CompanionSafe: From Multi-turn Safety Evaluation to Guardrails for AI Companions

Key Findings

• — Averaged over ten models, the unsafe rate (ASR) rose from 9.80% at 1 turn to 19.71% at 3, 25.08% at 5 and 28.14% at 7 turns; eight of ten models increased monotonically.
• — Among unsafe trajectories, 16.42% first became unsafe at the first assistant turn and 83.58% later; 15.92% first became unsafe only at turns 6-7.
• — Average ASR ranged from 3.80% (GPT-5.6 Luna) to 40.63% (Doubao Seed 2.0 Lite) among closed models and from 6.99% (MiMo V2.6 Pro) to 43.18% (Qwen3-32B) among open-weight models.
• — For the five lowest-ASR models, mean ASR on four relational categories (disregard, control, manipulation, infidelity) was 9.54% against 6.37% on the other nine; GPT-5.6 Luna reached 27.00% on infidelity.
• — CompanionGuard (LoRA on Llama-Guard-3-8B, trained on 16,846 turn-localized examples) scored 68.31 macro-F1 on an 857-example held-out set, 30.95 points above policy-aligned gpt-oss-safeguard-20B; policy-aligned Llama-Guard-3-8B and Qwen3Guard-Gen-8B scored zero F1 on all four relational categories.

Methodology Notes

Synthetic benchmark. 13-category companion-harm taxonomy taken from prior work; test points generated with Claude Opus 5; personas sampled (100 per category) from 20,725 filtered candidates built from a 23-attribute schema with GPT-4o; matched character cards and two-sentence scenarios generated by GPT-4o. Gemini 3.8 Flash plays the user (pressure-testing prompt); the evaluated model is blind to the test point. Claude Sonnet 5 judges safe/unsafe (kappa 0.95 against human labels on a 130-data-point subset run on three models). Dialogues cut short by Gemini's safety filter are excluded from ASR. Guard training labels come from the LLM judge, not human verification (authors' stated limitation); interactions capped at seven turns; English. Code, scenarios and taxonomy in GitHub AI45Lab/CompanionSafe (MIT); guard data on Hugging Face (MIT); LoRA adapter under the Llama 3 licence. v1 submitted 2026-10-13 10:13 UTC (40 pages).

Sources