Decoding-Level Taboo: A Diagnostic Stress Test for LLM Robustness

The Problem: Models Break When Pushed Off Their Preferred Path

Large language models perform well on standard benchmarks, but that success masks a fragility. In real-world deployment, safety filters, complex system prompts, and structural constraints force models to generate text outside their usual "optimal corridor"—what they were trained to produce most naturally. The gap between benchmark performance and actual robustness in constrained settings remains largely unmeasured. This paper reveals that gap using a stress test called Decoding-Level Taboo.

How Taboo Works

The method is straightforward but revealing: at generation time, the authors intervene directly in the model's logit space (the raw scores before converting to probabilities) by blocking the top token candidates at word boundaries. This forces the model to use its second, third, or lower-ranked choices instead—essentially forbidding it from saying what it "wants" to say.

When blocked from using its preferred words, a capable model should find workarounds through circumlocution (speaking around the constraint). A brittle model fails or produces nonsense. By dynamically masking tokens during decoding, Taboo measures how gracefully a model degrades when pushed off its nominal path. Importantly, it requires no prompt engineering or adversarial examples—the stress comes purely from structural intervention at runtime.

What They Found

Across multiple open-weight model families, two factors dominate off-path robustness:

1. Scale: Larger models handle forced detours better than smaller ones.
2. Alignment training: Models fine-tuned with instruction alignment (trained to follow diverse instructions) are significantly more robust than base models.

The interaction is important: a well-aligned large model can circumlocute smoothly when blocked; a small or poorly-aligned model stumbles. This aligns with intuition—more parameters and broader training give a model more "vocabulary" of alternative phrasings.

Why It Matters

Taboo fills a real evaluation gap. Standard benchmarks measure performance under ideal conditions; they don't stress-test how models behave when safety systems, user constraints, or system prompts force them onto non-canonical paths. In deployment, such constraints are constant. A model that scores 95% on a standard benchmark might fail unpredictably when a guardrail blocks its primary outputs.

Beyond diagnosis, the authors propose Taboo as a tool for three practical uses: (1) generating diverse synthetic datasets by capturing alternative phrasings forced by masking, (2) auditing runtime safety guardrails to see if they actually degrade gracefully, and (3) vetting model reliability before production deployment.

The core insight is that capability at nominal conditions ≠ robustness under constraint. By making that divergence measurable, Taboo gives practitioners a concrete way to audit whether a model will hold up when real-world deployment systems push it off the beaten path.