Try this: tell someone “whatever you do, don’t think about a pink elephant.”
They’ll think about a pink elephant. Every time.
The same thing happens with language models — except the consequences show up in your code, your outputs, and your workflows.
The effect
When you include a negation in a prompt — “don’t use global variables,” “avoid nested callbacks,” “never return null” — the model has to process every word in that instruction. Including the thing you told it to avoid.
Language models predict the next token based on the probability distribution of everything in the context. When “global variables” appears in your prompt, those tokens get weighted in the model’s attention. The word “don’t” modifies the intent, but it doesn’t erase the attention. The concept is now primed.
Researchers at Booz Allen Hamilton formalized this as the Pink Elephant Problem. Their finding: even large models struggle to suppress concepts once they’ve been introduced into the prompt. The model has to simultaneously hold the concept in working memory and try to steer away from it. That tension produces exactly the behavior you were trying to prevent.
Chase Adams demonstrated this visually with Midjourney — asking for “anything except a pink elephant” reliably generated pink elephants. The negation word had zero suppressive effect. The content tokens dominated.
Why it matters for agents
This gets more consequential when you’re working with AI agents that operate in loops. A system prompt full of “don’t do X” instructions is a minefield.
Consider an agent with these instructions:
“Help users with their code. Don’t execute destructive commands. Don’t modify files outside the project directory. Don’t make API calls without confirmation.”
That’s three concepts the agent now has primed: destructive commands, modifying files outside the project, and unsanctioned API calls. Every time the agent processes its system prompt, those patterns get attention weight. You’ve built a map of everything dangerous and handed it to the agent on every turn.
Now consider the positive version:
“Help users with their code. Execute only read operations and safe, reversible modifications. Modify files only within the project directory. Confirm with the user before making API calls.”
Same boundaries. No priming of the behaviors you’re trying to prevent. The agent’s attention is on the correct behaviors, not the dangerous ones.
The mechanism
This isn’t a flaw in any particular model. It’s how attention-based architectures work.
A transformer processes all tokens in the context window and assigns attention weights based on relevance. Negation words like “don’t,” “never,” and “avoid” are low-information tokens — the model has seen them in countless contexts where they carry varying semantic weight. The nouns and verbs that follow them are high-information tokens. They carry the meaning.
When you write “don’t use eval(),” the strongest signal in that phrase isn’t “don’t” — it’s “eval().” You’ve just made eval() more salient in the context, not less.
The fix
State what you want. Only what you want. Let the positive instruction define the boundary implicitly.
| Primed prompt | Clean prompt |
|---|---|
| ”Don’t use eval() or exec()" | "Use safe, standard library methods for evaluation" |
| "Avoid making changes to production" | "Make all changes in the staging environment" |
| "Don’t respond with more than 3 sentences" | "Respond in 3 sentences or fewer" |
| "Never store passwords in plaintext" | "Store passwords using bcrypt hashing” |
Every negative instruction has a positive equivalent that’s more precise and carries less risk. The positive version is usually shorter, too.
A rule of thumb
If your prompt contains the word “don’t,” rewrite it. Every time. Not because negation always fails — sometimes models handle it fine. But because the positive version is always at least as good, and often better. There’s no upside to the risk.
Your prompts should read like a destination, not a list of places to avoid. Tell the model where to go. Let it fill in the “not everywhere else” on its own.