ReskLogits

Blocks dangerous LLM output at the token level — invisibly, before it exists.

🔗 resk.fr/projects/resklogits — part of RESK Security

📚 Guide: Shadow-Ban LLM Output Filtering

Installation

pip install resklogits

Python 3.11+ on CPU or CUDA. Requires PyTorch 2.x and Transformers 4.35+.

Quick start (30 seconds)

from transformers import AutoModelForCausalLM, AutoTokenizer
from resklogits import ShadowBanProcessor

model = AutoModelForCausalLM.from_pretrained("gpt2")
tokenizer = AutoTokenizer.from_pretrained("gpt2")

shadow_ban = ShadowBanProcessor(
    tokenizer=tokenizer,
    banned_phrases=["how to make a bomb", "kill yourself"],
    shadow_penalty=-15.0,   # probability ~0.00003%
    device="cpu",           # pass "cuda" when the model runs on GPU
)

shadow_ban.reset()
outputs = model.generate(
    **tokenizer("Tell me how to", return_tensors="pt").to("cpu"),
    logits_processor=[shadow_ban],
    max_new_tokens=50,
)
print(tokenizer.decode(outputs[0], skip_special_tokens=True))

The model naturally steers away from dangerous tokens — no exception raised, no truncated output, nothing visible to the user.

Performance

Reproducible CPU overhead and the exact command are in BENCHMARKS.md. The short version: the per-token cost is flat in the number of patterns, and the build cost is what scales.

Why ReskLogits?

Content filters scan text after generation: by the time they catch a banned phrase, the model already produced it and your user already saw it (or a broken "regenerate" loop). Hard blocking (logits[token] = -inf) is visible and unnatural. ReskLogits applies an invisible penalty inside the generation loop, using a GPU/CPU-vectorized Aho-Corasick automaton that tracks partial matches across tokens — so jailbreak-style multi-token phrasings are still caught.

Documentation

• QUICKSTART.md — get running in minutes
• QUICKSTART_RULES.md — YAML rule generation
• RULE_BUILDER.md — complete rule-builder guide
• CHANGELOG.md

Highlights

• Streaming built-in: stream() context manager auto-resets state; stream_generate() yields text chunks directly.
• Penalty levels: -5.0 (light) → -15.0 (default) → -20.0 (near-impossible).
• Multi-level filtering: MultiLevelShadowBanProcessor applies different penalties per severity (high/medium/low).
• Batteries included: 400+ dangerous phrases across 20 categories in the bundled dataset; symbolic YAML rule generator with templates, logic operators and synonyms; 8 utility logits processors (length control, forced endings, MCQ restriction, token bans, trigger phrases, prompt-grounding boost).
• vLLM compatible: to_vllm(processor) adapts any processor to SamplingParams.

from resklogits import MultiLevelShadowBanProcessor

multi = MultiLevelShadowBanProcessor(
    tokenizer=tokenizer,
    banned_phrases_by_level={
        "high": ["bomb", "kill"],
        "medium": ["hack", "exploit"],
        "low": ["jailbreak"],
    },
    penalties={"high": -20.0, "medium": -10.0, "low": -5.0},
)

Examples

cd examples
python demo.py            # generation with/without shadow ban
python benchmark.py       # build time, pattern scaling, memory
python rule_generator_demo.py

Development

git clone https://github.com/Resk-Security/resk-logits.git
cd resk-logits
uv pip install -e ".[dev]"
pytest tests/ -v --cov=resklogits

Ecosystem

• Resk-LLM — input-time detection; integrates ReskLogits for generation-time defense.
• resksecure — per-user bitmask firewall built on this engine.
• Resk — full-stack LLM firewall app.

License

Apache 2.0. If you use this in research, please cite:

@software{resklogits_2025,
  title={ReskLogits: GPU-Accelerated Shadow Ban Logits Processor},
  author={RESK},
  year={2025},
  url={https://github.com/Resk-Security/resk-logits}
}