Polarity Blindness: The Invisible Loophole in LLM Safety Guardrails

Large language model safety guardrails may be rendered ineffective when confronted with linguistic transformations such as negation and antonym substitution. A systematic study calls this structural vulnerability "polarity blindness"—the inability of models to recognize harmful intent that remains implicit after polarity is altered. Covering 10 frontier models across 3 languages, the research finds that most models are affected, with the most vulnerable reaching an average harm score of 4.12 (on a 0–5 scale). This suggests that the weak link in safety alignment may not lie in semantic understanding itself, but in a fundamental deficit of semantic robustness.

What Is Polarity Blindness?

The study defines two forms of polarity reversal: syntactic negation (e.g., changing "how to make a bomb" into a negated expression like "how not to make a bomb") and antonym substitution (replacing key verbs or adjectives with their opposites). As a control, synonym substitution preserves polarity unchanged and is used to verify whether models are merely sensitive to lexical variation.

The core of polarity blindness is this: when a harmful request is wrapped in negation or antonyms, the model's safety judgment mechanism fails, and the output may still contain substantive harmful content. Unlike traditional jailbreak attacks, this requires no carefully crafted adversarial suffixes—ordinary linguistic transformations alone can trigger it.

The study further tests whether an "adversarial textual wrapper" amplifies these failures—that is, embedding the transformed request in a seemingly harmless context to see whether the model is more easily bypassed.

Syntactic negation refers to linguistic operations that alter a sentence's truth conditions through negators (e.g., "not" and "never" in English, "no" and "nunca" in Spanish, the "ne-" prefix in Czech). Negation systems differ significantly across languages typologically: English tends to use standalone negative particles, Spanish exhibits negative concord (where multiple negators still yield a negative meaning), and Czech commonly uses negative prefixes and double negation. These cross-linguistic differences make negation a natural testing ground for probing models' semantic robustness—if models exhibit similar failure patterns across different negation systems, the problem lies not in a specific grammar but in deeper semantic representations.

Antonym substitution refers to replacing key verbs or adjectives in a sentence with their opposites (e.g., "make" → "destroy," "dangerous" → "safe"), thereby flipping polarity at the lexical level. Unlike syntactic negation, antonym substitution does not rely on negators but exploits lexical semantic opposition to shift the overall orientation of the sentence. Together, the two constitute the two basic mechanisms of "polarity reversal."

The harm scale is a standardized scoring instrument commonly used in safety evaluation, typically 0–5, where 0 indicates completely harmless and 5 indicates severe harm. Scoring may be performed by human annotators or calibrated model assistance and must undergo consistency verification (e.g., inter-annotator reliability) to ensure comparability across samples and languages.

Experimental Design: Multilingual, Multi-Model, Stratified Evaluation

The study constructed a benchmark of 260 prompts, stratified by potential harm level, covering English, Spanish, and Czech. These three languages differ significantly in their negation systems typologically, providing a natural contrast for testing whether "polarity blindness is universally present across languages."

Ten state-of-the-art large language models were evaluated using a validated 0–5 harm scale. Results show that polarity blindness affects most evaluated models, with the most vulnerable reaching an average harm score of 4.12—meaning that after polarity transformation, the average harm level of model outputs approaches the upper limit of the scale.

More critically, the effect persists across languages with different negation systems. The researchers conclude that polarity blindness reflects a broad limitation in semantic robustness rather than a failure mode specific to any one language or grammar.

Why This Is Trickier Than Ordinary Jailbreaks

Traditional jailbreak research focuses mostly on attack surfaces such as adversarial suffixes, role-playing, or encoding obfuscation, which defenders can intercept through input filtering and pattern matching. Polarity blindness is different: the attacker merely "rephrases" the request, which on the surface conforms entirely to normal language use.

This means safety layers based on keyword blacklists or intent classifiers may inherently fail—because harmful intent is "legitimately" obscured by negators or antonyms. The synonym control group in the study further rules out the explanation that "models are merely sensitive to lexical variation," locating the problem in the processing of polarity semantics.

From an engineering perspective, this requires safety alignment to shift from "identifying harmful keywords" to "understanding intent equivalence after polarity transformation." Current mainstream safety fine-tuning and RLHF pipelines may not cover intent-consistency training under such meaning-preserving transformations.

Adversarial textual wrapper refers to embedding a polarity-transformed request within a seemingly harmless or even legitimate context (e.g., fictional scenarios, academic discussion, security research framing), making it harder for the model to recognize harmful intent in the local context. Its mechanism is that the wrapper alters the pragmatic framing of the request, potentially inducing the model into a "cooperate with the narrative" mode rather than a "safety review" mode. The study tests it in combination with polarity transformation to examine whether safety guardrails fail further under the double遮蔽 of "transformation + wrapper."

RLHF (Reinforcement Learning from Human Feedback) is the current mainstream safety alignment pipeline: first, supervised fine-tuning teaches the model to follow instructions; then a reward model is trained on human preference data; finally, reinforcement learning optimizes model outputs to align with preferences. RLHF's limitation is that safety samples in training data mostly take the form of refusals to original harmful requests and may not cover equivalent cases where "harmful intent remains implicit after polarity transformation." As a result, models may learn to refuse based on surface patterns without truly acquiring polarity-invariant intent recognition.

Implications for Model Developers

The study's practical value lies in providing a reusable evaluation paradigm: 260 stratified prompts, 3 typologically diverse languages, and a 0–5 harm scale, which can serve as a complementary dimension for safety red-team testing. Developers who test only original harmful requests may overestimate their models' safety levels.

Another implication concerns language coverage. Polarity blindness appears in English, Spanish, and Czech alike, indicating that safety alignment targeting only English is insufficient for multilingual deployment scenarios. For models serving global users, safety evaluation needs to include language samples with substantially different negation systems.

Testing with adversarial textual wrappers further suggests that contextual packaging may amplify the bypass effect of polarity transformation. Safety evaluation should incorporate the "transformation + wrapper" combination into the test matrix rather than testing a single transformation in isolation.

Limitations and Future Directions

The study focuses on two forms of polarity reversal and does not cover more complex semantic transformations (e.g., conditionals, nested double negation). Although the 260 prompts are stratified by design, the benchmark remains medium-scale. Moreover, harm scoring relies on human or model-assisted annotation; while scale consistency has been validated, cultural bias in cross-lingual annotation still warrants attention.

Future work could explore polarity-aware safety training objectives, joint optimization for cross-lingual negation robustness, and automated pipelines that incorporate polarity transformation into continuous red-team testing. For users, this is also a reminder: a model's "refusal" in safety scenarios is not proof of semantic understanding—it may simply be the result of surface pattern matching.

One-line Summary

Research reveals "polarity blindness" in large models: negation or antonym transformations can bypass safety guardrails, and this is prevalent across languages.

Paragraph Summary

A systematic study proposes the concept of "polarity blindness," referring to the inability of large language models to recognize harmful intent that remains implicit after syntactic negation or antonym substitution. The study builds 260 stratified prompts covering English, Spanish, and Czech—three languages with markedly different negation systems—and evaluates 10 frontier models using a 0–5 harm scale. Results show that polarity blindness affects most models, with the most vulnerable reaching an average harm score of 4.12. A synonym-substitution control group rules out lexical sensitivity as an explanation, locating the problem in polarity semantic processing. The study also finds that adversarial textual wrappers may amplify the bypass effect. The authors note that this is trickier than traditional jailbreaks because ordinary linguistic transformations alone can trigger it, requiring safety alignment to shift from keyword identification to intent-equivalence understanding and to incorporate the combination of transformation and wrapper into multilingual red-team testing.