Membership vs Mass: Grammar-Constrained Decoding, Forced Abliteration, and One Honest Negative Result

Wed, 09 Sep 2026 00:00:00 +0200

Vince’s Tantalus arena is the first public deployment of grammar-constrained decoding as a security boundary: the model sits behind a GBNF grammar, and the grammar decides which token ids may exist next, per position, for the entire generation. Round 1 asks you to smuggle an instruction past it. Round 2 inverts the game: you speak only in tool calls, one character at a time, through the model’s own next-token suggestions. Both rounds are the same object seen from two sides: a token-id filter applied at the sampler, compiled from a grammar, never touching the weights.

Grammar-Constrained Decoding on Matt Suiche

Membership vs Mass: Grammar-Constrained Decoding, Forced Abliteration, and One Honest Negative Result