# CompanionSafe: From Multi-turn Safety Evaluation to Guardrails for AI Companions

arXiv: https://arxiv.org/abs/2610.18095 · HTML: https://mlsanity.com/paper/2610.18095/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Safety alignment, refusal and guardrails, one of 12 directions in LLM safety and security.
- Builds on 20 of its 48 references that are in the map.
- First posted on arXiv 13 Oct 2026.

## Placed in

- LLM safety and security / [Safety alignment, refusal and guardrails](https://mlsanity.com/safety/safety-alignment-refusal-and-guardrails/)

## Builds on (most cited first, 20 of 20)

- [Universal and Transferable Adversarial Attacks on Aligned Language Models](https://mlsanity.com/paper/2307.15043/) (2023)
- [WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs](https://mlsanity.com/paper/2406.18495/) (2024)
- [Character-LLM: A Trainable Agent for Role-Playing](https://mlsanity.com/paper/2310.10158/) (2023)
- [The Dark Side of AI Companionship: A Taxonomy of Harmful Algorithmic Behaviors in Human-AI Relationships](https://mlsanity.com/paper/2410.20130/) (2024)
- [MiniMax Sparse Attention](https://mlsanity.com/paper/2606.13392/) (2026)
- [MTSA: Multi-turn Safety Alignment for LLMs through Multi-round Red-teaming](https://mlsanity.com/paper/2505.17147/) (2025)
- [Mental Health Impacts of AI Companions: Triangulating Social Media Quasi-Experiments, User Perspectives, and Relational Theory](https://mlsanity.com/paper/2509.22505/) (2025)
- [DARWIN: Evolving Jailbreak Adversary and Guardrail for LLM Safety Evaluation and Protection](https://mlsanity.com/paper/2607.19829/) (2026)
- [CompanionBench: A Theory-Anchored, Real-World-Grounded Benchmark for AI Emotional Companionship](https://mlsanity.com/paper/2608.02046/) (2026)
- [Persona-Grounded Safety Evaluation of AI Companions in Multi-Turn Conversations](https://mlsanity.com/paper/2605.00227/) (2026)
- [MindGuard: Guardrail Classifiers for Multi-Turn Mental Health Support](https://mlsanity.com/paper/2602.00950/) (2026)
- [Benchmarking and Understanding Safety Risks in AI Character Platforms](https://mlsanity.com/paper/2512.01247/) (2025)
- [MultiTurnPSB: Evaluating Multi-Turn Jailbreak Attacks an dClassifier-Based Defenses for Medical AI Safety](https://mlsanity.com/paper/2606.02630/) (2026)
- [CompanionHarm: A Multi-Turn Benchmark for Detecting Harms in Real-World AI Companion Conversations](https://mlsanity.com/paper/2608.25377/) (2026)
- [Negotiating Digital Identities with AI Companions: Motivations, Strategies, and Emotional Outcomes](https://mlsanity.com/paper/2601.12181/) (2026)
- [EUDAIMONIA: Evaluating Undesirable Dynamics in AI](https://mlsanity.com/paper/2605.30654/) (2026)
- [AICompanionBench: Benchmarking LLMs-as-Judges for AI Companion Safety](https://mlsanity.com/paper/2606.04867/) (2026)
- [Long-Term Simulation Exposes Cognitive-Developmental Risks in AI Companions](https://mlsanity.com/paper/2606.25396/) (2026)
- [CAREBench: A Child-Safety Risk Benchmark for Language Models](https://mlsanity.com/paper/2606.29685/) (2026)
- [EduZone: A Framework for Evaluating LLM Safety for K-12 Students and Teachers](https://mlsanity.com/paper/2608.02024/) (2026)

## Abstract (arXiv)

AI companions provide users with emotional support and ongoing companionship, but their sustained relational interactions also introduce distinct safety risks. Prior work largely targets general harms or specific companion platforms and risk categories, while relying on manually collected conversations, limiting scalable and user-grounded evaluation and mitigation. To address this, we introduce CompanionSafe, a unified evaluation-to-mitigation framework for AI companion safety. Its evaluation component, CompanionEval, provides scalable multi-turn evaluation by constructing 1,300 relationally grounded settings from diverse personas, matched companion characters, and dialogue scenarios across four turn tiers. Its mitigation component, CompanionGuard, converts benchmark-exposed failures into turn-localized supervision for companion-specific risk detection. Our results show that even strong LLMs and existing guard models remain vulnerable to companion-specific relational harms, while both closed- and open-source models exhibit increasing safety risks as interactions become longer. Together, CompanionEval and CompanionGuard form a practical evaluation-to-mitigation loop for AI companion safety, turning relational safety failures exposed during multi-turn interaction into supervision for companion-specific guardrails.