Worked examples — Guardrails and constrained generation

This page is the "no surprises" drill for Guardrails and constrained generation. We will build one scenario matrix of every case class the topic can throw at you, then work each cell to the ground. If you have not yet seen how a mask turns logits into probabilities, read the parent note first — but every symbol is re-earned below from zero.

Look at the first figure: three logits go in on the left, softmax squeezes them into a bar chart of probabilities on the right that sums to $1$.

---

The scenario matrix

Every question this topic can ask lands in one of these cells. The worked examples below are tagged with the cell they cover.

Cell	Case class	What makes it tricky
A	Mask one token, positive logits only	baseline sanity check
B	Mask a token that had a negative logit	the "multiply-by-0" trap
C	All-but-one tokens masked	degenerate: forced token, prob $=1$
D	All tokens masked	degenerate: division by zero — must detect
E	Zero tokens masked	constraint is a no-op; softmax unchanged
F	Finite $-10^9$ vs literal $-\infty$	limiting behaviour, why NaN is avoided
G	Multi-step grammar (JSON prefix)	valid set changes each step
H	Word problem: refund guardrail	reactive filter, not a mask
I	Exam twist: multiplicative mask boosts a bad token	proving the parent's warning numerically

---

Example A — mask one token, all logits positive (Cell A)

Forecast: guess first — does { become the most likely token now that 9 is gone?

1. Apply the mask. Set $m=[0,0,-\infty ]$, so the biased logits are $[2,1,-\infty ]$. Why this step? Adding $-\infty$ to the forbidden logit makes $e^2,e^1,e^{-\infty }=(e^2,e^1,0)$.
2. Sum the survivors. Denominator $=e^2+e^1+0=7.389+2.718=10.107$. Why this step? Softmax's denominator only counts allowed tokens now, so probabilities renormalize automatically.
3. Divide. $P(\text{{})=7.389/10.107=0.731$, $P(\text{"})=2.718/10.107=0.269$, $P(9)=0$. Why this step? This is softmax applied to the two survivors.

Verify: $0.731+0.269+0=1.000$ ✓ and the highest-logit allowed token { won, as expected.

---

Example B — masking a token that had a negative logit (Cell B)

Forecast: b already had a low logit — does masking it barely change anything?

1. Additive mask. Biased logits $[0.5,-\infty ]$, so $P(a)=e^{0.5}/(e^{0.5}+0)=1.0$, $P(b)=0$. Why this step? $e^{-\infty }=0$ kills b completely regardless of how negative it already was.
2. Compare to no mask. Un-masked: $P(a)=e^{0.5}/(e^{0.5}+e^{-3})=1.6487/(1.6487+0.0498)=0.9707$. Why this step? Shows masking pushed a from $0.971\to 1.0$; it removed b's leftover $0.029$.

Verify: masked probs sum to $1.0$ ✓, and a strictly increased ✓ — masking never lowers an allowed token's probability.

---

Example C — everything masked but one (Cell C: forced token)

Forecast: does the model's preference (token 0 had the biggest logit) still matter?

1. Mask. Biased $[-\infty ,-\infty ,0]$. Why this step? Two tokens forbidden, one allowed.
2. Softmax over one survivor. $P=e^0/(0+0+e^0)=1/1=1$. Why this step? A single survivor always gets probability $1$ — the model is forced, its original logits are irrelevant.

Verify: $P=1$ for the allowed token, $0$ for the others; sum $=1$ ✓. This is exactly what happens deep inside a JSON string when only a closing quote is legal.

---

Example D — everything masked (Cell D: the degenerate crash)

Forecast: what is $0/0$?

1. Mask. Biased $[-\infty ,-\infty ]$, so numerators and denominator are all $0$. Why this step? Every $e^{-\infty }=0$.
2. Attempt softmax. $P=0/0=$ undefined (NaN). Why this step? The denominator is $0+0=0$; division by zero is not a probability.
3. The fix. A correct decoder must detect an empty valid set and either raise an error or backtrack the grammar. Never feed an all-masked vector to softmax. Why this step? This case means your grammar has a dead-end; masking cannot invent a legal token.

Verify: denominator $=0$, so no valid distribution exists ✓ — the machine-check below confirms the sum of masked exponentials is exactly $0$.

---

Example E — no tokens masked (Cell E: no-op constraint)

Forecast: is a "constraint that allows everything" the same as no constraint?

1. Mask. $m=[0,0]$, biased logits unchanged: $[1,2]$. Why this step? Adding $0$ does nothing.
2. Softmax. $P(0)=e^1/(e^1+e^2)=2.718/(2.718+7.389)=0.269$; $P(1)=0.731$. Why this step? Identical to plain sampling.

Verify: $0.269+0.731=1.0$ ✓. An all-allowed mask is provably a no-op — useful for testing your masking code by feeding it a trivial constraint. See 4.3.4-Sampling-strategies for how temperature would further reshape this.

---

Example F — $-10^9$ versus literal $-\infty$ (Cell F: limiting behaviour)

Forecast: does using a big finite number instead of $-\infty$ leak any probability to the bad token?

1. True mask. $P(\text{bad})=e^{-\infty }/\cdots =0$ exactly.
2. Practical mask. Biased bad logit $=0+(-10^9)=-10^9$. Then $e^{-10^9}$ underflows to $0.0$ in floating point. Why this step? Any input below about $-745$ makes $e^x$ round to $0$ in double precision, so $-10^9$ behaves like $-\infty$ but never produces $e^{-\infty }$'s indeterminate forms.
3. Result. $P(\text{good})=e^3/(e^3+0)=1.0$, $P(\text{bad})=0$. Why this step? Numerically identical to the true mask, but safe from inf - inf = NaN if two masked logits were ever subtracted.

Verify: $e^{-10^9}$ evaluates to $0.0$ and $P(\text{good})=1.0$ ✓.

---

Example G — multi-step JSON grammar, the valid set moves (Cell G)

Forecast: at the very start, is 5 ever a legal first character?

Look at the figure: each state of the little parser lights up a different allowed set (the red tokens are the only ones with mask bias $0$).

1. Step 1 — nothing written. Legal first char of a JSON object: only {. Mask everything else. Why this step? A JSON value here must open an object; a bare 5 would be invalid at position 0.
2. Step 2 — prefix {. Legal next: a " (start a key) or } (empty object). Digits still forbidden. Why this step? The grammar parser reads the open brace and knows only keys or a close can follow.
3. Step 3 — prefix {"r":. Now, because the schema says r is an integer $1$–$5$, legal next tokens are the digits 1–5 only. Here 5 finally becomes allowed. Why this step? The valid set is prefix-dependent — this is the whole point of constrained decoding versus a fixed blacklist.
4. Step 4 — prefix {"r": 5. Legal next: } to close. Digits now forbidden again (single-digit schema). Why this step? The state machine has consumed one integer and expects the object to close.

Verify: the character 5 has mask bias $-\infty$ at steps 1–2 and $0$ at step 3 — the same token flips legality as the prefix grows, which no static rule could capture. This is why 6.2.8-Function-calling-and-tool-use relies on schema-driven decoding.

---

Example H — word problem: refund guardrail (Cell H, reactive)

Forecast: will a simple keyword rule catch this? Would it catch "I'll make sure you're compensated"?

1. Regex pass. Pattern \b(refund|money back|reimburse)\b matches refund → 1 match. Why this step? Fast, cheap first line of defence — catches the explicit word.
2. Guardrail fires. Since match count $\ge 1$, replace the response with the fallback: "I'll escalate this to a human agent." Why this step? This is reactive filtering (generate → check → replace), not masking — the model already produced the sentence.
3. Edge case. "I'll make sure you're compensated" has 0 regex matches, so it slips through; you would add an LM-as-judge from 5.1.5-RLHF-and-preference-learning-trained models to catch the paraphrase. Why this step? Guardrails handle fuzzy meaning; constrained generation cannot, because "promising a refund" is not a formal grammar.

Verify: regex match count on the first sentence $=1$ (fires) and on the paraphrase $=0$ (misses) ✓ — demonstrating why guardrails are probabilistic, unlike the guaranteed validity of masking. See also 7.3.2-Adversarial-attacks-on-LLMs for how attackers phrase around keyword rules, and 6.2.11-Multi-agent-systems for a separate judge agent.

---

Example I — exam twist: multiplicative masking boosts a forbidden token (Cell I)

Forecast: the parent note warned about this — by how much does BAD go up?

1. Correct additive mask (reference). Biased $[1.0,-\infty ]$ → $P(\text{BAD})=0$, $P(\text{ok})=1$. Why this step? Establishes the correct target: a truly forbidden token must reach probability exactly $0$, so we can measure how badly the wrong method deviates from it.
2. Student's multiplicative mask. Multiply BAD's logit by $0$: it becomes $0.0$, not $-\infty$. New logits $[1.0,0.0]$. Why this step? Multiplying by $0$ sets the logit to $0$, but a logit of $0$ is a perfectly ordinary, non-forbidding value.
3. Softmax. $P(\text{BAD})=e^0/(e^1+e^0)=1/(2.718+1)=0.269$. Why this step? Compare to BAD's original probability $e^{-2}/(e^1+e^{-2})=0.1353/(2.718+0.1353)=0.0474$.
4. The disaster. The forbidden token went from $0.047$ (allowed model) to $0.269$ — a 5.7× increase — because multiplying a negative logit by $0$ raises it toward $0$. Why this step? This is the concrete proof behind the parent's mistake callout: multiplicative masking can promote exactly the tokens you meant to ban.

Verify: multiplicative-mask $P(\text{BAD})=0.269>0.0474=$ original ✓; additive-mask $P(\text{BAD})=0$ ✓.

---

Recall Self-test

Why must an all-masked logit vector be caught before softmax? ::: The denominator becomes $0$, so softmax returns $0/0=$ NaN; the grammar has a dead-end and no legal token exists. In Example G, why is 5 illegal at step 1 but legal at step 3? ::: The valid token set is prefix-dependent; only after {"r": does the schema's integer field open, so digit 5 earns mask bias $0$. Multiplying logit $-2$ by $0$ gives $0$. Is $0$ a "forbidding" value? ::: No — a logit of $0$ yields positive probability after softmax and here boosts the token, which is exactly the multiplicative-mask trap.