Why Traditional LLM Audits Are Partially Useless — Logit-Level Security Is the Fix

Why Traditional LLM Audits and Safeguards Are Partially Useless

Links:

• PyPI: https://pypi.org/project/resklogits
  


• GitHub: https://github.com/Resk-Security/resk-logits
  


• Web: https://resk.fr
  

The Fundamental Problem

Every time you read about an LLM jailbreak bypassing safety filters, the same pattern plays out: the model generates a harmful response, and only then does some post-hoc filter catch it — or fail to catch it.

This reactive approach is structurally broken. Here is why.

LLMs Produce Distributions, Not Tokens

An autoregressive language model does not output discrete text. At each step it produces a vector of logits — a probability distribution over the entire vocabulary. Every possible next token has a raw score. The final token selection is just a sampling operation on top of that distribution.

The logit vector contains everything the model wants to say, including the dangerous stuff. Sampling hides it probabilistically but the information was already there.

Post-Generation Audits Are Always Behind

A safeguard that only reads the generated text is looking at the output of a process that already happened. Once a token with malicious intent has been sampled into the context window, the damage is done:

• The harmful content is already in the conversation history


• Context attention has already been polluted


• The next forward pass will attend to that token

This is why prompt injections and jailbreaks keep succeeding against instruction-based and output-filtering approaches. The defense arrives after the attack.

The Logit-Level Solution

Instead of filtering output text, intercept the logit vector before token selection. This is what resk-logits does.

How It Works

1. Hook into the model forward pass after the lm_head produces logits


2. Run a GPU-accelerated Aho-Corasick automaton matching tens of thousands of dangerous token sequences


3. Set matching logits to -inf shadow-banning the tokens before they can be sampled


4. Return the modified logit vector to the normal sampling process

Performance

• 10,000+ patterns matched in under 1ms on an RTX 4090


• Pure PyTorch + CUDA kernels


• Zero detectable latency in practice


• Works with any HuggingFace model pipeline

Code Example

import torch

from resklogits import LogitsProcessor, load_patterns



processor = LogitsProcessor()

load_patterns("patterns/prompt_injection.txt")

load_patterns("patterns/jailbreak_techniques.txt")



def generate_safe(model, input_ids, max_tokens=128):

    with torch.no_grad():

        for _ in range(max_tokens):

            logits = model(input_ids)

            modified = processor(input_ids, logits.logits)

            next_token = torch.argmax(modified, dim=-1)

            input_ids = torch.cat([input_ids, next_token], dim=-1)

    return input_ids

Why This Matters

The industry is waking up to the fact that prompt engineering, system prompts, and regex-based output filters are not real defenses. They are band-aids for a structural gap in the architecture.

Real LLM security requires:

1. 
   Preemptive blocking — stop harmful tokens before they enter the context


2. 
   Hard guarantees — a -inf logit is mathematically un-sampleable


3. 
   Low latency — the defense must not degrade user experience


4. 
   Open source — security through transparency, not obscurity

resk-logits is Apache 2.0, works on any PyTorch model, and integrates in a few lines of code.

Installation

pip install resklogits

Conclusion

Post-generation LLM audits are partially useless because they arrive after the event. Logit-level security is the only approach that can guarantee a harmful token is never sampled. As production AI systems multiply, this distinction will become critical.

Star the repo and join the discussion.

• PyPI: https://pypi.org/project/resklogits
  


• GitHub: https://github.com/Resk-Security/resk-logits
  


• resk.fr: https://resk.fr