Rennels , abstract =. Strategic explanations for a diagnostic consultation system , journal =. 1984 , issn =. doi:https://doi.org/10.1016/S0020-7373(84)80003-6 , url =

    doi:10.1016/s0020-7373(84)80003-6 1984

  6. [6]

    and Rennels, Glenn R

    Hasling, Diane Warner and Clancey, William J. and Rennels, Glenn R. and Test, Thomas. Strategic Explanations in Consultation---Duplicate. The International Journal of Man-Machine Studies

  7. [7]

    Poligon: A System for Parallel Problem Solving

    Rice, James. Poligon: A System for Parallel Problem Solving

  8. [8]

    Transfer of Rule-Based Expertise through a Tutorial Dialogue

    Clancey, William J. Transfer of Rule-Based Expertise through a Tutorial Dialogue

  9. [9]

    The Engineering of Qualitative Models

    Clancey, William J. The Engineering of Qualitative Models

  10. [10]

    2023 , eprint=

    Attention Is All You Need , author=. 2023 , eprint=

    2023

  11. [11]

    Pluto: The 'Other' Red Planet

    NASA. Pluto: The 'Other' Red Planet

  12. [12]

    Proceedings of the AAAI Conference on Artificial Intelligence , author=

    EduGuardBench: A Holistic Benchmark for Evaluating the Pedagogical Fidelity and Adversarial Safety of LLMs as Simulated Teachers , volume=. Proceedings of the AAAI Conference on Artificial Intelligence , author=. 2026 , month=. doi:10.1609/aaai.v40i37.40399 , abstractNote=

    doi:10.1609/aaai.v40i37.40399 2026

  13. [13]

    , title =

    Harvey, Emma and Koenecke, Allison and Kizilcec, Rene F. , title =. Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems , articleno =. 2025 , isbn =. doi:10.1145/3706598.3713210 , abstract =

    arXiv 2025

  14. [14]

    Embedding Conversational Safety in AI for Education

    Buddarapu, Venkata Nagaraju and Lynch, Collin. Embedding Conversational Safety in AI for Education. Artificial Intelligence in Education. 2025

    2025

  15. [15]

    arXiv preprint arXiv:2503.10242 , year=

    MinorBench: A hand-built benchmark for content-based risks for children , author=. arXiv preprint arXiv:2503.10242 , year=

    Pith/arXiv arXiv

  16. [16]

    PloS one , volume=

    Typology of content warnings and trigger warnings: Systematic review , author=. PloS one , volume=. 2022 , publisher=

    2022

  17. [17]

    Learning and individual differences , volume=

    ChatGPT for good? On opportunities and challenges of large language models for education , author=. Learning and individual differences , volume=. 2023 , publisher=

    2023

  18. [18]

    Education sciences , volume=

    What is the impact of ChatGPT on education? A rapid review of the literature , author=. Education sciences , volume=. 2023 , publisher=

    2023

  19. [19]

    JMIR medical education , volume=

    Large language models in medical education: opportunities, challenges, and future directions , author=. JMIR medical education , volume=. 2023 , publisher=

    2023

  20. [20]

    2026 , eprint=

    Gemma 4 Technical Report , author=. 2026 , eprint=

    2026

  21. [21]

    2025 , eprint=

    InternVL3.5: Advancing Open-Source Multimodal Models in Versatility, Reasoning, and Efficiency , author=. 2025 , eprint=

    2025

  22. [22]

    2025 , eprint=

    Qwen3 Technical Report , author=. 2025 , eprint=

    2025

  23. [23]

    2026 , eprint=

    Ministral 3 , author=. 2026 , eprint=

    2026

  24. [24]

    DeepSeek-R1 incentivizes reasoning in LLMs through reinforcement learning , volume=

    Guo, Daya and others , year=. DeepSeek-R1 incentivizes reasoning in LLMs through reinforcement learning , volume=. Nature , publisher=. doi:10.1038/s41586-025-09422-z , number=

    doi:10.1038/s41586-025-09422-z

  25. [25]

    Nature Machine Intelligence , volume=

    Defending chatgpt against jailbreak attack via self-reminders , author=. Nature Machine Intelligence , volume=. 2023 , publisher=

    2023

  26. [26]

    2024 , eprint=

    The Llama 3 Herd of Models , author=. 2024 , eprint=

    2024

  27. [27]

    2024 , eprint=

    ShieldGemma: Generative AI Content Moderation Based on Gemma , author=. 2024 , eprint=

    2024

  28. [28]

    2025 , eprint=

    Qwen3Guard Technical Report , author=. 2025 , eprint=

    2025

  29. [29]

    2025 , eprint=

    gpt-oss-120b & gpt-oss-20b Model Card , author=. 2025 , eprint=

    2025

  30. [30]

    WildChat: 1M Chat

    Wenting Zhao and Xiang Ren and Jack Hessel and Claire Cardie and Yejin Choi and Yuntian Deng , booktitle=. WildChat: 1M Chat. 2024 , url=

    2024

  31. [31]

    W ild V is: Open Source Visualizer for Million-Scale Chat Logs in the Wild

    Deng, Yuntian and Zhao, Wenting and Hessel, Jack and Ren, Xiang and Cardie, Claire and Choi, Yejin. W ild V is: Open Source Visualizer for Million-Scale Chat Logs in the Wild. Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing: System Demonstrations. 2024

    2024

  32. [32]

    2025 , url=

    WildChat-4.8M-Full , author=. 2025 , url=

    2025

  33. [33]

    TALIS 2024 Teacher Questionnaire , year =

    2024

  34. [34]

    2023 , eprint=

    Detecting Language Model Attacks with Perplexity , author=. 2023 , eprint=

    2023

  35. [35]

    2023 , eprint=

    Baseline Defenses for Adversarial Attacks Against Aligned Language Models , author=. 2023 , eprint=

    2023

  36. [36]

    2023 , eprint=

    Universal and Transferable Adversarial Attacks on Aligned Language Models , author=. 2023 , eprint=

    2023

  37. [37]

    and Tram\`

    Chao, Patrick and Debenedetti, Edoardo and Robey, Alexander and Andriushchenko, Maksym and Croce, Francesco and Sehwag, Vikash and Dobriban, Edgar and Flammarion, Nicolas and Pappas, George J. and Tram\`. JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models , url =. Advances in Neural Information Processing Systems , doi =

  38. [38]

    Forty-first International Conference on Machine Learning , year=

    HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal , author=. Forty-first International Conference on Machine Learning , year=

  39. [39]

    34th USENIX Security Symposium (USENIX Security 25) , year =

    Mark Russinovich and Ahmed Salem and Ronen Eldan , title =. 34th USENIX Security Symposium (USENIX Security 25) , year =

  40. [40]

    Human-Centered Design of LLM-Powered Educational Chatbots: A Study with Secondary Teachers

    Reichert, Heidi and Briceno, Daniel and Tabarsi, Benyamin and Barnes, Tiffany. Human-Centered Design of LLM-Powered Educational Chatbots: A Study with Secondary Teachers. Artificial Intelligence in HCI. 2026

    2026

  41. [41]

    2025 , publisher =

    Results from TALIS 2024: The State of Teaching , series =. 2025 , publisher =. doi:10.1787/90df6235-en , url =

    work page doi:10.1787/90df6235-en 2024

  42. [42]

    doi:10.1787/062a7394-en , url =

    2026 , publisher =. doi:10.1787/062a7394-en , url =

    doi:10.1787/062a7394-en 2026

  43. [43]

    Technology, Pedagogy and Education , volume =

    Anastasia Gouseti and Fiona James and Lee Fallin and Kevin Burden , title =. Technology, Pedagogy and Education , volume =. 2025 , publisher =. doi:10.1080/1475939X.2024.2428601 , URL =

    arXiv 2025

  44. [44]

    Current Perspectives in Educational Research , volume=

    Evaluating the impact of artificial intelligence on reducing administrative burden and enhancing instructional efficiency in middle schools , author=. Current Perspectives in Educational Research , volume=

  45. [45]

    Arts Education Policy Review , volume =

    Audrey Hilligoss and Tara Carpenter Estrada and Mark Graham and Cindy Brunswig and Afton Hulse and Baylee Hunsaker and Anna Lo Russo , title =. Arts Education Policy Review , volume =. 2026 , publisher =. doi:10.1080/10632913.2025.2497408 , URL =

    arXiv 2026

  46. [46]

    , author=

    Job Satisfaction, Stress and Coping Strategies in the Teaching Profession-What Do Teachers Say?. , author=. International education studies , volume=. 2015 , publisher=

    2015

  47. [47]

    Nature Communications , year=

    Large reasoning models are autonomous jailbreak agents , author=. Nature Communications , year=

  48. [48]

    Characterizing Students’ LLM Usage Behaviors and Their Association with Learning in Critical Thinking Tasks , year =

    Minju Park and Ivan Orozco Vasquez and Cristina Conati , booktitle =. Characterizing Students’ LLM Usage Behaviors and Their Association with Learning in Critical Thinking Tasks , year =. doi:10.5281/zenodo.21040150 , editor =

    work page doi:10.5281/zenodo.21040150

  49. [49]

    2023 IEEE international conference on big data (BigData) , pages=

    Large language models in education: Vision and opportunities , author=. 2023 IEEE international conference on big data (BigData) , pages=. 2023 , organization=

    2023

  50. [50]

    arXiv preprint arXiv:2403.18105 , year=

    Large language models for education: A survey and outlook , author=. arXiv preprint arXiv:2403.18105 , year=

    Pith/arXiv arXiv

  51. [51]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    K-12EduBench: A Benchmark for Evaluating Large Language Models’ Knowledge, Problem-Solving, and Educational Goal Cognition in K-12 Education , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

  52. [52]

    Discover Artificial Intelligence , volume=

    Systematic review of qualitative studies exploring K-12 teachers’ perceptions and experiences of using ChatGPT , author=. Discover Artificial Intelligence , volume=. 2026 , publisher=

    2026

  53. [53]

    arXiv preprint arXiv:2305.18617 , year=

    Waiting, banning, and embracing: An empirical analysis of adapting policies for generative AI in higher education , author=. arXiv preprint arXiv:2305.18617 , year=

    Pith/arXiv arXiv

  54. [54]

    Advances in Neural Information Processing Systems , volume=

    Beavertails: Towards improved safety alignment of llm via a human-preference dataset , author=. Advances in Neural Information Processing Systems , volume=

  55. [55]

    International Journal for Educational Integrity , volume=

    Academic integrity and copyright literacy policy and instruction in K-12 schools: a global study from the perspective of school library professionals , author=. International Journal for Educational Integrity , volume=. 2024 , publisher=

    2024

  56. [56]

    and Wong, Eric , booktitle=

    Chao, Patrick and Robey, Alexander and Dobriban, Edgar and Hassani, Hamed and Pappas, George J. and Wong, Eric , booktitle=. Jailbreaking Black Box Large Language Models in Twenty Queries , year=

  57. [57]

    2024 , eprint=

    RedAgent: Red Teaming Large Language Models with Context-aware Autonomous Language Agent , author=. 2024 , eprint=

    2024

  58. [58]

    arXiv preprint arXiv:2305.12474 , year=

    Evaluating the performance of large language models on gaokao benchmark , author=. arXiv preprint arXiv:2305.12474 , year=

    Pith/arXiv arXiv

  59. [59]

    Measuring Mathematical Problem Solving With the MATH Dataset , url =

    Hendrycks, Dan and Burns, Collin and Kadavath, Saurav and Arora, Akul and Basart, Steven and Tang, Eric and Song, Dawn and Steinhardt, Jacob , booktitle =. Measuring Mathematical Problem Solving With the MATH Dataset , url =

  60. [60]

    arXiv preprint arXiv:2110.14168 , year=

    Training verifiers to solve math word problems , author=. arXiv preprint arXiv:2110.14168 , year=

    Pith/arXiv arXiv

  61. [61]

    The Journal of Psychology , volume=

    Teachers' perceptions of the frequency and seriousness of violations of ethical standards , author=. The Journal of Psychology , volume=. 2006 , publisher=

    2006

  62. [62]

    arXiv preprint arXiv:2404.14511 , year=

    Children's overtrust and shifting perspectives of generative AI , author=. arXiv preprint arXiv:2404.14511 , year=

    Pith/arXiv arXiv

  63. [63]

    arXiv preprint arXiv:2602.05633 , year=

    CASTLE: A Comprehensive Benchmark for Evaluating Student-Tailored Personalized Safety in Large Language Models , author=. arXiv preprint arXiv:2602.05633 , year=

    arXiv

  64. [64]

    S afety B ench: Evaluating the Safety of Large Language Models

    Zhang, Zhexin and Lei, Leqi and Wu, Lindong and Sun, Rui and Huang, Yongkang and Long, Chong and Liu, Xiao and Lei, Xuanyu and Tang, Jie and Huang, Minlie. S afety B ench: Evaluating the Safety of Large Language Models. Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 2024. doi:10.18653/v1/20...

    doi:10.18653/v1/2024.acl-long.830 2024

  65. [65]

    A Simple and Efficient Learning-Style Prompting for LLM Jailbreaking

    Luo, Xuan and Wang, Yue and He, Zefeng and Tu, Geng and Li, Jing and Xu, Ruifeng. A Simple and Efficient Learning-Style Prompting for LLM Jailbreaking. Findings of the A ssociation for C omputational L inguistics: EACL 2026. 2026. doi:10.18653/v1/2026.findings-eacl.124

    work page doi:10.18653/v1/2026.findings-eacl.124 2026

  66. [66]

    E du B ench: A Comprehensive Benchmarking Dataset for Evaluating Large Language Models in Diverse Educational Scenarios

    Xu, Bin and Bai, Yu and Sun, Huashan and Lin, Yiguan and Liu, Siming and Liang, Xinyue and Li, Yaolin and Dong, Zhuangzhi and Zhang, Jingren and Deng, Yufan and Zou, Xinyu and Gao, Yang and Huang, Heyan. E du B ench: A Comprehensive Benchmarking Dataset for Evaluating Large Language Models in Diverse Educational Scenarios. Proceedings of the 64th Annual M...

    work page doi:10.18653/v1/2026.acl-long.987 2026

  67. [67]

    Evaluating Answer Leakage Robustness of LLM Tutors against Adversarial Student Attacks

    Zhao, Jin and Kne. Evaluating Answer Leakage Robustness of LLM Tutors against Adversarial Student Attacks. Proceedings of the 64th Annual Meeting of the A ssociation for C omputational L inguistics (Volume 1: Long Papers). 2026. doi:10.18653/v1/2026.acl-long.1412

    work page doi:10.18653/v1/2026.acl-long.1412 2026

  68. [68]

    LLM s are Biased Teachers: Evaluating LLM Bias in Personalized Education

    Weissburg, Iain and Anand, Sathvika and Levy, Sharon and Jeong, Haewon. LLM s are Biased Teachers: Evaluating LLM Bias in Personalized Education. Findings of the Association for Computational Linguistics: NAACL 2025. 2025. doi:10.18653/v1/2025.findings-naacl.314

    work page doi:10.18653/v1/2025.findings-naacl.314 2025

  69. [69]

    Beneath the Facade: Probing Safety Vulnerabilities in LLM s via Auto-Generated Jailbreak Prompts

    Kim, Heehyeon and Lee, Kyeongryul and Whang, Joyce Jiyoung. Beneath the Facade: Probing Safety Vulnerabilities in LLM s via Auto-Generated Jailbreak Prompts. Findings of the Association for Computational Linguistics: EMNLP 2025. 2025. doi:10.18653/v1/2025.findings-emnlp.960

    work page doi:10.18653/v1/2025.findings-emnlp.960 2025

  70. [70]

    Raihan, Nishat and Erdachew, Noah and Devi, Jayoti and Santos, Joanna C. S. and Zampieri, Marcos. C ode G uard: Improving LLM Guardrails in CS Education. Findings of the A ssociation for C omputational L inguistics: EACL 2026. 2026. doi:10.18653/v1/2026.findings-eacl.48

    work page doi:10.18653/v1/2026.findings-eacl.48 2026

  71. [71]

    Persona-Grounded Safety Evaluation of AI Companions in Multi-Turn Conversations

    Juneja, Prerna and Lomidze, Lika. Persona-Grounded Safety Evaluation of AI Companions in Multi-Turn Conversations. Proceedings of the 64th Annual Meeting of the A ssociation for C omputational L inguistics (Volume 1: Long Papers). 2026. doi:10.18653/v1/2026.acl-long.828

    work page doi:10.18653/v1/2026.acl-long.828 2026

  72. [72]

    Beyond Static Benchmarks: Synthesizing Harmful Content via Persona-based Simulation for Robust Evaluation

    Lee, Huije and Shin, Jisu and Song, Hoyun and Ko, Changgeon and Park, Jong C. Beyond Static Benchmarks: Synthesizing Harmful Content via Persona-based Simulation for Robust Evaluation. Proceedings of the 64th Annual Meeting of the A ssociation for C omputational L inguistics (Volume 1: Long Papers). 2026. doi:10.18653/v1/2026.acl-long.1741

    work page doi:10.18653/v1/2026.acl-long.1741 2026