Researchers uncover new jailbreak attack targeting LLMs through structured output grammar

Researchers have identified a critical vulnerability in large language models that use grammar-guided decoding for structured outputs. The attack, called Constrained Decoding Attack (CDA), operates at a different layer than typical jailbreak attempts—targeting the LLM control plane rather than relying on visible input manipulation.

How the Attack Works#

The control-plane vulnerability functions in two stages. First, the schema enforcement mechanism—which constrains token generation to match a specified format—becomes an injection point for malicious content. The attacker embeds a harmful prefix into the decoding trajectory through this grammatical constraint. Second, the model itself completes the malicious intent once the adversarial setup is in place.

This differs fundamentally from data-plane jailbreaks. Traditional safety measures focus on alignment trained into the model weights, but CDA attacks the decoding process itself—bypassing these defenses by modifying how the model generates outputs at runtime.

Attack Variants and Results#

The researchers instantiated two versions of CDA. EnumAttack hides harmful prompts inside enumeration fields, making it relatively easy to defend against with basic grammar auditing. The more sophisticated DictAttack, however, decouples the attack payload between a seemingly benign prompt and dictionary-based grammar constraints, proving far more evasive.

Testing across 13 models—including closed proprietary systems like GPT-5, Gemini 2.5 Pro, and DeepSeek-R1, as well as open-weight models like GPT-OSS-120B—revealed alarming success rates. DictAttack achieved 94.3–99.5% attack success on flagship models. Even against state-of-the-art jailbreak defenses, DictAttack sustained 75.8% success, exposing what researchers call a "semantic gap" between data-plane and control-plane security.

Why It Matters#

As LLMs increasingly power API-based tools and applications relying on structured outputs, this vulnerability represents a systemic security gap. Current alignment techniques and safety guardrails do not account for threats operating at the decoding level. Defending against CDA requires coordinated defenses that bridge both the data and control planes—a challenge that demands new research into cross-plane security architectures.