Oct 24, 2026 · @Rick
Draft v2, restructured for publication
Grammar-constrained decoding guarantees that an LLM classifier emits valid structured output, but it does so by discarding information: at every forced position, the model's own next-token distribution is replaced by a masked one. We show that this discarded distribution is a useful security signal. We define constraint pressure, the divergence between the raw and grammar-masked distributions summed over the output, and argue that it measures how hard the decoder is overriding what the model wanted to say. For a clean input and a well-exemplified format, pressure is near zero. For an input that successfully redirects the model, such as a prompt injection, the model wants to obey the injected instruction or break into prose, and the grammar hides this while pressure records it. The familiar practice of scoring a classifier by the log-probability o