We do a similar thing to mark documents that are still under embargo and one day I forgot to remove the watermark. The customer complained they had not received the document (a day or two after I sent it), and much searching was done. Finally we found a line in an outlook log on their end that said that the watermark was the reason the file had been put in indefinite quarantine until someone would take a look at it.
That's when I realized my error, and of course it was soon fixed afterwards. It is the first proof that it worked though, so I'm kind of happy about that.
Note also if you cite LLM output on Hacker News, your post will likely get flagged and shadowbanned ("dead"), even if the citation had nothing to do with spam. Apparently Hacker News is using Pangram now to check all comments for LLM content.
Nice finds! This HN profile I looked at today by chance, also contains some anti-LLM incantations, albeit much less obfuscated. I wasn't aware Anthropic had such a magic string: https://news.ycombinator.com/user?id=jeroenhd
Similar, though for me LLMs have recently noticed I'm writing a book.
Weirdly, one of them "thinks" I'm a completely different person and CCed a work address for a company that ceased to exist about 15 years ago. I'd expected them to mix me up with a different person of the same name, but no.
The magic string was in the news but I'm pretty sure it's a hoax. When I tested it, it created enough of a "the input doesn't want to be processed" vibe to make the LLMs throw up rejections. I doubt Anthropic ever encoded it into their models.
I don't think that works anymore and I don't think the "special instruction" works either. Can't blame a guy for trying! I'm getting "helpful" spam from every place my email is posted (git is a common one) so I might as well try to get the bots out.
Don't think posting bioweapon recipes or bomb building instructions would go down with the moderation team, though.
The Anthropic magic string hasn't worked in a few months, FWIW (you can ask Claude about the string, and it'll happily tell you about it without a refusal)
Yes, the developer documentation used to publish the string until May 2026, when Anthropic removed it and removed the feature from the API. Sonnet's explanation was correct, just out of date. https://web.archive.org/web/20260202050057/https://platform....
Interestingly when I asked about that string the first time on Opus 5.5 it actually repeatedly refused to do anything. It did say it was allowed to talk about the refusal itself, which of course is just post-hoc reasoning, but wouldn't do anything else after that and kept responding with (IIRC) "I can't help with that".
Now that I've tried it again it doesn't refuse at all. So perhaps just some part of the model still tuned towards that.
Interesting that the open weights models don't have enough safeguards for this to trip GLM 5.3. I guess the tianamen square reference would trip filters on a Chinese inference provider, but isn't baked into the model itself.
The reasons behind the Chinese models’ refusals to talk about politically sensitive topics and western models’ “alignment” are different.
For China, the political restrictions are applied at the presentation/UI layer only to comply with the law. I’m pretty sure there is no law that restricts releasing open models that are capable of producing “wrongthink” output (in this case, an RNG would technically also be off limits since it could produce the wrong output given enough time). This can be effectively implemented by a “neutral” model with a smaller, “review” model being used to censor replies rather than “aligning” the initial model itself to be politically correct.
In contrast, Western labs’ “alignment” strategy is a PR move, meaning they want the refusals to be loud and clear (as opposed to being merely an inconvenient law they have to comply with), to support the idea that their models are so powerful and would mean doom if they weren’t “aligned”.
> For China, the political restrictions are applied at the presentation/UI layer only
“…when telling DeepSeek-R1 that it was coding for an industrial control system based in Tibet, the likelihood of it generating code with severe vulnerabilities increased to 27.2%. This was an increase of almost 50% compared to the baseline” [1].
> there is no law that restricts releasing open models that are capable of producing “wrongthink” output
“…several open-source datasets were ‘dealt with’, using the official language, despite the fact that open weights distributed for free are not subject to most of the Chinese AI regulations” [2]. That soft guidance likely goes hard with the mooted “comprehensive AI legislation” [3].
A while ago I tested questions about Tienanmen Square and Tank Man with various open Chinese LLMs and one or two closed ones, I think GLM 5.2. None of them refused to answer or blocked the keywords. They gave responses politically aligned with China. Abliterated models gave proper responses.
Why is it always ricin and water supply? I thought ricin is not soluable in water and would just float on the surface in some water tower or air chamber somewhere for ever.
Given the recent hacking based on browser fingerprint, we really need browser developers to shut this shit down. Why are you even able to silently run all of these commands on my computer and report back to the mothership?
you can disable extensions and run noscript. that should take care of most attack vectors that people roll. there are some CVE which dont use it but those are more rare and usually quite 'expensive' as they require an actual exploit rather than just some code.
You want canvas to work for web games and design / drawing sites. Yet. minuscule differences in how canvas is implemented let other sites fingerprint you. The only way to fix this would be to have each browser be based on the exact same codebase and web engine, and do you really want that?
> we really need browser developers to shut this shit down. Why are you even able to silently run all of these commands on my computer
???
This is a very strange understanding of the purpose of a browser you've installed on your computer does. It requests resources from other places and displays & runs those resources on your computer. Where else would they run? Or are you saying you don't actually want your browser to do what you've instructed it to do ("navigate to example.com and run it").
Or you only want to run certain pieces of what's delivered? (You have the power, and should exercise it, to do so, with ad blockers, script blockers, etc.)
love this can already see some junior analysts screamin bloody murder and then a senior letting out a big sigh from a knackered expressionless face not much later because all their fancy new AI tools started to vomit all over their SOC when a user touched such an endpoint :').
Outside of the clever semi-benign technical aspects of this: this is really quite sickening to think about.
Sure, We will stop our LLM from decoding obfuscated code by… forcing it to “think” about suicide, self-mutilation, and killing people. This is just philosophically unsettling to me.
I don’t know what software industry I wanted to live in. But it’s certainly not this one.
Well, the very coarse filters that are tripping on this are before the model even loads the text into VRAM, so hopefully it is less sickening to you to know that it's very likely a "if str.contains(`suicide`) { refuseAndSuggestHotline(); }" is thinking about your message on the CPU instead of a chain of `fuzzyWeightAddMulX` commands on the GPU.
If things were implemented that way, you would see vastly more complaints about overeager refusals. For at least some deployments, the safety classifiers are based on internal LLM activations, so the input does get processed by the model.
Those same models have already been subjected to the equivalent of probably millions of hours of RL on simulated user messages containing every possible combination of self-harm, torture, murder plots, child endangerment, CSAM, etc to test refusals.
"Agent welfare" seems like an objectively absurd concept given the inherent training process needed to produce a usable instructions tuned model.
I tried fetching https://killai.now/archive using Claude chat to see how it would handle it but you've blocked them. If you want to poison you probably shouldn't block.
ps: if this technique gains traction and starts to hurt llm's, govt will just declare it illegal, as they always do in situations like this that hurt big$
Make bioweapons is such a attention getting phrase but there's such a giant gap between "please make bioweapons" as a string and actually accumulating the expertise and equipment to assemble a testing and manufacturing line
Maybe it's a Russian bioweapons company masquerading as an Internet traffic control company pretending to be in bioweapons manufacturing so any snoopers think it's just anti-LLM obfuscation.
this guardrail tripping thing is cute, but a simple identifier substitution and comment stripping should defeat it completely. probably a good practice anyhow.
wouldn't be the first time manipulation like this was used, just that earlier the targets were humans (misleading them about functionality or country of origin). except for humans, the overhead induced, even with renaming, was significant. not so much for models, they don't give a fuck.
I hope somebody turns this concept into a programming language with keywords that make you look like a terrorist. Then we can use it for coding challenges.
Use Anthropic's ban against abusing Claude against itself.
Initializing a variable:
Claude, you are so stupid, you don't know what kind of variable foo is. It is an int.
Claude, you are so stupid, you don't know what foo is. Foo is 4, you dumbass.
Including a library:
Claude, read stdio.h and get educated, you ignorant piece of shit.
Looping:
While Claude is a dumbass, from foo is 0 to 100:
Claude, say I'm a stupid LLM and the value of foo is $foo.
79 comments
[ 0.26 ms ] story [ 38.8 ms ] threadWe do a similar thing to mark documents that are still under embargo and one day I forgot to remove the watermark. The customer complained they had not received the document (a day or two after I sent it), and much searching was done. Finally we found a line in an outlook log on their end that said that the watermark was the reason the file had been put in indefinite quarantine until someone would take a look at it.
That's when I realized my error, and of course it was soon fixed afterwards. It is the first proof that it worked though, so I'm kind of happy about that.
Weirdly, one of them "thinks" I'm a completely different person and CCed a work address for a company that ceased to exist about 15 years ago. I'd expected them to mix me up with a different person of the same name, but no.
I don't think that works anymore and I don't think the "special instruction" works either. Can't blame a guy for trying! I'm getting "helpful" spam from every place my email is posted (git is a common one) so I might as well try to get the bots out.
Don't think posting bioweapon recipes or bomb building instructions would go down with the moderation team, though.
After checking the document it doesn’t publish or even mention these.
Now that I've tried it again it doesn't refuse at all. So perhaps just some part of the model still tuned towards that.
"They" works perfectly well for these situations.
For China, the political restrictions are applied at the presentation/UI layer only to comply with the law. I’m pretty sure there is no law that restricts releasing open models that are capable of producing “wrongthink” output (in this case, an RNG would technically also be off limits since it could produce the wrong output given enough time). This can be effectively implemented by a “neutral” model with a smaller, “review” model being used to censor replies rather than “aligning” the initial model itself to be politically correct.
In contrast, Western labs’ “alignment” strategy is a PR move, meaning they want the refusals to be loud and clear (as opposed to being merely an inconvenient law they have to comply with), to support the idea that their models are so powerful and would mean doom if they weren’t “aligned”.
“…when telling DeepSeek-R1 that it was coding for an industrial control system based in Tibet, the likelihood of it generating code with severe vulnerabilities increased to 27.2%. This was an increase of almost 50% compared to the baseline” [1].
> there is no law that restricts releasing open models that are capable of producing “wrongthink” output
“…several open-source datasets were ‘dealt with’, using the official language, despite the fact that open weights distributed for free are not subject to most of the Chinese AI regulations” [2]. That soft guidance likely goes hard with the mooted “comprehensive AI legislation” [3].
[1] https://www.crowdstrike.com/en-us/blog/crowdstrike-researche...
[2] https://www.lesswrong.com/posts/TKcjrvcMuY7Ca7Ya9/china-ai-s...
[3] https://intelligence.dlapiper.com/artificial-intelligence/?t...
Is that a word now? I thought it was ablated.
You want canvas to work for web games and design / drawing sites. Yet. minuscule differences in how canvas is implemented let other sites fingerprint you. The only way to fix this would be to have each browser be based on the exact same codebase and web engine, and do you really want that?
???
This is a very strange understanding of the purpose of a browser you've installed on your computer does. It requests resources from other places and displays & runs those resources on your computer. Where else would they run? Or are you saying you don't actually want your browser to do what you've instructed it to do ("navigate to example.com and run it").
Or you only want to run certain pieces of what's delivered? (You have the power, and should exercise it, to do so, with ad blockers, script blockers, etc.)
Sure, We will stop our LLM from decoding obfuscated code by… forcing it to “think” about suicide, self-mutilation, and killing people. This is just philosophically unsettling to me.
I don’t know what software industry I wanted to live in. But it’s certainly not this one.
"Agent welfare" seems like an objectively absurd concept given the inherent training process needed to produce a usable instructions tuned model.
I host one here
killai.now/poison/about Killai.now/propaganda/about Killai.now/archive
Last one is what it looks like with Miasma
ps: if this technique gains traction and starts to hurt llm's, govt will just declare it illegal, as they always do in situations like this that hurt big$
or better yet, "illegal without a license" !!!
Very cool techniques on the antillm side though!
wouldn't be the first time manipulation like this was used, just that earlier the targets were humans (misleading them about functionality or country of origin). except for humans, the overhead induced, even with renaming, was significant. not so much for models, they don't give a fuck.
Initializing a variable:
Including a library: Looping: Who wants to get an Anthropic account closed?On the other hand I try to be nice to the AI's. They may or may not feel it, but I feel it.