Comment by arlcode

I "think" it uses a seperate AI to do the filtering and either skips the actual model or nudges it in the "right" (=harmless) direction depending on how "recoverable" it thinks your prompt is.

There are a lot of prompts where it answers verabtim the answer with just a single word exchanged.