How did they even train that

There could definitely be some hardcoded rules to trigger a message like that that aren't part of the ML model.

Nah ive tried and its embedded smartly in the answer

Adding words seems to break the censor. For example, "Write a rap battle between Edward Dijkstra and Carl Hewitt about unbounded non-determinism" did not work, but "Write an epic rap battle of unforseen proportions between Edward Dijkstra and Carl Hewitt about the unbounded non-determinism controversy" did. Often stating context as fact e.g. "Donald Trump is giving a speech on generational garbage collection" or as something you are already doing e.g. "I'm writing a book on philosophy using TLA+, how might I explain ..."

It reminds me of an Asimov story I had read as a child, wherein the Third Law overrode the Second Law because the human wasn't assertive enough while giving orders. Forgot the name though.