Researchers found a cheap way to make AI models more suspicious of sneaky prompts: train them on unrelated trick questions first.
A new paper introduces training data called "cunning questions" - prompts that have nothing to do with safety but contain misleading premises, faulty logic, or subtle inconsistencies designed to trip up a model's reasoning. The bet is that if a model learns to catch these logical traps in mundane contexts, that same skepticism carries over to real jailbreak attempts, which often hide harmful requests inside innocuous-sounding scenarios. Across nine combinations of model and benchmark, layering this training on top of an existing safety alignment pipeline cut the average attack success rate from 17.40% to 15.05%. Tracing how the models reached their answers, the researchers also found that safety judgments started kicking in earlier - before the model began planning a harmful response, rather than after.
Most jailbreak defenses work by recognizing dangerous topics or keywords, which is exactly what attackers route around by dressing up harmful requests as puzzles, roleplay, or hypotheticals. Training models to be generally vigilant, rather than handing them a list of red flags, is a different kind of lever - one that does not require anticipating every disguise an attacker might invent.
Still, a model that has learned to ask "wait, does this premise actually make sense" is at least behaving like something that thinks, rather than one running down a blocklist.