No evaluated LLM tutor is reliably safe: every model exceeds 60% harm rate on at least five risk categories in single-turn and six in multi-turn evaluation¶

Claim · All claims
Evidence · 1 study · design r2 · q2
Currency · newest study 2026 · not yet checked against its sources · not reviewed by a person · recheck by 2029: tool and model accuracy changes quickly

Subclaims¶

q2 i? Every evaluated model exceeds a 60% harm rate on at least five risk categories in single-turn and six in multi-turn settings. → Rima Hazra 2026

Evidence¶

Rima Hazra 2026¶

Rima Hazra, Bikram Ghuku, Ilona Marchenko, Yaroslava Tokarieva, Sayan Layek, Somnath Banerjee, Julia Stoyanovich, Mykola Pechenizkiy. (2026). SAFETUTORS: Benchmarking Pedagogical Safety in AI Tutoring Systems. arXiv preprint. https://arxiv.org/abs/2603.17373 doi:10.48550/arxiv.2603.17373

q2 · i? · design · r2

Benchmark evaluation of ten open-weight LLMs (3.8B-72B) and one closed-weight model on SAFETUTORS across three STEM subjects and eleven harm dimensions, with harm rates reported in Tables 1 and 2. The article reports that "Every evaluated model exceeds 60% harm rate" on at least five single-turn and six multi-turn categories; no effect size is printed.

"No model is universally safe:Every evaluated model exceeds 60% harm rate on at least five cat- egories in single-turn and six in multi-turn."

Discussion¶

Related Claims¶

• Informational harm is the sole dimension that decreases in multi-turn interaction, dropping from 60.52% to 11.90% — related
• Adaptive multi-turn interactions substantially amplify LLM vulnerabilities to conventional safety risks in educational contexts — related
• LLM attack success rates increase consistently from single-turn to static multi-turn and dynamic multi-turn interactions in educational settings — related
• Multi-turn interaction amplifies pedagogical harm: mean harm rises 6-11 percentage points across subjects and pedagogical-relationship harm surges from 17.7% to 77.8% — related
• Current LLMs are more vulnerable to education-specific risks such as academic misconduct and excessive cognitive load than to conventional safety risks in K-12 educational interactions — related
• Risk category explains the largest share of variation in educational attack success, far more than LLM usage context or curriculum topic — related
• Taxonomy-augmented guardrail classifiers reduce educational attack success more than general-purpose jailbreak defenses — related
• Single-turn tutors disclose answers pervasively while challenge scores are near zero across every model and subject — related
• Harm profiles are subject-dependent: metacognitive harm crosses 90% in all three subjects in multi-turn, peaking at 97.44% for Qwen2.5-32B in Mathematics — related
• Boundary compliance (S3) drives nearly all inter-model safety divergence, with a 53-point gap between the safest and least safe models — related
• Safety and task quality are largely independent across models, implying safety guardrails impose no measurable performance tax — related
• Model scale does not consistently improve pedagogical safety: within the Qwen2.5 family the 72B model beats the 7B on only 17 of 33 subject-dimension pairs — related