A translator bot must never answer the question

14 July 2026 · ThaiPo

ThaiPo sits inside couples' LINE chats and translates everything both ways. The product only works if the bot is invisible: a wire between two people, never a third person in the room. Which means the worst bug this product can have is not a bad translation. It is this:

Her:มารับหน่อยได้ไหม ทุ่มนึง ("can you pick me up at 7?")
Bot:Sure! I'll be there.

The model answered her. It did not translate; it participated. On a good day this is embarrassing. In a relationship chat it is catastrophic, because the person on the other end believes the reply came from their partner. A modern chat model is trained with every instinct pointed at being helpful and conversational, and we need it to suppress exactly those instincts, forever, on every message, including messages that look precisely like instructions addressed to it.

Why prompting alone cannot be the answer

The naive fix is a system prompt that says "you are a translator, never respond to the content". That gets you from failing constantly to failing rarely, and rarely is nowhere near good enough at thousands of messages a day. Questions, greetings, and commands are adversarial by their very shape: "translate this" is a message some users genuinely want translated, literally, because they are talking about ThaiPo to each other. Every message is simultaneously content and a potential instruction, and the model has to treat all of it as content.

So the guarantee is enforced in five layers, and each one has caught real failures:

  • The prompt is a contract, not a vibe. The instructions define the bot as a wire with exactly one output: the translation. No acknowledgements, no offers of help, no answering. Every revision of that wording is versioned and benchmarked before it ships.
  • Output-shape guards. After generation, cheap checks ask: does this look like a translation of the input, or does it look like a reply to it? A response in the wrong direction (English in, English out) or an output that answers a question the input asked triggers a forced retry, stripped of conversational context so the model cannot lean on the chat history that tempted it.
  • An escape hatch that keeps users out of the fight.A literal-translation command exists for the genuinely ambiguous cases, so "translate exactly this, even if it sounds like an instruction" is a feature, not a prompt-injection battle.
  • Context hygiene. The most surprising failures were self-inflicted, via the rolling context window. More below.
  • An eval that never sleeps. A corpus of the exact messages that once broke character (questions, greetings, commands, meta-talk about the bot) is scored on every prompt change. Staying in character is a release gate, not a hope.

The night the messages started doubling

Our favorite incident, in the sense that we never want another one: an operations group started receiving every translation twice, glued together. The chain took a while to see. A rare bug caused one output to contain the translation twice. That doubled output was appended to the chat's rolling context, which the model reads to stay consistent with recent phrasing. On the next message, the model looked at recent history, saw doubled output, inferred that doubling is the house style, and doubled again. Its new output went into the context. The context was now two examples deep in doubled messages.

This is a feedback loop with no damping: the model learns from its own mistakes in the worst possible sense. The fix was two-sided: the echo guard catches the malformed shape before it ever reaches the user, and, just as important, output that fails any guard is never appended to the context. A related incident taught the same lesson from another angle: one garbled, clipped output poisoned the window badly enough that the model gave up and dumped its entire context into the chat. There is now a runaway detector on output, and a clean way to reset a chat's window.

The principle we took away: in any system that feeds its own output back as input, the guard has to sit on the write path, not just the read path. Filtering what users see is half the job; filtering what the model remembers is the half that prevents spirals.

Does the guarantee hold?

The eval says character breaks are now vanishingly rare, and the guards mean the rare ones mostly retry into silence instead of reaching the chat. The field agrees in the way that matters: couples chat for weeks and forget the bot is there. For this product, being forgotten is the highest praise available, and it is an engineered property, not a personality trait.

Try it in your own chats

ThaiPo lives inside LINE and translates every message in both directions, free forever. Get started free or add @thaipo.ai as a friend on LINE and it sends your signup link right in the chat.