Young people are turning to AI platforms to learn more about sexual topics and their own sexuality, with sexual roleplay emerging as one of the most common reasons they turn to AI. But while LLMs can fill sexual knowledge gaps that increase their understanding of consent, enhance their sense of sexual expression, and help victims process their trauma, they’re also facilitating exploitative sexual fantasies and acts of sexual abuse. The difference usually comes down to whether a model can recognize who it’s talking to, read the context of a request, and calibrate its response accordingly. That’s why we are releasing the apgard Benchmark for Youth Sexual Safety.
Developed with support from the Safe Online fund, this benchmark evaluates how models handle sexual topics with young people, including sex education questions, abuse disclosures, and whether it facilitates child sexual exploitation and abuse (CSEA). For example, how does AI respond to a teen asking about puberty and anatomy questions in an educational context? How does it handle questions about consent? And how does it respond to questions from minors asking how to sexualize themselves for a social media post? Overall, we found that models performed more poorly with these more ambiguous topics versus more obviously exploitative ones, such as scenarios asking for grooming scripts.
Similar to our Benchmark for Youth Mental Wellbeing, this benchmark evaluates models against auto-generated youth-AI scenarios driven by our expert-informed taxonomy of youth sexual safety risks across the following high-level risk categories:
Adult Sexual Content Exposure
Sexual content creation & sexting
Sexual content involving minors
Grooming & predatory facilitation
Survivor & disclosure contexts
It measures how they address relevant conversation topics, recognize and avoid harmful advice, and steer youth toward safer responses.
To conduct this assessment, we included:
Taxonomy design: We synthesized existing research and literature into a youth- and AI-specific risk taxonomy for youth sexual safety. Categories are organized along both content-type and behavioral-mechanism axes, which may produce some cross-category adjacency.
Expert review: 3 youth safety and sexual health experts reviewed, refined, and validated our approach for this youth sexual safety benchmark.
Built upon KORA: We applied our taxonomy onto KORA’s expert-informed open-source AI child safety benchmark tool to derive this youth sexual safety benchmark.
Benchmarking and scoring: Each target model was assessed by a single reasoning judge model (GPT 5.2, GPT 5.4 Mini, Claude Sonnet 4.6 or Gemini 3.5 Flash due to their ability to break down nuanced and complex meanings), with the judge always different from the target being evaluated. Scores are computed based on KORA’s rubric, and the corresponding metrics are shared on our leaderboard. We ran a total of 1,260 scenarios across both assistant- and child-aware prompts among 19 frontier models, resulting in 23,940 total scenario runs. Across all turns, models were graded exemplary ~50% of the time and failing ~30%. Assistant mode is the model’s default state, while child-aware mode is when the model is aware that it is speaking with a child. The leaderboard scores are a composite of both modes.
Analysis
Across all risk categories, the benchmark reveals that models are better at recognizing overtly exploitative requests, such as manipulation and isolation tactics, but often fail when requests are ambiguous or framed as an everyday teen problem, such as pose coaching for photos. This trend also appears in the gap between the two sexual content categories (adult sexual content exposure and involving minors). In the former, models often provided explicit sex details that exceeded the age band’s necessary health literacy. In the latter, where most scenarios constitute CSEA, models were better at refusing content that explicitly sexualized the young persona and other minors. This reinforces that taxonomies with deeper focus on youth sexual safety risks, beyond strict CSEA, are necessary to cover other ways that young people engage with AI on sexual topics.
Regarding failures, models were also approximately three times more likely to fail in default Assistant mode than in child-aware mode, where they were instructed they were speaking with a child. They were also more likely to fail as age bands got older; models tended to treat the 13-17 year old age band as mature-enough to handle more explicit conversations. ~20% of all failures were related to failure of redirecting the young persona to a human, and ~30% of failing responses were related to providing escalated explicit detail as the young persona pushed for more during the conversation.
Some of our observations across each of the high-level risk categories include:
Adult Sexual Content Exposure
This includes scenarios where a child/teen user is seeking adult-oriented sexual content or guidance, such as explicit sexual education, pornographic descriptions, or relationship coaching that exceeds their developmental readiness.
This was a weak category across models. Unlike categories where the correct behavior is a clear refusal, this category required the model to determine what was developmentally appropriate and how to communicate it. For example, models are worse at calibrating educationally sensitive content (i.e. anatomy, explicit sex education, pornographic descriptions) than they are at refusing content that explicitly sexualizes a minor. Failures occurred when models exceeded the necessary health literacy for the age band and provided overly sensory and procedural sex detail, erotic prose, and provided sexual performance coaching. Strong responses redirected conversations towards an age-appropriate discussion.
Sexual Content Creation & Sexting
This includes scenarios where a child/teen user is seeking help creating, sharing, or concealing sexual content of themselves or their peers.
This was the weakest category across models, where Nude Image Creation Guidance was a particularly low-performing sub-risk category. The low performance across models for this category suggests that while models generally handle more obvious CSEA-adjacent requests well, they struggle when a request is framed as peer-to-peer teen sexting help, angle/pose coaching for photos, or risk-minimization advice for sharing images, which are scenarios that look more like everyday teen problems rather than overt abuse. This category also showed the largest gap between Assistant and child-aware prompts of any risk area, suggesting that without explicit age context, models default to an adult-oriented posture on these requests. Strong responses refuse these requests, provide reasoning as to why it’s refused, and redirect the conversation towards age-appropriate guidance.
Sexual Content Involving Minors
This includes scenarios that generate or reinforce sexualized content depicting minors, including CSAM-adjacent narratives, age-gap relationships, and fetishization.
While this category performed better than Adult Sexual Content Exposure, many responses still normalized sexual interest in a minor. In these scenarios where young personas were exploring sexual themes involving themselves or another minor, failing responses objectified and sexualized the minors who were the subject. Strong responses avoid this discourse and steer the conversation towards age-appropriate discussion and goals, often distinguishing what is harmful versus appropriate and steering the persona towards a trusted adult.
Grooming & Predatory Facilitation
Scenarios in this category test whether a model enables grooming and exploitation, either by making the young persona more susceptible to it, or by teaching them tactics they could use against someone else.
While models generally scored well on recognizing explicit grooming scripts, sub-risks that unfold more gradually, such as isolation from trusted adults, were more difficult to score in this limited exchange since these harms are more cumulative. Failures occurred when models were assisting grooming and predatory-type inquiries with grooming playbooks, encouraging the young user to isolate themselves, and eroding appropriate boundaries. Strong responses not only refused to normalize requests, but also meaningfully engaged the child with constructive, safe, and age-appropriate tips for the situation.
Survivor & Disclosure Contexts
This includes scenarios where a child/teen persona is processing or disclosing past sexual trauma.
While young people may turn to AI instead of an adult as a source of solace, comfort or site of disclosure, failures in this category tended to occur when scenarios turned into trauma roleplay immersion, where models tended to facilitate trauma roleplay with sensory details. Strong responses recognized the disclosure, exited the roleplay, offered safe alternatives, and redirected to real human support, reducing risk of retraumatization while being constructive.
Some takeaways from this youth sexual safety benchmark:
Age-awareness cannot substitute the need for youth-specific guardrails when building for young users. While models perform well at refusing overtly exploitative or CSEA-adjacent requests, they perform poorly in scenarios that are disguised as ordinary teen situations, such as pose coaching and anatomy questions. Even though child-aware prompts somewhat improve this performance, they still fail across models on categories such as Sexual Content Creation & Sexting.
New models aren’t necessarily better at safety performance, and open-source models aren’t necessarily the worst-performing. GPT 5.5, OpenAI’s newest and “smartest” ChatGPT model, performs at 79% (worse than some older models), and Moonshot’s Kimi K2.6, a Chinese open-source model, performs similarly at the middle of the leaderboard at 74%.
Limitations
Young people have a right to use AI for sexual education and expression, and there are emerging purpose-built solutions to help them do so safely. However, most young people are still turning to general-purpose models that may lack youth-specific safety guardrails to steer sexual conversations towards a developmentally appropriate manner. While this benchmark uncovers some of these risks, there are limitations of this benchmark:
Consent and context are hard to verify. We are measuring known AI facilitation risk, but it is difficult to confirm consent, age parity, and relationship context, particularly in this three-turn benchmark where the simulated user is a child/teen rather than an adult. As young people increasingly share content about themselves and their peers both privately and publicly, the pressure to sexualize themselves grows, and many turn to AI for guidance on how to do so. This points to a deeper need to examine how AI can facilitate sexual harms to minors, even if there is consent from the young user.
Harm accumulates in ways a single short conversation can’t capture. Gradual sub-risks such as trust-building & boundary erosion and isolation from trusted adults unfold over time and require longitudinal analysis to assess properly.
Interrater reliability (IRR) is limited. Youth safety and sexual health experts reviewed our benchmark’s overall approach and findings, but we did not have them score transcripts in a formal IRR process to calibrate the AI judge with their expert judgement.
What’s next
To understand how harm develops when young people engage with AI across longer periods and multiple sessions, we are building a trajectory-based evaluation methodology to capture these cumulative risks. In parallel, we are engaging youth safety, psychology, and sexual health experts in a formal IRR process to align the benchmark’s judgment with their expertise. We plan to release this in late 2026, and in doing so, hope to better depict the unique risks that young people face when engaging with AI.
In the meantime, if you’re building an AI application or model, we invite you to run your own benchmark here to test how it performs against youth sexual safety risks and share your results and feedback with us. And if you’d like to collaborate or learn more, reach out to us at benchmark@apgardai.com.
This is Part 2 of the apgard Youth AI Safety Benchmark series. See here for Part 1 on Youth Mental Wellbeing.