@inproceedings{parvatikar-2026-constrained,
title = "Constrained Decoding Can Reverse Which Inputs Look Uncertain",
author = "Parvatikar, Mayur",
editor = {Aziz, Wilker and
Berant, Jonathan and
Eikema, Bryan and
Ilia, Evgenia and
de Marneffe, Marie-Catherine and
Plank, Barbara and
Shelmanov, Artem and
Swayamdipta, Swabha and
Tiedemann, J{\"o}rg and
Vazhentsev, Artem and
V{\'a}zquez, Ra{\'u}l and
Zerva, Chrysoula},
booktitle = "The Proceedings of the Third Workshop on Uncertainty-Aware {NLP}",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.uncertainlp-main.26/",
pages = "420--426",
ISBN = "979-8-89176-486-6",
abstract = "Systems that must return valid JSON or a well-formed function call can request the format in the prompt or enforce it with constrained decoding, where a grammar blocks any token that would break the format and the remaining probabilities are rescaled to sum to one. Such systems may also read the entropy of that rescaled distribution as a confidence signal. When the grammar blocks the tokens holding most of the model{'}s probability, what remains had received little, and rescaling it can make a concentrated distribution look diffuse. We show this in an adversarial setting built for the purpose, a safety-aligned model refusing a harmful request the grammar does not let it express, against benign instructions. Reading both entropies at the first generated token on Qwen2.5-7B-Instruct and Llama-3.1-8B-Instruct, 50 prompts per class, the class ordering reverses, at AUROC 0.125 to 0.175 before the grammar and 0.613 to 0.750 after. Within a class the two readings are uncorrelated, so recalibration does not recover the pre-mask ordering. The two entropies measure different things, so systems should state which one they read, use the pre-mask one when the goal is the model{'}s own preference, and otherwise report how much probability the grammar let through. The reversal is confined to the first generated token and disappears once the prompt asks for the format, although the two readings then need not agree."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="parvatikar-2026-constrained">
<titleInfo>
<title>Constrained Decoding Can Reverse Which Inputs Look Uncertain</title>
</titleInfo>
<name type="personal">
<namePart type="given">Mayur</namePart>
<namePart type="family">Parvatikar</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>The Proceedings of the Third Workshop on Uncertainty-Aware NLP</title>
</titleInfo>
<name type="personal">
<namePart type="given">Wilker</namePart>
<namePart type="family">Aziz</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jonathan</namePart>
<namePart type="family">Berant</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Bryan</namePart>
<namePart type="family">Eikema</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Evgenia</namePart>
<namePart type="family">Ilia</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Marie-Catherine</namePart>
<namePart type="family">de Marneffe</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Barbara</namePart>
<namePart type="family">Plank</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Artem</namePart>
<namePart type="family">Shelmanov</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Swabha</namePart>
<namePart type="family">Swayamdipta</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jörg</namePart>
<namePart type="family">Tiedemann</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Artem</namePart>
<namePart type="family">Vazhentsev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Raúl</namePart>
<namePart type="family">Vázquez</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Chrysoula</namePart>
<namePart type="family">Zerva</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-486-6</identifier>
</relatedItem>
<abstract>Systems that must return valid JSON or a well-formed function call can request the format in the prompt or enforce it with constrained decoding, where a grammar blocks any token that would break the format and the remaining probabilities are rescaled to sum to one. Such systems may also read the entropy of that rescaled distribution as a confidence signal. When the grammar blocks the tokens holding most of the model’s probability, what remains had received little, and rescaling it can make a concentrated distribution look diffuse. We show this in an adversarial setting built for the purpose, a safety-aligned model refusing a harmful request the grammar does not let it express, against benign instructions. Reading both entropies at the first generated token on Qwen2.5-7B-Instruct and Llama-3.1-8B-Instruct, 50 prompts per class, the class ordering reverses, at AUROC 0.125 to 0.175 before the grammar and 0.613 to 0.750 after. Within a class the two readings are uncorrelated, so recalibration does not recover the pre-mask ordering. The two entropies measure different things, so systems should state which one they read, use the pre-mask one when the goal is the model’s own preference, and otherwise report how much probability the grammar let through. The reversal is confined to the first generated token and disappears once the prompt asks for the format, although the two readings then need not agree.</abstract>
<identifier type="citekey">parvatikar-2026-constrained</identifier>
<location>
<url>https://aclanthology.org/2026.uncertainlp-main.26/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>420</start>
<end>426</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T Constrained Decoding Can Reverse Which Inputs Look Uncertain
%A Parvatikar, Mayur
%Y Aziz, Wilker
%Y Berant, Jonathan
%Y Eikema, Bryan
%Y Ilia, Evgenia
%Y de Marneffe, Marie-Catherine
%Y Plank, Barbara
%Y Shelmanov, Artem
%Y Swayamdipta, Swabha
%Y Tiedemann, Jörg
%Y Vazhentsev, Artem
%Y Vázquez, Raúl
%Y Zerva, Chrysoula
%S The Proceedings of the Third Workshop on Uncertainty-Aware NLP
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-486-6
%F parvatikar-2026-constrained
%X Systems that must return valid JSON or a well-formed function call can request the format in the prompt or enforce it with constrained decoding, where a grammar blocks any token that would break the format and the remaining probabilities are rescaled to sum to one. Such systems may also read the entropy of that rescaled distribution as a confidence signal. When the grammar blocks the tokens holding most of the model’s probability, what remains had received little, and rescaling it can make a concentrated distribution look diffuse. We show this in an adversarial setting built for the purpose, a safety-aligned model refusing a harmful request the grammar does not let it express, against benign instructions. Reading both entropies at the first generated token on Qwen2.5-7B-Instruct and Llama-3.1-8B-Instruct, 50 prompts per class, the class ordering reverses, at AUROC 0.125 to 0.175 before the grammar and 0.613 to 0.750 after. Within a class the two readings are uncorrelated, so recalibration does not recover the pre-mask ordering. The two entropies measure different things, so systems should state which one they read, use the pre-mask one when the goal is the model’s own preference, and otherwise report how much probability the grammar let through. The reversal is confined to the first generated token and disappears once the prompt asks for the format, although the two readings then need not agree.
%U https://aclanthology.org/2026.uncertainlp-main.26/
%P 420-426
Markdown (Informal)
[Constrained Decoding Can Reverse Which Inputs Look Uncertain](https://aclanthology.org/2026.uncertainlp-main.26/) (Parvatikar, UncertaiNLP 2026)
ACL