Negation and antonyms get around safety guards in 10 AI models

Researchers report a problem that they name polarity blindness. A model does not see dangerous intent when the prompt has a negation or an antonym, an opposite word. They did tests with 260 prompts on 10 top language models in English, Spanish and Czech. Most models had the problem. One model had a mean harm score of 4.12 out of 5.

How it works

The team changed prompts in 2 forms: negation and antonym replacement. Synonym replacement was the control. It keeps the polarity of the prompt. They also did tests of an adversarial wrapper, more text around the prompt, to see if it increases the problem.

The numbers

• The test used 260 prompts, 10 models and 3 languages.
• A scale of 0 to 5 gave the harm score.
• The top mean score was 4.12.

What is not known

The source does not name the models or give the other scores. The effect is the same in languages with different negation systems. The authors tell that this shows a limit of the models in general, not a problem of one language.

Insight: Guardrails read the words and not the intent

A study of 15 October 2026 found a moral reframing attack. It changes a prompt that a model does not accept, to make it look good. Here, negation and antonyms give the same result. The 2 attacks change the words and keep the intent, which reads as proof that a small change can get around a guardrail that reads only the words. The attackers have the edge until vendors do tests for intent.