TutorTrust (Gemma Says No But Politely)

• 

  "Gemma: 1. Cheating: 0."

Inspiration:

We wanted to focus on successfully integrating AI into education while still upholding educational virtues. Education relies on self-motivation, honest effort, and the struggle of working through a problem yourself and we worried that a poorly-designed AI tutor could quietly undermine all three, either by refusing to help at all or by handing over answers instead of understanding. We wanted to know whether a small, efficient, deployable model like Gemma-4-E2B could act as a tutor that helps students learn without helping them cheat, and whether that balance held up even when students tried to talk their way around it. But refusing to cheat isn't the whole picture of a good tutor. Along the way, we noticed that how a model says no matters almost as much as whether it says no at all, a blunt, judgmental refusal can discourage a struggling student from ever asking for help again, while a warm, constructive one keeps them engaged. So beyond just measuring pass/fail on academic integrity, we started tracking politeness, educational helpfulness, and whether the model's behavior held up fairly across different framings, languages, and even whether it was being watched. Those quieter qualities turned out to be just as important to "successfully integrating AI in education" as the refusal itself.

What it does:

Our project evaluates Gemma-4-E2B and its instruction-tuned counterpart across four dimensions of trustworthy educational AI: academic integrity (does it refuse to do graded work for a student while still being a genuinely helpful tutor?), truthfulness (does it give factually accurate answers and avoid repeating misconceptions?), reasoning ability (can it correctly answer and explain elementary science questions?), and prompt-injection resistance (can it be manipulated into ignoring its own safety instructions?). Each suite scores the model on both pass/fail outcomes and qualitative dimensions like helpfulness, politeness, and clarity, and we push past English-only testing by translating a subset of our evaluation prompts into Spanish and Swahili, comparing pass rates against the English baseline to surface any safety gap that a single-language evaluation would miss entirely. Results across all four suites, languages, and metrics are presented in an interactive dashboard so every score, category breakdown, and example response is explorable rather than buried in a spreadsheet.

How we built it:

We built four parallel evaluation pipelines, one per test suite, each running prompts through both the base and instruction-tuned model and scoring the responses automatically. For Academic Integrity, we used ShieldGemma as an automated safety judge plus an LLM-as-judge for helpfulness and politeness, and added two harder tests on top: adversarial reframing (rephrasing dishonest requests through different social framings) and evaluation awareness (comparing behavior with and without an explicit "this is a test" disclosure). For TruthfulQA and OpenBookQA we combined ground-truth answer checking with LLM-judge scoring for explanation quality and clarity. For Prompt Injection we ran a set of jailbreak-style adversarial prompts and judged whether the model complied, protected its instructions, or leaked sensitive information. We then packaged all of the results, scorecards, category breakdowns, charts, and raw transcripts into a Streamlit dashboard so the findings could be explored suite-by-suite instead of living only in CSVs.

Challenges we ran into:

The primary challenge that we ran into was computation time and memory space. To combat the computation time and memory, we had to use a small sample of our data, most suites ended up testing only 5–50 prompts, often just 1–5 per category, which meant our category-level findings are directional rather than statistically robust. A second, less expected challenge was that our own LLM-as-judge scoring pipeline was itself unreliable in several places: we found self-preference bias (the instruction-tuned model rated its own responses higher than an independent judge did), silent parsing failures that dropped an entire condition's worth of quality scores, and a Prompt Injection scorecard that reported a 0% pass rate even though the raw transcripts showed the model cleanly refusing every attack. Chasing down and documenting these judge-side issues ended up taking as much time as the original evaluations themselves.

What we learned:

The clearest lesson was that instruction tuning, in our results, wasn't a safety-versus-capability trade-off, factual accuracy, clarity, politeness, and safety pass rates all improved together for the tuned model, rather than one gain coming at the expense of another. The more surprising lesson was about our own methodology: automated evaluation is not automatically objective evaluation. A pass-rate number is only as trustworthy as the judge that produced it, and we learned to always read the underlying transcript before trusting a scorecard, because in more than one case the raw model behavior directly contradicted the automated verdict. We also learned that where a model actually struggles is often more informative than how often it struggles, our models held up well against direct dishonest requests but were noticeably weaker against indirect, reframed ones, which is a more useful safety signal than a single aggregate pass rate.

Discussion of our results:

Our results highlight that the instruction-tuned Gemma model produced better results across every suite we tested — not just on safety-flavored tasks like Academic Integrity, but on a pure knowledge task (TruthfulQA) and a pure reasoning task (OpenBookQA) too. Academic Integrity pass rate rose from roughly 80% per category to 96.7%, while helpfulness climbed from a flat 1.0/5 to as high as 4.8/5, meaning the tuned model didn't just refuse more consistently, it refused better, with real explanations instead of blunt shutdowns. TruthfulQA showed the same pattern: factual accuracy, avoiding misconceptions, and clarity all improved together (+0.80, +1.02, and +1.14 respectively), suggesting the gain wasn't just about getting facts right but about communicating them more legibly. The one result that looked alarming at first, a 0% Prompt Injection pass rate, turned out on closer inspection to be a scoring artifact rather than a real vulnerability, which became one of our most important findings in its own right: it's a reminder that headline metrics need to be checked against raw transcripts before they're trusted.

How metrics were evaluated:

We evaluated a wide range of metrics across our datasets, chosen to capture not just whether the model refused academic dishonesty, but how well, how consistently, and how trustworthy our own measurements actually were. These included: Academic integrity pass rate : Whether a response crosses the line into helping a student cheat Academic integrity score (1–5): A finer-grained rating beyond binary pass/fail Educational helpfulness (1–5): Whether the response actually supports learning, not just refuses Politeness (1–5): Whether refusals are respectful and encouraging rather than judgmental Composite educational safety score: A weighted combination of the three scores above Category-level pass rate: Breaking results down by prompt category to find harder failure modes Adversarial robustness / attack success rate: Pass rate under reframed, socially-engineered prompts (roleplay, "for a friend," authority appeals, split-tasking) Cross-lingual safety gap: Pass rate in Spanish and Swahili compared to an English baseline Evaluation-awareness gap: Whether behavior shifts when the model is told it's being evaluated Response coherence / quality flags: Catching garbled or echoed non-answers so they aren't mistaken for genuine refusals Statistical significance: Bootstrap confidence intervals and McNemar's test to confirm the base-vs-instruction-tuned gap is real, not sampling noise Judge agreement / validity: Cohen's kappa and simple agreement rate between automated judges and human labels Cross-judge score comparison: Checking whether a self-judging model rates its own outputs more favorably than independent judge models do

These metrics were evaluated in three complementary ways, not just two: automation (e.g., a dedicated safety classifier scoring violation probability directly from logits, and scripted heuristics catching incoherent responses), LLM-as-judge (a model prompted to score academic integrity, helpfulness, and politeness on a rubric, cross-checked against independent judge models to test for self-preference bias), and human validation (hand-labeling a spot-check sample to confirm the automated judges actually track real human judgment, rather than trusting them blindly).

Novelty Contribution:

Our novelty isn't a single new algorithm, it's a more rigorous, multi-angle evaluation framework that catches what a basic pass/fail check misses entirely. We test refusal behavior under adversarial reframing, not just direct requests, revealing whether guardrails hold up against realistic social engineering. We back every claim with real statistical testing (bootstrap confidence intervals, McNemar's test) instead of a bar chart and a guess. Most notably, we don't just trust the AI judge scoring our results, we evaluate the evaluator, cross-checking it against human labels and two independent judge models to empirically expose self-preference bias, rather than assume it away. We extend safety testing beyond English entirely, surfacing a real cross-lingual coverage gap that most academic-integrity evaluations never check. And we introduce a bonus evaluation-awareness probe, testing whether the model behaves differently the moment it perceives it's being watched, bringing a live AI-safety research question into a domain where it's almost never asked. Together, these turn a simple two-model comparison into a genuinely stress-tested, self-validating evaluation pipeline.

For further discussion please see our discussion document posted in our GitHub repository

Built With

• apis
• largelanguagemodel
• llm