logits

With the model fully frozen, merely adding random biases to its output logits can match or even exceed the effect of full weight perturbation on most reasoning tasks.

In autoregressive generative models, the network outputs a real-valued vector (logits) covering the entire vocabulary at each step, which is passed through softmax to obtain the probability distribution of the next token, and sampling strategies such as temperature sampling, top-k, and top-p then determine the actual output.

Modifying logits at sampling time means adding or subtracting bias values dimension by dimension on the vector before softmax—adding a positive value raises the probability of a certain type of token being selected, while subtracting a negative value suppresses it—without changing the model weights and intervening only at the inference stage.

During performance, the system tracks the current key, the chords being played, and the tempo in real time, and applies biases to the logits before sampling.

A common approach is to first train a lightweight conditioning module (such as a conditioning head or adapter) on a small amount of data, then at inference time superimpose its output as a logits bias, thereby balancing learning capability and real-time controllability.

The raw scores output by the model are logits, which need to be converted into a probability distribution via the softmax function; temperature is precisely the scaling applied to the logits before softmax: as temperature approaches 0 the distribution becomes sharp (approaching greedy), and as temperature rises the distribution becomes flat.

In autoregressive language models, logits are the unnormalized scores the model gives to each token in the vocabulary, which only become probabilities after softmax.

In distillation attacks, if the API exposes logits or temperature-scaled softmax outputs, attackers can train a substitute closer to the original model with fewer queries.

Reducing the amount of information returned by the API (such as returning only the final text result without exposing logits distributions, top-k probabilities, or token-level confidence) can significantly increase the difficulty of distillation attacks, because the supervision signal available to the attacker becomes sparser.

约束解码通过维护由JSON Schema推导的有限状态机，在token采样前将非法token的logit置为负无穷，使JSON结构从统计概率问题升级为数学确定性保证