When Do Repetition Loops Lock? Truncation Sampling, Bounded Penalties, and a Blind Spot in DRY

Introduction

Open-weight models can repeat a line until the token budget is exhausted, including inside reasoning, JSON and tool calls. The phenomenon is old [14], and its onset has been studied from several angles: the self-reinforcing rise of repetition probability (Xu et al., 2022), properties of the transition matrix [7], training data [20], and, most recently, learning errors in reasoning models [30].

This paper asks the complementary question. Suppose a loop has started. Why can the model not get out, and which decoding-time interventions can in principle get it out?

Our starting observation is that, conditioned on staying in a loop, the context is a deterministic sequence. Every sampler, including history-dependent penalties, therefore assigns a deterministic probability to “continue the loop” at each step, and the probability that a loop survives $m$ more repetitions is a product of such numbers (Proposition 1). Teacher forcing supplies the logits without sampling loop trajectories.

Truncation can remove the exit. Under pure sampling every step has a positive escape probability. Under top-$p$ with the usual threshold $\pi> 1/2$, a position is locked (the loop token is the only candidate) exactly when its raw probability $q$ satisfies $q \ge\pi$ (Theorem 1). Measured reinforcement curves cross this threshold within a few repetitions. In our finite-horizon tests, 80%–100% of sampled units are locked through the last ten repetitions under top-$p$ 0.9, compared with none under pure sampling; the units include corpus sentences and hand-written structured spans.

Penalty growth determines the available guarantee. For an additive logit penalty $d$ on the loop token, locking persists whenever $\operatorname{logit}(q) - d \ge\operatorname{logit}(\pi)$ (Theorem 2). A bounded penalty only raises the threshold at which locking sets in. Escape is guaranteed under top-$p$ once the penalty outgrows $\ln(q/r^\circ)$, where $r^\circ$ is the raw mass of tokens not yet in the context and therefore unpenalized (Corollary 2). A full-context frequency penalty grows fast enough as long as $r^\circ$ stays bounded below; presence penalties and windowed frequency penalties come with no such guarantee.

DRY has a blind spot, and it can be closed. DRY [35, 37] penalizes a token exponentially in the length of the verbatim match it would extend, and is widely used in local inference. To protect formatting, matches may not cross sequence breakers (newline, colon, quote, asterisk). We show that for a loop whose longest breaker-free run has $g$ tokens, the penalty on the loop token is at most $\lambda b^{g-1-a}$ (Proposition 4): on such loops DRY is a bounded penalty. The prediction is borne out in a dose–response experiment, in the unmodified llama.cpp sampler, and in free generation, where every one of the 109 loops that appear with DRY enabled has $g \le7$. We then add a count term that penalizes how many times the same continuation has already occurred, prove that the resulting sampler, DRY-C, penalizes every loop exponentially, breakers or not, up to its look-back window (Proposition 5), and show that it eliminates run-to-the-limit loops in two model families.

This matters most for structured output: under default settings our prose prompts loop in 0%–7% of generations and structured prompts in 16%–21%, and breakers are densest there.

Related Work

Why loops start. Holtzman et al. [14] documented degenerate repetition under likelihood-maximizing decoding and introduced nucleus sampling. Fu et al. [7] analyzed repetition through a Markov model of the transition matrix. Xu et al. (2022) measured a self-reinforcement effect: the probability of repeating a sentence rises with the number of previous repetitions; our reinforcement curves extend this measurement to current instruction-tuned and reasoning models and to 200 repetitions. Li et al. [20] traced repetition to training data, Yao et al. (2025) and Mahaut and Franzon [22] to internal features and mechanisms. Pipis et al. [30] explain why reasoning models enter loops through learning errors and study the role of temperature, keeping each model’s default truncation and explicitly setting penalties aside. Lee et al. [19] separate loop entry from loop persistence in pruned models, relate persistence to the escape mass that the sampling set leaves to alternatives, and address both with fine-tuning objectives. We take the loop as given, work at decoding time, and characterize when that escape mass is exactly zero; these views are complementary.

Truncation samplers. Top-$p$ ([14]), min-$p$ ([26]), typical sampling ([23]), and related truncation rules ([12, 6, 1]) are motivated by the unreliability of the distribution’s tail. We point out a side effect: truncation turns a near-certain continuation into a certain one.

Repetition penalties. The multiplicative penalty of Keskar et al. [15], presence and frequency penalties, training-time remedies ([38] (Xu et al. 2022)), contrastive search ([33]), and penalty decoding with a forgetting window ((Zhu et al., 2023)) all discourage reuse of tokens; hard $n$-gram blocking ([29, 16]) forbids it outright. Ginart et al. [10] derive a penalty from LZ77 code lengths. Wang et al. [34] compare remedies in a production setting. Grammar-constrained decoding ([39, 4]) guarantees well-formed structured output but does not stop a valid record from being repeated. DRY (Weidmann, [35]}) acts on repeated continuations rather than repeated tokens; Weidmann et al. [37] evaluate it at scale, report roughly halved loop rates, and show that removing sequence breakers damages formatting while lowering their loop metric slightly further, treating breakers as a structure-preserving benefit. We characterize the cap, the loops it can leave locked, and a count-based modification that retains breakers. Further decoding and monitoring approaches are discussed in Appendix E.

Setup

Let $V$ be the vocabulary. Fix a prefix and a loop unit $u=(u_1,\ldots,u_L)\in V^L$. In state $(n,l)$, with $n\ge0$ and $1\le l\le L$, the context is the prefix, followed by $n$ complete copies of $u$, followed by $u_1,\ldots,u_{l-1}$; the model is about to produce the $l$-th token of copy $n+1$. Write $p_{n,l}$ for the model’s next-token distribution in this state, and

for the raw probability of continuing the loop and of the strongest rival. We drop subscripts when no confusion arises.

A sampler $S$ maps the history, meaning the tokens so far together with the model’s logits at every step (which the tokens determine), to a distribution over the next token, possibly using internal randomness independent of the history. Along the loop the history is determined by $(n,l)$, so the probability that $S$ emits $u_l$ is a deterministic number $q^S_{n,l}$; this includes samplers with internal state such as Mirostat. Let $Q_n=\prod_{l=1}^{L}q^S_{n,l}$ be the probability of completing one more copy. State $(n,l)$ is locked if $q^S_{n,l}=1$; repetition $n$ is locked if $Q_n=1$. Starting with $k$ copies in context, let $T_k\in\{0,1,\ldots\}\cup\{\infty\}$ be the number of further complete copies produced before the first deviation.

The proof is the chain rule (Appendix § 10). Its practical content is that loop survival under any sampler is computable exactly from the logits along the repetition path. We distinguish three notions: a position is not locked ($q^S<1$); there is no permanent lock (no $n_0$ beyond which every repetition is locked); and the loop ends almost surely ($\mathbb{P}(T_k=\infty)=0$).

Truncation Can Lock Loop Positions

Truncation changes the picture qualitatively. We use the standard definitions. Top-$p$ with threshold $\pi\in(1/2,1)$ keeps token $v$ iff the total probability of tokens strictly more probable than $v$ is below $\pi$. Min-$p$ with ratio $\beta\in(0,1)$ keeps $v$ iff $p(v)\ge\beta\max_w p(w)$. Greedy decoding keeps the most probable token. We assume no exact ties among the largest probabilities, which holds almost surely for real-valued logits; implementations break ties by token order.

Whether a position locks can therefore be read off the reinforcement curve $n\mapsto q_{n,l}$. Top-$k$ applied before top-$p$ (the default order in llama.cpp) renormalizes over the $k$ retained tokens: the state is then locked iff $u_l$ is retained among the top $k$ tokens and $q/m_k\ge\pi$, where $m_k$ is their total raw probability. For a retained loop token, this renormalization can only make locking easier.

Temperature and sampler order. Temperature $\tau$ maps $p$ to $p^{(\tau)}\propto p^{1/\tau}$. Its effect depends on where it sits in the chain.

With $\pi=0.9$ and $\tau=0.7$ in order (B), the sufficient threshold drops from $q\ge0.9$ to $q\ge0.823$: lowering the temperature does not merely sharpen the distribution, it lowers the bar for becoming trapped. The case $\tau>1$ is treated in Appendix § 10.

Penalties: Bounded versus Growing

An additive penalty subtracts $d(v)\ge0$ from the logit of $v$ before truncation, where $d$ may depend on the history. Let $d=d(u_l)$ and let $r^\circ$ be the raw probability mass of tokens absent from the context; we assume this untouched set is nonempty, so $r^\circ>0$.

Table 1 classifies common penalties. Two entries deserve comment. First, the look-back window decides the class: over the full context the frequency penalty grows linearly with $n$, but restricted to the last $W$ tokens (64 by default in llama.cpp) a token appears at most $W$ times; once the window lies entirely within the looping region, the sharper bound is $m\lceil W/L\rceil$, where $m$ is its count per unit. Every deployed penalty has such a window and is thus strictly bounded; what matters is whether the cap exceeds the lock margin for the loop lengths that occur. The frequency cap grows linearly in $W/L$ (with $\alpha=0.5$ and a 20-nat margin it covers units of a single token for $W=64$ and of about 100 tokens for $W=4096$); the DRY-C cap grows exponentially (§ 6). For a linear penalty $d\ge\alpha n$ and a finite supremum of the margin, Theorem 2 gives an explicit unlock time under top-p: no state is locked beyond $n^*=\sup_{n,l}(\ln(q/r^\circ)-\operatorname{logit}(\pi))/\alpha$. Second, the multiplicative penalty divides positive logits and multiplies negative ones, so its strength depends on where the model places the zero of its logits, a quantity with no meaning for the distribution; Hollows [13] measure this effect and its damage to structured output.

Penalty	$d$ on loop token	Class
Presence $\beta_p$	$\beta_p$	bounded
Frequency $\alpha$, full context	$\ge\alpha n$	linear
Frequency $\alpha$, window $W$	$\le\alpha W$	bounded
Multiplicative $\varrho$	$z(1-\frac{1}{\varrho})$‡	bounded†
DRY, no breaker in unit	$\ge\lambda b^{(n-1)L-a}$	exponential
DRY, breaker-free run $g$	$\ge\lambda b^{g-1-a}$	bounded
DRY-C	$\ge\lambda b^{n-\lceil a'/L\rceil-c_0}$	exponential

DRY and Its Sequence Breakers

The penalty cap

We state DRY as implemented in llama.cpp (Gerganov and contributors, [9]). Parameters are a multiplier $\lambda$, a base $b>1$, and an allowed length $a$ (defaults 0.8, 1.75, 2). Let $B\subset V$ be the set of breaker tokens, those whose text contains a newline, colon, quotation mark, or asterisk (with these default single-character breakers every breaker occurrence is a single token; we do not consider user-defined multi-token breakers). For context $x_1,\ldots,x_t$, choose a look-back window $W$ and put $h=\max\{1,t-W+1\}$ ($h=1$ if $W=\infty$). Let $\kappa$ be the trailing non-breaker length and $M_j$ the common-suffix length of $x_{1:j}$ and $x_{1:t}$. The windowed match length is

with an empty maximum equal to zero, and

Breakers enter twice: they truncate the match, and breaker tokens themselves are never penalized.

For a unit containing at least one breaker token, arrange $u$ on a circle and let $g$ be the largest number of consecutive non-breaker tokens.

Proof sketch. If $u_l\in B$ the penalty is zero. Otherwise the $\kappa$ trailing non-breaker tokens together with $u_l$ form $\kappa+1$ consecutive non-breaker tokens on the circle, so $\kappa\le g-1$ and $M(u_l)\le g-1$. $\square$

With default parameters, $D_g=0.8,\,1.4,\,2.45,\,4.29,\,7.50,\,13.1$ for $g=3,\ldots,8$, so locking under top-p 0.9 requires log-odds of 3.0, 3.6, 4.7, 6.5, 9.7, 15.3. Measured log-odds after many repetitions lie between about 6 and 20 (§ 7.2). The theory therefore predicts a transition between $g=7$ and $g=8$: loops with short breaker-free runs—JSON records, key–value lines, quoted dialogue, short lines—remain locked under DRY. Without breakers and with unlimited look-back, the match length is at least $(n-1)L$; a finite window eventually caps this growth.

DRY-C: a count term

Match length is capped by breakers, but a loop has a second signature that breakers do not affect: the same continuation recurs many times. Let $a' \ge1$ (minimum length), $c_0 \ge1$ (allowed recurrences) and $b_c > 1$. Let $J_W = \{j : h + a' - 1 \le j < t\}$. Define

that is, how many earlier positions in the window are preceded by the same $a'$ tokens as the current one, verbatim and ignoring breakers, and are followed by $v$ ($W = 4096$ here). The count term is

it applies to breaker tokens as well, and the total penalty is $\max\{d_{\mathrm{DRY}}, d_{\mathrm{cnt}}\}$. We call the combined sampler DRY-C.

Proof sketch. The same position in each of the $n$ earlier copies is followed by $u_l$; for the $k$-th most recent one, at least $(n-k)L$ preceding tokens agree with the current suffix. Those with $(n-k)L \ge a'$ whose matching span lies in the window are counted.

The unlock time is logarithmic in $\Delta$, compared with linear for the frequency penalty. With $W = 4096$, $\Delta= 20$ and our parameters, the window condition holds for loop units of up to 814 tokens; our detector looks for periods of up to 400. The count term has a cost. A format skeleton that repeats, such as the same JSON keys line after line, can build up $a'$ matching tokens and trigger it when nothing is looping; Appendix § 14 measures how often this happens and what it does to requested copying. We use $a' = 24$, $c_0 = 2$, and $b_c = 3$ unless stated otherwise.

Experiments

Setup

Models. Eleven instruction-tuned models from 1.5B to 9B parameters: Qwen2.5 1.5B and 7B (Qwen Team, 2024); Qwen3 1.7B, 4B and 8B [32]; Llama 3.2 3B and 3.1 8B (Llama Team, 2024); Gemma 2 2B and 9B (Gemma Team, 2024); Phi-4-mini [25]; and the DeepSeek-R1 distillation of Qwen 7B [2].

Teacher-forced measurement. We sample 150 English sentences from the WikiText-103 test set [24] and 150 Chinese sentences from Chinese Wikipedia, stratified by length, and add 22 hand-written units (dialogue lines, list items, code). Each unit is repeated up to 200 times after the beginning-of-sequence token, in an inline variant (joined by a space) and a line variant (terminated by a newline), keeping units whose tokenization is stable under repetition. One forward pass with key–value caching yields $q_{n,l}$, $a_{n,l}$, and $r^\circ_{n,l}$ at every position; softmax is evaluated in 64-bit precision. Given the logits, the continuation probability under any sampler configuration is computed exactly, with penalties applied before truncation as in llama.cpp. Our DRY computation follows the definition of § 6 and was validated position by position against the llama.cpp sampler Appendix § 12.

Free generation. We run llama.cpp with its own samplers on GGUF quantizations of Qwen3-4B, Llama-3.1-8B and Qwen3.6-35B-A3B. Prompt set 1 has 20 prompts (reasoning, enumeration and eight structured-output tasks); prompt set 2 has 24 structured-output prompts (JSON, tables, YAML, CSV, logs, lists, dialogue) and 12 prose-writing prompts. “Default” denotes the sampler recommended by each model’s developers (Qwen: $\tau= 0.6$, top-$p$ 0.95, top-$k$ 20; Llama: $\tau= 0.6$, top-$p$ 0.9), with at most 3000 new tokens. A generation contains a loop if some span of at least 4 tokens occurs at least 5 times consecutively, covering at least 60 tokens. Details are in Appendix § 13.

Reinforcement curves

In Figure 1(a) the log-odds (median over positions, then over sentences) climb steeply over the first few repetitions. The log-odds keep rising, roughly as a saturating power law, to between 6 (Llama-3.2-3B) and 20 (Gemma-2-9B) after 200 repetitions; the copying behind this rise is usually attributed to induction heads ([27]). Every curve sits above the top-$p$ thresholds from the first repetition onward for the median token; locking requires this at every position, which happens after 5–40 repetitions for half of the sentences (Figure 1(b)). Onset is not monotone: several models dip around the tenth repetition.

Verification of the criteria. On four models (Qwen2.5-1.5B and 7B, Qwen3-4B, Llama-3.2-3B; about 160,000 positions each) the criteria of Theorem 1 agree with the exactly computed lock status at every position for top-$p$ 0.9 and 0.95 and min-$p$ 0.1 and 0.05. The sufficient and necessary conditions of Proposition 3(B) and Theorem 2 have zero violations; the sufficient conditions cover over 99% of locked positions, and the necessary condition with $r^\circ$ is tight (Appendix § 11). A Monte Carlo check with the transformers sampler reproduces the survival formula (0.789 ± 0.013 sampled against 0.786 computed).

Which settings lock

Table 2 reports which units stay locked through the last ten measured repetitions. Pure sampling locks nothing. Top-$p$ 0.9 locks 80%–100% of units through that interval. Among penalties, the split predicted by Section 5 is visible in every row: presence 1.0 (74%–100%) and windowed frequency 0.5 (56%–99%) leave most units locked; the mild multiplicative penalty leaves between 47% and 99%, a spread that reflects its dependence on the logit origin; a strong one removes most locks (0%–35% remain); and the full-context frequency penalty leaves none locked through the final ten repetitions. Under the full-context frequency penalty locks still form transiently, as late as repetition 86 (Qwen3-8B), before the linear term overtakes them. Figure 5 in Appendix § 13 puts the penalty classes side by side against the measured lock margin.

Model	Truncation only: pure	Truncation only: top-$p$ 0.9	Truncation only: min-$p$ 0.1	Truncation only: $\tau=0.7$ +top-$p$	top-$p$ 0.9 + bounded penalty: pres.	top-$p$ 0.9 + bounded penalty: freq$_{64}$ 0.5	top-$p$ 0.9 + bounded penalty: rep$_{64}$ 1.1	top-$p$ 0.9 + bounded penalty: rep$_{64}$ 1.3	top-$p$ 0.9 + other penalties: freq. 0.1	top-$p$ 0.9 + other penalties: DRY	top-$p$ 0.9 + other penalties: DRY-C
Qwen2.5-1.5B	0	1.00	1.00	1.00	1.00	.96	.80	0	0	.02	0
Qwen2.5-7B	0	.99	.99	.99	.98	.95	.83	0	0	.02	0
Qwen3-1.7B	0	.99	.99	.99	.99	.99	.98	.21	0	.02	0
Qwen3-4B	0	1.00	1.00	1.00	.99	.99	.98	.01	0	.02	0
Qwen3-8B	0	.99	.99	1.00	.99	.99	.99	.35	0	.02	0
R1-Distill-7B	0	.88	.91	.95	.79	.70	.50	0	0	.01	0
Llama-3.2-3B	0	.95	.97	1.00	.77	.56	.47	0	0	.01	0
Llama-3.1-8B	0	1.00	1.00	1.00	1.00	.90	.89	0	0	.01	0
Gemma-2-2B	0	.80	.85	.87	.74	.69	.59	.01	0	.01	0
Gemma-2-9B	0	.91	.92	.92	.91	.90	.88	.20	0	.02	0
Phi-4-mini	0	.99	.99	1.00	.95	.95	.53	0	0	0	0

The DRY blind spot

Dose–response. To vary the breaker-free run length while holding content fixed, we take the first 24 tokens of 40 sentences per model and insert a colon (a breaker) after every $g$ tokens, for nominal $g \in\{2, 3, 4, 6, 8, 12, 24\}$; as a control we insert a semicolon (not a breaker). Retokenization can change the actual gap; Appendix § 14 reports both groupings.

Figure 2 shows a sharp transition. Pooled over models, DRY leaves 400/400 units locked at $g = 2$, 404/409 at $g = 3$, 393/419 at $g = 4$, 276/416 (66%) at $g = 6$, and 5/422 (1%) at $g = 8$, and none beyond. With semicolons, none of the 2,919 units locked under top-$p$ alone remain locked under DRY (the control selects its locked units separately, hence the different denominator). The models that unlock earliest at $g = 6$ are the two Llama models, whose reinforcement curves are the lowest in Figure 1, in line with Corollary 3, whose sufficient condition never predicts a lock that does not occur. Among the corpus units of Table 2, the 23 that stay locked under DRY all have $5 \le g \le7$, and DRY-C leaves none; Appendix § 14 also reports transient locks and finite-horizon survival.

The real sampler. We queried the unmodified llama.cpp server for the post-sampling probability of the loop token along the repetition path of 12 units. For six ordinary sentences, top-$p$ locks between repetitions 5 and 15 and DRY removes every lock. Six breaker-dense units (short lines, a key–value line, a JSON object, quoted code) lock under DRY at exactly the repetition at which they lock without it.

Free generation. Figure 3 pools the loops found in four free-generation runs (Qwen3-4B on both prompt sets, Qwen3.6-35B, Llama-3.1-8B; 1,780 generations per setting in total). With the default sampler there are 233 loops, of which 110 have $g \le7$ and 123 have $g \ge8$ or no breaker. With DRY added there are 109 loops, and all 109 have $g \le7$. DRY thus removes the loops outside the predicted blind spot, while the number inside it is unchanged (110 versus 109). Within the blind spot the distribution shifts: at $g=7$, where the cap $D_7=7.5$ is close to typical log-odds, loops drop from 10 to 1, whereas loops with $g \le5$ rise from 70 to 83: generations that DRY steers away from a long-run loop can fall into a shorter-run one. The pattern holds in each run separately (Appendix § 13) and the surviving loops are spread over many prompts. Loops are concentrated in structured output: with the default sampler, 20.8% (Qwen3-4B) and 16.1% (Llama-3.1-8B) of structured generations on prompt set 2 contain a loop, against 0% and 7.2% for prose; the prose loops of Llama all have $g \ge8$ or no breaker, and DRY removes all of them.

Closing the blind spot

We implemented the count term as a patch to the llama.cpp DRY sampler, disabled by default; with it disabled, outputs are identical to the unpatched build.

Teacher-forced. With DRY-C ($b_c \in\{1.75, 3\}$) no unit stays locked: not in the dose–response experiment at any $g$ on any model, not among the corpus units (Table 2), and not among the six breaker-dense units in the real sampler.

Free generation. Figure 4 shows the effect on structured prompts. On Qwen3-4B, loops that run to the length limit fall from 59 (default) and 30 (DRY) to 0; on Llama-3.1-8B from 52 and 32 to 0. Loops still appear in 8 and 6 generations but end after a median of 6 and 5 repetitions, in line with the logarithmic unlock time of Corollary 4. The share of generated tokens that lie inside loops drops from 12.2% to 6.7% to 0.1% on Qwen3-4B and from 15.0% to 9.4% to 0.1% on Llama-3.1-8B.

Side effects. DRY-C lowers item duplication (Table 3). Mean coverage moves a little either way, from 40.5% to 38.2% on Qwen and from 71.5% to 73.1% on Llama. Pure sampling leaves Llama a single loop in 360 generations but lowers the share of generations reaching 90% of the requested items to 23.1%. Appendix § 14 compares further baselines. Two results stand out: dropping DRY’s breakers also removes loops but roughly halves JSON validity, and a light repetition penalty (1.05) combines well with DRY-C, raising coverage to 46.8% and JSON validity to 51.1% on Qwen with no loop reaching the limit.

	Sampler	Ans.	≥90%	Cov.	Dup.	JSON
Qwen3-4B	default	62.2	15.0	34.0	28.1	26.7
	+ DRY	68.3	20.0	40.5	18.5	31.1
	+ DRY-C	65.6	20.3	38.2	15.0	31.1
	pure	69.2	21.4	40.1	18.5	24.4
Llama 3.1-8B	default	100	52.8	66.1	23.0	13.3
	+ DRY	100	58.9	71.5	12.9	26.7
	+ DRY-C	100	61.7	73.1	8.7	22.2
	pure	100	23.1	46.7	8.9	8.9

Requested repetition. When the user asks for verbatim repetition, DRY and DRY-C both get in

the way: exact completion falls from above 90% to about 10% (Table 7). A stricter test shows that the count term costs extra on blocks of short repeated lines; raising $c_0$ to 6 recovers most of it on those blocks (Appendix § 14).

Model	Sampler	sent.	para.	chorus	templ.	all
Llama-3.1-8B	default	100	100	70	100	95
	+ DRY	22	0	0	8	10
	+ DRY-C	22	0	0	8	10
	+ DRY-C, $c_0=6$	23	0	0	7	10
Qwen3-4B	default	100	100	80	82	91
	+ DRY	0	0	75	0	12
	+ DRY-C	0	0	75	0	12
	+ DRY-C, $c_0=6$	1	0	75	0	13

Discussion and Conclusion

Locked versus long. Pure sampling never locks a position, yet Qwen3-4B produces loops reaching the generation limit. Positive escape probabilities can be too small to end a loop within a finite budget (Proposition 2); conversely, a trajectory may deviate before a later lock forms.

Conclusion. Whether a loop still has an exit depends on how strongly the model prefers to continue it and on what the sampler does with that preference. Truncation can remove the exit outright; a bounded penalty only raises the bar, while a penalty that keeps growing reopens it. DRY’s breakers make it a bounded penalty on exactly the loops that matter most for structured output, and a count term lifts that cap without giving up the breakers.

Limitations

Our analysis covers verbatim loops only. Near-loops, in which a counter increments or wording drifts, fall outside the model; DRY-C turns a few verbatim loops into such near-repeats (Appendix § 14). We explain persistence, not onset: all results are conditional on a loop having begun. The reinforcement curve is treated as an empirical input; we fit but do not derive its shape. Proposition 1 applies to any sampler whose state is determined by the generated prefix (as with Mirostat), but we derive lock criteria only for top-$p$, min-$p$ and greedy decoding, not for Mirostat or XTC; for $\tau> 1$ with temperature before top-$p$ our sufficient condition is loose. Every deployed penalty, DRY-C included, has a finite look-back window and is therefore bounded; with $\Delta= 20$ and our parameters, the sufficient window condition holds for units of up to 814 tokens. The count parameters were chosen from format considerations; we test several alternatives, but do not optimize them. Side effects are measured by coarse task-completion and copying tests on two models, without human evaluation. DRY-C inherits from DRY a strong penalty on verbatim copying: when the user explicitly requests repetition, both samplers reduce exact completion from above 90% to about 10%. Beyond that, DRY-C by construction penalizes the $(c_0 + 1)$-th verbatim recurrence of any span longer than $a'$, including legitimately repeated blocks of short lines that DRY’s breakers would protect. Teacher-forced experiments use eleven models up to 9B parameters; free-generation experiments use quantized weights, three models, and a 3000-token limit, and loop counts from the 35B model are small. Loop detection uses a fixed criterion (five consecutive repetitions covering at least 60 tokens); other thresholds change the counts but not the pattern (Appendix § 13).

Use of AI Assistance

An AI assistant (Claude, Anthropic) was used extensively in this work: in deriving and checking the proofs, writing the measurement and analysis code, running the experiments, and drafting the text. The authors reviewed the derivations, results and text, and take full responsibility for the content.

Proofs

Proof of Proposition 1. The event $\{T_k \ge m\}$ says that the next $mL$ tokens equal the tokens of the loop. Write its probability by the chain rule in generation order. Each factor is conditioned on no deviation so far, in which case the context is exactly some state $(j,l)$ and the factor is $q^s_{j,l}$. Grouping the $L$ factors of each copy gives $Q_j$ for $j = k,\ldots,k+m-1$. The events decrease to $\{T_k = \infty\}$, and continuity of probability gives the second formula.

Lemma 1. Let $0 \le a_j < 1$. Then $\prod_j(1-a_j)>0$ iff $\sum_j a_j<\infty$.

Proof. For $0 \le x < 1$, $-\ln(1-x) \ge x$; for $0 \le x \le\frac{1}{2}$, $-\ln(1-x) \le2x$ (compare derivatives). If $\sum a_j<\infty$ then $a_j \le\frac{1}{2}$ for $j \ge J$ and $\sum_{j>J}-\ln(1-a_j) \le2\sum_{j>J}a_j<\infty$, so the tail product is positive, and the first $J-1$ factors are positive. If $\sum a_j=\infty$ then $-\ln\prod_{j\le N}(1-a_j) \ge\sum_{j\le N}a_j\to\infty$.

Proof of Proposition 2. A temperature-scaled softmax of finite logits gives every token a probability strictly between 0 and 1, so $q^s_{n,l}<1$. The second claim is Proposition 1 with Lemma 1 applied to $a_j=1-Q_j$. For the third, $\mathbb{P}(T_k\ge m)\le\overline{Q}^m$ and $\mathbb{E}[T_k]=\sum_{m\ge1}\mathbb{P}(T_k\ge m)\le\overline{Q}/(1-\overline{Q})$.

Proof of Theorem 1. A state is locked iff the retained set is $\{u_l\}$.

(a) Suppose $q\ge\pi>\frac{1}{2}$. Any other token $v$ has $p(v)\le1-q<q$, so the mass strictly above $v$ is at least $q\ge\pi$ and $v$ is dropped; nothing lies strictly above $u_l$, so $u_l$ is kept. Conversely suppose $q<\pi$. If $u_l$ is not a most probable token, a most probable token $v_1\ne u_l$ is kept. If $u_l$ is the most probable token, let $v_2$ be most probable among the rest; the mass strictly above $v_2$ is at most $q<\pi$ (if several tokens tie with $v_2$ the mass strictly above them is still only $q$), so $v_2$ is kept.

(b) If $u_l$ is not the most probable token, the most probable token is kept and $\ln q-\ln a\le0$. Otherwise all other tokens are dropped iff $a<\beta q$.

(c) By definition. The last sentence of the theorem follows from Proposition 1.

Proof. The case $A=\sum_i x_i=0$ is trivial; otherwise normalize by $A$ and put $y_i=x_i/A\in[0,1]$. For $s\ge1$, $y_i^s\le y_i$; for $s\le1$, $y_i^s\ge y_i$; summing gives the bounds around $(\sum_i x_i)^s$. The remaining bound for $s\ge1$ is trivial and for $s\le1$ is Jensen’s inequality for the concave map $t\mapsto t^s$.

Proof of Proposition 3. (A) The retained set is determined by the raw distribution; temperature only reweights tokens inside it, and a singleton has probability 1 regardless.

(B) Let $s=1/\tau\ge1$. After temperature the loop token has probability $q^{(\tau)}=q^s/(q^s+\sum_{v\ne u_l}p(v)^s)$. By Lemma 2, $a^s\le\sum_{v\ne u_l}p(v)^s\le(1-q)^s$, so

By Theorem 1(a) the state is locked iff $q^{(\tau)}\ge\pi$. The left side is at least $\pi$ iff \logit(q)\ge\tau\logit(\pi); if the state is locked the right side is at least $\pi$, i.e. $(q/a)^s\ge\pi/(1-\pi)$. For min-$p$, temperature preserves the order of tokens and raises probability ratios to the power $1/\tau$, so by Theorem 1(b) the state is locked iff $(q/a)^{1/\tau}>1/\beta$.

For $\tau>1$ and top-$p$, the second part of Lemma 2 with $m=|V|-1$ gives in the same way

The sufficient condition is loose because it allows the remaining mass to be spread uniformly over the vocabulary.

Proof of Theorem 2. The penalized distribution is proportional to $p(v)e^{-d(v)}$, which gives the formula for $q'$. Since $e^{-d(v)}\le1$, the sum in the denominator is at most $1-q$; keeping only unseen tokens, which have $d(v)=0$, it is at least $r^\circ$. As $c \mapsto x/(x+c)$ is decreasing this gives the two-sided bound. The lower bound has log-odds $\operatorname{logit}(q)-d$ and the upper bound has log-odds $\ln(q/r^\circ)-d$; Theorem 1(a) applied to $q'$ gives the two implications. The min-$p$ statement is Theorem 1(b) for the penalized distribution; note that the strongest rival may change after the penalty. □

Proof of Corollary 1. $q \ge\sigma(\operatorname{logit}(\pi)+D)$ iff $\operatorname{logit}(q) \ge\operatorname{logit}(\pi)+D$, which implies $\operatorname{logit}(q)-d \ge\operatorname{logit}(\pi)$. □

Proof of Corollary 2. By the upper bound of Theorem 2, $q_{n,l} \le q_{n,l}^{\prime}e^{-d_{n,l}/r_{n,l}^{\circ}} = \exp(-(d_{n,l}-\ln(q_{n,l}/r_{n,l}^{\circ}))) \to0$. The set retained by top-$p$ has mass at least $\pi$, so after renormalization $q_{n,l}^{s} \le q_{n,l}^{\prime}/\pi$ (or 0 if the loop token is dropped). Hence $Q_n \le q_{n,l}^{\prime}/\pi\to0$ and $\mathbb{P}(T_k=\infty) \le Q_N \to0$ by Proposition 1. If $d_{n,l} \to\infty$ and $r_{n,l}^{\circ} \ge\rho> 0$, then $d_{n,l}-\ln(q_{n,l}/r_{n,l}^{\circ}) \ge d_{n,l}-\ln(1/\rho) \to\infty$. □

Proof of Proposition 4. If $u_l \in B$ the penalty is zero by definition. Let $u_l \notin B$. Since $n \ge1$, the context ends with at least one complete copy of $u$, which contains a breaker; the $\kappa$ trailing non-breaker tokens therefore lie in the loop and form a contiguous arc of the circle. The token $u_l$ extends this arc, giving $\kappa+1$ consecutive non-breaker tokens, so $\kappa+1 \le g$. Thus $M(u_l) \le\kappa\le g-1$. If $g-1<a$ the penalty is zero; otherwise it is at most $\lambda b^{g-1-a}$ because $b>1$. For attainment, let $u_l$ be the last token of a longest breaker-free arc, so that $\kappa=g-1$. For $n \ge2$ the position $j=t-L$ satisfies $x_{j+1}=u_l$ and is preceded by at least one full copy that agrees with the current suffix, so $M_j \ge L>\kappa$; if $W \ge L+g-1$, it also lies in the window with $j-h+1 \ge W-L \ge g-1$, so $M(u_l)=g-1$. □

Proof of Corollary 3. Proposition 4 bounds the penalty on the loop token by $D_g$. DRY may also penalize other candidates, but the sufficient condition of Theorem 2 holds for arbitrary $d(v)\ge0$, so Corollary 1 applies. □

Proof of Proposition 5. Let $t$ be the last position of the context, so that $u_l$ is to be generated next. For $k=1,\ldots,n$ put $j_k=t-kL$, the same position $k$ copies earlier; then $x_{j_k+1}=u_l$. From the start of the loop up to $j_k$ there are $(n-k)L+(l-1)$ loop tokens, and by periodicity they agree with the equally long suffix ending at $t$, so $M_{j_k}\ge(n-k)L$. Therefore $j_k$ is counted whenever $(n-k)L\ge a'$, i.e. for $k\le n-\lceil a'/L\rceil$, provided its matching span of $a'$ tokens lies within the last $W$ tokens, i.e. $kL+a'\le W$, i.e. $k\le N_W$. Hence $c(u_l)\ge\min(n-\lceil a'/L\rceil,N_W)$, and the bound follows because $b_c>1$. □

of $a'$ tokens lies within the last $W$ tokens, i.e. $kL+a' \le W$, i.e. $k \le N_W$. Hence $c(u_l) \ge\min(n-\lceil a'/L\rceil,N_W)$, and the bound follows because $b_c>1$. □

Proof of Corollary 4. By the necessary condition of Theorem 2, a locked state has d(u_l) \le\ln(q/r^\circ)-\logit(\pi) \le\Delta. Let $m=\min(n-\lceil a'/L\rceil,N_W)$ and suppose $m>c_0+\delta$. Then $m\ge c_0$, so Proposition 5 gives $d(u_l)\ge\lambda b_c^{m-c_0}>\lambda b_c^\delta=\max\{\Delta,\lambda\}>\Delta$, and the state is not locked. If $N_W>c_0+\delta$, then $m>c_0+\delta$ holds exactly when $n>\lceil a'/L\rceil+c_0+\delta$. □

Verification Details

Lock criteria. For Qwen2.5-1.5B, Qwen2.5-7B, Qwen3-4B and Llama-3.2-3B we compared, at every position of every unit, the lock status computed exactly from the full distribution with the status predicted from $q$ and $a$ alone. For top-$p\in\{0.9,0.95\}$ and min-$p\in\{0.1,0.05\}$ the two agree at all positions (about 160,000 per model). The smallest escape probability $1-q$ observed under pure sampling ranges from $1.9\times10^{-13}$ to $3\times10^{-6}$ across models and is always positive; the per-repetition escape probability $1-Q_n$ settles between $10^{-1.5}$ and $10^{-3.5}$.

Temperature. For $\tau=0.7$ before top-$p$ 0.9, the sufficient and necessary conditions of Proposition 3(B) have no violations, and the sufficient condition covers 99.6%–99.9% of locked positions. Lock onset moves from repetitions 10–13 to 4–6.

Penalties. For presence penalties 1 and 2 and full-context frequency penalties 0.1 and 0.5, the sufficient condition of Theorem 2 has no violations and covers 99.2%–100% of locked positions. The necessary condition with the measured $r^\circ$ has no violations, and the smallest slack among locked positions is 0.00; replacing $r^\circ$ by $1-q$ produces tens to thousands of violations, so the distinction matters.

Simulation versus the llama.cpp Sampler

The teacher-forced DRY results rely on our implementation of the definition in § 6. We compared it with llama.cpp (commit 03aa006) on 12 units and 40 repetitions (about 5,000 positions), using the server’s post-sampling probabilities with DRY followed by top-$p$ 0.9. Lock status differs at 15 positions and the largest probability difference is 0.24. The same comparison for top-$p$ alone, which involves no DRY computation, differs at 20 positions with a largest difference of 0.22; the residual is therefore due to numerical differences between the half-precision GGUF and the single-precision weights, at positions near the truncation threshold. The comparison is sensitive to the specification: a variant that omits the exemption of breaker tokens differs at 152 positions, with differences up to 1.0. The count term was validated in the same way against the patched sampler (13 and 10 differing positions for $b_c = 1.75$ and 3). With the patch disabled, the patched and unpatched builds return identical probabilities at all 5,072 positions for top-$p$ and at all positions where both return a value for DRY.

Experimental Details

Teacher-forced runs. In the window reruns, Qwen2.5-1.5B uses float32, both Gemma models use bfloat16, and the other models use float16. Softmax and sampler calculations use float64. Contexts are limited to 12,288 tokens, and to 4,000 tokens for Phi-4-mini, whose outputs degrade abruptly beyond 4,096 tokens under chunked evaluation. Reinforcement curves use the inline variants of the corpus sentences whose tokenization is stable under repetition (277–300 per model); lock fractions and the DRY comparison use an evenly spaced subset of 150 units; the dose–response experiment uses 40 base sentences per model that contain no breaker characters or semicolons. A unit is counted as finally locked if its last ten measured repetitions are entirely locked (Table 2 and the 60-repetition dose experiment). Ever-locked means at least one measured repetition is entirely locked.

Free generation. Quantizations: Q8_0 for Qwen3-4B and Llama-3.1-8B, Q4_K_M for Qwen3.6-35B-A3B. Prompt set 1: 25 samples per prompt and setting for Qwen3-4B, 10 for the 35B model. Prompt set 2: 15 samples per prompt and setting. DRY uses $\lambda= 0.8$, $b = 1.75$, $a = 2$, the default breakers, and a range of 4,096 tokens. Table 5 lists loop counts per run, and Table 4 gives every sampler setting run on prompt set 1. The windowed multiplicative penalty (rep. 1.1) yields fewer loops there than DRY, which we attribute to its also penalizing breaker tokens; in teacher forcing it leaves most units locked (Table 2).

	default	+ DRY	+ pres. 1	+ rep. 1.1	pure
Qwen3-4B	78	28	44	24	37
of which $g \le7$	30	28	29	19	26
Qwen3.6-35B	9	4	1	0	1
of which $g \le7$	3	4	0	0	0

Run	Sampler	loops	$g \le7$	$g \ge8$
Qwen3-4B, set 1	default	78	30	48
	+ DRY	28	28	0
Qwen3-4B, set 2	default	75	45	30
	+ DRY	44	44	0
Qwen3.6-35B, set 1	default	9	3	6
	+ DRY	4	4	0
Llama-3.1-8B, set 2	default	71	32	39
	+ DRY	33	33	0

DRY-C uses $a' = 24$, $c_0 = 2$, $b_c = 3$; with $b_c = 1.75$ on Qwen3-4B (prompt set 2), 25 structured generations contain a loop instead of 8, and again none runs to the length limit.

Sensitivity to the loop criterion. Table 6 repeats the count of Figure 3 under looser and stricter loop criteria. The number of loops changes, but under every criterion no loop that appears with DRY enabled has $g \ge8$.

Criterion	default all	default $g \le7$	default $g \ge8$	default + DRY all	default + DRY $g \le7$	default + DRY $g \ge8$
$\ge$3 reps., $\ge$30 tok.	309	124	185	129	129	0
$\ge$4 reps., $\ge$40 tok.	262	120	142	116	116	0
$\ge$5 reps., $\ge$60 tok.	233	110	123	109	109	0
$\ge$8 reps., $\ge$100 tok.	184	95	89	99	99	0
$\ge$10 reps., $\ge$150 tok.	169	91	78	90	90	0

Requested repetition. Twelve prompts ask for verbatim repetition of a text given in the prompt: four ask for a sentence to be copied 5 or 8 times, two for a paragraph to be copied 3 times, two for a four-line chorus after each of 4 verses, and four for a fixed line in each of 5–8 items (notes, functions, SQL statements); half are in English and half in Chinese. A generation succeeds if the given text occurs the required number of times in the answer, ignoring differences in whitespace. Table 7 reports this 12-task experiment, with 10 generations per task for default and DRY (120 per row) and three batches of 10 per task for each DRY-C setting (360 per row). A stricter 16-task version is reported in Appendix § 14. The chorus tasks, whose lines are short and newline-terminated, are the only ones on which Qwen3-4B still succeeds under DRY, as expected from § 6.

Larger models. The 35B model loops far less than the 4B model under the same sampler and prompts (4.5% of generations against 15.6%), in agreement with Pipis et al. [30]; the four loops that survive DRY all have $g \le6$.

Penalty trajectories. Figure 5 shows each penalty on the loop token as a function of $n$, contrasting fixed caps with linear and exponential lower-bound trajectories. The curve labeled “count term” shows the count component alone, not the maximum of the DRY and count penalties.

Task completion. For each structured prompt we extract items from the answer (for reasoning models, the text after the reasoning block) with a prompt-specific pattern, and compare the number of distinct items with the number requested. Generations that reach the length limit before producing an answer count as zero items.

Additional Baselines and Robustness

Additional interventions. Antislop suppresses unwanted strings by backtracking (Paech et al. [28]); Local Temperature Beam Search uses deterministic calibration (Lee et al. [18]); Variance-

Calibrated Modulation adjusts decoding to address concentration in the distribution head (Ding et al. [3]); XTC excludes top choices (Weidmann et al. [36]). e-CUSUM studies reasoning monitors (Ettifouri et al. [5]), “One Neuron” explores internal-component edits (Lazaridis et al. [17]), “Feedback That Backfires” examines repeated failed actions after feedback (Gumaan [11]), and “Word Salad Chopper” detects unproductive reasoning from hidden states (Xie et al. [40]). None of them asks our question: whether the sampler still leaves any probability for leaving a given loop.

Additional baselines. Table 8 uses the same 24 structured prompts, 15 samples per prompt and setting, and 3,000-token generation limit as Table 3. The two token penalties with $W=4096$ look back 4,096 tokens, which covers the whole generation, so the frequency penalty grows throughout. The bounded alternatives (rep. 1.1, DRY + rep. 1.05, newline-only breakers) still produce loops that run to the generation limit. Frequency 0.1 nearly removes such loops, but on Llama lowers mean item coverage from 66.1% (default) to 43.3%, with only 7.8% of generations reaching 90% of the requested distinct items. Removing every breaker eliminates detected loops in both models while reducing JSON validity relative to DRY (31.1% to 17.8% for Qwen; 26.7% to 11.1% for Llama). DRY-C again has no loop reaching the limit. On completion it neither beats nor trails DRY consistently: mean coverage is 38.2% against 40.5% on Qwen and 73.1% against 71.5% on Llama. Adding rep. 1.05 to DRY-C on Qwen yields 3 loops, none to the limit, 46.8% coverage and 51.1% JSON validity; the corresponding DRY + rep. 1.05 baseline has 11 run-to-limit loops and 47.4% coverage. The two combine well: the light penalty helps completion, and the count term removes the locks.

Model	Sampler	Loops	To limit	Loop tokens (%)	Coverage (%)	JSON (%)
Qwen3-4B	default	75	59	12.2	34.0	26.7
	DRY	44	30	6.7	40.5	31.1
	DRY-C	8	0	0.1	38.2	31.1
	frequency 0.1, $W = 4096$	19	4	0.7	39.6	15.6
	rep. 1.1, $W = 4096$	31	22	4.1	52.9	51.1
	DRY + rep. 1.05	20	11	2.7	47.4	42.2
	DRY, newline breakers only	31	28	4.9	43.3	15.6
	DRY, no breakers	0	0	0.0	42.7	17.8
	DRY-C + rep. 1.05	3	0	0.3	46.8	51.1
Llama-3.1-8B	default	58	52	15.0	66.1	13.3
	DRY	33	32	9.4	71.5	26.7
	DRY-C	6	0	0.1	73.1	22.2
	frequency 0.1, $W = 4096$	85	1	4.0	43.3	4.4
	rep. 1.1, $W = 4096$	7	4	1.6	63.3	35.6
	DRY + rep. 1.05	6	5	1.8	67.0	33.3
	DRY, newline breakers only	14	14	4.9	70.1	33.3
	DRY, no breakers	0	0	0.0	60.7	11.1

Count-parameter sensitivity. On Qwen, changing $(a', c_0)$ from (24, 2) to (12, 2), (48, 2) or (24, 4) yields respectively 4, 33 and 39 detected loops in 360 generations per setting, all ending before the generation limit. The loop-token shares are 0.04%, 0.41% and 1.31%; the baseline (24, 2) has 8 loops and a 0.1% share. With $a'=48$, more loops persist long enough to meet the detector criterion before ending, consistent with the later activation in Proposition 5. Coverage/JSON are 39.1%/28.9% for $a'=12$ and 38.1%/37.8% for $a'=48$. For $c_0=4$ they are 37.8%/28.9%.

Windowed lock status and finite survival. The second run, with a 4,096-token look-back for DRY and DRY-C, covers all eleven models with 150 units each (Phi-4 again capped at 4,000 tokens). Top-$p$ is ever locked on 1,632/1,650 units and locked through the last ten repetitions on 1,577/1,650. DRY has 28 ever-locked and 23 finally locked units, all final locks with $5 \le g \le7$; DRY-C ($b_c=3$) has 3 ever-locked units and no final locks. In Table 9, $k_3$ is the probability, starting with three copies in context, of following the loop to that unit’s measured endpoint, averaged over units.

Model	$N$	top-$p$ ever/final	top-$p$ mean $k_3$	DRY ever/final	DRY mean $k_3$	DRY-C ever/final	DRY-C mean $k_3$
Gemma-2-2B	150	144/120	0.0221	3/2	3.23e-10	0/0	0
Gemma-2-9B	150	150/137	0.0696	3/3	0.000738	0/0	0
Llama-3.1-8B	150	150/150	0.113	1/1	9.57e-06	0/0	0
Llama-3.2-3B	150	143/142	0.147	1/1	1.38e-06	0/0	0
Phi-4-mini	150	150/149	0.472	0/0	6.83e-35	0/0	0
Qwen2.5-1.5B	150	150/150	0.130	3/3	0.000435	0/0	0
Qwen2.5-7B	150	150/149	0.346	3/3	0.00173	0/0	0
Qwen3-1.7B	150	150/149	0.272	4/3	0.0061	0/0	0
Qwen3-4B	150	150/150	0.373	4/3	0.00839	1/0	0
Qwen3-8B	150	150/149	0.700	4/3	0.0146	2/0	0
R1-Distill-7B	150	145/132	0.000902	2/1	2.99e-08	0/0	0

Actual breaker gaps. Of 3,080 colon units, 2,914 satisfy the top-$p$ last-ten lock criterion. Retokenization changes the actual gap on 51 units overall, including 48 of these 2,914. Table 10 contrasts grouping by the intended insertion interval with grouping by the recorded actual token gap. The transition persists: at actual $g=6$, 277/417 remain locked under DRY; at $g=8$, 5/418 do. The semicolon control has 0/2,919 remaining locks; its denominator counts the control units (out of 3,080) that lock under top-$p$ alone.

$g$	Nominal interval	Actual gap
2	400/400	392/392
3	404/409	410/415
4	393/419	393/418
5	–	1/2
6	276/416	277/417
8	5/422	5/418
9	–	0/3
10	–	0/1
11	–	0/2
12	0/423	0/421
23	–	0/30
24	0/425	0/395

Stricter requested-copying evaluation. This experiment adds four tasks that repeat blocks of short lines to the twelve tasks of Appendix § 13. Each setting has 16 tasks with 10 samples each (160 generations per model and setting). We report both whitespace-normalized substring counts and strict counts that normalize only spaces/tabs immediately before a newline, preserving internal spaces and line structure (Table 11). Trailing whitespace is normalized because default outputs also use trailing double spaces as Markdown line breaks. The strict metric shows additional copying loss from DRY-C: overall success falls from DRY’s 10.6% to 6.3% on Llama and from 18.1% to 11.2% on Qwen at $c_0=2$. On the four block tasks (40 generations), strict success is 42.5% to 25.0% on Llama and 30.0% to 10.0% on Qwen. Raising $c_0$ to 6 brings these to 40.0% and 27.5%, respectively. The count term therefore costs extra on legitimately repeated blocks, a cost the twelve-task test does not reveal.

Sampler	Llama norm.	Llama strict	Qwen norm.	Qwen strict
default	127	120	127	126
DRY	27	17	31	29
DRY + rep. 1.05	28	12	35	31
DRY, newline only	32	18	26	24
DRY-C, $c_0 = 2$	26	10	18	18
DRY-C, $c_0 = 6$	30	16	28	22

Count activation outside detected loops. Table 12 counts teacher-forced activations on default-sampler generations with no loop under our detector, using exact $(a' + 1)$-token tuples and a 4,096-token window (all sequences are at most 3,000 tokens). At $(a', c_0)=(24, 2)$, at least one continuation would be penalized in 108/285 (37.9%) Qwen structured outputs and 57/302 (18.9%) Llama structured outputs; affected-position shares are 3.0% and 5.7%. For prose the corresponding generation shares are 9/180 (5.0%) and 50/167 (29.9%). Raising either threshold reduces them.

$a'$	$c_0$	Structured Qwen	Structured Llama	Prose Qwen / Llama
12	2	68.1	53.0	14.4 / 49.7
12	4	42.8	42.7	2.8 / 19.8
24	2	37.9	18.9	5.0 / 29.9
24	4	14.4	13.2	0.0 / 15.0
48	2	27.0	10.3	1.7 / 18.0
48	4	6.7	6.0	0.0 / 9.0

Near-loops. Does DRY-C just push verbatim loops into approximate ones that our detector misses? We decoded all 8,280 structured generations and computed two text-level measures: the zlib compression ratio (lower means more repetitive) and the share of lines that are at least 90% similar (difflib) to an earlier line, ignoring lines under five characters. Going from DRY to DRY-C, the share of generations with no verbatim loop but more than half of their lines near-duplicated rises a little, from 8.9% to 12.2% on Qwen and from 17.8% to 19.7% on Llama. Overall repetition does not rise: the median compression ratio goes up (0.339 to 0.347 on Qwen, 0.323 to 0.347 on Llama), and the median near-duplicate line share is essentially unchanged (0.083 to 0.081; 0.050 to 0.054). So a few verbatim loops turn into drifting near-repeats, but the repetition is not simply moved out of sight.