Question bank — Guardrails and constrained generation

False. A guardrail acts around generation (filter the input or reject the output), while constrained generation acts inside the sampler at every step; you cannot force valid JSON by post-hoc filtering without wasteful rejection sampling.

False. It guarantees the output matches a formal grammar (e.g. valid JSON), but a valid JSON string can still contain toxic or false content — safety is a fuzzy property a grammar cannot express.

Effectively true in floating point: $e^{-10^9}$ underflows to $0$, so after softmax its share is $0$; literal $-\infty$ is avoided only because it produces NaN in the arithmetic.

False. Logit $0$ becomes probability $e^0/{\sum }_{j=1}^V{e}^{z_j}>0$, so the token survives — and a token whose logit was negative is boosted up to $0$, making it more likely.

False. The regex constraint proactively forbids off-pattern tokens during decoding so the format is always valid; an LM-judge only reviews finished text and may itself be wrong.

False. It only edits the logits $z$ at sampling time via a mask; the trained parameters are untouched, which is why the same model can serve constrained and unconstrained requests.

False. softmax renormalises over only the surviving (valid) tokens, so their probabilities are rescaled to sum to $1$ no matter how small the original logits were.

False. Input guardrails stop prompt injection and jailbreaks that could corrupt tool calls or leak instructions before any output exists — see adversarial attacks on LLMs.

Not necessarily. It prunes only illegal tokens; if the model already wanted valid output, the distribution over legal tokens is unchanged, so fluent legal outputs stay just as likely.

False. Regex catches only surface patterns; paraphrases like "I'll make sure you're compensated" slip past keyword filters, which is why fuzzy content needs a classifier or LM-judge.

Wrong operation. Elementwise multiply leaves valid tokens with logit $z_i$ but sets invalid ones to logit $0$ (probability $>0$), not zero probability. The fix is to add a $-\infty$ bias before softmax (see the first figure's right panel).

Risky. During the subtract-the-max stabilisation step (defined above), $-\infty$ minus ${\max }_j{z}_j$ stays $-\infty$ and its exponential is fine, but if $-\infty$ is the max it poisons the shift and yields NaN; production code uses a large finite negative like $-10^9$.

That is rejection sampling, not constrained decoding. It can loop forever if the model rarely emits valid JSON; constrained decoding forbids the invalid token at the step it would be sampled.

Wrong. The mask depends on the current prefix $x_{<t}$ (the tokens $x_1,\dots ,x_{t-1}$ decoded so far) — after { only " or } are legal, so the parser recomputes the legal set at every step as $x_{<t}$ grows.

Wrong tool. 'Promising a refund' is a fuzzy content policy, not a formal grammar — that belongs to a guardrail (regex + LM-judge), as in the parent's customer-service example.

Wrong. The masked tokens contribute $e^{-10^9}\approx 0$ to the denominator ${\sum }_{j=1}^V{e}^{z_j}$, so the sum is effectively over valid tokens only — that is why renormalisation is automatic.

Because softmax is what converts scores $z$ to probabilities; masking before it lets the exponential and normalisation do the zeroing cleanly (see figure 1). Masking after softmax would require you to re-normalise the remaining probabilities by hand — the exact bug SE6 exposes.

The constraint prunes illegal branches at each step, so the model never wastes a full generation on output it will discard; a reject-and-retry guardrail (SE3's rejection sampling) may burn several complete generations.

A competitor name can appear in infinitely many phrasings and contexts, which no finite-state grammar captures cleanly; content-level rules like this are better handled by a guardrail classifier — exactly why SE5's tool choice is wrong.

Because grammars track state — whether you are inside a string, mid-number, or after a comma — and that state accumulates over the whole prefix $x_1,\dots ,x_{t-1}$, so nesting depth and open quotes matter; a single last token cannot reveal how deep you are.

They cover complementary failure modes: the constraint guarantees format validity while the guardrail checks content safety; a valid-JSON toxic comment (the TF2 trap) needs both to be caught.

Injection corrupts the model's intent before it decodes, so a valid, well-formatted, on-schema output can still be doing exactly what the attacker wanted; you must inspect and sanitise the input. See function calling and tool use where injected text can trigger unintended tools.

The mask only zeroes illegal tokens; temperature and top-p from sampling strategies then reshape the distribution over the remaining legal tokens, so the two operate on disjoint concerns and compose. Because masking only edits logits (TF6), it never touches the sampler that runs afterwards.

All logits become $-10^9$ and softmax degenerates — a well-built constraint compiler prevents this by ensuring the grammar's state machine always has an exit (e.g. a closing brace path), or by allowing the end-of-sequence token.

softmax over a single surviving logit returns probability $1$ for it regardless of its raw value, so decoding is forced — the model has no choice, which is exactly how required structural characters like closing quotes get emitted.

The grammar is a state machine over characters, so it must forbid more than just the digit set: after "rating": it disallows a leading - (no negatives), disallows a . (no decimals), and — because the value tops out at a single digit — after emitting one of 1–5 it forbids a second digit and forces a delimiter. For a wider range like min 1, max 250 the machine would instead permit one, two, or three digits and check the running value against the bound at each digit, blocking 9 after 25 because 259 > 250. Multi-digit, negative, and decimal handling is thus all encoded as extra states, not a flat digit whitelist.

Only if the grammar's start state can legally reach end-of-sequence immediately; for a required-field JSON schema it cannot, so the opening { is forced and an empty string is impossible.

The behaviour is a design choice, but a boundary score signals an ambiguous case; robust systems either escalate to an LM-judge or apply a conservative 'block on tie' policy rather than leaving it undefined.

No. Alignment from RLHF and preference learning shifts the model's tendencies but gives no hard guarantee; guardrails add an independent, auditable layer that fails safe even when alignment is bypassed.

At every trust boundary — one agent's output is another's input, so both output guardrails (before hand-off) and input guardrails (on receipt) are needed, as discussed in multi-agent systems.