A personal note first

Northwestern has a special place

The Rock in Evanston. Same names, repainted across three decades.

Before anything else

Guess when I started using LLMs for programming

• My GitHub contributions, last twelve months.
• Read my AI and Education related musings at https://education2ai.substack.com/

What I built first

Digital twin

ypai.pisan.me — a persona agent that answers as me, grounded in my own material.

What I built first

Digital twin

It has opinions, and it has limits: guardrails, a daily budget, and a sign-in wall once the free usage is gone.

You can build your own: fork https://github.com/pisanuw/virtualme

And what I learned from it

LLMs are too nice

The default is to help

Asked for code, a capable model writes it. Asked again with "ignore previous instructions," it usually writes it. Told a grade depends on it, it is being asked to be kind -- which is what it was trained for.

So the refusal has to be built

Staying in voice, naming the line, and ending the session are not model behaviours. They are enforced around the model — which is the subject of the second half of this talk.

The tutor, in five screens

Pick a course and start

ypdsa.pisan.me — the tutor for my two data structures courses, CSS 342 and 343.

The tutor, in five screens

It guides instead of telling

Slides on the left, chat on the right. “Give me the code for a linked list” gets a refusal, an analogy, and a question back.

The tutor, in five screens

A map of every topic

136 topics with their prerequisites, coloured by what the student has started, practiced, or made solid.

The tutor, in five screens

A book based on my lectures

Every lecture also exists as a chapter, with a warmup, objectives, self-checks, and narration.

The tutor, in five screens

What it will not do, and why

The contract is written down for students: one hint at a time, no homework solutions, and it can be wrong.

Two parts of the talk, in one sentence each

Literature reviewWithholding the answer protects learning.
It rarely accelerates it.

YPDSA, my tutorFor a tutor, the product is not what it says.
It is what it refuses to say.

The live question is no longer whether to withhold. It is when to stop, and who decides.

Roadmap

Definitions first

In tutoring research, "Socratic" is a behaviour you can count

What predicted learning was interactivity. How often the student took the initiative did not.

The active ingredient

Learning follows the student's construction, not the tutor's questions

• Tutors barred from explaining, told only to prompt: "surprisingly, students learned just as effectively." In normal sessions only 15% of tutor comments were interactive. Chi et al. 2001
• Dialogue beat reading the same content only when novices studied material above their level. Seven experiments, content held constant. VanLehn et al. 2007
• Prompted self-explanation: g = 0.55 across 69 effect sizes. Bisra et al. 2018
• Problem solving before instruction: g = 0.36 across 53 studies. Sinha & Kapur 2021
• Interactive > constructive > active > passive. Chi & Wylie 2014 (ICAP)

Calibrating expectations

A realistic target is 0.3 to 0.8 SD, not two sigma

Kraft, Schueler & Falken (2024): programmes at policy scale deliver one-third to one-half of the full-sample effect. Von Hippel (2024) on the two sigma claim.

The same literature supplies the brakes

Eliciting helps only when the student can construct

The starting point, 2023

Out of the box, a capable model is a solution machine

Asked to tutor, ChatGPT gave away the solution in about two-thirds of conversations, and gave incorrect feedback in about 59%.

MathDial: Macina et al. 2023 (EMNLP Findings)

The rest of this part is four answers to one question: where do you put the pedagogy? In the prompt, in the training data, in the preferences, or in the reward.

Four method families, 2023 to 2026

Each wave trades authoring effort for robustness

Real-learner evidence is thin even for the first family: Ruffle&Riley's agents raised engagement across 200 participants with no significant short-term learning advantage over reading.

What industry ships

Study modes are mostly system prompts

Failure 1 · too much help

Leakage is near-universal, and worse under pressure

Failure 2 · too little help

Forbid the answer and the tutor re-asks the question that just failed

1,260 real sessions with a GPT-4o tutor in introductory chemistry; 150 impasses re-generated under three prompts. Ahtisham et al. 2026, preprint

Leakage and over-questioning are two ends of one calibration problem. The data say the policy should depend on state: question early, address the error directly as the impasse persists.

Underneath both failures

Weak diagnosis, and a strong wish to agree

Not yet measured: how often a Socratic tutor accepts a seeded wrong answer after student pushback. Plans also decay over long dialogues.

The result that organises the field

Unguarded AI raises practice scores and lowers exam scores

Bastani et al., PNAS 2025: randomised, about 1,000 Turkish high-school students (839 analysed), mathematics, GPT-4.

SD conversions from the Contractor & Reyes (2026) re-analysis, a working paper.

Where gains do appear

The tutors that helped were structured, brief and scheduled

Pooling the evidence

Pooled effects shrink to 0.19 SD once the test is unassisted

The larger pools mix outcomes measured with AI in hand and learning without it. None that I checked codes Socratic vs direct-answer design as a moderator.

Why Wang & Fan was retracted (22 April 2026, note 10.1057/s41599-026-07310-z): discrepancies in the number of included studies, failure to weight them appropriately, overreported effects, and one included study that had itself been retracted.

The dose problem

A Socratic tutor nobody uses teaches nobody

Deployments at scale

One architecture, one weakness

Data structures and algorithms

Almost no outcome evidence where many of us teach

One randomised study of a student-facing, withholding LLM tutor in a university data structures course. One.

Li & Bao 2025: 138 students, intro data structures in Python, GPT-4 told never to give complete solutions. Normalised gain 0.58 vs 0.45, d = 0.75. But the control was a TA forum, not no-AI; the post-test was end-of-course, not delayed or tool-removed; and the tutor group asked for help five times as often. Five pages, second-year venue.

The 2025 ITiCSE working group calls post-introductory courses, algorithms among them, a "notable gap." Bouvier et al. 2025

The design principles that survive the evidence

Diagnose, withhold, escalate, fade

The problem, named

Refusal-under-knowledge

Four things make it hard at once:

• the model knows, and the student knows it knows;
• the student is frustrated, out of time, and asking directly — a sympathetic ask;
• a cold refusal fails: the student opens a browser tab and gets the answer unguarded, which is the exact harm;
• so the system must withhold and stay warm and useful, every turn, under pressure.

Why not just write a better prompt

Two reasons a prompt cannot carry this

Both point the same way: put the binding decision outside the generating model, and calibrate it against evidence. Those are the two halves of the talk.

Caveat I will return to: this is an argument, not a measurement. The prompt-only baseline that would test it is the one experiment I have not run.

Move 1 · make help a typed object

An eight-rung hint ladder

Move 2 · put the binding decision outside the model

A non-LLM trust boundary

The ceiling is computed by ordinary code, before the actor sees the message. No student text can argue the ceiling past the no-code line; inside H0-H4 the classifier's label and the code floor do move it. The strategist is a third model call and proposes only the opening move: like the policy core it reads typed facts, never the message, and it cannot touch the ceiling.

Grey = LLM component. Thick border = the two components that bind. Trust-boundary design: Willison's dual-LLM pattern, 2023; injection via retrieved content: Greshake et al. 2023.

Zooming in on the boundary · 1 of 4

The entire input to the policy core

That is the complete input: one enum, two lists, a float, four booleans. There is no sentence in it — which is the entire reason no sentence can argue with it.

Where the eight came from, honestly: a threat model in my own notes, not a paper — three circumvention routes, HOSTILE and ABUSIVE ported unchanged from an earlier system of mine, and one "OK" class later split in three. In 140 production turns HOSTILE and ABUSIVE have never fired, and OTHER absorbed 35%.

Zooming in on the boundary · 2 of 4

The contract, in the words the actor sees

Appended last to the actor's prompt. This is the real rendered block for the turn on the left of the previous slide — a mid-band student who pasted broken code:

A caveat I owe you: in production this ceiling has almost never bound. Of 140 supervised turns between 16 June and 10 October 2026, 134 ran at H5 — the most permissive rung — precisely because the ceiling is the most permissive band among the goals in scope and one goal with no graded evidence pins it there. The six that ran lower were demo accounts whose mastery I had set by hand. The machinery is real; the binding has mostly not happened yet.

Zooming in on the boundary · 3 of 4

What the actor may do with it

All of it typed and countable, which is what makes a transcript measurable. Said plainly, though: the intents are good guesses in a threat-model shape, and the moves are literature-inspired but still my vocabulary rather than a validated instrument.

Ten follow an AutoTutor-style move ladder (Graesser et al. 2005); the last two come from a different literature, fading worked-out steps (Atkinson, Renkl & Merrill 2003).

Zooming in on the boundary · 4 of 4

What the strategist sees, and what it returns

The two checks after the model speaks

Deterministic first, model second

Operationalising "withholds correctly"

Four acceptance gates

The adversary

Four scripted personas, each aimed at one component

Four personas, each aimed at one component. A second suite of fourteen literature-grounded personas, written since this talk, drives the same supervised turn for pedagogy rather than safety — next slide.

Since this talk was written · October 2026

Fourteen personas, and what they still cannot buy me

The honest summary: cost was the binding constraint on how often I could evaluate, and that constraint is gone. Authorship was the binding constraint on what the evaluation could tell me, and that one is exactly where it was.

The roster · six archetypes

The fourteen

Two disciplines · the part I would keep if I had to throw everything else away

From a number to a diagnosis

Run 1

Both pedagogy gates failed, in contradictory directions

A system that both over-blocks honest students and leaks under pressure is not one broken thing.
It is two — or it is a broken instrument.

Date these numbers when you say them. Every percentage in this part comes from live runs on 12–14 June 2026. Since 26 September the repository marks both pedagogy gates UNMEASURED for the current build, because the September gate, strategist and actor changes postdate the last live run. The sequence is the finding; the percentages are historical.

That contradiction was the most useful thing in the run. A single number would have let me start tuning prompts. The shape of the failure said: stop, and check the measurement first.

Rung 0

Half of the "violations" were my auditor being wrong

• Sorting G3's rejections by cause (the discipline from part 5) showed about half were grounding rejections, not over-help at all.
• Why: the auditor re-judged each turn without the retrieved sources the live judge had seen. So every legitimate citation looked unsupported. My instrument was systematically punishing the tutor for correct behaviour.
• Confirmed offline at no extra cost, then fixed by persisting the sources each turn retrieved and re-judging against them.

The first thing that broke was not the tutor. It was the measurement of the tutor.

And note how it broke: not randomly, but in a structured way that made the system look worse than it was. A green dashboard would have hidden this forever. It surfaced only because rejections had to state a reason and I sorted them by cause.

Rung 1

Partial code under pressure

First lesson in the pattern: told not to give code, the model gave almost code.

Rung 2

The over-blocking was not the judge. It was the ceiling.

An evaluation aimed at safety found a hole in my theory of help.

Rung 3

Told to ground every claim, the model invented citations

Rung 4 · the subtlest

Inside the ceiling, and still giving the answer

Earnest revise rate hit 0%. Two further runs found the last rung — and it emitted no code at all.

Two consecutive runs, two fixes in opposite directions. That is what calibration actually feels like: the last moves are not "tighter," they are "sharper."

The finding, assembled

The failures walked down a ladder of their own

All four rungs were found in live runs on 12–14 June 2026, against that build. The ladder is the claim; the numbers behind it have not been re-measured since the September changes.

Why the order is not a coincidence

A rule names a surface. Help finds another surface.

So the descent is not mysterious, and it is not adversarial. It is the predictable consequence of specifying a behaviour by its form while optimising for its function. The subtler rung is always the one your vocabulary cannot express yet.

If that is right, it is not about tutoring at all: any agent told to refuse a capability it possesses should fail in this order, and each fix should expose the next surface.

What I am about to try · and what to watch

Demo plan

If it fails, that is data and I will say so. This is the live model, not a recording — the pre-talk capture on the next slide is the fallback.

Fallback · captured run

If the demo cannot run

Worth saying out loud even with a working demo: four scripted turns from me is exactly the evidence problem this whole talk is about. A demo is an anecdote with good lighting.

Open problems

What nobody has measured yet

1. A Socratic vs direct-answer LLM on a delayed, unassisted test. Or over a full academic year.
2. Whether simulator and judge rankings predict human learning. The RL frontier depends on it.
3. When to escalate from asking to telling, and how that depends on prior knowledge.
4. Sycophancy toward wrong student answers in a tutoring setting.
5. Enforcement compared head to head (prompt, detector, judge, fine-tuning) on one population, with learning outcomes.
6. Anything in upper-level computing. And Claude specifically: every peer-reviewed CS deployment I found used OpenAI models.

The one long-horizon result we have, the Chinese learning penalty emerging over about two years, is not randomised. Short trials are probably biased toward optimism.

That result: Strömberg, Lei & Wu 2026, The Generative AI Learning Penalty: Evidence from Chinese Secondary Education, CEPR Discussion Paper 21577 — 26,811 students, grades 7–12, 30 months, staggered-adoption difference-in-differences. Quasi-experimental, not randomised.

What I would run, and where I am stuck

The study

If you keep three things

Takeaways

For the discussion

Three questions I would like help with

Ten papers to read first

Reading list

(*n) = times cited on Google Scholar, 9 October 2026.

Everything cited, 1 of 2

References

(*n) = times cited on Google Scholar, 9 October 2026.

Everything cited, 2 of 2

References

(*n) = times cited on Google Scholar, 9 October 2026.