PaperlayerView exact revision on arXiv

Source-linked AI summary

Decoding-Level Taboo: A Diagnostic Stress Test for LLM Robustness

Tadanobu Chuyo Kamijo, Ori Rottenstreich, Javier Conde, Gonzalo Martínez, Pedro Reviriego

arXiv:2608.09900v2cs.CL

TL;DR

Standard LLM evaluations probe narrow nominal decoding paths, leaving off-path robustness insufficiently measured. Decoding-Level Taboo intervenes in logit space at word boundaries, and results across open-weight families show robustness generally improves with model scale and instruction alignment.

  • Problem

    Standard evaluations mainly probe narrow nominal token paths, leaving adaptable off-path reasoning insufficiently assessed.

  • Method

    Decoding-Level Taboo is a zero-prompt runtime stress test that masks preferred word-initial tokens directly in logit space.

  • Results

    Across four open-weight families and four benchmarks, off-path robustness is jointly governed by parameter scale and post-training instruction alignment.

  • Takeaways & Limitations

    Taboo is positioned as a runtime primitive for safety auditing, synthetic reasoning-trajectory discovery, structured-output stress-testing, and policy alignment.

  • Takeaways & Limitations

    The evaluation suite spans several task types, but other tasks and benchmarks remain unevaluated.

Abstract

from arXiv · show

Large language model evaluations typically focus on performance under nominal conditions, creating an illusion of capability where models comfortably walk a narrow, highly optimized generation corridor. In real-world deployments, however, complex system prompts, safety guardrails, and structural constraints continuously force models off this nominal path, driving a divergence between benchmark scores and deployment performance. To address this issue, we introduce Decoding-Level Taboo, a zero-prompt diagnostic stress test that intervenes directly in logit space at runtime, forcing models out of their nominal paths. By dynamically masking primary candidate tokens at word boundaries, Taboo forces machine circumlocution. Evaluating Taboo across several open-weight model families reveals that off-path robustness is heavily influenced by both parameter scale and post-training instruction alignment, with robustness generally improving with model size and alignment. Beyond the results presented in this paper, Taboo provides a novel primitive for generating diverse synthetic datasets, stress-testing runtime safety guardrails, and auditing model reliability prior to real-world deployment.

1 Introduction

The introduction argues that nominal-condition evaluations can obscure LLM robustness under real-world constraints, which force generation off preferred decoding paths. It presents Decoding-Level Taboo, a zero-prompt runtime intervention in logit space that masks primary candidate tokens to diagnose off-path reasoning.

  • Motivation: Nominal evaluations assess narrow preferred-token paths and may create an illusion of capability by obscuring whether models possess adaptable, robust reasoning.This concern motivates testing beyond standard leaderboard conditions.
  • Motivation: Complex instructions, safety guardrails, structured outputs, and negative constraints force models off nominal decoding corridors, but their reasoning resilience under continuous stress remains unclear.The introduction frames this as a deployment-relevant gap in current evaluation.
  • Limitations of prior evaluation: Prompt-based non-nominal benchmarks cannot cleanly distinguish instruction noncompliance from collapse of the underlying logic engine under off-path pressure.Prompt modifications also introduce confounds such as instruction-parsing overhead, phrasing sensitivity, and attention drift.
  • Decoding-Level Taboo: Decoding-Level Taboo holds prompts fixed and dynamically masks primary candidate tokens at word-start boundaries during autoregressive decoding, forcing machine circumlocution.The method intervenes directly in logit space at runtime rather than through the prompt interface.
  • Diagnostic measure: Injected surprisal quantifies the distributional shift caused by diverting a model from its preferred decoding corridor, isolating off-path execution from prompt interpretation.The stated goal is to assess whether multi-step reasoning remains structurally intact under forced divergence.
  • Main contributions: Across four open-weight families, the reported Taboo effect widens with scale, varies by family, is task-specific to generative reasoning, and is bounded by formal syntax.The effect is absent in Llama-3 at 7–8B, reappears by 70B, and HumanEval collapses to zero.

2 Decoding-Level Taboo

Decoding-Level Taboo is a zero-prompt diagnostic that forces autoregressive models off their nominal decoding paths by masking top candidates in logit space. It applies this intervention at word boundaries, preserves subword completion, and quantifies the resulting off-path stress with injected surprisal.

  • Logit-space intervention: At each decoding step, Taboo masks the top i logit candidates with −∞, setting their conditional probabilities to zero and forcing a lower-ranked alternative.The taboo rank i is the mask width; the selected token is the highest-scoring unmasked candidate.
  • Word-boundary restriction: Masking mid-word subwords collapses GSM8K accuracy to 0.01–0.05 at matched mask width i = 2 across all four evaluated model families.This ablation motivates restricting Taboo to word starts to separate semantic reasoning from tokenization corruption.
  • Word-boundary restriction: Interventions trigger only when the nominal top candidate begins a new word, while mid-word subword continuations remain completely unmasked.Word-initial status is precomputed from tokenizer-specific boundary markers, though the predicate can miss first tokens, punctuation-attached words, and numerals.
  • Behavioral implications: Taboo exposes a divide between natural language, which can use synonyms and circumlocution, and formal code, where mandatory structural keywords or operators have near-zero lexical redundancy.The intervention changes decoding paths without systematically breaking forbidden-word constraints: aggregate IFEval compliance changes by +0.0 to +0.2 across families.
  • Stress quantification: Injected Surprisal ∆S_t measures the extra surprisal, in bits, of the forced alternative under the nominal distribution, with ∆S_t = 0 when no intervention occurs.Total off-path stress S_total accumulates stepwise surprisal, while Mean Injected Surprisal Per Intervention normalizes it by the number of word-boundary interventions.

3 Experimental Setup

The experiments compare base and instruction-tuned open-weight models across four benchmark tasks under standardized, deterministic evaluation, with performance measured nominally and under Decoding-Level Taboo. The setup spans model families and scales while controlling for quantization and isolating conditional off-path retention.

  • The evaluation compares base and instruction-tuned models across four distinct benchmark tasks in a controlled off-path decoding environment.
  • The model suite covers Qwen2.5, Gemma-3, Llama-3, and OLMo-2 families, spanning parameter scales from 0.5B to 72B.
  • Quantization does not drive the findings: across 50 GSM8K model-dose cells, the median absolute 4-bit–bf16 accuracy difference is 0.03 and 47 of 50 differences are ≤0.07.The larger discrepancy is Qwen2.5-14B-Instruct at i=2, with 0.62 bf16 versus 0.44 4-bit; 8-bit reruns further examine precision effects.
  • The suite contrasts semantic flexibility with rigid syntactic constraints using GSM8K multi-step mathematics and MMLU four-way multiple-choice questions under fixed answer formats.For MMLU, the single-letter answer token is word-initial, so Taboo directly masks the target choice rather than forcing semantic circumlocution.
  • The study reports Nominal Accuracy and Taboo Accuracy, while Conditional Retention isolates off-path reasoning resilience from nominal capability and stochastic recovery on base-incorrect items.Conditional retention ranges conceptually from R = 100% for total immunity to R = 0% for complete logic collapse under off-path stress.

4 Empirical Results and Analysis

Decoding-Level Taboo reveals that off-path robustness generally benefits from instruction tuning and scale on multi-step generative reasoning, but these effects vary by model family and task. TriviaQA remains resilient through lexical flexibility, whereas MMLU and HumanEval expose format-specific failure modes.

  • Instruction-tuning effects: At i = 1, instruction tuning raises GSM8K conditional retention from 8% to 48% in Qwen2.5-7B, 15% to 45% in OLMo-2-7B, and 25% to 90% in Gemma-3-12B.The alignment benefit persists across taboo doses, with Gemma showing the largest improvement among these families.
  • Instruction-tuning effects: Llama-3.1-8B is an exception: GSM8K retention is 14% vs. 16% at i = 1 for base and instruct checkpoints, with both falling to ∼5% by i = 8.Increasing its generation budget to 1024 tokens leaves retention unchanged at 22% vs. 24% at i = 1, indicating the issue is not answer truncation.
  • Scale effects: On Qwen GSM8K at i = 1, base retention rises with size overall from 6% at 0.5B to 59% at 32B, while instruct retention reaches 93% at 32B and 85% at 72B.The base trend is non-monotone because 7B dips to 8%, while alignment compounds the scale effect.
  • Task dependence: Scale does not recover MMLU performance, which collapses toward the multiple-choice guessing floor at every size, while TriviaQA degrades gracefully and retains a small base–instruct gap.On MMLU, forced re-selection can produce non-monotone responses because Taboo masks the word-initial single-letter answer.
  • Task dependence: TriviaQA has the highest global retention because natural-language answers provide substantial surface-form flexibility, whereas masking reserved keywords at word boundaries instantly breaks Python AST construction.HumanEval is an off-grid negative control: all models score near-zero, approximately 0%, except for one 1/102 cell.

5 Broader Applications of Decoding-Level Interventions

Decoding-Level Taboo extends beyond internal reasoning diagnostics as a runtime logit-space intervention. The section presents applications in evaluating refusal behavior, diversifying reasoning trajectories, stress-testing structured outputs, and regularizing verifier-based reinforcement learning.

  • Safety Alignment: Taboo masks candidate refusal tokens at decoding time to test whether safety refusals reflect deep latent alignment or shallow memorized token preferences.Prompt-level evaluations may not distinguish these mechanisms.
  • Knowledge Distillation and Reasoning Alignment: Taboo constraints at word boundaries systematically divert models from preferred reasoning paths for more diverse step-by-step trajectories in distillation and reasoning alignment.Temperature scaling and top-p sampling can produce repetitive paths or unguided entropy that harms multi-step coherence.
  • Structured Outputs: Runtime logit masking stress-tests whether models understand semi-structured schema constraints by masking preferred top tokens among allowed candidates without additional training.Relevant interfaces include JSON schemas, function calling, and API payloads; flexibility can arise from key ordering, parameter names, or free-text values.
  • Verifier-Based Reinforcement Learning: Integrating Taboo sampling into verifier-based RL rollouts can reward alternative valid reasoning paths and mitigate fragility during policy alignment.The passage gives GRPO on mathematical domains as an example.

6 Conclusion

Decoding-Level Taboo is a zero-prompt diagnostic that masks preferred tokens at word boundaries during decoding, using injected surprisal as a graded stress dose. Across four open-weight families and four benchmarks, it shows that off-path robustness is acquired through post-training alignment and scale, with the largest aligned models retaining most multi-step reasoning.

  • Diagnostic design: Decoding-Level Taboo stresses model reasoning by masking preferred tokens at word boundaries during decoding.The intervention uses injected surprisal as a measured, graded dose.
  • Evaluation scope: Applied to four open-weight families across four benchmarks, the diagnostic consistently evaluates off-path robustness.
  • Main conclusion: Off-path robustness is acquired rather than given, with post-training alignment conferring it in three of four families and scale compounding it.The largest aligned models retain most of their multi-step reasoning.

Limitations

The initial Taboo study leaves important parts of the intervention design space, sampling strategies, and task/format sensitivity characterization unexplored. Its reported retention patterns are robust across temperatures, but broader evaluation remains future work.

  • Scope of Intervention Regimes and Masking Rules: The current formulation uniformly masks the top-i candidates at every word start, leaving sparse and adaptive intervention regimes unexplored.Taboo is presented as one instantiation within a broader decoding-intervention design space.
  • Sampling and Model Coverage: 41% →85% retention at i=1 for Gemma-3-12B and 53% →91% for Qwen2.5-32B at τ=0.7 preserve the base-vs-instruct gap, while Llama-3.1-8B shows no instruct advantage.At τ=1.0, the same pattern remains, with Qwen2.5-7B increasing from 22% →58%; seed-to-seed SD is ≤0.04.
  • Sampling and Model Coverage: A full characterization across top-p nucleus filtering, higher temperatures, and every family×scale cell remains future work.The limitation concerns broader sampling-strategy and model-family/scale coverage beyond the reported conditions.
  • Task Categorization and Format Sensitivities: Task categorization and format sensitivities are identified as additional limitations requiring further characterization.The supplied passage introduces this limitation but does not provide its remaining details.

A Qualitative Failure Modes under Taboo

Under Taboo, Llama-3.1-8B-Instruct often loses coherent reasoning rather than making isolated arithmetic errors, failing to terminate through derailment, repetition loops, or degenerate expansion. These behaviors characterize its missing base-vs-instruct gap on GSM8K and flat injected-surprisal response.

  • Failure modes: On 64 GSM8K items solved at baseline but failed under Taboo at i=1, Llama-3.1-8B-Instruct commonly lost the ability to terminate coherent reasoning.The observed failures were rarely single arithmetic slips.
  • Failure modes: The three recurring degeneration modes were derailment, repetition loops, and degenerate expansion.Derailment emits no final Answer: line; repetition loops repeat short fragments; degenerate expansion continues until the generation budget is exhausted.
  • Repetition loops: In a repetition-loop example with gold = 25, Taboo at i=1 repeatedly recomputed values and never emitted an Answer: line.The baseline correctly concluded that the average was 25, whereas the Taboo chain cycled through values including 30 and 15.
  • Degenerate expansion: In a degenerate-expansion example, blocking the preferred continuation produced an endless additive decomposition of 216 until the generation budget was exhausted.The sequence progressed through forms such as 200+10+5+1+0+0 rather than reaching a solution.
  • Interpretation: These degeneration modes were presented as the behavioral signature of Llama-3’s missing base-vs-instruct gap on GSM8K and flat injected-surprisal response.The paper links these qualitative failures to Section 4.1 and Figure 4.

B Conditional retention with confidence intervals

Figure 2 presents conditional retention for 7–12B model families, including 95% Wilson confidence intervals that visualize item-sampling uncertainty behind the observed trends.

  • B Conditional retention with confidence intervals: Figure 2 reports conditional retention for 7–12B model families with 95% Wilson confidence intervals.The intervals visualize item-sampling uncertainty underlying the observed trends.

C Absolute accuracy across the full ladder · D Injected surprisal versus model size and type

Figure 3 provides a comprehensive view of absolute accuracy across the full model-size spectrum under intervention. Figure 4 shows that injected surprisal increases roughly logarithmically with taboo rank, with aligned checkpoints absorbing more surprisal than base checkpoints.

  • C Absolute accuracy across the full ladder: Figure 3 presents absolute accuracy across the entire model-size spectrum.The figure is intended to provide a comprehensive view of performance under intervention.
  • C Absolute accuracy across the full ladder: The full ladder spans the entire model-size spectrum rather than a restricted subset.This broad coverage supports a comprehensive assessment of performance under intervention.
  • C Absolute accuracy across the full ladder: Figure 3 evaluates performance under intervention across that full spectrum.Its purpose is to give a comprehensive view of intervention performance.
  • D Injected surprisal versus model size and type: Mean injected surprisal per intervention, ¯ ∆S, grows roughly logarithmically with taboo rank i.This pattern appears for base and instruct checkpoints across all three benchmarks.
  • D Injected surprisal versus model size and type: The taboo rank parameter behaves as a graded dose of intervention.The graded-dose interpretation follows from the roughly logarithmic increase in ¯ ∆S with rank i.
  • D Injected surprisal versus model size and type: Aligned checkpoints absorb more injected surprisal than their base counterparts at every rank.Their next-token distributions are sharper, so masking top candidates costs more bits.

E The Llama Alignment Effect Across Scale · F Accuracy versus injected surprisal · G Answer-Length Expansion under Taboo

Across Llama scales, alignment improves Taboo retention only at 70B despite a flat surprisal signature, indicating scale-dependent off-path robustness. The section also relates accuracy to injected surprisal and documents answer-length expansion from circumlocution.

  • E The Llama Alignment Effect Across Scale: In Qwen2.5, OLMo-2, and Gemma-3, instruct checkpoints absorb more injected surprisal per intervention than base models, unlike Llama-3 at both measured scales.Llama-Instruct absorbs no more injected surprisal than its base and slightly less at every rank.
  • E The Llama Alignment Effect Across Scale: At 8B, marginal GSM8K retention changes from 14% to 16% at i=1, whereas at 70B it rises from 36% to 75%.The retention benefit therefore appears strongly at 70B but remains small at 8B.
  • E The Llama Alignment Effect Across Scale: Llama-70B’s retention gain occurs without distribution sharpening, leaving the mechanism unresolved and motivating next-token entropy as a follow-up probe.The supplied passage identifies this dissociation as an open question made measurable by the diagnostic.
  • E The Llama Alignment Effect Across Scale: Because Llama-8B and Llama-70B share tokenizer architecture and vocabulary, their behavioral shift is attributed to a scaling threshold rather than tokenization artifacts.The larger model is described as navigating off-path constraints without relying on distribution sharpening.
  • F Accuracy versus injected surprisal: Figures 6 and 7 compare Taboo accuracy with unconstrained baselines and marginal retention against measured injected surprisal rather than nominal taboo rank.The retention ratio credits items recovered under Taboo and tracks Eq. 5 closely.
  • G Answer-Length Expansion under Taboo: Figure 8 shows generated answer lengths expanding with taboo rank, providing evidence of token overhead caused by circumlocution.The figure characterizes relative answer-length expansion as a function of taboo rank.

H Compute and Reproduction Details

Experiments used one NVIDIA A100 or H100 GPU per run, with model-dependent bf16 or 4-bit execution and standardized batched decoding. Generation dominated runtime, with the full study requiring only a few GPU-days on a single accelerator.

  • Hardware and precision: Experiments ran on shared NVIDIA A100 (40 GB) and H100 (94 GB) GPUs, using one GPU per run.Models up to 14B used native bf16 or 4-bit; larger listed models used 4-bit on H100.
  • Hardware and precision: 4-bit nf4 with bf16 compute was used for speed because it matched bf16 within sampling variance, while 8-bit was limited to one outlier-cell spot check.The H100 could fit the larger models in 8-bit, but int8 generation was too slow for a full sweep.
  • Decoding configuration: Decoding used batch size 8, reduced to 4 for the largest models, with generation capped at 512 new tokens.
  • Runtime and cost: Generation length dominated per-condition cost: about 4 minutes for a 7B model at n=100, 20 minutes at n=500, 9 minutes for 32B, and 16 minutes for 70–72B models.A full family/dose sweep fit in one overnight session, while the entire study required a few GPU-days on one accelerator.
Loading 2608.09900v2…