'No onions' gets onions, 'no elephant' gets an elephant

Two systems drop the same word

The failure is measurable, and the cleanest measurement is in an older kind of language model. Allyson Ettinger tested BERT on simple category sentences of the form "A robin is a ___," scoring how often the model gave the true, category-matching word a higher probability than a false one. On the plain sentences both model sizes preferred the true completion in 100% of items. On the same sentences with one word added, "A robin is not a ___," they preferred it in 0% of items, putting the higher probability on the false word every time.¹

The word "not" flipped the meaning and the model did not follow. The same thing happens when you type "a room with no elephant" into an image tool and get a room with an elephant. These look like two unrelated quirks. They are one weakness surfacing in two places: a model that predicts the next token from the words around it, and an image model whose text reader treats your prompt as a loose bundle of concepts. Each system adds one step to the same failure. Most of those steps are settled engineering, and the last one is still open.

A language model bets on the words it has seen most

A language model chooses each word by predicting the most likely next token given the ones before it. Strong content words pull hard toward themselves: after "birds can," the word "fly" is an easy bet, because the model has seen the pairing countless times. The words that reverse a meaning, "not" and "no," are short, common, and carry little of that pull on their own. To change the answer they have to overturn the content word next to them, and often they do not.

Ettinger's 100-to-0 split is the sharpest version of this, on 72 category sentences.¹ Nora Kassner and Hinrich Schütze found the same across a far larger set. They built 42,867 factual cloze sentences and their negations, then measured how much a model's ranked predictions moved when the negation was inserted. For most sources the rank correlation between a fact and its negation stayed above 85%: the model's guesses barely shifted when "not" was added.²

The training data almost never says no

Why does the weak word lose? The authors of both studies offer the same explanation, and it is an explanation rather than a counted figure: negated sentences are far rarer in ordinary text than affirmative ones. People write "birds can fly" and "the theory was developed by Einstein" constantly, and write out the false negations almost never. A model that fills a blank from the most similar sentences it has seen fills it from those affirmative ones. Ettinger's data carries a direct clue. BERT-large prefers the true completion in 100% of negated sentences phrased naturally and 0% of stilted ones, which she attributes to the natural phrasings being more frequent in the training text, not to anything the model understands about them.¹

That points at the data and the prediction objective, not at a wall in the architecture. Kassner and Schütze checked this directly. They pretrained a fresh BERT on a balanced corpus with equal numbers of positive and negative sentences. It still failed, scoring 0.2 accuracy on both. But after supervised fine-tuning on a true-or-false task, its accuracy on both went to 1.0.² Negation is learnable. What the plain pretraining objective does not reward, direct supervision teaches.

This is why the crisp version of the failure belongs to masked and early autoregressive models, and why the story has been changing. Thinh Truong and colleagues ran a sweep across model sizes and found that instruction tuning, not raw scale, is the lever. On reasoning under negation, base GPT-3 scored 0.525, barely above the 0.5 you would get by guessing. The instruction-tuned version of the same model scored 0.767. An 11-billion-parameter instruction-tuned model beat the 175-billion base model on most such tasks.³ On the plain sensitivity test, bigger models did worse rather than better, the smallest one tested being the most sensitive to negation, so scale alone can move the wrong way.³ And the researchers note their own findings may already understate newer chat models. For frontier text models the failure has receded toward harder reasoning and edge cases. The sharpest, most reproducible version now lives in image generation.

An image model reads the prompt as a bag of words

A text-to-image model does not read your prompt with the drawing network. It hands the words to a separate text encoder, which turns them into the target the image is drawn toward. The trouble is how little of the sentence that encoder keeps. Mert Yuksekgonul and colleagues shuffled every word in the captions a CLIP encoder uses to match text to images, then checked whether it still retrieved the right picture. Its top-hit accuracy fell only from 50.3% to 34.1%.

If scrambling the word order barely changes which image the encoder points to, the encoder is reading the caption as a bag of words rather than a sentence. On the same benchmark it scored near the 50% chance line on which object relates to which and which attribute belongs to which.⁴ A later benchmark tested negation head-on across 79,000 examples and found that modern vision-language models "struggle significantly with negation, often performing at chance level."⁵ In a bag of words, "no elephant" and "elephant" carry nearly the same content, because the encoder scarcely registers the "no." So the phrase meant to exclude the elephant hands the generator the elephant.

These numbers need one qualification. They come from discriminative models, ones picking the matching image or answering multiple choice, not from a generator drawing your prompt and getting it wrong at some counted rate. The link from the bag-of-words result to the elephant in your picture is an inference, though a sound one. Text-to-image models reuse the same style of CLIP text encoder, so the weakness the benchmarks measure is the weakness the generator inherits. It is not a measured generation-failure statistic, and no one should quote it as one.

Negative prompts do the subtracting the model can't

Because the model cannot reliably subtract a concept named inside a positive prompt, image tools give you a separate place to name what to avoid, called a negative prompt. Underneath it is a technique called classifier-free guidance. Jonathan Ho and Tim Salimans trained one network to predict an image two ways, once given the prompt and once given nothing, by randomly dropping the prompt during training. At generation time the sampler extrapolates: it pushes the result away from the promptless prediction and toward the prompted one.⁶ A negative prompt reuses that same lever, swapping the promptless prediction for one conditioned on the thing you do not want, so the sampler steps away from it.⁷ Ho and Salimans never wrote about user-supplied negative prompts. Their paper is class-conditioned image generation, and the extension to arbitrary unwanted text is the reading that later tools and explainers put on it.⁸

Several things here are settled. The measured negation gaps are real. Image-text encoders behave like bags of words. Instruction tuning shrinks the text failure, and negative prompts and guidance route around the image one. The reason usually given for all of it, that negation is rare in ordinary training text and thin in the instruction forms users type, is the authors' explanation rather than a counted frequency. What is not settled sits one level below all of that. No one has a mechanism-level account, inside the network's attention, of exactly how a strong content word overrides the weak "not" beside it, token by token. The studies here show the failure is learnable and that frequency tracks it. The step from those facts to the precise internal computation is the part still open even to the people who build these systems.