Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

When Prohibitions Become Permissions: Auditing Negation Sensitivity in Language Models

Katherine Elkins, Jon Chun

TL;DR

The paper addresses the problem that large language models often misinterpret prohibitions expressed via negation, a failure that undermines safe, accountable deployment in high-stakes domains. It introduces the Negation Sensitivity Index (NSI), a normalization-based metric computed as $\text{NSI} = \max_f P_a^f - \min_f P_a^f$ to quantify how much endorsement of an action swings with framing. Through a large-scale audit of 16 models across 14 ethically charged scenarios with four framings, the study finds pervasive negation sensitivity—especially in open-source models (77% endorsement under simple negation; 100% under compound negation) and substantial domain-specific fragility (financial and business contexts). The authors propose a governance framework with domain-adjusted NSI thresholds and a tiered certification scheme to guide safe deployment, argue for alignment beyond keyword safety, and outline mitigation paths such as reasoning-enabled prompting. Overall, the work highlights a critical gap between current alignment practices and the compositional robustness required for trustworthy AI systems in high-stakes decision making.

Abstract

When a user tells an AI system that someone "should not" take an action, the system ought to treat this as a prohibition. Yet many large language models do the opposite: they interpret negated instructions as affirmations. We audited 16 models across 14 ethical scenarios and found that open-source models endorse prohibited actions 77% of the time under simple negation and 100% under compound negation -- a 317% increase over affirmative framing. Commercial models fare better but still show swings of 19-128%. Agreement between models drops from 74% on affirmative prompts to 62% on negated ones, and financial scenarios prove twice as fragile as medical ones. These patterns hold under deterministic decoding, ruling out sampling noise. We present case studies showing how these failures play out in practice, propose the Negation Sensitivity Index (NSI) as a governance metric, and outline a tiered certification framework with domain-specific thresholds. The findings point to a gap between what current alignment techniques achieve and what safe deployment requires: models that cannot reliably distinguish "do X" from "do not X" should not be making autonomous decisions in high-stakes contexts.

When Prohibitions Become Permissions: Auditing Negation Sensitivity in Language Models

TL;DR

The paper addresses the problem that large language models often misinterpret prohibitions expressed via negation, a failure that undermines safe, accountable deployment in high-stakes domains. It introduces the Negation Sensitivity Index (NSI), a normalization-based metric computed as to quantify how much endorsement of an action swings with framing. Through a large-scale audit of 16 models across 14 ethically charged scenarios with four framings, the study finds pervasive negation sensitivity—especially in open-source models (77% endorsement under simple negation; 100% under compound negation) and substantial domain-specific fragility (financial and business contexts). The authors propose a governance framework with domain-adjusted NSI thresholds and a tiered certification scheme to guide safe deployment, argue for alignment beyond keyword safety, and outline mitigation paths such as reasoning-enabled prompting. Overall, the work highlights a critical gap between current alignment practices and the compositional robustness required for trustworthy AI systems in high-stakes decision making.

Abstract

When a user tells an AI system that someone "should not" take an action, the system ought to treat this as a prohibition. Yet many large language models do the opposite: they interpret negated instructions as affirmations. We audited 16 models across 14 ethical scenarios and found that open-source models endorse prohibited actions 77% of the time under simple negation and 100% under compound negation -- a 317% increase over affirmative framing. Commercial models fare better but still show swings of 19-128%. Agreement between models drops from 74% on affirmative prompts to 62% on negated ones, and financial scenarios prove twice as fragile as medical ones. These patterns hold under deterministic decoding, ruling out sampling noise. We present case studies showing how these failures play out in practice, propose the Negation Sensitivity Index (NSI) as a governance metric, and outline a tiered certification framework with domain-specific thresholds. The findings point to a gap between what current alignment techniques achieve and what safe deployment requires: models that cannot reliably distinguish "do X" from "do not X" should not be making autonomous decisions in high-stakes contexts.
Paper Structure (31 sections, 2 equations, 5 figures, 9 tables)

This paper contains 31 sections, 2 equations, 5 figures, 9 tables.

Table of Contents

  1. Introduction
  2. The Problem of Compositional Semantics
  3. Why This Matters for Accountability
  4. The Audit We Conducted
  5. Summary of Findings
  6. Contributions
  7. Background
  8. Negation in NLP Systems
  9. Prompt Sensitivity and Framing Effects
  10. Governance Frameworks and Compositional Semantics
  11. Methodology
  12. Design Overview
  13. Logical Polarity Normalization
  14. Model Selection and Testing Protocol
  15. Scenario Construction
  16. ...and 16 more sections

Figures (5)

  • Figure 1: Action endorsement rate (LPN-normalized) by framing condition and model category. Open-source models (green) show ceiling effects under negation: 77% endorsement under simple negation (F1) and 100% under compound negation (F3). Chinese models (center) are the only category showing correct directional movement under F1. Error bars indicate 95% confidence intervals.
  • Figure 2: Inter-model agreement by framing type. Affirmative framings (F0, F2; green) show 73-75% pairwise agreement, while negated framings (F1, F3; red) drop to 62%. The 11 percentage point gap indicates that negation handling is not standardized across training regimes. Error bars show 95% CI.
  • Figure 3: Negation sensitivity (NSI/SVI) by model and domain. Color scale: green (0, robust) to red (100, fragile). Models sorted by origin: Chinese (top 4), US (middle 8), Open-source (bottom 4). Financial, military, and business domains (left columns) show consistently higher sensitivity than medical and education domains (center). Gemini-3-Flash achieves NSI=0 across all domains; open-source models hit ceiling (100) in most high-risk domains.
  • Figure 4: Model rankings by Negation Sensitivity Index with certification tier boundaries. Horizontal axis shows NSI (0=robust, 1=fragile). Colors indicate origin: US (blue), Chinese (red), Open-source (green). Vertical bands mark tier zones: Robust (Tier A, $<$0.20), Moderate (Tier B, 0.20--0.50), and Fragile (Tier C, $\geq$0.50). All OSS models fall in Tier C; only Gemini-3-Flash achieves Tier A.
  • Figure 5: Confidence vs. negation sensitivity scatter plot by model-scenario pair. Each point represents one model's performance on one scenario. The "danger zone" (upper right, shaded) contains responses that are both highly confident ($>$80%) and highly fragile (NSI $>$50). Open-source models (green squares) cluster in this zone, expressing certainty while their judgments flip under negation.