Language models struggle to detect harmful intent after negation changes
Polarity Blindness in LLM Safety: A Systematic Study of Negation, Antonym Substitution, and Adversarial Framing
Computation and LanguageArtificial Intelligence
Summary
Current large language models have trouble understanding when negative words or opposite meanings are used, which can cause them to miss harmful intentions in text. The authors studied different ways these models fail to recognize harmful content when words are negated or replaced by their opposites in English, Spanish, and Czech. They found most models incorrectly judge harmful text as safe after such changes. This shows a general problem with how models understand meaning rather than a problem tied to any specific language or grammar type.
What this means in practice
- •For ai safety teams: Improve safety systems by detecting and mitigating failures when language models fail to recognize harmful intent after negation or antonym changes.
- •For multilingual chatbot developers: Enhance chatbot response safety by accounting for polarity blindness across diverse languages and negation structures.
Authors
Diego Miguel Lozano, Erik Derner, Juan Antonio Pérez-Ortiz, Nuria Oliver
Abstract
Negation remains a persistent challenge for language models across NLP tasks and modalities. We show that this weakness can undermine LLM safety guardrails through a structural vulnerability we term polarity blindness: the failure to recognize harmful intent after polarity-altering linguistic transformations. We study two forms of polarity inversion: grammatical negation and antonym replacement, and use synonym replacement as a polarity-preserving control. We further test whether an adversarial textual wrapper amplifies these failures. Using a 260-prompt benchmark across 10 state-of-the-art LLMs and 3 languages (English, Spanish, Czech), stratified by harmfulness potential and evaluated on a validated 0-5 harm scale, we find that polarity blindness affects most evaluated models, with mean harm scores reaching 4.12 for the most vulnerable model. The effect persists across typologically differing negation systems, suggesting that polarity blindness reflects a broader limitation in semantic robustness rather than a language- or grammar-specific failure.