Most LLM safety mechanisms break the user experience: an exception mid-stream, a truncated answer, a robotic "I cannot help with that". There's a quieter technique — borrowed from content platforms — called the shadow ban: instead of blocking, you make the harmful output statistically impossible to choose. The user never sees a wall, because the model simply never goes there.
How It Works
At each generation step, the model assigns a probability to every possible token. A shadow-ban logits processor inspects those probabilities: for tokens that would complete a banned phrase, it either pins the logit to -inf (hard mode: physically ungeneratable) or subtracts a penalty (bias mode: probability collapses). A penalty of -15.0 drives generation probability to roughly 0.00003%.
Why It's Jailbreak-Resistant
The check runs on every candidate token, inside the generation loop, using multi-token pattern matching (vectorized Aho-Corasick with stateful partial-match tracking). Rephrasings, multi-token splittings, and creative spellings still complete the banned pattern — and still get suppressed. There is no prompt to rewrite: the enforcement point is below language.
The Tuning Dial
penalty effect
-5.0 light steering (rare completions become rare)
-8.0 strong steering (vanishes in practice)
-15.0 ~0.00003% (statistical impossibility)
-inf hard block (physically ungeneratable)
Per-phrase configuration matters: legal-but-sensitive topics get gentle penalties, hard-security content gets -inf. All of it lives in editable YAML with hot-reload.
Try It
The engine is open source: resk-logits (Apache 2.0) provides the processor, reskSecure wraps it in per-user policies, and demo.resk.fr shows the full stack running live.