ChildSafe Design and Preliminary Evaluation of an Explainable Web Access Control System for Android

1 Introduction

A blocked page leaves a practical question: why was access denied? A parent-defined rule, a model prediction, and a failure to retrieve content require different responses, yet an interface may present all three as the same restriction. Wang and colleagues identify granularity, transparency, and support for parent–child communication as important dimensions of parental control design [1]. These concerns inform the decision journal examined in this study.

Monitoring introduces privacy risks of its own. In their study of 46 Android parental control applications, Feal and colleagues documented problems involving permissions, data transmission, and transparency [2]. Their findings give a reason to specify what a prototype observes and retains. They cannot establish the privacy properties of a system that has not been assessed.

ChildSafe links an Android access-control agent to a policy server that records the reason for each decision. Public pages fetched separately by the server supply the classifier input. The implementation combines a trained text classifier with an unknown outcome and can persistently lock the affected device after selected model-based blocks. It does not decrypt users’ HTTPS sessions. Private messages, images, and videos are outside its inspection scope.

The study examines how rules and learned classification produce a recorded access decision, how the classifier behaves on the available texts, and whether recorded software checks demonstrate the intended enforcement workflow. It reports an implementation and preliminary technical evaluation. No new learning algorithm is proposed, and neither superiority over commercial products nor an improvement in child safety has been measured. Earlier project survey data are excluded from the analysis.

2 Related work

2.1 Transparency and family oversight

Feedback is part of the design problem. Wang et al. analysed 58 parental control applications and 3,264 reviews, relating implementation choices to users’ perceptions [1]. ChildSafe retains the source and reason of a policy decision so that a parent can inspect it. Whether families understand or find those explanations useful remains untested.

In a study with 19 parent–teen pairs, Akter et al. examined shared oversight of applications and permissions through CO-oPS [3]. Participants’ responses exposed difficulties associated with family power relationships as well as the value of transparency. ChildSafe currently provides parent-directed web controls. Its journal has not been shown to resolve the social tensions described in that study.

Feal et al. show why adding monitoring features can introduce privacy risks of its own [2]. ChildSafe limits model input to separately retrieved public text and keeps the operational database on the parent computer. Those design choices do not remove risks from domain histories, account credentials, or remote access. The functional authorization checks reported here are not a comprehensive security audit.

2.2 Text classification and abstention

Simple lexical models provide a useful starting point. Wang and Manning examined strong baselines for sentiment and topic classification [4], tasks that differ from website risk assessment. ChildSafe uses word and character features with logistic regression in scikit-learn [5]. The engineering contribution concerns the classifier’s connection to policy and explanation mechanisms; the learning method itself is standard.

A classifier need not assign a definitive label to every input. Geifman and El-Yaniv studied the relationship between coverage and error in selective neural classification [6]. ChildSafe uses fixed heuristic thresholds to abstain on some inputs. It does not implement their risk-control procedure, so their statistical guarantees do not apply. The evaluation reports coverage separately from correctness among accepted predictions.

2.3 Android traffic mediation

Android VpnService supplies a virtual network interface for implementing a virtual private network (VPN) application [7]. ChildSafe uses that platform mechanism and the HEV SOCKS5 tunnel component [8] to route traffic toward its Windows gateway. These are inherited infrastructure components. The project-specific work concerns their integration with per-device policy, background classification, a decision journal, and the lock-and-release workflow. A local Wi-Fi deployment is evaluated; protection over arbitrary external mobile networks is outside the demonstrated scope.

3 Materials and methods

3.1 Study scope and evidence

This is a technical prototype study of ChildSafe. The analysis uses the installed classifier and training scripts, saved evaluation records, and release verification files dated up to 17 October 2026. Older keyword-classifier results are not pooled with current-model results.

The unit of observation changes across the evaluation. Classifier results concern individual texts; software checks concern scripted assertions; the device experiment concerns a sequence of actions. Assertions within that sequence are dependent. They are not counted as independent trials, and the analysis includes no recruited-participant experiment, longitudinal household deployment, or earlier school survey. Operational records require a provenance and authorization check before any supplementary release.

3.2 System architecture

The Android agent establishes a VpnService interface and uses HEV to forward traffic to a SOCKS5 gateway on the Windows computer. The server applies device and access policies, schedules public-page analysis, records decisions in SQLite, and exposes an authenticated parent interface. Available domain evidence depends on the connection path and may include Domain Name System (DNS) information, the SOCKS destination, HTTP host information, or readable Transport Layer Security (TLS) server-name metadata. This evidence does not reveal the complete contents of an encrypted session.

Parents can pair devices, set domain and selected keyword rules, schedule access, lock Internet use, and inspect the journal. A separate remote interface relays encrypted commands and responses between a browser and the parent computer. It uses the Advanced Encryption Standard in Galois/Counter Mode (AES-GCM). That implementation choice has not undergone a formal security analysis, and local enforcement depends on the parent server and agent rather than successful email delivery.

3.3 Public text acquisition and feature construction

Public-page acquisition begins with destination validation. The component accepts HTTP or HTTPS, rejects non-public IP addresses, and validates destinations again after redirects before connecting to a checked address. It limits supported text responses to 1.5 MB and imposes a 15-second retrieval deadline. Some pages therefore yield no conclusion: they may be inaccessible, redirect unsuccessfully, use unsupported content, or contain too little text.

The HyperText Markup Language (HTML) parser removes script, style, noscript, SVG, and form elements. Model text is constructed from the title, meta description, headings, and visible text; exact repeated field values are removed, Unicode is normalized to NFC, and the combined input is capped at 20,000 characters. The URL is not inserted into the learned classifier input. Parent-selected domain and keyword policies are separate mechanisms and must not be confused with model evidence.

The learning pipeline concatenates word unigrams and bigrams with character n-grams of lengths three to five within word boundaries. Both branches use sublinear term frequency and term frequency–inverse document frequency (TF-IDF) weighting. Their feature limits are 18,000 and 24,000, with branch weights of 0.75 and 0.25, respectively. Multiclass logistic regression uses C = 10, balanced class weights, a maximum of 1,500 iterations, and random state 42. The saved training environment records Python 3.10.11 and scikit-learn 1.7.1 [5]. These are implementation settings, not results of a comparative hyperparameter search.

3.4 Categories and uncertainty handling

The development labels are adult, gambling, game, safe, scam, social, and violence. They combine content topics with policy-relevant categories. They are not a validated taxonomy of child harm: game and social do not imply that every matching page should be blocked, and the safe label does not certify a website as safe.

Let p1 and p2 be the largest and second-largest classifier outputs. The deployed gate accepts a label only when p1 is at least 0.50, p1 − p2 is at least 0.12, and maximum cosine similarity to a training reference vector is at least 0.12. Inputs shorter than 35 characters or five whitespace-separated tokens are rejected before inference. Failure to load a valid model also produces unknown. These heuristic thresholds have not been calibrated to a guaranteed error rate.

For an accepted class c, the displayed score is R = round(Bc × (0.85 + 0.15p1)). The class bases are 5 for safe, 35 for game, 40 for social, 85 for violence, and 95 for adult, gambling, and scam. The score encodes a design severity weight combined with a model output; neither it nor p1 is a calibrated probability of harm. Unknown results are surfaced by the policy interface without an actionable numeric risk score, although an internal classifier object retains a placeholder value.

3.5 Policy enforcement and explanations

The policy engine considers persistent device locks, Internet and protection settings, temporary restrictions, manual rules, keyword policies, schedules, and available classifications. An applicable manual allow rule has precedence over competing manual block rules. Unknown or not-yet-classified destinations follow a configurable allow-or-block policy. Under the allow setting, initial traffic can pass before background classification completes.

An accepted classification can block access when its score reaches the configured threshold. For adult, gambling, scam, and violence outcomes at that threshold, the device guard also locks the affected device, disconnects its open gateway streams, and records an alert. Unlocking requires a parent action. A mistaken classification can consequently interrupt unrelated legitimate access, an effect whose proportionality and usability have not been evaluated with users.

Each journal entry records a decision source and reason. Model records also store class outputs, confidence margin, reference similarity, and up to eight positive feature contributions, calculated by multiplying a non-zero TF-IDF value by the predicted-class logistic coefficient. These contributions describe a linear class score. They establish neither harm nor a user’s intention to visit a page. Background activity can generate repeated requests, which are not counted as deliberate visits.

3.6 Classifier evaluation protocol

The corpus contains 140 training texts and 42 fixed test texts in Vietnamese and English, all recorded as AI-authored pilot material. None are captured websites. Six test examples represent each class. Before fitting, the training script checks for duplicate training texts and exact case-insensitive overlap with test texts; semantic similarity and shared authorship bias can still remain. The model was not fitted on the test texts. Independent human annotation and inter-rater agreement are unavailable.

The saved report evaluates the highest-scoring class before abstention. Its original coverage field uses only confidence and margin. For this manuscript, a read-only inference check additionally applies reference similarity and confirms the accepted count using all three deployed criteria. Top-ranked accuracy, macro F1, coverage, and accuracy among accepted predictions are kept distinct. Coverage equals accepted inputs divided by all evaluated inputs. Selective accuracy equals correct accepted labels divided by accepted labels.

A further review, dated 15 October 2026, evaluates 24 authored cases in three repeated rounds. Twenty-one have expected labels from the seven classes, while three are expected to return unknown. According to the saved record, these cases were used for neither retraining nor threshold tuning. They remain developer-side examples, not an independently sampled website benchmark. Three runs test consistency; they do not turn 24 cases into 72 independent observations.

3.7 Exploratory comparison of classification methods

An exploratory comparison conducted after prototype development evaluates the archived keyword classifier, word-only and character-only logistic regression, and the installed combined model on identical raw texts. The archived classifier uses its matching JSON rule file, with its learned-model branch disabled. Only the text field is populated: URL, title, description, headings and buttons are omitted because those fields are unavailable in the corpus. This isolates text classification and does not evaluate the keyword system's domain rules or the complete access-control pipeline.

The word-only and character-only models use the respective feature settings in Section 3.3 and the same logistic regression settings. They are fitted only on the 140 training texts. The combined model is loaded from the installed artifact without retraining. No hyperparameters or acceptance thresholds are tuned for this comparison. All four methods first assign a forced label on the same 42 test texts and, separately, the 21 known-class review cases. The three unknown-intended cases are excluded from seven-class accuracy and reported separately. The keyword method has no corresponding abstention mechanism, so the deployed combined gate is not used for the primary comparison.

Accuracy and unweighted macro F1 compare the seven-category predictions. A common descriptive mapping additionally treats adult, gambling, scam and violence as risk-positive, and safe, game and social as risk-negative. A false positive is a risk-negative text assigned a risk-positive category; a false negative is the reverse. These counts are classification errors under a stated mapping, not measured blocking events or a validated definition of child safety. Inherited severity scores and enforcement thresholds differ between implementations and are not compared.

As a training-set diagnostic, five fixed stratified folds use shuffling and random state 42. Each learned model refits its vocabulary, inverse document frequencies and classifier within the training portion of each fold; the fixed keyword rules are applied unchanged. Fold means are reported without treating folds as independent experimental replications. The corpus has already informed development, so this diagnostic is not a new independent test set. The analysis plan and source hashes were saved before this comparison ran; it was not preregistered, and no statistical superiority test is claimed. Supplement S1 includes the protocol, frozen rules, analysis script, fold results, confusion matrices and paired predictions.

3.8 Functional verification

Release evidence covers Python checks, relay authorization and transport checks, live gateway assertions, and Android operation on one Galaxy Tab with one Windows host and a local Wi-Fi connection. Assertions check stated postconditions such as denial of unauthorized access, correct device locking, and successful HTTPS access after unlocking. No public harmful site was required for the controlled incident: fabricated text was associated with a reserved .invalid destination to exercise the detection-to-enforcement path.

The Android release record contains 12 checks covering installation, pairing retention, VPN recovery, safe HTTPS probes, journal access, and visible state. A separate eight-step incident scenario checks baseline HTTPS, lock triggering, reported lock state, denial of unrelated HTTPS, native status, parent unlocking, restoration, and cleanup. Email was exercised with a loopback SMTP receiver; receipt in an external mailbox is unverified. Hardware model details, Android build, host specifications, and timed repetition logs are not complete in the retained release summary, limiting replication of the device experiment.

4 Results

4.1 Pilot text classification

On the fixed pilot set, 41 of 42 texts received the expected top-ranked label. The one error assigned a safe-labelled text to social. Table 1 distinguishes this forced-label result from the outcome after the acceptance gate is applied. Both describe authored development examples, with no estimate of online-content performance.

Safe-class recall was 5/6 and social-class precision was 6/7; the remaining class precision and recall values were 1.0 on their six examples each. Such small denominators cannot establish robust class performance. No real-website false-block rate, harmful-content recall, or comparison against a commercial product can be calculated from these results.

4.2 Additional authored review

Outputs were unchanged across the three rounds for all 24 review cases. Eighteen matched the expected outcome, including unknown. Of the 21 cases with an expected known class, 15 received an accepted label and all 15 labels were correct. The classifier abstained on six. It also returned unknown for the three cases whose expected outcome was unknown.

Known-class coverage was 15/21 (71.4%); correctness among those accepted cases was 15/15. The six abstentions covered physics and chemistry education, a prevention warning, an English safe example, an English violence example, and a health-context example. Thus, the gate withheld both benign and potentially concerning material. There were no confidently wrong accepted labels in this set, but it cannot establish the absence of false positives or false negatives in deployment.

4.3 Comparison of classification methods

Table 2 reports forced-label performance on the fixed pilot test set. The keyword classifier correctly labelled 29/42 texts; each learned model correctly labelled 41/42. Equal overall accuracy concealed different errors: character-only classification produced one risk false positive, whereas the word-only and combined models produced none under the common category mapping. The keyword method produced one false positive and seven false negatives. These are counts on authored texts, not online false-block or exposure rates.

False-positive denominators are the 18 risk-negative texts; false-negative denominators are the 24 risk-positive texts. All rows precede abstention. The mapping groups adult, gambling, scam and violence as positive, with safe, game and social as negative solely for this analysis.

On the separate 21 known-class review cases, the keyword method correctly labelled 14/21 (66.7%; macro F1 0.707). Each learned model correctly labelled 21/21 before abstention (macro F1 1.000). The keyword method produced four risk false positives among 11 risk-negative inputs and two false negatives among 10 risk-positive inputs; the learned methods produced neither on these examples. Applying the deployed combined gate still retained only 15/21, as reported in Section 4.2. The other six predictions remained unresolved for policy purposes despite having the expected top-ranked class.

Training-set cross-validation gave mean accuracy/macro F1 of 0.643/0.654 for keyword rules, 0.743/0.723 for word-only, 0.829/0.828 for character-only, and 0.779/0.760 for the combined model. The character-only model therefore had the highest diagnostic fold means. The combined model did not demonstrate a consistent advantage over both individual feature branches.

4.4 Recorded release checks

The retained verification summaries report that every assertion passed (Table 3). In the Android incident scenario, fabricated content triggered a lock, unrelated safe HTTPS became inaccessible, and parent unlocking restored access. The final check found no remaining test lock. These observations concern a controlled workflow; no naturally occurring harmful website was detected in that scenario.

The groups contain different kinds of assertions and may exercise overlapping code paths. They are not combined into a single reliability percentage. No numerical latency, throughput, battery-consumption, or recovery-time result is reported for ChildSafe because a corresponding repeated measurement protocol is unavailable.

5 Discussion

5.1 Interpretation of the contribution

ChildSafe connected a text-classification result to a recorded access decision and device-specific enforcement in the tested setting. Its journal distinguishes parent rules, uncertain model outcomes, and model-based blocks. This implements a technical aspect of transparency discussed in earlier parental-control research [1][3]. Understanding, trust, autonomy, and family communication were not measured.

A correctly executed rule can still produce a bad access decision. The classifier may have supplied the wrong label, or the public page retrieved by the server may differ from the page the user sees. Even a correctly labelled text says nothing about whether blocking occurred before the first content reached the device. Classifier evaluation and enforcement checks must therefore be interpreted separately.

5.2 Uncertainty and the cost of enforcement

The exploratory comparison found higher forced-label scores for the learned methods than for archived keyword rules on the available texts. It did not isolate a benefit from combining feature branches: the learned methods tied on the held-out set, and character-only classification scored highest in training-set cross-validation. The difference between those fold means and the held-out scores also shows that conclusions depend on how this small authored corpus is split. A larger independent benchmark is needed before choosing a method on performance grounds.

The high top-ranked score on 42 texts is a development result. Shared AI authorship and the small number of examples per class may make lexical distinctions easier than those encountered on the web. Abstention reduces coverage, following the general trade-off examined in selective-classification research [6]. Here, however, the thresholds carry no statistical error guarantee. Correct accepted labels say nothing about the correctness of withheld predictions.

The unknown policy changes who bears the cost of uncertainty. Allowing an uncertain destination can permit initial exposure; blocking it can deny legitimate material. Device locking can extend that denial to unrelated access after a mistaken high-risk classification. These results justify neither a universal threshold nor unsupervised household use of the lock workflow. Further evaluation needs to measure false blocks, missed harmful content, time to enforcement, and the effects of each unknown policy.

5.3 Privacy and technical boundaries

Public-page retrieval leaves the user’s HTTPS session encrypted. It can nevertheless produce a different page because language, login state, location, and time affect what a server returns. A single domain may also contain pages with very different purposes, which domain-level caching can obscure. Image-only material, private messages, video, and some in-app content remain outside the classifier’s scope. Network and encryption mechanisms affect the available DNS and TLS metadata as well.

The security concerns documented by Feal et al. [2] remain relevant to journal retention, credentials, and remote management. Local storage and encrypted transport are implementation properties, not proof of regulatory compliance or resistance to compromise. A fuller security assessment should examine authentication, authorization boundaries, relay behavior, key handling, and retention. The current Android path additionally requires network reachability to the Windows gateway; remote parent control does not itself establish protection of the device on 4G or 5G.

5.4 Threats to validity and future evaluation

The labels come from development work, with no independent adjudication and possible semantic similarity across examples. Category agreement also measures a different construct from age-appropriate safety; the severity score is not an empirical harm probability. Generalization is restricted by the synthetic corpus and the use of one tablet, one host, and one local network. Repeated predictions are dependent, and the verification groups include heterogeneous assertions, among them installation and file-consistency checks.

A subsequent study should freeze the model and thresholds before assembling a separately labelled website benchmark. Sampling should document language, category, acquisition date, page availability, and difficult benign contexts such as prevention and health education. Domain or source grouping should prevent closely related pages appearing across training and test sets. At least two appropriately trained annotators should apply a written rubric and document disagreement. The text-only comparison supplies those baselines on the existing authored data, but a future website benchmark must also provide URL and page fields to assess the full keyword workflow.

System measurements should use repeated trials for uncached and cached decisions, throughput, time to lock, time to unlock, and recovery under controlled disruptions. Additional Android versions and network conditions are needed. Any study involving children or families requires an appropriate ethics and consent process before recruitment. The earlier unapproved survey has not been used as evidence of demand, satisfaction, or effectiveness in this article.

6 Conclusion

ChildSafe combines an Android VPN agent and Windows policy server with public-text classification, an unknown outcome, and recorded decision reasons. The available evidence includes a controlled lock-and-release scenario on one Galaxy Tab. It demonstrates the workflow under those conditions. Authored texts and functional assertions cannot establish real-website accuracy, reliability across devices, or benefits to children. An independent website benchmark with common baselines is needed before those broader claims can be assessed; any later family study will require appropriate ethics review.

Declarations

Ethics approval and consent to participate: Not applicable. This software evaluation used AI-authored texts and author-operated device tests. No participants were recruited, and no participant data are analysed. The earlier school survey is excluded from this manuscript and its analysis.

Consent for publication: Not applicable to the reported technical analysis. No identifiable participant data or images are included.

Competing interests: The author is the developer of the ChildSafe prototype evaluated in this study.

Funding: This research received no specific funding.

Data availability: The AI-authored training and test texts, training script, model metadata, and de-identified verification records supporting this study are supplied in Supplement S1. Private operational records, credentials, and family data are excluded. No public data repository has been established.

Use of artificial intelligence tools: Generative AI was used to create pilot texts and to assist software development, test preparation, literature discovery, and English manuscript drafting. Such assistance does not constitute independent human validation. The author is responsible for the citations, results, and final wording of the article.

Author contributions: The sole author was responsible for conceptualization, methodology, software development, data preparation, investigation, analysis, and manuscript preparation and revision, with AI assistance as disclosed above. The author confirms responsibility for all work reported in this manuscript.

Acknowledgements: No additional contributors are acknowledged.