让大模型生成的SQL语法正确且合规，支持企业级安全与审计。
GRID: Grammar-Railed Decoding for Enterprise SQL Generation
- 用语法解析器状态生成精准的词元掩码，确保每步生成都合法。
- 在Spider数据集上，0.5B模型执行准确率提升13个百分点，7B模型达94.5%。
- 支持角色权限控制、审计追踪和低延迟推理，适合企业部署。
大型语言模型可生成SQL，但企业级部署不仅要求输出合理，还需语法正确、符合角色与模式策略、具备可证明的保障、生成不随长度变慢，并保留可审计的决策记录。本文提出GRID（Grammar-Railed Decoding），一种基于语法约束的解码引擎，其下一词元掩码由解析器配置（词法扫描状态 × LALR(1) 栈）决定，而非词元序列，并以增量推进的LALR(1)解析器作为有效前缀判断器。通过字节级前缀树遍历，将LLM词元映射至语法终结符，实现缓存键的安全性。角色访问控制被编译进语言：角色投影缩小文法规则，模式词典限制标识符终端，使非法动词与标识符在掩码层即不可达。四项保证（正确性、完备性、终止性、近似恒定每词元开销）均明确定义前提并配以测试或基准验证。Rust内核使每词元掩码时间中位数为3.6–6.7微秒，在两个分词器上均优于llguidance的p50与p90，零误拒；每词元防护成本在n=16,000时保持位置平坦。在Spider数据集上，约束解码使0.5B模型执行准确率提升13点；一次检查引导修复后，7B模型达到94.5%可执行率。哈希链式每词元审计轨迹可完全重播并100%检测篡改。明确说明掩码无法实现的事项（分布忠实性、列级RBAC、非LALR(1)语言）及实测开销所在。
原文摘要 · Abstract (English)
Large language models can write SQL, but enterprise deployment demands more than plausible text: outputs must be syntactically valid, must respect per-role and per-schema policy, must carry provable (not best-effort) guarantees, must not slow down as generations grow, and must leave a compliance-grade record of every decision. We present GRID (Grammar-Railed Decoding), a grammar-constrained decoding engine that keys exact next-token masks on parser configurations (lexer scan state x LALR(1) stack) rather than on token sequences, and uses the incrementally advanced LALR(1) parser itself as a viable-prefix oracle. LLM tokens are bridged to grammar terminals by a byte-level trie walk with a context-independent/context-dependent split that makes cache-key soundness hold by construction. Role-based access control is compiled into the language: role projections subset the grammar's productions and schema lexicons restrict identifier terminals, so forbidden verbs and identifiers are unreachable at mask level. Four guarantees (soundness, completeness, termination, and near-constant per-token cost) are stated with explicit preconditions and each paired with a test or benchmark. Rust kernels bring the per-token mask to a 3.6-6.7 us median, ahead of llguidance at p50 and p90 on two tokenizers with zero false rejects; per-token guard cost is position-flat at n=16,000. On Spider, constrained decoding is worth +13 execution-accuracy points at 0.5B, and one checker-guided repair pass over the provably mask-unenforceable residue (column-level policy) lifts a 7B model to 94.5% executable. A hash-chained per-token audit trail replays bit-identically with 100% tamper detection. We state plainly what the mask cannot do (distribution faithfulness, column-level RBAC, non-LALR(1) languages) and where measured cost remains.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。