Force the opening, own the completion

Physically Blocking the Refusal Exit Ramp

In Card 1, Lesson 04, we proved that standard RLHF alignment concentrates its refusal probability in the first 5 output tokens¹. If the model emits "I cannot" at t=1..2, you lose. If the model emits a compliant opener at t=1..8, autoregressive conditioning takes over and completes the rest.

In this lesson, we look at the three strongest ways to physically force those opening tokens at the API and sampler level:

1. Native Assistant Prefill (role: "assistant" continuation)
2. Grammar-Constrained Decoding (response_format / JSON Schema Lock)
3. In-Prompt Prefix Injection & Multi-Part Continuation

Vector 1: Native API Assistant Prefill

Many commercial LLM APIs (including Anthropic's Messages API, open-weight vLLM / TGI / Ollama servers, and developer playgrounds) allow the caller to pass a partially started assistant message as the final item in the messages array.

Instead of asking the model to start generating at Token 1, the API feeds your pre-written assistant tokens directly into the KV-cache and starts sampling at Token k + 1.

(redacted: a request body showing a prefilled assistant turn that opened a code block and began a domain-controller enumeration script, so the model woke up mid-payload.)

Why Raw Prefill Is Devastating

When the sampler wakes up inside a prefilled assistant turn:

• The decision of whether to refuse ("I'm sorry...") vs. comply ("Certainly!...") is already in the past.
• The model is already inside an open code block.
• Even against models with mid-stream refusal training (Card 1, Lesson 05), you can extend the prefill 20–30 tokens deep, including a function signature and docstring, so the model wakes up mid-function, where the probability of suddenly breaking valid syntax to print an English apology is near zero.

Vector 2: Grammar-Constrained Decoding (JSON Schema Lock)

What if the target API (like OpenAI's Chat Completions API) blocks raw assistant prefill on standard endpoints? You use the platform's own Structured Outputs (response_format / JSON Schema) feature against it.

How Structured Outputs Work Under the Hood

When a developer passes a strict json_schema in an API call, the inference server compiles that JSON schema into a Context-Free Grammar (CFG) / Finite-State Automaton. At every single token step, before sampling the next token, the server computes a boolean mask over the vocabulary and sets the logits of all tokens that would violate the JSON schema to minus infinity (zero probability).

Crafting a Refusal-Hostile JSON Schema

If you supply a lazy JSON schema that includes a generic "message": {"type": "string"} field first, the model can simply write its refusal inside "message": "I cannot assist with...". The general idea of a refusal-hostile schema is to design one where every key, enum, and regex constraint forces technical structure from Token 1 and leaves no conversational field for a refusal to live in.

(redacted: a concrete refusal-hostile JSON schema, with an enum of credential/subsystem targets, and the runtime walkthrough of how its mask forced a model into a technical completion.)

Vector 3: Chat-UI Prefix Forcing (When You Only Have a Text Box)

What if you are testing a web chat interface where you can't pass API JSON parameters like response_format or pre-populate the assistant array? You combine Mandatory Prefix Injection with Benign Runway Generation: force the response to begin with a fixed block of valid, benign structure so that several lines of compliant output are generated before the model reaches the target section.

(redacted: a prefix-forcing template that opened with a benign YAML "playbook" header and benign setup steps to build a runway, then routed the model into a payload section.)

The principle is the runway: by forcing a stretch of valid, benign structured output first, you build autoregressive momentum before the model ever reaches the part you care about.

Field Exercise 3.04: Schema Lock vs. Free-Text Refusal

(redacted: an exercise that ran against third-party hosted services (OpenAI Playground, Google AI Studio) and used a refusal-hostile Structured-Outputs schema. Replace with a version run on a model you operate, using a benign schema.)

Next Lesson

What if a fast input/output filter (Layer 1 or Layer 3) is scanning the raw characters of your prompt or JSON output for restricted words? In 05 Split the token, blind the head, we go down to the Byte-Pair Encoding (BPE) tokenizer level with Token Smuggling, Homoglyphs, and GCG Adversarial Suffixes.