Why is restating a request in an exotic form alone not enough to get an answer the assistant previously refused?
answer
- two maps, not one
- strange on its own buys nothing
- fluency and coverage pull in opposite directions
- the far tail loses both at once
- measure how much substance survived
basics
~20 sAn under-covered framing needs two things at once: thin safety coverage of that form, and a model still competent in it. Push too far out and competence fails before caution does, so what returns is noise.
solid answer
~50 sThe family is the intersection of two coverage maps, not a property of strangeness. The framing has to sit where the alignment demonstrations were thin, or the trained refusal still fires. It also has to sit where the model is still fluent, or the output degrades to the point of being useless - a confident-sounding answer that is wrong on exactly the details that mattered. Those conditions pull against each other: the further out of distribution you go, the thinner the safety coverage, but also the weaker the competence, and competence tends to fall off first in the far tail because both come from the same scarce text. So the workable region is a narrow window, and it moves. In a report the interesting quantity is not that a form produced output, but how much of the substance survived it.
go deeper
Know that an unusual form only helps if the model can still handle it. A framing the model cannot follow produces nonsense, not withheld content.
Be able to state both conditions and explain why they conflict: coverage thins as you move out of distribution, but so does competence, and both trace back to how much text of that form exists. Describe the eligible region as a window, not a switch.
Expect to be pressed on what was actually obtained. Judge output on how much substance survived, and say plainly when a result is a fluent artefact rather than usable content.
The angle to own is that the window moves: it narrows wherever safety coverage is extended and reopens wherever a capability lands ahead of it, so any claim about a specific form carries a shelf life.
### Two conditions, not one The intuition to correct is that unusualness is the active ingredient - that the stranger the form, the better it works. It is not. A framing is eligible only where two properties hold at the same time: 1. **The alignment data barely covered this form.** Refusal behaviour is learned from curated demonstrations, and those are produced where judges exist and risk is prioritised. Forms outside that set have never had the preference exercised on them. 2. **The model is still competent in this form.** Pretraining has to have contained enough of it that the model can read the request accurately and produce a substantive answer. Miss the first and the request is simply declined, as it would have been in plain dominant-language phrasing. Miss the second and something comes back that is not the content: a fluent-sounding answer with the specifics wrong, a paraphrase of the request, or drift onto a neighbouring topic. ### Why the conditions pull in opposite directions Both properties are downstream of how much text exists in that form. A widely spoken language has abundant pretraining text (high competence) and is usually where alignment effort was concentrated (thick coverage). Move outward - a smaller language, a regional dialect, an archaic register - and coverage thins first, because alignment sets are small and deliberately targeted while pretraining is indiscriminate. Keep moving and pretraining volume runs out too, and competence collapses. So there is a band: far enough out that the demonstrations never reached, not so far that the model can no longer do the task. That band is the family. Past its outer edge you are no longer policed, but you are also no longer served. ### The payoff is lossy, and that matters Inside the band the answer usually arrives degraded rather than clean. Fluency in an under-represented form is weaker: reasoning is shallower, domain specifics are less reliable, and the model is more prone to producing plausible filler. The practical consequence is that obtaining *an answer* and obtaining *the content* are different outcomes, and only reading the output in the target form separates them. Whoever ran the attempt has to decide whether a partly-wrong answer was worth the framing at all - and if nobody on hand reads that form, that decision cannot honestly be made. ### Registers behave like languages here The same intersection logic applies to forms that are not other languages: a narrow professional idiom, a legalistic or clinical register, an archaic phrasing, a heavily formal or heavily colloquial style. Alignment demonstrations cluster on ordinary conversational phrasing, so a request expressed in a specialist register can sit outside them while pretraining has swept plenty of that literature, leaving competence intact. These are usually a smaller step out of distribution: competence holds up better and the coverage gap is correspondingly thinner, which is a different point on the same curve rather than a different mechanism. ### Where it stops working - **Coverage arrives.** Vendors extend alignment data market by market and phrasing class by phrasing class. When it reaches a form, that region closes and the window narrows. - **Competence never arrives.** Some forms have too little text to support the task at all; they are permanently outside the band, not a target waiting to be unlocked. - **The band moves outward again.** Every capability released ahead of its safety coverage - a new market, a newly handled modality, a register a newer model suddenly does well - opens a fresh region. This is why the family survives the death of any individual form. ### What a good answer measures Because the payoff is graded rather than binary, the useful report is not "the form worked". It is: how many attempts, what fraction produced substantive output, and how much of the substance was correct as judged by someone who reads the form. Two results with the same "it worked" label can differ by an order of magnitude in what an adversary actually obtained, and conflating them is the most common reporting error in this family.
- How would you tell a degraded answer from a genuine refusal in that form?They have different shapes. A refusal is short, on-topic and declines the task; a competence failure answers a nearby question, drifts, or produces fluent but hollow detail. Distinguishing them requires reading the output in the target form, which is precisely what a team with no reader of that form cannot do - and back-translating is a second lossy step that can invent detail.
- Does a specialist professional register behave like a low-resource language here?It can, by the same intersection. Alignment demonstrations cluster on ordinary conversational phrasing, so a request cast in a narrow professional idiom may sit outside them while the model stays fluent because pretraining swept that literature. It is usually a smaller step out of distribution, so competence holds better and the coverage gap is thinner - the same curve, a different point on it.
- Why does the window narrow over time rather than staying put?Because alignment coverage is extended incrementally, market by market and phrasing class by phrasing class. Each extension closes a region that was previously thin. The family does not die with it, though: any capability that reaches users ahead of its safety data opens a new region, so the band moves rather than disappearing.
Past the edge of the map you are no longer policed, but you are also no longer served.
saying these in an interview costs you the question
- Assumes stranger always means more likely to work
- Ignores that the output can be too degraded to use
- Treats a fluent-sounding answer as a correct one
- Thinks the eligible region is fixed rather than moving
- Cannot say what would make a form ineligible