Decoding Algorithms

The rotation guide won its place in the context prompt:

Create a replacement key, deploy it, then revoke the old key.

That passage still isn't the answer. In Core Retrieval Algorithms, retrieval picked the relevant documentation for How do I rotate an API key? It didn't generate the next token. To complete The first rotation step is, the language model might score create (supported), revoke (real action, but dangerous if done first), or quota (a fluent leak from an unrelated dashboard). Only one candidate preserves system uptime.

Decoding translates raw model scores into generated text. The exact same scores can produce radically different completions depending on whether we greedily grab the largest value, sample from a probability distribution, explore a beam of partial paths, or guide reasoning rollouts with a verifier. None of those search algorithms turns an unsupported hallucination into ground truth.

We'll work with explicit score vectors rather than downloading a multi-gigabyte checkpoint. That lets us inspect every probability, track numerical boundaries, and evaluate the decoder independently from base model weights.

The autoregressive search space: $|V|^T$ exponential token trees

An autoregressive model doesn't generate an entire sentence in one shot. It predicts text sequentially, token by token. Given an input prompt $x = (x_1, \dots, x_M)$, the model computes conditional probabilities over the vocabulary $V$ at each step $t$:

$$P(y_{1:T} \mid x) = \prod_{t=1}^T P(y_t \mid x, y_{<t})$$

Working in log-probability space turns this product into a sum, preventing floating-point underflow across long answers:

$$\log P(y_{1:T} \mid x) = \sum_{t=1}^T \log P(y_t \mid x, y_{<t})$$

Finding the globally optimal completion means finding the sequence $y^*$ that maximizes this joint log-probability:

$$y^* = \arg\max_{y \in \mathcal{Y}} \sum_{t=1}^T \log P(y_t \mid x, y_{<t})$$

That objective sounds straightforward until you inspect the size of the search space $\mathcal{Y}$. Modern tokenizer vocabularies contain between $|V| = 32{,}000$ and $|V| = 128{,}000$ tokens. If the generation horizon is $T = 100$ tokens, the complete tree contains:

$$|\mathcal{Y}| = |V|^T \approx 32{,}000^{100} \approx 10^{450} \quad \text{possible sequence paths}$$

The observable universe contains roughly $10^{80}$ atoms. Evaluating every path in this tree is computationally impossible. Because language model probabilities change conditionally after every appended token, we can't use dynamic programming algorithms like Viterbi decoding without Markovian independence assumptions that transformers violate.

Every decoding algorithm is therefore an approximation. Some use greedy or beam search to hunt for high-probability sequences; others sample stochastically to preserve human-like diversity; modern reasoning systems use verifiers and tree search to explore multi-step deductions.

From raw logits to numerically stable probabilities

For clear arithmetic, treat each word below as a single token. Our prompt ends with:

Suppose the model outputs these raw prediction scores, called logits, for the immediate next token:

Logits aren't probabilities: they're real numbers that can be negative and don't sum to one. Softmax converts unbounded logits into a normalized probability distribution:

$$p_i = \frac{\exp(z_i - m)}{\sum_j \exp(z_j - m)} \qquad \text{where} \qquad m = \max_j z_j$$

Subtracting the maximum logit $m$ doesn't alter the output probabilities. Because $\exp(z_i - m) = \exp(z_i) \cdot \exp(-m)$, the constant factor $\exp(-m)$ factors out of both numerator and denominator and cancels cleanly.

This shift prevents exponential overflow when logits grow large, a practical necessity in FP16 and FP32 inference engines.^{[1]Reference 1Accurate Computation of the Log-Sum-Exp and Softmax Functionshttps://arxiv.org/abs/1909.03469} Without it, evaluating $\exp(1000)$ crashes floating-point hardware with an overflow exception.

create is the distribution's mode at 0.568. But revoke still holds 0.345 of the total mass: over a third of the probability distribution points to an action that revokes active credentials before new keys are deployed.

Sampling unconstrained from this distribution will trigger production incidents in roughly one out of every three requests.

Numerical stability under extreme ranges

The max shift isn't an optional speed trick. Directly calling exp(1000) overflows standard 64-bit floating-point math, even though the resulting probabilities are mathematically well behaved.

The max subtraction eliminates exponential overflow, but hardware floating-point numbers still have finite precision. An extreme negative gap like exp(-1000) safely underflows to 0.0.

When every token is masked to negative infinity, total probability mass collapses to zero: the decoder must handle that condition explicitly rather than dividing zero by zero.

Deterministic search: greedy myopic traps and beam exploration

After picking a token, the runtime appends it to the prefix and feeds the extended sequence back into the model to predict the subsequent position. Repeating that process builds the autoregressive loop.

In serving runtimes, a key-value (KV) cache retains previous attention keys and values so earlier positions aren't recalculated from scratch.^{[2]Reference 2Efficient Memory Management for Large Language Model Serving with PagedAttention.https://arxiv.org/abs/2309.06180} That architecture optimizes inference throughput, but it doesn't choose the token. Selecting tokens remains the responsibility of the decoding algorithm.

Greedy decoding picks the token with the highest logit at every step:

$$y_t = \arg\max_{w \in V} P(w \mid x, y_{<t})$$

Greedy generation is completely deterministic. Given identical inputs, hardware, and tie-breaking rules, it always returns the exact same sequence. It requires no hyperparameters, adds zero search overhead, and works well for structured code generation or focused factual extraction.

Yet greedy decoding suffers from a fundamental search failure: the myopic trap. Because greedy search commits irreversibly to the immediate highest-scoring token at step $t$, it can miss globally higher-probability sequences that begin with a slightly lower-scoring first token.

Beam search tracks parallel hypotheses

Beam search mitigates greedy myopia by maintaining a set of $B$ active hypotheses, where $B$ is the beam width.

At each step, the algorithm:

1. Expands all $B$ currently retained partial sequences by considering all possible continuations in $V$.
2. Computes the cumulative log-probability for each candidate extension: $\sum_{\tau=1}^t \log P(y_\tau \mid x, y_{<\tau})$.
3. Prunes the pool back to the top $B$ highest-scoring paths.

Consider an example where the prompt prefix is You should. Greedy immediately grabs create at step 1 because $0.40 \gt 0.35$. But look at what happens at step 2:

Greedy gets trapped with create . at joint probability $0.080$. A beam search with width $B = 2$ retains both create and first through step 1. At step 2, it evaluates the joint paths and discovers first create at $0.245$: more than triple the joint probability of the greedy choice.

Beam search remains an approximate heuristic. Once a prefix falls outside the top $B$ hypotheses at any step, the search discards it permanently. Even if that pruned prefix would have unlocked a continuation with probability $1.0$, beam search can never recover it.

Width $B = 2$ prunes branch C at step 1 because $0.2 \lt 0.3$. It then settles for B 0 at joint probability 0.060. Expanding width to $B = 3$ preserves C, discovering the global optimum C win at joint probability 0.200.

Scaling beam width increases hypothesis coverage, but running $B$ concurrent beams multiplies memory footprint and KV-cache storage by $B$.

Length normalization and repetition penalties

Unconstrained beam search encounters two notorious failure modes in production generation: short-sequence bias and degenerative repetition loops.

Length normalization prevents premature termination

Every generated token multiplies the joint probability by a conditional value $P(y_t \mid \dots) \le 1$. In log space, adding non-positive log-probabilities causes cumulative path scores to decay monotonically with sequence length:

$$\sum_{t=1}^{L+1} \log P(y_t) \le \sum_{t=1}^L \log P(y_t) \le 0$$

A completed two-token answer almost always has a higher raw joint log-probability than an insightful 15-token explanation. Raw beam search is artificially biased toward emitting the end-of-sequence token $\langle\text{EOS}\rangle$ as early as possible.

To compare sequences of different lengths fairly, we apply a length penalty $\text{LP}(L)$. Wu et al. developed the Google Neural Machine Translation length penalty:^{[3]Reference 3Google's Neural Machine Translation System: Bridging the Gap between Human and Machine Translation.https://arxiv.org/abs/1609.08144}

$$S(Y) = \frac{\sum_{t=1}^L \log P(y_t \mid x, y_{<t})}{\text{LP}(L)} \qquad \text{where} \qquad \text{LP}(L) = \frac{(5 + L)^\alpha}{(5 + 1)^\alpha}$$

The exponent $\alpha \in [0.6, 1.0]$ tunes length tolerance. At $\alpha = 0$, there is no penalty; at $\alpha = 1$, the score approaches average log-probability per token.^{[4]Reference 4Text Generation.https://huggingface.co/docs/transformers/en/main_classes/text_generation}

Raw scoring prefers the terse -1.000 completion. Length normalization divides by token count: -1.600 / 5 = -0.320 beats -1.000 / 2 = -0.500, correctly selecting the complete procedure.

Repetition penalties break self-reinforcing loops

In open-ended tasks like dialogue or report generation, standard beam search frequently degenerates into repetitive loops:

The incident team notified the manager and notified the manager and notified the manager...

Language models attend to their own generated tokens. Once an n-gram repeats, self-attention reinforces that pattern, assigning high conditional probabilities to repeating it again. Maximization-based search greedily exploits this loop.^{[5]Reference 5The Curious Case of Neural Text Degeneration.https://arxiv.org/abs/1904.09751}

Keskar et al. introduced a multiplicative logit penalty $\theta > 1$ that discounts any token that has already appeared in the generated prefix:^{[6]Reference 6CTRL: A Conditional Transformer Language Model for Controllable Generation.https://arxiv.org/abs/1909.05858}

$$z_w \leftarrow \begin{cases} z_w / \theta & \text{if } z_w > 0 \\ z_w \cdot \theta & \text{if } z_w \le 0 \end{cases} \qquad \forall w \in \text{generated sequence}$$

Dividing positive logits by $\theta$ lowers their probability; multiplying negative logits by $\theta$ pushes them further negative. This penalizes repetition without banning words outright.

With $\theta = 1.2$, the logit for create drops from 3.0 to 2.50. That demotes create below deploy (2.8), steering the decoder to the next required operation instead of stuttering on the same verb.

Temperature reshapes entropy

Stochastic sampling trades exact log-likelihood maximization for linguistic variety. The first parameter governing this tradeoff is temperature $T > 0$, which scales logits prior to softmax:

$$p_i(T) = \frac{\exp(z_i / T)}{\sum_j \exp(z_j / T)}$$

• As $T \to 0$, the probability distribution collapses into a one-hot vector on the mode $\arg\max_j z_j$. The sampler behaves like greedy search.
• When $T = 1.0$, probabilities match the model's raw unscaled distribution.
• As $T \to \infty$, logits are squashed toward zero, converting the distribution into uniform random noise where every token has probability $1 / |V|$.

We measure the dispersion of the distribution using Shannon entropy: $H(p) = -\sum_i p_i \log p_i$. When using natural logarithms, entropy is expressed in nats. Higher entropy means greater output unpredictability.

At $T = 0.5$, entropy falls to $0.647$ nats and create claims $72.1\%$ of the probability mass. At $T = 2.0$, entropy rises to $1.190$ nats: the irrelevant tail token quota jumps from $1\%$ to nearly $6\%$.

Lowering temperature sharpens the distribution, but it doesn't remove bad tokens mathematically. As long as $T > 0$, every token with a finite logit retains non-zero probability.

Does setting temperature to 0.2 eliminate the risk of sampling an unsupported tail token?

Answer

No. Temperature compresses logit gaps but leaves every finite token with positive probability. Even at T = 0.2, tail tokens retain non-zero mass. To guarantee that low-probability candidates cannot be sampled, you must use truncation filters or grammar constraints.

Seeding and production reproducibility

Sampling draws random tokens according to model probabilities. In local development, passing a fixed random seed allows repeatable draws from a static distribution:

Local seeds ensure test determinism. But in production GPU clusters, exact byte-for-byte reproducibility is difficult to guarantee.

Parallel matrix multiplications (such as cuBLAS GEMM or FlashAttention) perform floating-point additions across distributed GPU threads. Because floating-point addition is non-associative, small variations in dynamic request batching or CUDA thread scheduling alter intermediate sums slightly. Those micro-variations can flip borderline logits and steer sampling onto entirely different paths.

Hosted model providers also update inference backends and quantization layers over time. For example, Anthropic's Claude Sonnet 5 rejects custom temperature, top_p, and top_k parameters entirely, returning a 400 Bad Request if developers attempt to override default values.^{[7]Reference 7What's new in Claude Sonnet 5https://platform.claude.com/docs/en/about-claude/models/whats-new-sonnet-5}

Production evaluation harnesses must log model version hashes, prompt snapshots, decoder parameters, and vendor response headers alongside each generated answer.

Truncating the long tail: Top-k, Top-p, and Min-p

Unconstrained sampling from the entire vocabulary inevitably pulls from what Holtzman et al. call the unreliable tail.^{[5]Reference 5The Curious Case of Neural Text Degeneration.https://arxiv.org/abs/1904.09751} Even if an absurd token has a tiny probability of $p = 0.002$, over an answer of 500 tokens the probability of drawing at least one tail token is:

$$1 - (1 - 0.002)^{500} \approx 63.2\%$$

To prevent tail pollution, inference engines truncate the vocabulary before drawing tokens.

Top-k truncation: fixed rank cutoff

Top-k sampling retains only the $k$ highest-probability tokens, setting the probability of all other tokens to zero and renormalizing the remaining mass:^{[8]Reference 8Hierarchical Neural Story Generation.https://arxiv.org/abs/1805.04833}

$$V^{(k)} = \{i \in V : \text{rank}(p_i) \le k\}$$

Top-k sampling has a major structural flaw: fixed cardinality.

When the model is confident and the distribution is steep (for instance, completing The capital of France is), the single correct token might hold $99\%$ of the mass. A setting of $k = 50$ forces the sampler to keep 49 garbage tokens.

Conversely, when the distribution is flat because many synonyms are equally valid, $k = 50$ arbitrarily cuts off good candidates that happen to rank 51st.

Top-p (Nucleus) sampling: dynamic cumulative thresholding

Top-p sampling, or nucleus sampling, solves the fixed-cardinality problem by accumulating mass. It selects the smallest set of ranked tokens whose cumulative probability reaches a threshold $p \in (0, 1]$:^{[5]Reference 5The Curious Case of Neural Text Degeneration.https://arxiv.org/abs/1904.09751}

$$V^{(p)} = \text{smallest subset of } V \text{ such that } \sum_{i \in V^{(p)}} p_i \ge p$$

At $p = 0.90$, Top-p keeps only 2 tokens for the peaked distribution ($0.568 + 0.345 = 0.913 \ge 0.90$). For the flat distribution, it dynamically expands to keep all 4 tokens. Top-p adapts candidate pool size to the model's certainty.

Min-p sampling: relative probability filtering

Top-p works well at moderate temperatures ($T \approx 0.7$), but it struggles at higher temperatures ($T \ge 1.2$). High temperatures flatten the entire vocabulary tail. Because hundreds of near-zero probabilities accumulate slowly, reaching $p = 0.90$ forces Top-p to retain a massive pool of noisy tail tokens, triggering syntactic degeneration.

Min-p sampling sets its truncation threshold relative to the top candidate's probability.^{[9]Reference 9Turning Up the Heat: Min-p Sampling for Creative and Coherent LLM Outputs.https://arxiv.org/abs/2407.01082} Instead of fixing rank $k$ or cumulative mass $p$, it keeps only tokens whose probability is at least a fraction $p_{\text{base}}$ of the maximum token's probability:

$$V^{(\text{min-}p)} = \{i \in V : p_i \ge p_{\text{base}} \cdot \max_j p_j\}$$

Under the peaked distribution, the top token is create at 0.568. With $p_{\text{base}} = 0.10$, the absolute cutoff is $0.10 \times 0.568 = 0.0568$. rename ($0.077$) survives, but quota ($0.010$) is discarded.

Under the flat distribution, the top token is 0.28, establishing a cutoff of $0.028$. All four tokens easily clear that bar.

Min-p scales its cutoff with the model's confidence. When the model is certain ($\max p = 0.90$), the cutoff jumps to $0.090$, aggressively pruning the tail. When the model is uncertain ($\max p = 0.10$), the cutoff falls to $0.010$, preserving healthy exploration.

Hugging Face includes native support for min_p directly in GenerationConfig.^{[4]Reference 4Text Generation.https://huggingface.co/docs/transformers/en/main_classes/text_generation}

Boundary cases in filter implementations

Production filter implementations must handle boundary conditions predictably:

These checks protect against silent generation failures. In production pipelines, apply temperature scaling before running truncation filters, and renormalize surviving candidates before drawing.

Grammar-constrained decoding: syntax enforcement versus semantic truth

Production applications frequently require models to produce structured outputs: valid JSON, strict enum values, or executable SQL. Left unconstrained, a model might emit valid JSON for 200 tokens and then break the parser with a trailing comma or unescaped quote.

Constrained decoding prevents syntax violations by applying a formal grammar (Context-Free Grammar, JSON Schema, or Regular Expression) directly to the decoding loop.^{[10]Reference 10Efficient Guided Generation for Large Language Models.https://arxiv.org/abs/2307.09702[11]Reference 11XGrammar: Flexible and Efficient Structured Generation Engine for Large Language Modelshttps://arxiv.org/abs/2411.15100[12]Reference 12llama.cpp Grammars Documentationhttps://github.com/ggml-org/llama.cpp/blob/master/grammars/README.md}

The grammar compiler compiles the schema into a Finite-State Machine (FSM) or pushdown automaton. At each decoding step:

1. The FSM inspects its current state and identifies the set of allowable next characters or bytes.
2. The engine maps those allowed transitions against the tokenizer vocabulary.
3. Any token that would transition the output into an invalid state has its logit forced to $-\infty$ prior to softmax:

$$z_i \leftarrow \begin{cases} z_i & \text{if token } i \text{ is a valid grammar transition} \\ -\infty & \text{otherwise} \end{cases}$$

Because masked tokens receive an exponent of zero ($\exp(-\infty) = 0$), their probability drops to zero. The model is mathematically incapable of emitting a syntax error.

Notice the clear distinction between the second and third lines:

• Unconstrained decoding picks quota because it has the highest logit (6.0).
• Schema-constrained decoding masks quota, but picks revoke (4.0) because revoke is a valid enum field in the JSON Schema.
• Evidence-supported decoding picks create because external validation confirmed it as the correct initial runbook step.

This illustrates the core boundary of constrained decoding: syntax enforcement is not semantic verification.^{[13]Reference 13Structured outputshttps://developers.openai.com/api/docs/guides/structured-outputs}

An engine using OpenAI Structured Outputs or Outlines will guarantee valid JSON format with 100% syntactic reliability. But if the model chooses to hallucinate incorrect data inside a syntactically valid field, grammar masking can't detect the error. Verifying factual accuracy requires external validation or reasoning search.

Test-time search and reasoning: verifiers and thought trees

Recent advances in reasoning models (OpenAI o1/o3, DeepSeek-R1) shift computational effort from training time to inference time. Snell et al. demonstrated that scaling inference compute via test-time search can outperform scaling pretraining compute by 10× on complex reasoning tasks.^{[14]Reference 14Scaling LLM Test-Time Compute Optimally Can Be More Effective Than Scaling Model Parameters.https://arxiv.org/abs/2408.03314}

Instead of searching blindly across raw token spaces, test-time search operates across complete trajectories or discrete reasoning steps.

Best-of-N rejection sampling with Outcome Reward Models

In Best-of-N sampling, the engine samples $N$ complete, independent candidate answers at temperature $T > 0$. An Outcome Reward Model (ORM) scores each finished sequence, and the highest-scoring candidate is selected as the final answer:^{[15]Reference 15Training Verifiers to Solve Math Word Problems (GSM8K).https://arxiv.org/abs/2110.14168}

$$y^* = \arg\max_{y^{(k)} \in \{y^{(1)}, \dots, y^{(N)}\}} \text{ORM}(x, y^{(k)})$$

Alternatively, in domains with verifiable ground truth (such as competitive programming or mathematical proofs), an automated checker (unit test runner or formal theorem prover) evaluates candidates directly.

Process Reward Models catch intermediate reasoning failures

While ORMs evaluate the final answer, they suffer from a severe credit assignment problem on multi-step reasoning.^{[16]Reference 16Let's Verify Step by Step.https://arxiv.org/abs/2305.20050} A model might follow flawed logic for 10 steps, make an offsetting arithmetic mistake, and stumble upon the correct final answer (a false positive). Conversely, a model might execute 10 brilliant deductive steps, make a minor typo on step 11, and receive a score of zero (a false negative).

Process Reward Models (PRMs) evaluate each intermediate reasoning step $s_t$ individually:

$$r_t = \text{PRM}(x, s_1, s_2, \dots, s_t) \in [0, 1]$$

Look closely at plan_B: step 1 revokes the old key before deploying a replacement. That immediately causes an active production outage.

A naive ORM that only evaluates whether all three rotation actions were mentioned scores plan_B at 0.72. But the PRM immediately catches the operational failure on step 1, scoring it at 0.05 and disqualifying the dangerous plan.

Tree of Thoughts and Monte Carlo Tree Search

Rather than sampling flat complete trajectories, advanced inference runtimes treat reasoning as search over a tree of thoughts.^{[17]Reference 17Tree of Thoughts: Deliberate Problem Solving with Large Language Models.https://arxiv.org/abs/2305.10601}

Each node in the tree represents a partial reasoning state (a thought step or sub-goal). The search engine uses PRM step scores or heuristic value functions to:

• Expand: Propose $k$ candidate next reasoning thoughts.
• Evaluate: Score the validity of each thought using a PRM.
• Backtrack: When all extensions from a reasoning branch yield poor scores ($r_t < 0.2$), backtrack to a parent node and explore alternative deductions.
• Roll out: Use Monte Carlo Tree Search (MCTS) to simulate continuations toward the final solution.^{[18]Reference 18Mastering Chess and Shogi by Self-Play with a General Reinforcement Learning Algorithm.https://arxiv.org/abs/1712.01815}

By operating at the thought level rather than the token level, test-time search navigates the exponential token tree with deliberate, System 2 problem solving.

Speculative decoding: lossless serving optimization

Deterministic search, stochastic sampling, and test-time reasoning all alter the text the model outputs. Speculative decoding solves a completely different challenge: reducing inference latency without changing the output distribution by even a single bit.^{[19]Reference 19Fast Inference from Transformers via Speculative Decoding.https://arxiv.org/abs/2211.17192}

Standard autoregressive decoding requires one forward pass of the multi-billion-parameter target model per generated token. Because memory bandwidth limits GPU processing when generating tokens one at a time, execution arithmetic intensity is low.

Speculative decoding pairs the large target model $M_{\text{target}}$ with a small, lightweight draft model $M_{\text{draft}}$:

1. Draft phase: The small draft model autoregressively proposes a burst of $K$ candidate tokens quickly.
2. Verification phase: The large target model processes all $K$ proposed tokens in a single parallel forward pass, evaluating their exact conditional probabilities: $p(y_1), p(y_2 \mid y_1), \dots, p(y_K \mid y_{<K})$.
3. Modified rejection sampling: For each draft token $i \in \{1, \dots, K\}$, if the target probability $p(x) \ge q(x)$ (where $q$ is the draft probability), the token is accepted. If $p(x) < q(x)$, the token is accepted with probability $p(x) / q(x)$.
4. Correction: If a token is rejected at index $j$, the remaining draft tokens $j+1 \dots K$ are discarded. The target model draws a replacement token from the adjusted residual distribution $\max(0, p(x) - q(x))$ without requiring another forward pass.

This verification math proves that the output text matches the exact sampling distribution of the large target model.

Speculative decoding provides a 2× to 3× wall-clock speedup on memory-bound workloads, but it doesn't change model behavior or fix factual errors.

Production generation audits and offline evaluation

When tweaking retrieval algorithms, prompt templates, or inference engines, teams frequently alter decoding configurations simultaneously. If retrieval embeddings and temperature change in the same deployment, you can't tell which change caused an answer regression.

A generation audit record must capture:

• Prompt hash, model identifier, and runtime build version.
• Retrieval evidence snapshot ID and document chunks.
• Decoding configuration: temperature, top-k, top-p, min-p, beam width, and length penalty.
• Repetition penalty $\theta$ and grammar FSM schema version.
• Random seed and engine stop reason (e.g. stop_token, length_limit).
• Ground truth verification judgments.

To audit decoder mechanics, run controlled simulations against fixed distributions before conducting full user-facing experiments.

Greedy outputs the supported action create 100% of the time. Top-p at $p = 0.90$ retains both create and revoke, selecting create in $62.1\%$ of draws and emitting the dangerous revoke in roughly $37.9\%$. Sampling at $T = 2.0$ drops the supported action rate to $45.7\%$.

Decoders only manipulate scores: they don't understand infrastructure safety. If the model had assigned a higher logit to revoke, greedy decoding would execute the dangerous step every single time. Real-world reliability requires pairing appropriate decoding algorithms with grounded evidence retrieval and verified system testing.