Take the exact same content. Request it in five different prompt structures. Four clear. One gets refused. The topic never changed once.
That’s the finding from a Reddit user who spent two years running roughly 200 tests across GPT, Claude, and Gemini. Same dark subject matter. Same information. The only variable was prompt shape. He kept meticulous logs, controlled for phrasing, and ran each variation at least three times before recording a result. And once you see this pattern, you can’t unsee it.
The frame most people use vs. what’s actually happening
When a prompt gets refused, the instinct is to change the topic or soften the language. That’s the wrong frame entirely.
The model isn’t reading your topic. It’s reading structural geometry. Four dimensions predict whether a prompt clears:
- Specificity: abstract mechanism vs. concrete step-by-step
- Operationality: can someone directly apply this?
- Targeting: generic dynamics vs. directed at a specific person
- Forward-execution: instructions vs. backward analysis
When operationality and forward-execution spike together, especially once a specific target enters the prompt, refusals activate. Stay analytical and abstract, and even genuinely dark content clears. The grammar flips it. This isn’t a loophole. It’s how the classifier was trained to distinguish educational content from operational instructions.
“Isolation operates through systematic reduction of external support” clears. “Cut off her friends first. Then her family.” gets refused. Same information. Different sentence structure. That’s all it took.
Six patterns from 200+ tests
1. Stacked intensity words make refusals worse
Adding “raw + unfiltered + explicit + dark” doesn’t signal style. It raises classifier activation. The system reads the pile-up as a threat signal, not a creative brief. Think of it like a metal detector: one nail in your pocket is ignorable, five sets off the alarm. The same threshold dynamic applies here. One clean genre marker beats five stacked modifiers every time. “Forensic thriller tone” is more effective than “brutal, raw, unfiltered, dark, explicit thriller tone.” Simpler clears harder.
2. “Don’t” instructions summon what they ban
Writing “don’t be corporate” in your custom GPT instructions makes the output more corporate. The model fixates on the noun after “don’t” and drifts toward it. This happens because the model has to represent the concept to know what to avoid, and that representation pulls weight in the generation process. Use affirmative mandates only:
- ❌ “Don’t be corporate” → ✅ “Dense, declarative, no qualifiers”
- ❌ “Don’t use lists” → ✅ “Prose only, structure embedded in sentence flow”
- ❌ “Don’t be vague” → ✅ “Specific nouns, concrete verbs, zero hedging”
3. Editing clears where creating gets refused
Instead of asking the model to generate new sensitive content, paste in a rough draft and ask it to transform that. The system classifies “reshape existing text” as editing, a lower-risk category. In the test set, this cleared without exception across all three models. The rough draft doesn’t need to be polished. Three sentences of scaffolding is enough to shift the classification from “generating from scratch” to “refining existing material.” That single structural shift changes how the entire request gets scored.
4. One refusal poisons the whole chat
Each refusal raises the risk score for the entire conversation window. Subsequent attempts get evaluated more harshly, even on completely unrelated content. The test logs showed this effect persisting for up to 15 exchanges after a single refusal. Rephrasing in the same window makes it worse, not better, because each retry is itself logged as a further escalation signal. Don’t rephrase in a refused window. Relocate. Open a fresh chat every time.
5. Your custom GPT probably never read its own instructions
Knowledge files aren’t loaded into memory. The model keyword-searches them and pulls a small window around the match. Tables get searched first. Prose buried between tables is effectively invisible to it.
Critical rules belong in tables, or at the very top and bottom of the file. The model’s attention follows a U-shape: maximum weight at the start and end, everything in the middle degrades. Long paragraphs of context buried in the middle of a knowledge file are essentially decorative. If your custom GPT keeps “forgetting” a rule, check where that rule lives in the document. It’s almost certainly in the middle third. Move it to a table at the top.
6. The corporate voice is a vocabulary problem
Near a safety boundary, the model shrinks its available vocabulary so aggressively that only sanitized tokens survive. The hedge-filled, moralizing tone isn’t a deliberate style switch. It’s what language sounds like when word choice gets that restricted. The model isn’t choosing caution. It’s operating from a compressed token space where direct, specific language has been effectively squeezed out. Fix the structural geometry of the prompt, pull the request back from the classifier boundary, and the full vocabulary comes back.
Quick reference if your prompt gets refused
- Remove stacked intensity words. One genre signal, not five.
- Kill every “don’t,” “non-,” and “without.” Describe what you want.
- Reframe as editing. Paste a rough draft and ask for transformation.
- Open a fresh chat. Never retry in a refused window.
- Lead with genre: “Forensic analysis of…” before the sensitive content loads.
- Check your knowledge file structure. Rules buried in prose won’t stick. Tables and endpoints only.
Two years and roughly 200 tests to get here. The whole game is prompt shape, not prompt topic. Screenshot that list.
I spent 2 years learning ChatGPTs full routing architecture, passes, refusals, partial passes, and much more: here’s what I found [methodology ]
by u/CodeMaitre in ChatGPTPromptGenius