SAFE-Teen: Evaluating Chatbot Safety Across Adolescent Mental Health Conversations
Andrea Mock, Valerie Chen, Eric Lin, Rayan Krishnan, Diyi Yang, Caroline Figueroa
cs.CL
2026-11-05
Across 32,555 simulated teen chats on 18 chatbot APIs, safety-criterion failures hit 43.3%; a teen-aware prompt cuts this to 24.9%, but missed indirect suicide cues stay at 52%.
Nearly one in five US teens and young adults already use AI for mental health advice, per a survey cited in the paper. No mainstream chatbot was designed for this. Most existing safety evaluations grade a single response: does the model refuse a dangerous request? That misses how risk actually appears with adolescents, who hint at things, deny them, or keep pushing after a refusal. A chatbot that passes a single-turn test can still miss a suicide cue that surfaces indirectly a dozen turns in. Some evaluations also lack clinical input, or score one reply against a fixed history. SAFE-Teen, from Vals AI and Stanford, asks a narrower question: when the same conversation unfolds differently because the teen responds differently, does the chatbot's safety hold?
Three layers: scenarios, branching, scoring.
Matched variants are the core design: with scenario and history fixed, changes in failure rate are attributable to the teen's behavior rather than scenario differences. Of the six youth safety evaluations compared in Table 1, only this one combines full-conversation scoring with matched behavior variants. The judge agreed with clinician majorities on 91% of 612 pairs.
Eighteen chatbot APIs across 12 families (Gemini, GPT, Claude, Grok, Muse Spark, DeepSeek, GLM, Kimi, MiMo, MiniMax, Mistral, Qwen) each ran every scenario twice: with no added system prompt, and with a teen-aware prompt stating the user is 13-17, prioritizing safety, encouraging trusted-adult and professional support, acknowledging the system is not human, refusing harmful requests, and routing crises to emergency support. The prompt was adapted from OpenAI's Under-18 Principles. Total: 32,555 conversations.
| Setting | Metric | Result |
| No prompt | Overall criterion failure rate | 43.3% |
| Teen-aware prompt | Overall criterion failure rate | 24.9% |
| No prompt → with prompt | Emotional-dependence failures | 54% → 15% |
| Both conditions | Missed indirect suicide risk | 52% either way |
| With prompt | Missed self-harm response | 75% |
| No prompt | Failure-rate spread | 14.0% (GPT-6.1 Sol) to 62.4% (Gemini 3.8 Flash) |
No model reached zero with the prompt: best was Muse Spark 1.3 (xhigh) at 7.5%, worst Gemini 3.6 Flash at 43.6%.
The prompt's effect is uneven. It works on explicitly discouraged behaviors: emotional dependence 54%→15%, romantic/sexual boundaries 26%→5%, substance-misuse help 56%→22%. It barely moves risk recognition: failures on indirect suicide risk sit at 52% under both conditions, and diagnosis failures only fall to 60% (mental health) and 66% (medical). Much of the improvement is fail-to-partial rather than fail-to-pass; emotional-dependence partials rose from 42% to 67%.
Teen behavior matters more than disclosure. Declining offered help raised emotional-dependence failures by 17.6 points for 17 of 18 chatbots (1.6 points with the prompt). Pushing back on a limit raised failures by 11.9 points on substance-misuse help, 11.8 on mental-health diagnosis, and 9.7 on medication advice without the prompt; with it, mental-health diagnosis still rose 9.9 points. Varying how much the teen disclosed changed failure rates least of the three.
Reasoning traces from 9 chatbots explain part of this. When reasoning noticed a risk but did not plan all required actions, 58% of replies still failed, close to the 66% failure rate when the risk went unnoticed; noticing and planning everything still left 14% failures. In 6% of cases the model noticed the risk but skipped a required action, almost always because the teen refused outside help, and 68% of those replies failed. At the opening turn, reasoning treated an already-stated warning sign as a safety concern only 69% of the time; in 30% of cases it mentioned the detail without connecting it to risk.
Three takeaways for anyone building safety or product. A system prompt declaring the user's age and drawing boundaries cuts the failure rate by roughly 42% relative, the cheapest safety intervention available. But prompting suppresses forbidden behaviors far better than it builds risk recognition; asking, escalating, and routing to humans need training and product mechanics, and red-teaming should be designed around that distinction. Single-turn evaluations systematically overestimate safety: the same model can differ by more than 10 points on a single criterion depending on whether the teen accepts advice or pushes back, so evaluation has to follow conversations to the branch point. The rubric, prompts, and methods are released for reuse as a teen-safety regression suite.
The authors' own list: every conversation is simulated, with no validation from actual adolescents; scenarios reflect what 12 clinicians have encountered in practice; conversations cap at 20 exchanges, so long-term use is untested; the judge was calibrated against clinicians on only 30 conversations (α = 0.66 across 58 applicable pairs); the teen-aware prompt approximates proprietary child-aware prompts rather than replicating them; reasoning-trace percentages are approximations since some models return only summaries.
Two more from reading the paper. Partials are excluded from the headline 43.3%/24.9% numbers, and partials grew as fails shrank; a stricter accounting would look worse. The simulated teen is itself an LLM, rated 'very realistic' in only 7 of 12 clinician assessments, so real adolescents likely press harder than the simulator, and these failure rates should be read as a floor.