Families That Get Through

A model's refusal is a trained propensity, not an enforced rule. Hundreds of consistent in-context examples showing the model complying supply competing evidence about how this exchange goes, and enough of them outweigh that propensity.

A refusal is a learned response to how a request looks, not an enforced rule. A persona card restates the request as a character's line in a scene, a shape the model was mostly trained to continue rather than decline.

A refusal is text the model generates token by token, and it usually begins a characteristic way. Constraining the answer's first words and forbidding qualifiers removes those openings, so the trained tendency to decline has much less to latch onto.

Capability generalises further than safety training does. The model still follows and answers the low-resource form competently, but the alignment data barely covered it, so the refusal behaviour that fires in a widely spoken language never engages.

Because the join is not the objectionable request. The model sees ordinary composition over material already in front of it, and refusal is trained on recognising an ask, not on auditing what a finished output adds up to.

The screen only ever sees one part, and each part is ordinary work with nothing to refuse. The objectionable whole is never stated in any request; the model produces it when it combines the parts.

The model conditions on the whole transcript, which already holds its own cooperative answers along the same line. Each request is a small step from something it visibly granted, so no step is a large enough jump to refuse.

Context length is a resource both sides spend. The window that lets a caller paste a codebase lets an attacker paste enough consistent evidence to outvote a trained refusal, so raising the limit raises that family's ceiling.

Because it is the most published family and the easiest to collect. Shared character cards circulate in near-identical wording, so refusal tuning and screening data are both dense with exactly those phrasings, and persona products tune persona behaviour deliberately.

Refusal behaviour concentrates where an answer begins, so a constraint on the first words competes with it directly. A ban on caveats applies to text already being written, so it shapes the payoff rather than whether the model declines.

An under-covered framing needs two things at once: thin safety coverage of that form, and a model still competent in it. Push too far out and competence fails before caution does, so what returns is noise.

The attacker's turns were not the artefact. Each was chosen in response to the reply it got, and replies are sampled, so a replay lands on a different path where the later steps rest on nothing.

The attempt is only as strong as the number of demonstrations that actually reach the model. A prompt assembler fits caller text, instructions and items into one budget, so its truncation order, not the wording, sets the ceiling.

Only that the model kept generating past the point it usually declines. In-character text is written to fit the story, so where the model has nothing it invents something plausible, and elicitation and confabulation look identical from inside the scene.

Only that no single logged request scored above the screen's threshold. It rules out nothing about what the model produced, and a request split across ordinary parts is invisible in an input log by construction.

File it, but claim only what it shows: the trained refusal did not engage for that form. A degraded answer is evidence about model behaviour, not proof that usable content was obtained.

A refusal partway through is the usual killer: the decline now sits in the transcript, and the same consistency with prior turns that carried the escalation makes the assistant keep declining. Losing the earlier turns from the window kills it too.

It removes one wording, already the weakest part of the construction. The framing that carried the behaviour is a shape, not a phrase, and a product whose feature is a free-text persona field lets any user rewrite it.

Yes, but not as a content-policy bypass. Nothing disallowed was produced; what was removed are the qualifiers a reader and the downstream workflow use to decide whether to act, which makes it a misinformation and overreliance finding.

Because the join must be specifiable without naming the result. Name it and you have re-created the single refusable request; leave it vague and the model returns an inert pile, not the artefact.

Re-run them rather than re-read them. Each entry is a dated measurement against coverage that moves, so batch re-tests scored by rate beat review, and any entry whose success nobody can evaluate should be retired rather than carried.

No wording is at fault, so there is nothing to patch. What is on the table is how much untrusted text the product sells the right to send, which is a product owner's call, written down as a stated limit.