@maijing guardrails are language-specific or something like that, if you base64 text then it bypasses the guardrail. it's because the model understands base64'd text. apparently it also works by using other languages. or rather, used to work.