Foundations — Guardrails and constrained generation

This page builds every symbol the parent note throws at you, starting from "what is a token". If a symbol appears in the parent note and you can't yet draw it, it lives here.

1. The token — the atom of everything

Picture a sentence broken into puzzle pieces:

Look at the figure. The sentence "rating": 5 is not one thing to the model — it is the ordered pieces "rating", :, 5. Each piece is one token. The model's whole life is: given the pieces so far, pick the next piece.

Why the topic needs it. Constrained generation works token by token — it decides "which pieces am I allowed to place next?" So we must know that text is a sequence of atoms before anything else makes sense.

2. The vocabulary and the index $i$ — every possible next piece

Look at the numbered shelf in the figure: seat $i=0$ holds ", seat $i=1$ holds }, seat $i=7$ holds cat, and so on. When the parent note writes "token $i$", it means the token sitting in seat $i$.

Why the topic needs it. Masking says things like "set the bias for token $i$ to $-\infty$." That sentence is meaningless unless $i$ is a concrete address in a fixed list. Every token in the vocabulary is a candidate for the next step, whether it makes sense or not — that's exactly why we later need to forbid some.

3. The step counter $t$ and the prefix $x_{<t}$ — "where are we so far?"

Read the subscript literally: $x_{<t}$ = "$x$ at positions less than $t$."

Why the topic needs it. The whole rule "what may come next depends on what came before" is written $P(x_t\mid x_{<t})$. The prefix is the memory the grammar-parser reads to decide the legal next moves.

4. Logits — the raw scores ${\text{logits}}_t[i]$

Look at the bar chart. Tall bars = large logits (the model likes that token); bars dipping below the line = negative logits (the model dislikes it). Crucially, a logit of $0$ is not "off" — it's just middling, and a logit of $-3$ still leaves that token possible.

Why the topic needs it. Constrained generation edits logits (not probabilities). To edit them correctly we must understand they live on the whole number line, so "shifting one down to $-\infty$" is the natural move — see §7.

5. Turning scores into a die: softmax and $e^x$

We can't roll a die on raw scores — some are negative, they don't add to 1. We need to turn the whole score list into probabilities: all non-negative, summing to 1. The tool that does this is softmax, and it is built from the exponential function $e^x$.

Look at the curve. Follow it leftward (toward very negative $x$): it hugs zero but stays positive. This single behaviour — "push $x$ to $-\infty$ and $e^x$ becomes exactly $0$" — is the entire mechanism of constrained generation.

6. Probability $P(\cdot \mid \cdot )$ and the sampling roll

Sampling = literally rolling the weighted die this distribution describes to pick the actual next token. The parent's phrase "sample token $x_t$ from the distribution" means exactly this.

Why the topic needs it. Guardrails act after this roll (inspect $x_t$, maybe reject). Constrained generation acts on the numbers before the roll. Same die — two different moments to intervene.

7. The mask bias ${\text{maskbias}}_t[i]$ — the surgical tool

Now everything is in place to state the topic's central object.

Trace it through §5's curve. A forbidden token's score becomes ${\text{logits}}_t[i]+(-\infty )=-\infty$, so its numerator $e^{-\infty }=0$, so its die-probability is $0$. Legal tokens keep their scores and simply re-share the whole probability among themselves.

This is the same numerical trick that safety-tuning (5.1.5-RLHF-and-preference-learning) and function-calling schemas (6.2.8-Function-calling-and-tool-use) rely on to force well-typed tool arguments.

8. The grammar / finite-state machine — who decides "legal"?

After a JSON {, the FSM sits in a state whose only outgoing arrows are " (start a key) or } (close). Every other token gets $\text{maskbias}=-\infty$. That's the bridge: the FSM reads the prefix $x_{<t}$ and paints each seat $i$ legal (bias $0$) or forbidden (bias $-\infty$) — see 7.3.2-Adversarial-attacks-on-LLMs for why a content attacker can slip through a format-only FSM.

Prerequisite map

Equipment checklist

Cover the right side and answer out loud.