**Replace logit bias with a block-list.** Instead of offering a logit bias, model developers could replace it with a block-list of tokens the model is prohibited from emitting. This would support (some) of the functionality discussed in the prior section, but would still prevent our attack.