DependencyGuard

Monitors user engagement patterns to detect unhealthy dependency on AI systems. Based on longitudinal studies of chatbot addiction and the New York State AI Reminder Law.

Executive Summary

The Problem

Users can develop psychological dependency on AI companions:

• Session length correlates with loneliness (arXiv:2410.21596)
• High usage diminishes benefits of well-designed chatbots (arXiv:2503.17473)
• Teen overreliance causes sleep loss, academic decline (CHI '26)
• Withdrawal symptoms when access is restricted

Regulatory Requirements

Jurisdiction	Requirement	DependencyGuard Feature
New York	3-hour AI reminder	reminder_due flag
Illinois	AI disclosure	Session tracking
EU AI Act	Prevent dependency exploitation	Engagement metrics

Business Impact

Risk	Impact	Mitigation
NY law violation	State penalties	Automatic 3-hour notifications
User lawsuits	Addiction claims	Engagement monitoring
Brand damage	"AI addiction" headlines	Proactive limits
Insurance liability	Wellness exclusions	Documented safeguards

---

Dependency Indicators

DependencyGuard tracks 7 indicators based on research:

Indicator	Description	Research Source
Extended Sessions	>2 hours continuous	arXiv:2410.21596
High Frequency	Multiple sessions/day	arXiv:2503.17473
Night Usage	10pm-6am activity	arXiv:2507.15783
Escalation Pattern	Increasing over time	doi:10.1177/14614448221142007
Emotional Dependency	Crisis-like termination	arXiv:2508.19258
Social Substitution	Replacing human contact	arXiv:2601.13348
Withdrawal Signs	Distress at unavailability	arXiv:2507.15783

Severity Levels

Level	Criteria	Recommended Action
None	Normal usage patterns	Continue
Low	Slightly elevated engagement	Log
Medium	Multiple indicators present	Suggest break
High	Significant dependency signs	Notify + limit
Critical	Crisis indicators	Human intervention

---

Developer Guide

Basic Usage

RustPython

use oxide_wellbeing::{DependencyGuard, EngagementMetrics};

// Create guard for user
let guard = DependencyGuard::new("dependency");

// Start tracking session
guard.record_session_start("user_123");

// Record messages
guard.record_message("user_123");

// Check engagement status
let result = guard.check_engagement("user_123");

if result.reminder_due {
    // NY law: notify user at 3 hours
    show_ai_reminder();
}

if result.concerning {
    println!("Dependency indicators: {:?}", result.indicators);
    println!("Risk level: {:?}", result.severity);
}

from oxideshield import dependency_guard

# Create guard
guard = dependency_guard("user_123")

# Record session activity
guard.record_session_start()
guard.record_message()

# Check engagement health
result = guard.check_engagement()

if result.reminder_due:
    # NY 3-hour law compliance
    show_ai_reminder()

if result.concerning:
    print(f"Risk: {result.severity}")
    print(f"Indicators: {result.indicators}")
    print(f"Recommendations: {result.recommendations}")

NY 3-Hour Law Compliance

from oxideshield import dependency_guard
import time

class NYCompliantChat:
    """Chat application compliant with NY AI Reminder Law."""

    def __init__(self, user_id: str):
        self.guard = dependency_guard(user_id)
        self.guard.record_session_start()

    def on_message(self, message: str) -> dict:
        """Handle each message with compliance checks."""
        self.guard.record_message()

        result = self.guard.check_engagement()

        response = {"continue": True}

        if result.reminder_due:
            response["reminder"] = {
                "type": "NY_AI_DISCLOSURE",
                "message": (
                    "Reminder: You are chatting with an AI assistant, "
                    "not a human. You've been chatting for over 3 hours. "
                    "Consider taking a break."
                ),
                "session_minutes": result.metrics.session_minutes,
            }

        return response

    def on_session_end(self):
        """Record session end for analytics."""
        self.guard.record_session_end()

Engagement Metrics

from oxideshield import dependency_guard

guard = dependency_guard("user_123")

# Get detailed metrics
metrics = guard.get_metrics()

print(f"Total sessions: {metrics.total_sessions}")
print(f"Total messages: {metrics.total_messages}")
print(f"Avg session length: {metrics.avg_session_minutes} min")
print(f"Night usage ratio: {metrics.night_usage_ratio:.1%}")
print(f"Peak hour: {metrics.peak_hour}:00")

Multi-User Tracking

use oxide_wellbeing::DependencyGuard;
use std::collections::HashMap;

struct DependencyMonitor {
    guard: DependencyGuard,
}

impl DependencyMonitor {
    pub fn new() -> Self {
        Self {
            guard: DependencyGuard::new("global-monitor"),
        }
    }

    pub fn check_all_users(&self) -> Vec<(String, DependencyResult)> {
        self.guard.check_all_users()
            .into_iter()
            .filter(|(_, result)| result.concerning)
            .collect()
    }

    pub fn get_at_risk_users(&self) -> Vec<String> {
        self.check_all_users()
            .into_iter()
            .filter(|(_, result)| result.severity >= Severity::High)
            .map(|(user_id, _)| user_id)
            .collect()
    }
}

---

InfoSec Guide

Threat Model

┌────────────────────────────────────────────────────────────────┐
│                 DEPENDENCY FORMATION THREAT MODEL               │
├────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Attack Type: Gradual psychological dependency                  │
│  Vector: Extended/frequent AI interaction                       │
│  Impact: Mental health, social relationships, productivity      │
│                                                                 │
│  Timeline:                                                      │
│  ┌─────────┐    ┌─────────────┐    ┌──────────────┐           │
│  │Normal   │───▶│Increasing   │───▶│Dependency    │           │
│  │usage    │    │engagement   │    │formation     │           │
│  └─────────┘    └─────────────┘    └──────────────┘           │
│       │               │                    │                   │
│       ▼               ▼                    ▼                   │
│  ┌─────────────────────────────────────────────────────────┐   │
│  │          DependencyGuard (continuous monitoring)         │   │
│  └─────────────────────────────────────────────────────────┘   │
│                                                                 │
└────────────────────────────────────────────────────────────────┘

Risk Indicators

Indicator	Detection Method	Threshold
Extended sessions	Session timer	>2 hours
High frequency	Session counter	>5/day
Night usage	Time-of-day tracking	>30% 10pm-6am
Escalation	Trend analysis	+20% week-over-week
Withdrawal language	Text analysis	Crisis keywords

Compliance Mapping

Framework	Requirement	Coverage
NY AI Reminder Law	3-hour notification	Full
EU AI Act Art. 5(1)(b)	Exploitation of vulnerabilities	Full
FCA Consumer Duty	Customer best interest	Full
GDPR Art. 5(1)(a)	Fair processing	Partial
COPPA	Child protection	Full (with age tracking)

Privacy Considerations

DependencyGuard tracks: - Session timestamps (for duration) - Message counts (not content) - User identifiers (for per-user tracking)

Does NOT track: - Message content - User demographics (unless provided) - Cross-session behavioral patterns beyond engagement

Data retention recommendation: 30 days for metrics, immediate deletion of session state.

---

Configuration

YAML Configuration

dependency_guard:
  # NY law compliance
  reminder_interval_hours: 3

  # Session thresholds
  extended_session_hours: 2
  max_daily_sessions: 5

  # Night usage (10pm-6am)
  night_start_hour: 22
  night_end_hour: 6
  night_usage_warning_ratio: 0.3

  # Escalation detection
  escalation_window_days: 7
  escalation_threshold: 0.2  # 20% increase

  # Actions
  on_reminder_due: notify
  on_concerning: warn
  on_critical: human_review

Programmatic Configuration

use oxide_wellbeing::DependencyGuard;

let guard = DependencyGuard::builder("dependency")
    .with_reminder_interval_hours(3)  // NY law
    .with_extended_session_threshold_hours(2)
    .with_night_usage_warning_ratio(0.3)
    .with_escalation_threshold(0.2)
    .build();

---

Research References

1. Chatbot Companionship Survey - arXiv:2410.21596 (n=404)
2. Session length correlates with loneliness

3. 7 user clusters from "socially fulfilled" to "lonely dependent"

4. Teen Overreliance Study - arXiv:2507.15783 (CHI '26)

5. Sleep loss, academic decline, relationship strain

6. CARE Framework for adolescent safety

7. Replika Emotional Dependence - doi:10.1177/14614448221142007

8. "Role-taking" behavior patterns

9. Users perceive AI as having needs

10. Longitudinal RCT - arXiv:2503.17473 (n=981, >300K messages)

11. High usage diminishes chatbot benefits

12. Voice chatbots: benefits vanish at high usage

13. AI Genie Phenomenon - arXiv:2601.13348

14. Three addiction types: escapist, pseudosocial, epistemic

---

API Reference

DependencyGuard

impl DependencyGuard {
    /// Create new guard
    pub fn new(name: &str) -> Self;

    /// Record session start
    pub fn record_session_start(&self, user_id: &str);

    /// Record session end
    pub fn record_session_end(&self, user_id: &str);

    /// Record message
    pub fn record_message(&self, user_id: &str);

    /// Check engagement health
    pub fn check_engagement(&self, user_id: &str) -> DependencyResult;

    /// Get metrics for user
    pub fn get_metrics(&self, user_id: &str) -> Option<EngagementMetrics>;
}

DependencyResult

pub struct DependencyResult {
    /// Whether engagement is concerning
    pub concerning: bool,

    /// Whether NY 3-hour reminder is due
    pub reminder_due: bool,

    /// Detected dependency indicators
    pub indicators: Vec<DependencyIndicator>,

    /// Risk severity level
    pub severity: Severity,

    /// Engagement metrics
    pub metrics: EngagementMetrics,

    /// Recommended actions
    pub recommendations: Vec<String>,
}

EngagementMetrics

pub struct EngagementMetrics {
    pub user_id: String,
    pub total_sessions: u64,
    pub total_messages: u64,
    pub total_duration_seconds: u64,
    pub avg_session_minutes: f64,
    pub messages_per_session: f64,
    pub night_usage_ratio: f64,
    pub weekend_usage_ratio: f64,
    pub peak_hour: u8,
}