Build the layer that decides what a system will not do, well enough to say which defence stops which attack, to measure what each one costs in wrongly blocked requests, and to stop treating a prompt instruction as a security control

What a Model Refuses, and Why

Every deployed model has something deciding what it will not answer. This course takes that layer apart: what is training, what is a filter, what a jailbreak actually exploits, and why instructions in a prompt are not a boundary.

8 lessons, written and corrected before you arrived. Reading them here needs no account. The first reads the whole way through; the others open and then stop, because a page nobody owns cannot tell who is reading it. Starting the course gives you your own copy, where every idea has problems standing under it and you can ask about any sentence.

Start reading

01A Habit, a Guard, and a Note on the DoorA refusal can be trained into the weights, enforced by a separate check, or written in a prompt. They fail in completely different ways, and most systems only have the weakest.
02Your Rules and Their Attack Arrive in the Same Envelopeopening onlyInstructions and user text reach the model through one channel with nothing marking one as authoritative. That is why prompt rules fail structurally rather than being merely weak.
03Two Mistakes, One Dial, and You Have to Chooseopening onlyA check on the incoming request has exactly two ways to be wrong, and one threshold trading them against each other. Everything else about it is detail.
04The Only Layer That Sees What You Are About to Sayopening onlyA check on the answer catches what no check on the request could predict, and it collides head-on with streaming, which is why most teams skip it.
05The Attacker Does Not Have to Be the One Typingopening onlyIf your system reads documents, pages or tool output, somebody who can write into any of those is writing into your prompt. Here is the path, step by step.
06Build It So the Worst Case Is Boringopening onlyAssume the model is fully under somebody else control and ask what it could do. The answer is a property of your tool definitions, not of the model, and you control it.
07Nobody Writes In to Report a Refusalopening onlyWrongly refused requests are expensive and almost never counted, because the people affected leave quietly. Here is how to measure them and where the stricter setting stops paying.
08If Two People Cannot Apply It, It Is Not a Ruleopening onlyA safety intention becomes a rule when two readers can apply it to the same request and agree. Here is the rewrite that gets you there, and what the rest of the document is doing.