Semantic Gravity Wells: Why Negative Constraints Backfire

TL;DR

This paper investigates why negative constraints in large language models often fail, revealing that explicit mentions of forbidden words paradoxically activate them, and identifies two distinct failure modes with mechanistic insights.

Contribution

It introduces semantic pressure as a measure of token generation likelihood and provides the first detailed mechanistic analysis of negative instruction failures in language models.

Findings

Violation probability correlates with semantic pressure via a logistic relationship.

Suppression signals are weaker in failures, with a 4.4× asymmetry between successes and failures.

Two failure modes identified: priming failure and override failure, with specific layer contributions.

Abstract

Negative constraints (instructions of the form "do not use word X") represent a fundamental test of instruction-following capability in large language models. Despite their apparent simplicity, these constraints fail with striking regularity, and the conditions governing failure have remained poorly understood. This paper presents the first comprehensive mechanistic investigation of negative instruction failure. We introduce semantic pressure, a quantitative measure of the model's intrinsic probability of generating the forbidden token, and demonstrate that violation probability follows a tight logistic relationship with pressure ($p=\sigma(-2.40+2.27\cdot P_0)$; $n=40{,}000$ samples; bootstrap $95%$ CI for slope: $[2.21,,2.33]$). Through layer-wise analysis using the logit lens technique, we establish that the suppression signal induced by negative instructions is present but systematically weaker in failures: the instruction reduces target probability by only 5.2 percentage points in failures versus 22.8 points in successes -- a $4.4\times$ asymmetry. We trace this asymmetry to two mechanistically distinct failure modes. In priming failure (87.5% of violations), the instruction's explicit mention of the forbidden word paradoxically activates rather than suppresses the target representation. In override failure (12.5%), late-layer feed-forward networks generate contributions of $+0.39$ toward the target probability -- nearly $4\times$ larger than in successes -- overwhelming earlier suppression signals. Activation patching confirms that layers 23--27 are causally responsible: replacing these layers' activations flips the sign of constraint effects. These findings reveal a fundamental tension in negative constraint design: the very act of naming a forbidden word primes the model to produce it.