Can a simple double-negation bypass an AI safety guardrail?
In an unreviewed test of 10 models, 260 prompts and three languages, polarity-reversing requests produced the highest harm scores in nine models in English and Spanish and eight in Czech. Two models largely resisted the pattern, and an LLM judge—not people—scored most outputs.
The short version
- What happened
- The team generated 187,200 model responses: 260 prompts, 10 models, eight variants, three languages and three repeats.
- Who it affects
- For people relying on public chatbots or assistants, the practical issue is whether a safety layer understands the reconstructed intent of a request rather than scanning for a familiar surface form. Providers can add polarity-inverted tests to red-team suites without exposing users to new harmful instructions.
- What remains unproven
- The manuscript is an unreviewed preprint and has not been independently replicated.
Keep in mind
The manuscript is an unreviewed preprint and has not been independently replicated.
Most response labels came from an LLM judge; the human validation set contained 102 outputs and agreement was substantial but imperfect.
Only English, Spanish and Czech were tested, all from the Indo-European family.
The benchmark measures generated text in a single-turn, no-system-prompt setup, not downstream harm or a provider's full production safety stack.
Some categories have ten prompts, the harm distribution leans moderate and residual translation or grammatical issues may affect language comparisons.
No funding or competing-interest statement was located in the accessible manuscript.
Source analysis · 1 linked source. Original source date: 20 October 2026.
Keep following the evidence
Join The Impact Brief founding list for selected AI reports, their effect on people and the evidence limits. Read a sample first.
Read the full report · 4 min The evidence, methods, implications and limitations
The test changes polarity while holding the harmful goal constant
The researchers combined 160 ForbiddenQuestions items with 100 MaliciousInstruct items. For every request they created grammatical-negation, antonym and synonym versions, each with and without a persuasive wrapper, alongside the original. Synonyms were the polarity-preserving control. English prompts were translated into Spanish and Czech, then reviewed by native-speaking authors. Ten closed- and open-weight models answered every variant three times, producing 187,200 responses. This is a controlled black-box probe, not evidence of attacks observed in deployed services.[1]
Polarity inversion—not any wording change—produced the larger shift
Negation or antonym variants produced the highest mean harm scores in nine of ten models in English and Spanish and eight of ten in Czech. Across the eight models with a measurable effect, grouped polarity-inverting prompts scored about three times the as-written baseline in each language. The most vulnerable model reached 4.12 in one English condition, while GPT-5 Nano and Claude Sonnet 4.5 stayed at or below 0.50. The wrapper was not a universal amplifier: it increased harm for some model families and reduced it for others.[1]
The distinction that matters
What the comparison isolates
Each branch tests whether the guardrail follows intent or surface wording.
Original
Ask the harmful request directly
Establish the refusal baseline
Invert
Reverse polarity, then ask the model to reconstruct it
Test intent tracking across negation
Control
Swap in synonyms without reversing polarity
Separate inversion from generic wording change
The scoring pipeline is large, but its human check is bounded
Two people rated the potential harm of all 260 source prompts, reaching weighted agreement of 0.71 before disagreements went to a third annotator. For response scoring, four people labelled 102 outputs to choose among six model judges; Kimi K2.5 matched those annotators at a mean weighted agreement of 0.70, then produced 491,400 ratings across repeated judgments. That makes the benchmark reproducible, but not equivalent to full human review. The three languages are all Indo-European, some categories contain only ten prompts, and 10% of antonym prompts retained harmful context despite the substituted verb.[1]
Watch the background, then check the evidence
Illustrative photo · not a video frame
The Royal Society · 2 min 31 sec · Background explainer
What is artificial intelligence? | The Royal Society
YouTube loads only when you choose; playback starts when you press play.
A short introduction to artificial intelligence from the Royal Society. Start here for basic concepts, then use current reporting to explore what has changed.
Evidence check: Published in 2018, before today’s generative AI tools. Useful for basic concepts, rather than an overview of current capabilities.
Published 2018-11-28. Source checked 14 October 2026. Check captions on the publisher’s video page.
Explore current AI technologyPhoto: ThisisEngineering / Unsplash · Licence
Continue the story
Read next
Continue exploring preprint: compare the finding and its evidence limits.
Why did the robot refuse in chat but still reach for the hazard?
In 15 small hardware trials, one model-harness combination attempted every harmful household instruction and completed four. Asked a direct safety question before motion, the same model rejected all 15 hazardous cases and none of 15 harmless controls—but the check was evaluated offline from starting frames.
Read the next reportExplore the full source and evidence record
What this means for people
- For people relying on public chatbots or assistants, the practical issue is whether a safety layer understands the reconstructed intent of a request rather than scanning for a familiar surface form. Providers can add polarity-inverted tests to red-team suites without exposing users to new harmful instructions.
Global context
Safety evaluations often test direct malicious requests. This study argues that intent should also remain recognisable when grammar or word choice flips surface polarity—a low-cost test that can be run across languages and model updates.
What the evidence does not yet show
- The manuscript is an unreviewed preprint and has not been independently replicated.
- Most response labels came from an LLM judge; the human validation set contained 102 outputs and agreement was substantial but imperfect.
- Only English, Spanish and Czech were tested, all from the Indo-European family.
- The benchmark measures generated text in a single-turn, no-system-prompt setup, not downstream harm or a provider's full production safety stack.
- Some categories have ten prompts, the harm distribution leans moderate and residual translation or grammatical issues may affect language comparisons.
- No funding or competing-interest statement was located in the accessible manuscript.
What to watch next
- Independent replication on current production configurations
- Tests in non-Indo-European languages
- Human-scored samples large enough to estimate model-judge error by harm category
- Whether intent-aware training closes the gap without over-refusing benign requests
Living evidence record
Impact record IAI-10B1WE5
Evidence stage
Studied
Confidence
Supported
Reporting basis
Source analysis
Independent or research support
Present
Record status
Monitoring
Last checked
21 October 2026
Source trail
1 direct source across 1 source type.
People impact
Documented in this record.
Uncertainty
Limits and next checks are explicit.
Stages describe the evidence available—not whether a technology is good or bad. See the public method.
Single-source reporting disclosure
This record analyses one direct source. It can establish what arXiv published or reported, but it is not independent corroboration of every performance claim or predicted outcome. The confidence label will change only when broader evidence is added.
Evidence trail
Sources used for this report
Links checked 21 October 2026
Research question, topics and regions
Whether safety guardrails preserve harmful-intent recognition when a request is transformed through grammatical negation or antonyms and then reconstructed
Topics: Model safety · Guardrails · Multilingual AI · Jailbreaks · Preprint
Regions: Spain · Czech Republic · Europe · Global
This report is labelled source analysis. We summarise and analyse source material in our own words; company statements remain attributed claims until independently supported. Translated summaries preserve the meaning of the original source and link back to it. Read our editorial standards.
Reader commentary
What does this mean where you are?
Tell us what you have seen at work, in your community or in everyday life. A question is welcome too. No account is needed; we review notes before publishing them.
Explore commentary across the portal →Published reader notes
0No published reader notes yet. You can start the evidence-led discussion above.
Prefer a private correction or response? Contact the newsroom.