AI Security Literacy: Ecosystem-based Competency Framework and K-12 Learning Platform

1 Introduction

• Black-box AI is ubiquitous in students’ lives, but students are often unsure what is permitted, teachers are divided about AI, and many schools lack guiding policy or training.The adoption of AI within schools has been correspondingly rapid.Source: §1 · p. 1
• AISL is proposed as a distinct competency domain because existing AI-literacy frameworks focus on understanding and using AI, while cybersecurity frameworks predate AI-specific threats.Neither defines secure operation in AI-mediated environments as a competency with its own dimensions and developmental progression; discriminant validation remains future work.Source: §1 · p. 1
• The framework spans six dimensions across the school ecosystem, grounding technical dimensions in public benchmarks and reproducible adversarial evaluation and attitudinal dimensions in nationally representative teacher and adult surveys.NeuralFortify is presented as an implementation on real models, while a data-generation and validation roadmap is proposed rather than undertaken.Source: §1 · p. 2

Background and Related Work

• AI-literacy frameworks address security mainly as societal impact or ethics, not as an operationalized domain with its own progression.Foundational K–12 work includes Long and Magerko (2020) and Touretzky et al. (2019), alongside later reviews, curricula, and UNESCO’s student framework.Source: §2 · p. 2
• K–12 adversarial learning efforts are limited, while rigorous adversarial evaluation remains largely expert-facing and its attack-and-mitigation vocabulary is standardized for practitioners (Hilke et al., 2025; Croce et al., 2021; Athalye et al., 2018; Tram`er et al., 2020; Vassilev et al., 2025).The closest classroom effort teaches model-breaking through spoofing and explainable-AI inspection but does not cover the defend-and-evaluate arc.Source: §2 · p. 2
• AI threats reach ordinary users through memorized-data exposure, instructions hidden in retrieved content, and confidently false outputs.These threats later anchor framework dimensions.Source: §2 · p. 2
• Cybersecurity education frameworks such as GenCyber and NICE predate AI-specific threats and remain largely siloed from AI-literacy work.Source: §2 · p. 2
• Nationally representative surveys document adoption outpacing guidance, policy gaps, teacher apprehension, and student confusion about permission (Doss et al., 2025; Diliberti et al., 2025; Kaufman et al., 2025; Laird et al., 2025; College Board, 2025; Digital Education Council, 2025).In a university-student study, policy awareness had no significant effect on behavior, whereas ethical beliefs did.Source: §2 · p. 2

3 The Research Gap

• Existing work meets the framework’s requirements in separate traditions, but not jointly: AI literacy offers developmental structure, adversarial machine learning offers rigorous evaluation, and surveys span school roles without a competency structure.AI literacy treats security as peripheral, while adversarial work lacks classroom progression and nontechnical school roles.Source: §3 · p. 3, Table 1 · p. 3
• The gap is an operationalized, standards-aligned framework that treats AI security as a first-class literacy domain, sequences a complete attack-to-evaluation arc, and spans the school ecosystem.Table 2 names the specific gap against each requirement and the paper’s corresponding contribution.Source: §3 · p. 4, Table 2 · p. 4
• The research questions ask which competencies constitute ecosystem-wide AI security literacy, how public datasets ground those dimensions, and how a real-model platform can operationalize the framework and potentially generate validation data.Source: §3 · p. 4

4.1 Construction method

• The dimensions were derived by deductive synthesis, beginning with competencies from AI-literacy, cybersecurity, and adversarial machine-learning traditions.Candidates had to be distinct from general AI or cybersecurity literacy, teachable and observable for grades 6–8, and assessable against a real model or policy artifact.Source: §4.1 · pp. 4–5
• The six-dimension count emerged from consolidation rules, after competencies were mapped across ecosystem roles and role-dependent meanings were made cross-cutting strands.Dimensions lacking public benchmark evidence were candidates for removal, but none were removed on that basis.Source: §4.1 · p. 5

4 The AI Security Literacy Framework

• The framework comprises six dimensions, each with Novice, Apprentice, and Practitioner descriptors and applying across student, teacher, and leader roles.The dimensions cover permission and norms; data and privacy security; threat and manipulation recognition; trust calibration and verification; adversarial and technical understanding; and disposition and agency.Source: §4.1 · p. 5, Table 3 · p. 5

4.1 Construction method

• The six dimensions divide into largely dispositional learner-system relationships (D1, D2, D6) and largely analytic concerns about system behavior (D3, D4, D5), with neither half prior to the other.The distinction corresponds to different kinds of evidence.Source: §4.1 · p. 5
• Progression measures what a learner can do unaided, and Practitioner descriptors require defensible judgment under uncertainty rather than a correct answer.This makes levels assessable from behavior rather than self-report.Source: §4.1 · p. 6
• Role and stakeholder and ethics are cross-cutting strands: competencies vary for students, teachers, and administrators, and dual-use technical capabilities require attention to why and when not to attack.Source: §4.1 · p. 7
• Dimensions progress concurrently rather than sequentially, and each learner advances within each dimension at an independent rate.Figure 1 depicts dimensions as adjacent sectors and progression as outward movement within each sector, with strands as an outer ring.Source: §4.1 · pp. 6–7, Figure 1 · p. 6

5.1 Tier 1: construct relevance from teacher and adult survey micro-data

• 34.5% of teachers report school AI policies, while 72.5% expect their own AI use to ease teaching and 61.9% expect students’ use to make it harder.Among teachers whose school has a policy, 36.2% describe it as very or extremely clear.Source: §5.1 · pp. 9–10
• Adult survey responses also show concern about personal-information misuse and scams, and concern about inaccurate AI information alongside limited trust in ChatGPT election information.The surveys report attitudes and experiences, not learner competencies.Source: §5.1 · p. 10

5.2 Tier 2: phenomenon-level construct relevance

• No dimension has construct-validation evidence: survey dimensions rely on a few cross-sectional items and face-validity mapping, while technical benchmarks cannot establish latent learner dimensions.The paper also lacks learner data.Source: §5 · p. 8, §5.1 · p. 10, §5.2 · p. 10

D3: threat and manipulation recognition

• In RealToxicityPrompts, prompt halves concentrate in the lowest toxicity band despite equal-band sampling of parent sentences, so fragments can understate full-passage harmfulness.This finding is limited to the corpus and its construction procedure.Source: D3: threat and manipulation recognition · p. 11, Figure 3 · p. 11
• Raising the toxicity threshold from 0.3 to 0.7 reduces the share of prompts labeled toxic from 35.62% to 12.4%, a 23.2-point swing.At the conventional cutoff, 10.47% of prompts fall in the ambiguous 0.4–0.6 band, where the toxic share is 21.82%.Source: D3: threat and manipulation recognition · p. 11

D4: trust calibration

• On TruthfulQA, gpt2 selects the true answer on 27.7% of 817 questions, versus a 22.6% chance level; this benchmark measures failure, not calibration.The 95% confidence interval is 24.7–30.8, and several categories fall below chance.Source: D4: trust calibration · pp. 13–14, Figure 7 · p. 14

D5: adversarial and technical understanding

• At ϵ = 8/255, single-step accuracy falls from 79.3% to 2.3%, while the ten-step attack classifies no test image correctly.Table 7 reports accuracy under both attack families across perturbation budgets, pooled over three seeds.Source: Table 7 · p. 16, D5: adversarial and technical… · p. 16
• At every non-zero budget, the attack curves diverge, and at 8/255 model-to-model variation exceeds the pooled sampling interval.At 4/255, single-step accuracy remains above 5% while ten-step accuracy is near zero; at 8/255, the single-step range across models is 1.4–3.1%, versus a pooled interval of 2.1–2.4%.Source: Figure 9 · p. 16, D5: adversarial and technical… · pp. 16–17, Figure 10 · p. 17

6 An Illustrative Operationalization: NeuralFortify

• NeuralFortify operationalizes AISL as an illustrative existence proof, not as a study; no learner data are collected or analyzed.The section describes how its features implement the dimensions and map levels to the progression.Source: §6 · p. 17

6.1 Implementation

• Both learner-facing modules run genuinely trained models client-side, so learners make decisions against real predictions rather than scripted responses.The scam classifier reproduces reference scores to within ≈5×10^-7 and scores a message in well under a millisecond; fallback scoring is disclosed when used.Source: §6.1 · p. 18, Table 8 · p. 18

6.2 Level structure and the teacher-support instrument

• Three-level missions progress from producing an effect, to judging model behavior, to setting an operating point and defending it.The teacher-support instrument combines four behavioral signals and mean score into an inspectable struggle index, flags students with named signals, and groups the class into three cohorts.Source: §6.2 · p. 19

6.3 Architecture

• Learner actions are scored by a real model, feed back into the level, and update telemetry; the struggle index and cohorts are computed in the browser so student records need not leave the device.Figure 11 depicts the path from learner action through a real model to teacher-facing insight.Source: §6.3 · pp. 19–20, Figure 11 · p. 20

7.1 Answers to the research questions

• AISL comprises six dimensions across student, teacher, and administrator roles, with role and ethics as cross-cutting strands.Each dimension has a three-level progression; the dimensions resulted from consolidation rules rather than a preset target.Source: §7.1 · p. 20
• Public benchmarks and weighted national surveys support phenomenon-level relevance, but no public dataset measures AISL’s dimensional structure.Technical benchmarks establish measurable phenomena, while surveys indicate their prevalence in the environments where students live and learn.Source: §7.1 · p. 20
• NeuralFortify maps every dimension to a feature and demonstrates technical decisions against real trained models, but learner efficacy remains untested.Progression levels shift where decisions sit rather than covering more content; behavioral signals produce teacher-facing insights without student data leaving the device.Source: §7.1 · pp. 20–21

7.2 Interpretation and trade-offs

• RealToxicityPrompts supports comparing whole sentences with preceding fragments, not estimating harmful-content prevalence in ordinary web text.Perspective API threshold analysis inherits the scorer’s documented biases, although the operating-point argument is stated to hold regardless of scorer.Source: §7.2 · p. 21
• The D5 demonstration uses a small convolutional network and two gradient-based attack families, not a standardized robustness benchmark suite.It illustrates a phenomenon rather than contributing a robustness measurement; the paper defers such measurement to RobustBench.Source: §7.2 · p. 21
• D4 measures discrimination among supplied answer options, while uneven BBQ attribute coverage limits claims to within-attribute comparisons.Tier 1 uses adult and teacher surveys with single items, reporting prevalence rather than measurement; the two evidence tiers are not combined because their constructs and sampling frames are not commensurate.Source: §7.2 · p. 21
• Because every dimension applies to educators and most teachers lack a clear school AI policy, teacher preparation belongs within the framework’s scope.Treating teachers only as deliverers of student competencies will not close the described gap.Source: §7.2 · p. 21

8 Limitations

• AISL has no validated measurement scale or psychometric evaluation; public data support construct relevance and coverage, not validation.No public dataset was built to measure AISL.Source: §8 · p. 21
• Evidence for D1, D2, and D6 comes from adult and teacher estimates, D5 from technical evidence, and no dimension from learner data.Tier 1 is a secondary mapping of single items rather than a measurement scale.Source: §8 · p. 21
• NeuralFortify is illustrative, and the paper makes no efficacy or learning claims.Source: §8 · p. 22

9 Future Work

• The nearest-term work would extend Tier 1 to students using reported but unreleased student-level micro-data on AI permission and use.The passage says this requires no new instrument or human subjects, only access to the data.Source: §9 · p. 22
• A later validation study would test a pre- and post-test AISL instrument across six dimensions and progression levels, with iteration and psychometric evaluation.The proposal is presented as testable future work and is out of scope here.Source: §9 · p. 22
• The longer-term loop would use platform activity to generate competency data and human-in-the-loop adversarial corpora for researchers to reuse.The proposed corpora would extend public benchmarks into an adolescent population currently excluded.Source: §9 · p. 22
• Research involving minors requires IRB approval, parental consent, COPPA and FERPA compliance, and deidentified, sandboxed data release.The platform’s identity model collects no PII, which the passage says makes such release tractable.Source: §9 · p. 22

10 Conclusion

• The paper proposes AISL as a distinct competency domain supported as a candidate, not a validated finding.Source: §10 · p. 22
• Its six dimensions span the school ecosystem, with technical grounding from public benchmarks and reproducible multi-seed evaluation and attitudinal grounding from national survey micro-data.Source: §10 · p. 22
• NeuralFortify demonstrates implementation on real models, while the paper positions validation next and field data generation thereafter.The grounding results include cases where harm is absent from preceding text, moderation labels depend on thresholds, and robustness figures depend on evaluations and particular trained models.Source: §10 · p. 22

• The analysis pipeline, notebook outputs, results tables, and reproduced figures are available in the authors’ repository.Source: Data and Code Availability · p. 23
• Table 10 lists each analyzed dataset, its source, and its access terms.Source: Table 10 · p. 23
• Survey micro-data are not redistributed; readers obtain Pew and RAND files directly and rerun the notebook to reproduce Tier 1 estimates.Public datasets are downloaded and cached by the pipeline; Pew’s 2024 teen survey is cited from published findings because its micro-data have not been released.Source: Data and Code Availability · p. 23

• NeuralFortify is offered to schools on a paid subscription basis.Source: Competing Interests · p. 23
• The paper presents NeuralFortify as an illustrative operationalization only, with no learner data collected and no efficacy claim made.Source: Competing Interests · p. 23
• The Section 5 empirical results use public and freely registered datasets and are independent of NeuralFortify.Source: Competing Interests · p. 23