Interesting. Curious if you tried constraining only the first n (1?) tokens and then removing the constraint; would the model revert to a refusal or follow through on its response?