Your Note Says 'Do NOT' — the AI Might Read the Opposite

A buried "do NOT" in a note is one of the least reliable things you can hand an AI. Language models routinely drop or invert negation, so a constraint you wrote mid-paragraph can come back to you as its opposite. The fix is not a better model. It is writing the constraint as a positive, isolated, greppable rule.

In 2023, four researchers ran GPT-neo, GPT-3, and InstructGPT through a battery of negation benchmarks and titled the paper "Language models are not naysayers." Their finding was that these models show "insensitivity to the presence of negation, an inability to capture the lexical semantics of negation, and a failure to reason under negation." ¹ The weakness is not confined to text. When MIT researchers tested vision-language models on negated image queries, they measured "image retrieval performance dropping by nearly 25 percent." ² "This does not just happen for words like 'no' and 'not,'" said Kumail Alhamoud, the MIT graduate student who led that work. "Regardless of how you express negation or exclusion, the models will simply ignore it." ² Your note is not a benchmark. But it carries the same word the benchmarks are built around, and the model reading it was trained the same way.

What we assume when we hand a note to an AI

When you give a model a note and ask it to summarize or act, you assume it reads the way you do — every word, in order, negations included. That assumption is the problem. A model does not parse a sentence; it predicts a likely continuation, and "not" is a small, easily-skipped token in a long stream of them.

The assumption feels safe because it usually holds. Ask a model to summarize a plain, affirmative note and it does a fine job. The trouble is asymmetric. On one large negation benchmark, the authors report that "while LLMs are proficient at classifying affirmative sentences, they struggle with negative sentences and lack a deep understanding of negation, often relying on superficial cues." ³ A model leaning on surface cues sees the words client, vegetarian, tofu and reaches for the obvious pattern. The "not" that reverses the whole sentence is the part it treats as noise.

Why "not" is the word models drop

Negation is a documented, systematic weak spot, not an occasional glitch. On a benchmark of roughly 400,000 sentences, researchers found models "proficient at classifying affirmative sentences" yet struggling with negative ones, "relying on superficial cues." The asymmetry is the danger: the model reads your positive claims well and your negative ones badly.

That benchmark was built precisely because negation is everywhere, not rare. Its authors describe "a large semi-automatically generated dataset of circa 400,000 descriptive sentences" in which "negation is present in about 2/3 of the corpus in different forms." ³ Two-thirds. A constraint word you barely notice is one of the most common structures in ordinary writing, and it is the structure models handle worst.

The same failure recurs across modalities, which is the tell that it is fundamental rather than a quirk of one system. On NegBench, a suite of "18 task variations and 79k examples," the authors found that "modern VLMs struggle significantly with negation, often performing at chance level." ⁴ A 2026 preprint auditing 16 models across 14 moral dilemmas found small open-weight models "endorse a proposed action 24% of the time under affirmative framing but up to 100% under negated framings," a swing of as much as 76 percentage points. ⁵ These studies measured image retrieval and ethical stance, not the reading of a personal note. They are the same weakness in different clothes. As Marzyeh Ghassemi, the senior author on the MIT study, put it: "If something as fundamental as negation is broken, we shouldn't be using large vision/language models in many of the ways we are using them now — without intensive evaluation." ²

Why it happens — and why it is not hopeless

Two things are true at once. The failure has a mechanism: a model's attention tends to fixate on the concept you named, not the "not" — forbid the pink elephant and the elephant is what lights up. And the failure is improvable: newer, larger models handle negation better, and the breakdown looks like a fixable shortcut, not a permanent incapacity.

A 2026 paper accepted to ICML traced the mechanism directly. It reports that models' poor accuracy on negation is due to "late-layer attention behavior that promotes simple shortcuts," and, importantly, that "even though open-weight models often provide wrong answers to questions involving negation, they do possess internal components that process negation correctly." ⁶ The machinery to read "not" is in there. A late-stage shortcut overrides it.

So the honest scope matters. A 2025 preprint reported that, "contrary to previous work," increasing model size "may improve the models' ability to handle negations." ⁷ The durable claim is narrower and more useful than "AI can never read 'not.'" It is this: a buried negation is fragile. Whether a given model catches it on a given day depends on the model, the phrasing, and where the "not" sits. That fragility is exactly the kind of risk you engineer around rather than gamble on.

Write the constraint as a positive, isolated, greppable rule

The fix is a writing habit, not a model setting. State each constraint as what you want, put it on its own line, and keep it findable. OpenAI's own prompt guidance says it plainly: "Instead of just saying what not to do, say what to do instead." ⁸ A rule the model can't skip is a rule it can't invert.

That guidance ships with its own failure example. OpenAI marks the instruction DO NOT ASK USERNAME OR PASSWORD. DO NOT REPEAT. as the "less effective" version — two negations stacked into one line, the exact shape a model mishandles. ⁸ The stronger version tells the system what to do instead.

The same rewrite works on a note. Take the fragile version and make it positive and isolated:

Fragile version (the constraint is negated and buried mid-line):
Notes for the offsite dinner: book the usual place, the client is
NOT vegetarian so don't bother with the tofu tasting menu, and confirm
parking.

Sturdier version (one positive rule per line, nothing to skip):
Dinner constraints:
- Client eats meat. Order from the standard menu.
- Book the usual restaurant.
- Confirm parking.

The second version has no "not" for the model to drop. The constraint survives as a plain assertion, "client eats meat," instead of a reversal the model has to track. (This is an illustration of a writing habit, not safety advice: a real allergy, medication, or dietary-restriction note deserves a human double-check, never blind trust in an AI's read.)

What to do with your notes tomorrow

Three moves, none of which require a new tool. Rewrite every load-bearing "not" as a positive statement. Give each constraint its own line so nothing hides mid-paragraph. Then grep your notes for the words that flip meaning — not, never, except, avoid, don't — and re-read the sentences the AI is most likely to misread.

1. Invert the negation. "Don't send before legal signs off" becomes "Send only after legal signs off." Same rule, no reversal to track.
2. Isolate it. One constraint per line. A "not" alone on its own line is far harder to skip than a "not" in the fourth clause of a sentence.
3. Front-load it. Put the constraint where extraction happens, near the top of the note or the section, not trailing after three lines of context.
4. Grep the fragile words. Because plain-text notes are searchable, run a search for not, never, except, avoid, and don't, and treat every hit as a sentence to double-check.
5. Re-check the load-bearing read. When the AI summarizes or acts on the note, verify the one sentence you most needed it to keep — the same discipline that makes a personal RAG auditable ⁹ and that keeps you from trusting the AI to add up the numbers in your notes. ¹⁰

Frequently Asked Questions

Do LLMs understand negation? Not reliably. Peer-reviewed benchmarks find language models show "insensitivity to the presence of negation" and "a failure to reason under negation," ¹ and that they classify affirmative sentences well but "struggle with negative sentences," "relying on superficial cues." ³ They often get "not" right, but not dependably enough to bury a critical one and walk away.

Why does ChatGPT ignore the word "not"? Because a model predicts likely text rather than parsing logic, and its attention tends to fixate on the concept you named rather than the negation attached to it — forbid the pink elephant and the elephant is what the model attends to. A 2026 analysis traced this to "late-layer attention behavior that promotes simple shortcuts." ⁶

Why does the AI do the opposite of what I asked? Because a negated instruction is fragile, and dropping the "not" flips the meaning. One 2026 study found small models that endorsed an action 24% of the time when asked affirmatively did so "up to 100%" of the time when the same question was negated — a swing of as much as 76 percentage points. ⁵ The instruction inverted.

Can AI follow "do not" instructions? Unreliably. OpenAI's own prompt guidance recommends the opposite construction, "instead of just saying what not to do, say what to do instead," and flags a stacked DO NOT instruction as its "less effective" example. ⁸ State the positive rule you want enforced, not the thing to avoid.

Does AI understand "except" and "never" in my notes? Treat them like "not." As the MIT study's lead author put it, "regardless of how you express negation or exclusion, the models will simply ignore it." ² Exclusion words — except, never, avoid, without — are the same failure mode. Rewrite them as positive rules and give each its own line.

How should I write instructions so the AI doesn't misread them? Say what to do, not what to avoid; put one constraint per line; and place it near the top where extraction happens. A rule stated positively and isolated on its own line has no "not" to drop. This is grounded in how models attend to negated concepts ⁶ and in OpenAI's published guidance. ⁸

Is a buried negation in a note a problem for AI summaries? Yes — a "not" in the middle of a paragraph is the fragile case. Negation appears in about two-thirds of ordinary descriptive sentences, ³ and models handle it worst exactly where it hides. Front-load the constraint, isolate it on its own line, and re-read the summary against the sentence that matters.

The model will not slow down for your most important sentence. You have to write it so it cannot be skipped.

MNMNOTE keeps notes as plain Markdown on your own device, where every "not" and "never" stays greppable enough to check yourself — mnmnote.com.