Teaching a Large Language Model Tutor to Withhold the Answer: A Supervisor Architecture and an Evidence-Driven Method for Tuning Socratic Behavior

An effective large language model (LLM) tutor must often decline to give an answer it could easily produce. In a randomized study, students who used an unguarded chatbot scored higher while practicing but lower on a later test taken without it, whereas a Socratically guarded version of the same model kept the practice gain and removed the later loss [4]. Reliable answer-withholding is therefore central to a tutor’s value, yet a capable model pressed by a frustrated student does not withhold reliably on a prompt alone. We report a deployed tutoring system that enforces answer-withholding as a per-turn, machine-checkable contract, and a method for tuning that withholding against evidence. A non-LLM policy core, reading only trusted learner state, sets a per-turn ceiling on an eight-rung help ladder; a deterministic detector strips solution code; and a separate LLM judge checks each risky reply against the contract. We tune the behavior with an automated evaluation that uses no human subjects: scripted student personas are driven through the live pipeline and re-scored by a stronger model, and we record each rejection’s stated reason so failures are fixed by cause.

Introduction. Most published cautions about LLMs in education share a structure: the model is too helpful. Asked a homework question, a capable model will solve it clearly and instantly. Decades of learningsciences research predict that this kind of help, giving the answer rather than supporting the student’s own reasoning, produces little durable learning: feedback that merely reveals the answer is among the least effective kinds [11, 28], and learning depends on the student doing the cognitive work of constructing and applying a solution [6, 25]. Recent evidence confirms this directly for LLMs. Bastani et al. ran a randomized controlled trial with roughly a thousand secondaryschool students: access to an unguarded chatbot raised performance while practicing but lowered it on a later exam taken without the tool, relative to students who never had the tool, while a Socratically guarded version of the same model kept the practice gain and removed the later loss [4].

Discussion / Conclusion. Refusal-under-knowledge is distinct and under-studied. Nothing in the calibration loop is specific to data structures, or even to education. Any LLM agent whose core requirement is to refuse a capability it possesses faces the same failure modes: the model edges toward the forbidden behavior, and naive metrics conflate distinct failures. Classical LLM safety studies refusal of content the model should not produce; this is the harder converse, refusing content it should and can produce, to a user who can see that it can. The over-help ladder is the tutoring instance of a general phenomenon: a model’s violations of a withholding contract are ordered gross-to-subtle, and a reason-capturing loop walks down that order. Put the irreversible decision in code, not in a prompt. The single most stabilizing choice was P2: computing the help ceiling in a non-LLM policy core fed only trusted state made the most important property both injection-proof and unit-testable, so prompt edits could never silently weaken it.