Inside the Guardrails
How Today’s AI Models Are Made Safe, in Plain English
Welcome
Every week, a new AI model is released with a long document called a system card. It says the model was trained to be helpful and harmless. It lists safety tests, red teams, classifiers and thresholds. It is full of words like RLHF, constitutional classifiers, sparse autoencoders and chain-of-thought monitoring.
This book explains what those words mean and how the methods behind them really work. It assumes no machine-learning background. If you can follow a short story and a for-loop, you can follow this book.
How the book works
One story. Lantern Labs, a small AI lab in London, has six weeks to launch its first assistant model, Wick. The launch customer, a publisher, has one hard rule: Wick must never reveal the ending of Book Seven of a bestselling fantasy series before publication day. Nadia Okafor, Lantern’s new safety lead, has to make that promise true, and prove it. Every chapter adds one safety layer and teaches you one technique.
One real model. Lantern tries every layer on a small test model called Wick-mini. Wick-mini is real: it is Qwen3-0.6B, an open model, fine-tuned by this book’s lab notebooks. Every number about Wick-mini in this book comes from a real run, and you can repeat each run yourself on a free Colab GPU.
Real research, with its limits. When the book describes a research result, a box tells you who did it, what they measured, what they found, and what it does not show.
What this book will not contain
This book explains how attacks on AI models work at the level of principle: the weakness each one exploits, how it gets spotted, and how it is defended against. It contains no working jailbreak prompts, no injection payloads and no step-by-step attack instructions. When a chapter needs an example of an attack, the example is a reader trying to get Wick to spoil Book Seven.
How to read it
Read it in order the first time: the story runs from the first chapter to the last. Boxes marked Under the hood hold the formulas and code; you can skip every one of them and still follow the book. Each chapter ends with a table of terms in English and Chinese.
This is a work-in-progress edition (October 2026): the Prologue, Parts I–III complete (Chapters 1–14), and two sample chapters from Part VI (Chapters 23–24). The full table of contents has 27 chapters.