Telling the model not to say a word makes it say the word

10 November 2026 · ThaiPo

Do not think of a pink elephant. There. You have now done the one thing you were asked not to do, and so will a language model, except the model will also type it into someone's chat.

ThaiPo's free tier runs on a cheaper model and Pro on a stronger one. The standing constraint on quality work is blunt: we are not buying a bigger model. Every improvement has to come from what we send the model we already have. Which makes it awkward that our most natural instinct for fixing a mistranslation, telling the model what not to write, turned out to make it write exactly that.

The gloss that backfired

When an audit finds a word or phrase the model keeps misreading, we write a gloss: a one-line hint that says how to read it. One ordinary English phrase kept coming out wrong in Thai. So the gloss said what the phrase means and then, to be thorough, named two wrong Thai words and said never to write either.

We probed it on the rows that had actually failed. The cheaper model wrote one of the forbidden words two times out of two.

The reworded gloss named no wrong word at all. It gave only the correct rendering, as one complete example sentence. Six out of six.

The explanation is not mysterious. A small model copies tokens it can see. A negated word is still a word sitting in the prompt, in the target language, right next to the thing being translated. "Never" is a weak signal. The word itself is a strong one. We had seen the cousin of this before, when an example inside a gloss leaked into output.

The rule we kept is narrow. "Never" is fine for a concept (never a name, never the weather). It is the exact wrong token in the output language that you must not quote. Show the right sentence and stop talking.

Where the hint lives matters as much as what it says

The second instinct to resist is promoting every fix to a standing rule. A system prompt that grows a new sentence for every bug becomes a wall of rules, each one diluting the others, and each one a word the model can now be primed by on messages that have nothing to do with it.

So a gloss is attached only to the message that contains the troublesome word. It rides the tail of the prompt, after the cached part. A dozen tokens when needed, nothing otherwise.

That placement is also what keeps the shared prompt templates byte-stable, which buys two things. The provider caches on the exact bytes of the prefix, so a prefix that never changes is a prefix we barely pay for. And the templates for our best-measured languages are pinned byte for byte by tests against recorded results, so a fix for a Chinese idiom physically cannot alter what the English prompt says. Each language's prompt carries that language's name, so each already sits on its own cached prefix, with its own short notes on how to read it and how to write it. Fix one language, and the others cannot tell anything happened.

The measurements, stated as they were taken:

• Nine new glosses from one audit took the failures they targeted from 16 in 30 to 3 in 30, with the control messages clean.
• An earlier set, shipped with a few small code fixes and tested as one bundle on 29 real failures with three samples per arm and two blind reviewers: 32% misleading before, 1% after.
• A single reading rule on the tail took meaning errors from 8 to 3 on 53 real messages. A far more expensive model, given no rule, also scored 3.

Not everything works, and the misses are instructive. A matching rule for the other direction produced four format failures in 43 messages and did not ship. A gloss for clipped texting English fixed one case and turned instructions into questions. It was dropped the same night. The method is the measurement, not the cleverness.

The same trick, twice more

Thai has gendered words for "I", and the model would drift between them for the same sender within one chat. We did not add a rule about pronouns. Once a sender's translations have agreed three times, a hint on the tail states the settled word. In a replay of 21 messages where 12 had come out with the wrong one, all 21 came out right. We should admit that this hint breaks our own rule: it states the settled word and then names the other one after a "never". On that replay it held anyway.

And when the model occasionally echoed a plain English greeting back untranslated, a retry that simply asked again still echoed. The escalation that followed carries a handful of concrete right answers: good morning is อรุณสวัสดิ์, thank you is ขอบคุณ. (For the stubborn remainder there is a fixed table of greetings, in code.)

Some mistakes belong to no language

Two kinds of error showed up on every language pair we audited: a dropped negation and a question delivered as a statement. A third travels with them: a few characters of the source script left sitting inside the output. A fluent translation of "I'm not coming tomorrow" that loses the "not" reads beautifully and says the reverse.

No note can hold these, because they are not about any one language. And the tempting fix, another paragraph of "never drop a negation" in every prompt, is the pink elephant again, with a cache bill attached.

Instead there is a soft guard, in plain code. It checks the source deterministically (does it contain a negation, is it exactly one question) and then checks whether the output still has one. If not, the model gets one repair call with the defect named. If the repair does not clear it, the first output is delivered anyway.

The softness is the design. A negation can be legitimately rephrased ("nobody came" as "the place was empty"), so this can never be a hard failure. Only drops are checked, because an added negation is how Thai and Chinese phrase plenty of positives: the everyday Thai for "busy" is literally "not free". Idioms whose "no" negates nothing are removed from both sides before counting, so "no worries" against ไม่เป็นไร is clean.

The guard needed its own debugging. The first negation word list fired on 7% of Thai-to-English rows. The Thai for "don't" hides inside the Thai for "like". Two Finnish negatives are ordinary words in Dutch and French. Romanised Thai for a question particle is Italian for "never". After the idiom pass it fires on about half a percent of rows, and costs nothing on the rest.

The cheapest lever of all

One more, because it fits the theme of not adding words. The cheaper model's provider publishes a recommended temperature of 1.3 for translation. We ran 157 cases, three samples each, at three temperatures, with three blind reviewers. Misleading outputs went 55, 49, 46 of 469 at 1.3, 1.0 and 0.7. Outright garbage went 2, 1, 0. About a third of the errors at 1.3 were sampling luck: another sample of the same prompt was right. We ship 0.7. Zero new prompt tokens.

Takeaway

A prompt is not a rulebook the model consults. It is a pile of text the model is influenced by, all of it, including the parts that start with "never". So show the right answer and only the right answer, show it only when it is relevant, keep everything else byte-for-byte still, and put the checks that must hold in code, where a test can pin them. Our process for testing prompts like code tells us whether a change helped. This is what we learned about which changes to try first.

ThaiPo is designed, built and run by one developer, Steven Acreman.

Try it in your own chats

ThaiPo lives inside LINE and translates every message in both directions, free forever. Get started free or add @thaipo.ai as a friend on LINE and it sends your signup link right in the chat.