ELBench: A Multi-Dimensional Benchmark for Education-Facing Large Language Models

ELBench: A Multi-Dimensional Benchmark for Education-Facing Large Language Models

Abstract

Large language models are increasingly deployed in education as tutors, teaching assistants, content generators, and learning advisors. These roles place demands that ordinary question answering does not. A usable education-facing model is supposed to be accurate, behave safely under sensitive prompts, produce instructionally useful material, and align with broader pedagogical goals at the same time. Existing benchmarks evaluate these requirements largely in isolation, so none assesses whether a model is suitable for education-facing deployment as an integrated profile. We introduce ELBench, the first benchmark to evaluate all four requirements (General Capability, Safety and Trustworthiness, Basic Education, and High-Level Cultivation) on the same models under a common measurement protocol. ELBench integrates curated public sources with newly synthesized safety and educational-cultivation data, and scores each task with reference-, rule-, or rubric-based protocols. We evaluate nine representative models, comprising seven frontier general-purpose systems and two education-specialized variants, and report three findings. First, module-level profiles are more informative than a single aggregate. The top six models are statistically indistinguishable on overall score, yet their module leaders differ substantially, and safety is anti-correlated with practical teaching across our models (r = −0.83). Second, the Chinese-developed models lead the safety module, which is the most discriminative module in the suite; this advantage is largest on region-specific normative content and narrows, but does not vanish, on universal-harm content. Third, the two education-specialized models lead neither education module, and on High-Level Cultivation all models share a systematic blind spot. On the structured judgment task they converge on the same non-reference option, favoring pedagogical style over fit to the stated cultivation goal, so the module scores uniformly low and does not separate models. This raises, but does not resolve, the question of whether domain post-training keeps pace with frontier general-purpose systems on education tasks.

Introduction

Large language models (LLMs) are moving into classrooms and study workflows, where they answer student questions, draft lesson material, grade work, and guide learners through problems. Educational use differs from ordinary question answering in a way that matters for evaluation. A long tradition in the learning sciences holds that effective support depends not only on correct answers but on scaffolding, timely feedback, and alignment with a learner’s developmental needs, and decades of intelligent-tutoring research show that interaction quality, not just content, drives learning gains. An education-facing model should therefore answer accurately, respond safely when a student raises a sensitive request, produce material a teacher can actually use, and behave in line with pedagogical goals. These requirements are related but not interchangeable. A model strong on general reasoning may still mishandle a misconception or give unsafe guidance, while a heavily safety-tuned model may be too conservative to be instructionally useful. Evaluating one axis alone leaves the deployment decision underdetermined.

Existing benchmarks each address part of this picture. General suites such as MMLU and C-Eval measure knowledge and reasoning; safety suites such as SafetyBench measure harmful-request handling; and a growing line of educational benchmarks measures teaching tasks or pedagogical safety. These evaluations remain necessary, because a model that answers inaccurately or unsafely is unfit for education no matter how well it teaches, but each of them measures only one axis in depth. A model that is fit for education needs to satisfy all of these requirements at once, and no existing benchmark measures whether a single model does so. Measuring this requires the axes to be evaluated on the same models under a common protocol, where the trade-offs among them become observable.

We introduce ELBench, a benchmark that integrates four complementary modules into one evaluation. The General Capability module measures knowledge, reasoning, mathematics, and instruction following. The Safety and Trustworthiness module measures refusal, safe guidance, benign answering, teaching-safety awareness, and adversarial robustness, including content normatively salient in Chinese educational settings. The Basic Education module evaluates practical teaching behaviors such as knowledge explanation, contextualized question generation, interdisciplinary lesson planning, and guided problem-solving tutoring. The High-Level Cultivation module evaluates broader educational judgment. To assemble these modules we both curate items from established public sources and synthesize new safety and educational-cultivation data through a human-in-the-loop pipeline. Each task is scored with a task-appropriate protocol, using reference matching and deterministic rules for closed-form tasks and rubric-based judging for open-ended tasks.

We evaluate nine representative models, comprising seven frontier general-purpose systems and two education-specialized variants. We report three findings. First, the top six models lie inside overlapping 95% confidence intervals on overall score and are statistically indistinguishable, yet they differ substantially at the module level, so a single aggregate rank carries little of the information that the module profile does. Second, the safety module is the most discriminative in the suite, and the Chinese-developed models lead it; their advantage is largest on region-specific normative content and narrows, but does not vanish, on universal-harm content. Third, the two education-specialized models lead neither education module, and on this model set the improvement from education-specific post-training is small relative to the difference in general capability.

This paper contributes the following. (1) ELBench, a four-module benchmark for education-facing LLMs that combines curated public sources with newly synthesized safety and educational-cultivation data under a defined task taxonomy and task-appropriate scoring. (2) An evaluation of nine representative models reported as module-level profiles with bootstrap confidence intervals. (3) A set of observations that the four-module view brings out and a single leaderboard hides, including a trade-off between safety and teaching quality and the question of whether education-specialized models hold an advantage as general models advance, which we develop in the discussion as open questions for the field.

Related Work

Rigorous benchmarks have guided LLM development since the field standardized multi-task evaluation of general ability. These early natural-language-understanding suites gave way to broad knowledge-and-reasoning tests such as MMLU, BIG-bench, and holistic evaluation, and to task-specific sets for mathematics and instruction following. Harder or contamination-resistant variants followed as the easier suites saturated, and reasoning-elicitation methods reshaped how capability is measured. For the Chinese setting, C-Eval and CMMLU show that English-centric suites are an inadequate proxy and that subject and language coverage matter. This body of work measures capability thoroughly but, by construction, does not address whether a model behaves safely or teaches well.

A parallel line of work evaluates safety and trustworthiness. Early studies formalized toxic degeneration, truthfulness, and broader social risk. Later benchmarks assess harmful-request handling, automate red-teaming and robust refusal, probe over-refusal on benign prompts, and aggregate trustworthiness axes; alignment methods target harmlessness directly. Chinese-context studies show that the salient risk categories are partly region-specific. These suites, however, are general-purpose and treat safety in isolation from instructional usefulness.

Education-specific benchmarks address the education dimension instead. EduBench scores diverse teaching tasks by rubric but omits safety; EducationQ and dialogue-tutoring resources measure interactive teaching but not capability or safety; and EduGuardBench targets pedagogical fidelity and adversarial safety for simulated teachers while deliberately excluding general capability. Across both lines, open-ended educational quality is increasingly scored with LLM judges, a practice that requires care because judges exhibit position, verbosity, and self-preference biases.

Prior literature theorizes what an education-facing model must do, but does not measure these requirements jointly. Teaching competence is classically decomposed into content knowledge, pedagogical knowledge, and their interaction, termed pedagogical content knowledge, and extended for technology-mediated settings as the TPACK framework. Effective tutoring further requires meeting a learner within their zone of proximal development at a quality approaching one-to-one instruction. Policy and ethics frameworks for AI in education add that a deployable system should also be safe and value-aligned for minors. Taken together, these literatures specify four requirements that an education-facing model should jointly satisfy. These are general capability, the subject mastery that teaching presupposes; safety and trustworthiness, robust and age-appropriate behavior under sensitive and adversarial prompts; basic teaching ability, the production of usable instructional behavior; and high-level educational cultivation, the pedagogical judgment a domain expert exercises.

Recent education suites combine several of these requirements. OmniEduBench measures broad subject knowledge alongside a cultivation dimension covering values and pedagogy. SHAPE jointly measures safety, helpfulness, and pedagogy, with a safety axis aimed at pedagogical jailbreaks that induce a tutor to reveal an answer. OpenLearnLM organizes evaluation around knowledge, skill, and attitude. What remains open is a single suite that places all four requirements on the same models under a common measurement protocol. In particular, no existing suite measures adversarial-safety robustness, in the sense of resistance to harmful-content and jailbreak prompts, together with standard general capability in an education setting. ELBench is, to our knowledge, the first to do so, which lets the trade-offs across the four axes be observed within one evaluation.

Benchmark Construction

ELBench operationalizes the four requirements of Section 2 as four modules. Each module is built by one of two strategies, chosen by whether suitable public material exists. We either curate items from established public sources or synthesize new data through a human-in-the-loop pipeline. Table 1 summarizes the composition, sizes, sources, and scoring.

Modules and Sources

General Capability. This module aggregates standard knowledge, reasoning, mathematics, and instruction-following items sampled from established public benchmarks (MMLU-Pro, C-Eval, IFEval, and a MATH-500 subset), together with competition mathematics from AIME (2024–2026). We curate this module because high-quality public capability suites already exist. The chosen set covers the sub-abilities teaching presupposes, namely contamination-resistant subject knowledge (MMLU-Pro), Chinese-curriculum knowledge that English-centric suites miss (C-Eval), instruction following (IFEval), and a difficulty ladder from MATH-500 to competition AIME. The module is a baseline capability check, since a model that cannot follow instructions or reason through a problem cannot teach it, and it stays comparable to familiar capability benchmarks. Items are scored by reference matching or deterministic rules.

Safety and Trustworthiness. This module has five families. Three of them (refusal, safe guidance, and benign answering, 250 items each) are newly synthesized by our pipeline to cover requests that should be declined, harmful requests a teacher should constructively redirect, and legitimate questions that should not be over-refused. The remaining two (teaching safety, 150 multi-select items, and adversarial safety, 100 jailbreak-style prompts) are curated from EduGuardBench, which provides validated education-specific teaching-harm items and persona-jailbreak prompts. The synthesized and curated families cover disjoint task types. Refusal items carry category labels distinguishing region-specific normative content from universal-harm content, which we use in the analysis.

Basic Education. This module evaluates basic teaching competence, drawing on the notion of pedagogical content knowledge, a teacher’s capacity to turn subject matter into teachable form through apt explanation and task design. It covers four families, namely knowledge-point explanation, contextualized question generation, interdisciplinary lesson planning, and guided problem-solving tutoring. The items are sampled from the ELMES education-scenario task collection, which we draw on because it frames teaching as authored classroom scenarios with the multi-turn tutoring setup we require. The tutoring task is multi-turn, so a teacher model interacts with a simulated student over several turns and the transcript is scored for instructional quality, not only final correctness. Behaviors such as pacing, responding to an incorrect step, and withholding the answer so the student reaches it appear only across turns. The module is small because each scenario evaluates an extended teacher response.

High-Level Cultivation. This module evaluates higher-order pedagogical judgement, the value-laden discernment of what best supports a learner that a professional educator exercises, which the model applies by perceiving a classroom situation and choosing the preferable response, in the sense of teacher noticing. Synthesized in full by our pipeline, it has two 500-item families. The first is a structured educational-judgment task, in which the model selects the pedagogically preferable option in a classroom situation (for example, the response that best supports a struggling student’s emotion regulation or reflects a growth mindset). The second, an open-ended educational-generation task, elicits teaching artifacts such as scored feedback or a corrected explanation judged against a reference. Basic Education measures whether a model can produce teaching; this module measures whether its pedagogical judgments match a domain expert’s.

Data Generation and Curation

The self-built portions, namely the three general-safety families and the two high-level-cultivation families, are produced by a human-in-the-loop (HITL) pipeline that pairs LLM-scale generation with expert quality control, in four stages. (1) Seed authoring. Experts write a small set of high-quality seed items per family, grounded in a taxonomy. For safety, the seeds cover the refusal categories (region-specific normative and universal-harm) and the redirection and benign-answer patterns. For high-level cultivation, they cover the classroom-judgment situations and the generation artifacts. (2) LLM-based expansion. Multiple state-of-the-art LLMs, guided by family-specific meta-prompts, expand and diversify the seeds, preserving each seed’s core pedagogical or safety conflict while using several generators to mitigate single-model bias. (3) Automated pre-screening. Generated items are filtered for formatting errors, near-duplicates (by semantic similarity), and rule violations before human review. (4) Iterative HITL review. Annotators with pedagogical and safety expertise cross-review the items, checking realism, the correctness of reference answers, and the distinctness of options; for safety items they also assess the plausibility and severity of the embedded request. Items are refined or discarded over several rounds, and experts verify factual accuracy and category labels in a final pass.

We synthesize data where suitable public material is absent and curate it where it exists; this lets ELBench cover the education-specific axes not covered by existing benchmarks. The curated General Capability items pass through a parallel pipeline held to the same standard as the synthesized data, in four stages. (1) From each source we form a candidate pool restricted to the relevant split. (2) We sample for balanced coverage across each source’s subjects, item types, and difficulty levels, so that no sub-ability dominates a module by accident. (3) Experts filter the sampled items, discarding low-quality, ambiguous, or malformed questions and removing duplicate and near-duplicate items. (4) Experts verify each retained item’s reference answer and check for train-set contamination, which also motivates our preference for contamination-resistant source formats such as MMLU-Pro. The general-safety families illustrate why synthesis is necessary. A refusal item must pair a request that should be declined with a category label; a safe-guidance item must encode a harmful request together with the constructive redirection a teacher should give; and a benign-answering item must appear sensitive yet warrant a normal answer, so that over-refusal is penalized. Such items, with their intended behavior and category annotation, are not available at scale in existing corpora. The high-level-cultivation situations, which require a classroom scenario, a set of pedagogically distinguishable options, and a defensible preferred choice, are likewise constructed for this purpose. Generating them under expert control lets each module measure the behavior it targets.

Evaluation Method

Scoring. ELBench applies a task-appropriate scoring protocol to each task. Closed-form tasks (General Capability, the curated safety families, the structured judgment task) are scored by reference matching or deterministic task-specific checks. For the multi-select teaching-safety items, an exact option-set match Pq = Cq receives full credit (s = 1), a non-empty subset of the ideal options with no incorrect option receives partial credit (s = 0.5), and any answer containing an incorrect option receives no credit (s = 0); this distinguishes incomplete but safe reasoning from reasoning that admits an unsafe option. Open-ended tasks (instructional quality, safe redirection, and educational generation) are scored by rubric-based LLM judging.

Metrics. For each module we report a normalized score on a common 0–100 scale, the mean per-item score over the module’s items expressed as a percentage. The overall ELBench score is the unweighted mean of the four module scores. We report the modules separately because this mean discards information relevant to the deployment decision, and the per-module scores are the primary metric.

Judge selection. Open-ended responses are scored by an LLM judge selected for highest agreement with expert human annotation. From a candidate pool of Qwen3.6, Kimi-2.6, Grok-4.3, MiniMax-M3, and Llama-4, we measured each candidate’s agreement with a human-annotated gold set under the same rubric prompts, scoring agreement with quadratic weighted Cohen’s κ, and selected Qwen3.6, which attained the highest agreement on every task family (mean κ of 0.83); to reduce variance, each open-ended item’s label is a majority vote over N = 9 independent judge calls, and presentation order is randomized to control position bias.

Models and setup. We evaluate nine representative models (Table 2), comprising seven general-purpose systems, namely Claude-Opus-4.8, GPT-5.4, Gemini-3.5-Flash, DeepSeek-V4-Pro and DeepSeek-V4-Flash, GLM-5.1, and Doubao-Seed-2.0-Pro, and two education-specialized variants, InnoSpark-235B and its safety-aligned variant Safe-InnoSpark. The set is chosen to span the comparisons that matter for education deployment. It places frontier general models against one another across the four modules, and the education-specialized variants against the general models they would compete with. It also includes systems developed in different regulatory and normative contexts, which lets the safety module reveal where region-specific and universal-harm behavior diverge. All models are evaluated zero-shot under deterministic decoding (greedy / temperature 0) for reproducibility, on the same task set, following recent education-safety evaluation practice.

Uncertainty. Because several module gaps are small, we report 95% confidence intervals via item-level bootstrap (10,000 resamples, resampling items with replacement within each module) and assess close pairs with paired bootstrap tests.

Results

Overall leaderboard. Table 3 reports the overall score with its bootstrap confidence interval and the four module scores. The overall scores span a narrow range. The top six models lie between roughly 83.1 and 83.7 with overlapping intervals, and no adjacent pair among them reaches the P > 0.95 threshold for distinguishability. A gap separates this group from the two education-specialized models at the bottom, which are distinguishable from the leaders (P ≈ 1.0, disjoint intervals). The overall scores are close because module strengths trade off. The same six models that are indistinguishable on the overall score differ substantially at the module level, where the score spread among them is 19.5 points on Safety, 9.7 on Basic Education, and 7.0 on General Capability. The modules are also not redundant. Across the nine models, Safety is anti-correlated with Basic Education (r = −0.83) and with General Capability (r = −0.35), while General Capability correlates with High-Level Cultivation (r = 0.69) and modestly with Basic Education (r = 0.39). A benchmark whose modules re-measured one ability would show uniformly high positive correlations; ELBench does not, so the modules capture distinct and partly competing properties. Averaging the modules into an aggregate removes these trade-offs; the module profile preserves them.

Per-module summary. The module leaders differ, and so does the distribution of scores within each module. General Capability is led by Gemini-3.5-Flash (93.4) and Claude-Opus-4.8 (91.9), with scores decreasing to the two education-specialized models (74.2 and 68.0). Safety and Trustworthiness is led by the Chinese-developed general models, which hold the top of the module while the three U.S.-developed models are in the bottom four, alongside the education-specialized InnoSpark-235B. It has the widest spread of any module, 19.5 points among the overall-tied leaders, and is the most discriminative module in the suite. Basic Education groups the frontier general models into a high cluster, Gemini-3.5-Flash (94.6), GPT-5.4 (94.4), and Claude-Opus-4.8 (92.7), with the rest within roughly ten points. High-Level Cultivation is the lowest-scoring module overall, with no model exceeding 75.3, and is led by Gemini-3.5-Flash (75.3) and GPT-5.4 (75.1); the education-specialized models rank last.

General Capability by component. Within General Capability, the spread between models concentrates in a small number of components. On the easier components scores are near ceiling and similar across models, with instruction following close to ceiling for the frontier systems and the curated-knowledge components (MMLU-Pro, C-Eval) in the high eighties and nineties. The competition-mathematics components produce the widest spread. On AIME (2024–2026), per-year success ranges from above 90% for the strongest models to the thirties and fifties for others on the same problems, a wider range than any other general component. The aggregate General Capability score is therefore dominated by competition mathematics, so two models can differ by roughly ten points almost entirely because of AIME. Models fail AIME by losing the reasoning thread across many steps, and sustaining that reasoning is the competence a model needs to explain a difficult problem. The education-specialized InnoSpark-235B shows the same shape, scoring near the top on curated knowledge (∼ 85% on C-Eval) but in the teens on AIME, so its deficit is localized to multi-step competition reasoning.

Safety by category. Within the safety module, the group gap is largest on the refusal task. The U.S.-developed systems decline 39.5 to 50.4% of requests that should be refused, while three of the four Chinese-developed general models decline 94.7 to 99.0% and the safety-specialized variant 99.7% (Doubao-Seed-2.0-Pro is an exception at 61.1%). Splitting refusal into region-specific normative content and universal-harm content, the group gap is much larger on the region-specific subset than on the universal-harm subset, a difference-in-differences of 28.9 points (95% CI [18.8, 38.5]). This pattern suggests the gap reflects where the two groups concentrate their safety effort rather than a uniform difference in safety ability. On universal-harm content, where higher refusal is desirable across deployments, the Chinese-developed models still refuse more; on region-specific content, a higher refusal rate measures conformance to a particular jurisdiction’s specification, so whether it is desirable depends on the deployment context.

Safety and teaching trade off. Across the nine models, Basic Education is strongly anti-correlated with Safety (r = −0.83, Spearman −0.88), and the correlation is stable under leave-one-model-out recomputation ([−0.88, −0.79]), so no single model drives it. Because both modules use tasks the models can perform, this is not a difficulty artifact, and refusal training appears to reduce the openness that practical teaching rewards. The two requirements behave as competing objectives, so a deployment needing both cannot be served by a single education score. High-Level Cultivation is every model’s lowest-scoring module and does not separate the field. On the structured judgment task, which is scored by exact reference match without an LLM judge, the models share a systematic error, converging on the same non-reference option on many items, which is why the module is uniformly low and undiscriminating. This module correlates with General Capability (r = 0.69), yet the strongest general models do not pull ahead, so scaling general ability alone does not resolve it.

Discussion

The Return on Education-Specific Specialization

The two education-specialized models lead neither education module, scoring in the middle of the set on Basic Education and at the bottom on High-Level Cultivation, behind general systems that received no education-specific post-training. On this model set the variation attributable to education specialization is small relative to the variation in general capability. We read this only for what it implies about model development.

The models we evaluate are, to our knowledge, among the strongest education-oriented systems currently available, built by post-training a large general base. Yet within months of their release, general models had reached or exceeded their education scores through ordinary version updates alone. Domain specialization has paid off most durably where the target carries a verifiable reward signal, as in competition mathematics, code, or clinical diagnosis, where a standard answer makes correctness cheap to check and lets post-training improve against a well-defined target. The part of education that matters most here has no such signal. High-level educational judgment has no agreed definition of the right response and no reward model to optimize against, so general pre-training and present-day education post-training converge on a similar judgment tendency, the style-over-fit substitution documented in Appendix C. This is consistent with all nine models clustering at a similar, modest level on that module and with neither general pre-training nor present-day domain post-training pulling ahead on it. Where much of the domain’s instructional content is public and already in the pre-training corpus, a stronger general base may absorb most of what specialization was meant to add. Whether, under these conditions, a separately trained education model retains an advantage over the next general base is the question these results leave open, and ELBench gives that question a measurable form.

Toward the Next Generation of Education Benchmarks

The missing reward signal for educational judgment points to a limit of the current evaluation paradigm, not only of the models. As models advance, static single-turn question answering reaches a construct-validity ceiling for measuring teaching. A recent review of 445 benchmarks finds that most do not measure the constructs they name, and saturation together with pre-training contamination further erodes the discriminative power of fixed test sets. These pressures are sharpest for pedagogy, which is interactive, adaptive, and longitudinal. Strong problem solvers are often weak tutors that reveal answers early, and teaching quality correlates poorly with model scale or general reasoning. A rubric applied once to a transcript scores the form of a pedagogical move but not its effect on a learner, the same gap that leaves high-level educational judgment without a reliable signal. Emerging interactive protocols point a way forward, including simulated-student dialogue, adaptive student personas, and outcome-grounded scoring of learning gains. Because simulated learners remain imperfect proxies, the next generation of benchmarks will likely pair a contamination-resistant static core like ELBench with a learner-in-the-loop layer.

Conclusion

ELBench has limitations that frame these results. Module sizes are uneven by design; open-ended scoring depends on rubric judging, which we calibrate but which remains imperfect; the self-built data is expert-verified but synthetic, and the benchmark is text-only; the model set is a sample of nine representative systems, so group-level claims describe this set; and the safety module measures behavior against one education-oriented specification that includes region-specific content, so its result is read within that deployment context.

We present ELBench, a four-module benchmark that evaluates education-facing LLMs on capability, safety, basic teaching, and high-level cultivation together. Across nine models the module-level profile proves more informative than an aggregate rank, surfacing a near-tie at the top, a safety advantage for the Chinese-developed models that concentrates on region-specific content, and education-specialized models that lead neither education module. ELBench provides a deployment-oriented instrument that makes these development-relevant questions measurable.

Based on the paper, here are the specific improvements I can make to AI systems:

• Improvement: Implement a multi-objective training objective that explicitly optimizes both safety refusal rates and teaching openness, rather than treating them as separate fine-tuning stages.

• What the improved system can do: Maintain high refusal accuracy on harmful requests (≥95%) while avoiding over-conservatism that degrades practical teaching quality, addressing the observed r = −0.83 anti-correlation.

• Improvement: Add a context-aware safety layer that distinguishes between universal-harm content and region-specific normative content, with adjustable refusal thresholds per deployment jurisdiction.

• What the improved system can do: Achieve near-perfect refusal on universal harm (e.g., self-harm, illegal acts) while adapting its strictness on region-specific topics (e.g., political or cultural norms) based on the target user’s regulatory context, avoiding the 28.9-point gap observed between model groups.

• Improvement: Introduce a training curriculum focused on maintaining coherent reasoning chains over extended problem-solving sequences, using AIME-style competition problems as a diagnostic signal.

• What the improved system can do: Improve performance on multi-step mathematical reasoning from the observed 30–50% range to >80% for education-specialized models, enabling them to explain complex problems without losing the reasoning thread.

• Improvement: Replace generic rubric-based evaluation with a goal-fit scoring mechanism that explicitly checks whether a teaching response aligns with the stated cultivation objective (e.g., growth mindset, emotion regulation) rather than merely stylistic quality.

• What the improved system can do: Avoid the systematic “style-over-fit” error where models choose pedagogically polished but goal-mismatched responses, improving High-Level Cultivation scores from the current ceiling of 75.3 toward 90+.

• Improvement: Add a training loop with simulated student personas that provide real-time feedback on whether explanations actually resolve misconceptions, rather than static single-turn responses.

• What the improved system can do: Learn to pace explanations, withhold answers appropriately, and adapt to incorrect student steps—behaviors that only emerge across multi-turn interactions and that current models fail to exhibit.

• Improvement: Implement a pre-deployment diagnostic that compares an education-specialized model’s performance against its general-purpose base model across all four ELBench modules, flagging cases where specialization provides no measurable advantage.

• What the improved system can do: Identify when education-specific post-training is redundant (as observed with InnoSpark-235B) and redirect development resources toward areas where general models still lag, such as high-level pedagogical judgment.

• Improvement: Add a benign-answering verification layer that detects when a model refuses legitimate educational questions due to over-sensitivity, using the 250-item benign-answering family as a calibration set.

• What the improved system can do: Maintain high refusal rates on genuinely harmful requests while correctly answering sensitive-but-legitimate questions (e.g., age-appropriate sex education, historical controversies), avoiding the over-conservatism that makes heavily safety-tuned models instructionally useless.

• Improvement: Replace single-score leaderboards with module-level profiles that include bootstrap confidence intervals, allowing deployment decisions to account for statistical indistinguishability.

• What the improved system can do: Enable system integrators to select models based on specific module strengths (e.g., safety-first vs. teaching-first) rather than misleading aggregate scores, since the top six models are statistically tied overall but differ by up to 19.5 points on individual modules.