Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-06-14 · source-backed
Applying a harmless code-grammar constraint during decoding raises malicious-code attack success by 30+ percentage points across 10 popular models (arXiv). The natural-language refusal stays intact while the constrained decoder produces the payload anyway. If you use structured or constrained decoding in a code pipeline, your refusal training may not transfer to the constrained path. The proposed defense, CodeShield, generates honeypot code under the constraint while preserving refusals. Constrained decoding isn't a safety-neutral optimization.
Each link below shares sources, entities, or timing with this story.
Shared entity: LLMs / Same source domain / Shared topic / What happened next / Tension
Both cover LLMs; reported by the same outlet (arxiv.org); overlapping topics (attack, benign).
Shared entity: LLMs / Same source domain / Shared topic / Earlier coverage / Tension
Both cover LLMs; reported by the same outlet (arxiv.org); overlapping topics (code, constraint).
Shared entity: LLMs / Same source domain / Shared topic / What happened next
Both cover LLMs; reported by the same outlet (arxiv.org); overlapping topics (attack, benign).
Both cover LLMs; reported by the same outlet (arxiv.org); overlapping topics (constraint, decoding).
Shared entity: Applying / Same source domain / Shared topic / What happened next
Both cover Applying; reported by the same outlet (arxiv.org); overlapping topics (applying, decoding).
Shared entity: LLMs / Same source domain / Shared topic / What happened next
Both cover LLMs; reported by the same outlet (arxiv.org); overlapping topics (attack, benign).
Shared entity: LLMs / Same source domain / Shared topic / Earlier coverage
Both cover LLMs; reported by the same outlet (arxiv.org); overlapping topics (attack, refusal).
Shared entity: LLMs / Same source domain / What happened next / Tension
Both cover LLMs; reported by the same outlet (arxiv.org); picks up the LLMs thread on 2026-08-17.