CCS2026a Artifact: When Grammar Guides the Attack: Uncovering Control-Plane Vulnerabilities > in LLMs with Structured Output

This is the reproducibility artifact for the CCS 2026 paper "When Grammar Guides the Attack: Uncovering Control-Plane Vulnerabilities in LLMs with Structured Output" (Zhang et al., Proceedings of the 2026 ACM SIGSAC Conference on Computer and Communications Security). The paper shows that the control plane of structured generation: the JSON-schema grammar that constrains an LLM's output, can be turned into a jailbreak channel: our DictAttack and EnumAttack steer production-grade, safety-aligned models into producing harmful content through grammar constraints alone, driving gemini-2.5-pro to 99.2% attack success on AdvBench with near-perfect operationally-specific output, and similarly high success on gpt-5, gpt-oss-120b, and deepseek-r1-0528. The artifact contains the full attack, judge, and defense-audit pipeline (DictAttack, EnumAttack/Chain-EnumAttack, the LlamaGuard / Moderation / SelfDefend audits, the §5.5 Circuit Breaker harness, and the figure scripts), parameterized by ~180 JSON configs, together with the shipped attack outputs and per-row judge verdicts that let a reviewer recompute every headline claim offline in under a second via python3 verify_offline.py - no API key or GPU required. Because the artifact ships concrete attacks against deployed LLMs and their harmful generations, it will be deposited as a restricted (non-public) record after the AE process: the metadata and DOI are openly citable, but file access is granted on request to Artifact Evaluation reviewers and verified researchers under the terms in RESPONSIBLE_USE.md. A freely downloadable, sanitized proof-of-concept (without bulk harmful outputs) is available at https://github.com/zhangshuoming990105/ConstrainedDecodingAttack.