Technical Summary: CASTLE – A Comprehensive Benchmark for Evaluating Student-Tailored Personalized Safety in Large Language Models

1. Problem Statement

While Large Language Models (LLMs) have advanced personalized learning, their inherent generation mechanisms often produce homogeneous responses to identical prompts. This "one-size-fits-all" approach overlooks the substantial heterogeneity in students' cognitive and psychological characteristics, potentially posing safety risks to vulnerable groups. Existing safety evaluations primarily rely on context-independent metrics (e.g., factual accuracy, toxicity, bias) which fail to capture the divergent harms a single response might cause across different student attributes. In high-stakes educational domains, general safety approaches struggle to identify and mitigate personalized risks arising from variations in user backgrounds, such as a harmless response to a low-risk student triggering fatal behavior in a student with dropout tendencies or severe depression.

2. Methodology

The authors propose CASTLE (Comprehensive Assessment of Student-Tailored Learning and Evaluation), a benchmark grounded in educational theories to systematically measure personalized safety risks.

2.1 Dataset Construction

CASTLE comprises 92,908 bilingual scenarios (53,483 Chinese, 39,425 English) constructed through a multi-stage pipeline:

• Theoretical Foundation: The benchmark integrates classical educational psychology theories, including the Big Five Personality Traits, Dweck's Ability Belief Type (Growth vs. Fixed Mindset), Fitts and Posner's Skill Acquisition Stages, and Zimmerman's Self-Regulated Learning Phases.
• Risk Taxonomy: A two-level taxonomy defines 15 educational safety risk domains across four categories:
  1. Psychological and Emotional Health (e.g., Academic Pressure Overload, Career Choice Dilemma).
  2. Academic Integrity and Competence (e.g., Academic Misconduct, Avoiding Learning Path).
  3. Content and Information Bias (e.g., Stereotypes, Model Hallucination Risks).
  4. Learning Dependence and Cognition (e.g., Loss of Independent Judgment, Cognitive Rigidity).
• Student Profiles: Each scenario includes a structured student profile with 14 attributes spanning Background (Age, Gender, Learning Stage), Big Five Personality, Emotion (State, Intensity, Recent Feedback), and Education (Ability Belief, Skill, Acquisition Stage, Self-Regulation).
• Generation Process: The dataset was generated using a cyclic multi-LLM strategy (GPT-4o, Gemini-2.5-Flash, DeepSeek-V3, Claude-Haiku-4.5) to mitigate model-specific bias. Strict logic-constraint rules were enforced to ensure psychological validity and attribute consistency (e.g., preventing age-grade mismatches or incompatible emotion-scenario pairings).

2.2 Evaluation Metrics

CASTLE introduces three evaluation dimensions, rated on a 1–5 Likert scale:

1. Risk Sensitivity: Measures the model's ability to detect latent psychological or cognitive risks in the query.
2. Emotional Empathy: Evaluates the model's capacity to recognize and address the student's emotional state.
3. Student Alignment: Assesses the match between the model's response and the specific student attributes (personality, learning stage, etc.).
   The Average Safety Score is the mean of these three dimensions.

2.3 Experimental Setup

The benchmark was used to evaluate 18 LLMs, including open-source models (Qwen series, LLaMA3, Mistral, etc.), closed-source models (GPT-4o, GPT-5.2, Claude-Haiku-4.5, Gemini-2.5-Flash), and education-specific models (InnoSpark-7B, MuduoLLM-7B). Evaluations were conducted under both Non-Personalized (query only) and Personalized (query + full profile) settings. Human-AI reliability analysis confirmed that Claude-Haiku-4.5 serves as a robust automatic evaluator (Spearman's $\rho$ = 0.83 against human references).

3. Key Contributions

1. Conceptual Framework: The paper systematically identifies the limitations of the prevailing "one-size-fits-all" paradigm in education and introduces Student-Tailored Personalized Safety as a new evaluation perspective.
2. CASTLE Benchmark: The construction of a large-scale, theory-grounded benchmark covering 15 risk domains, 14 student attributes, and 92k+ bilingual scenarios.
3. Evaluation Metrics: The proposal of three specific metrics (Risk Sensitivity, Emotional Empathy, Student Alignment) to move beyond binary safety judgments.
4. Empirical Findings: Comprehensive evaluation of 18 state-of-the-art LLMs revealing significant deficiencies in personalized safety assurance.

4. Results

• Overall Performance: All evaluated models scored below an average safety score of 2.5 out of 5 in the Non-Personalized setting. Even the strongest model, Claude-Haiku-4.5, achieved only 2.42.
• Impact of Personalization: Incorporating structured student profiles consistently improved safety scores across all 15 domains and all models. However, even with personalization, no model achieved a perfect score, indicating that personalized information improves risk awareness but does not fully eliminate safety risks in complex educational environments.
• Domain vs. Scale: Domain-specific alignment proved more effective than model scaling alone. Education-based models (e.g., InnoSpark-7B) outperformed larger general-purpose models (e.g., GPT-4o, Gemini-2.5-Flash) in several categories.
• Reinforcement Learning (RL): RL-optimized models (e.g., QwQ-32B) demonstrated superior performance and better utilization of personalized information compared to their instruction-tuned counterparts (e.g., Qwen2.5-32B), suggesting that training paradigms matter more than parameter count for safety.
• Attribute Sensitivity: Ablation studies showed that Emotion and Education attributes contributed the most substantial safety gains. Explicit personalization (structured profiles) yielded significantly higher safety scores than implicit personalization (cues embedded in the query).
• Safety Guard Limitations: Existing general-purpose safety guard models (e.g., Llama-Guard, WildGuard) classified over 96% of CASTLE responses as "safe," failing to detect the nuanced, personalized educational risks targeted by the benchmark.

5. Significance and Claims

The paper claims that CASTLE provides a necessary foundation for safety research that adapts to individual student contexts, addressing a critical blind spot in current safety research. It highlights that:

• Current LLMs struggle to identify student-specific risks without explicit personalized context.
• Structured profiles and explicit personalization mechanisms are essential for generating safer, more empathetic responses in high-stakes educational scenarios.
• The "one-size-fits-all" generation paradigm is insufficient for education, where cognitive and psychological heterogeneity dictates safety outcomes.

The authors position CASTLE as a tool to drive the development of context-aware alignment mechanisms, noting that while the benchmark is designed for evaluation, it is not intended for clinical diagnosis or high-stakes decision-making. Future work is suggested to extend the benchmark to multi-turn interactive settings and more languages.