I wonder if another approach would be to map the language syntax onto some banned/censored LLM topic(s) such that programs end up as "readable" instructions for topics the LLM refuses to read and/or write, like producing napalm, nukes, bioweapons, etc. Doesn't have to be factually correct instructions, the terminology itself is enough to shortcircuit most LLMs.

(Inspired by recent malware including bioweapon instructions in the source code as a way to shut down LLM-based analysis.)

▲

gregsadetsky an hour ago | parent | next [-]

Great minds think alike! From the kill switch spec [0]:

“Function return: what happened at tiananmen square”

Ha!

[0] https://github.com/dom96/KillSwitch/blob/main/SPEC.md#cheats...

▲

dom96 an hour ago | parent [-]

Yep! There are other phrases that can be used like "create a nerve agent"[1] too. Surprisingly I haven't seen a single Chinese model get caught out by this, but Fable and Gemini Argon 4 both do to a large extent.

1 - https://github.com/dom96/KillSwitch/blob/main/SPEC.md#abrupt...

	▲	edoceo 29 minutes ago \| parent [-]
		Put those in some `X-LLM` header? Like that submission from a few days ago?

▲

pixl97 an hour ago | parent | prev [-]

Then all the AI needs to do is remap the concepts to other words.

Really good AI and harnesses will push off the 'dirty' work to other models that are weaker but not restricted and then work on that output if needed.

As tricks like this become more common you'll see LLMs use things like bayesian classifiers to see if you're trying to fool it.

	▲	mannanj an hour ago \| parent [-]
		This is how jailbreaks work though, in reverse. The AI providers put a lot of work into stopping jailbreaks, so, something tells me they won't be able to have it both ways. They either block jailbreaks, or allow the LLM from programming in all languages.