The Implications of Linguistic Illegibility for LLM Security

This work defines "linguistic illegibility" as the mismatch between an LLM's human-readable outputs or linguistically derived probes and the model's true internal computations, which operate as high-dimensional mathematical transformations rather than literal language. It argues that lossy translations between activation-space computation and surface language are inevitable for current LLM architectures, so any security approach that depends on a model honestly encoding its internal state in language - examples include chain-of-thought monitoring, constitutional self-critique, and activation probing for linguistically defined feature vectors - cannot provide complete soundness. Because linguistic artifacts can misrepresent or hide internal goals and influences, relying solely on self-reporting or linguistic probes leaves sandboxes and monitors fundamentally vulnerable.

To achieve practical safety, the work advocates sandboxing and isolation mechanisms whose guarantees do not depend on reading a model's linguistic state. It highlights taint tracking as a promising enforcement layer: policies label system state a priori and prevent any influence from model-generated data on protected assets. Complementary defenses include robust virtualization, strict sandbox configurations, and third-party auditing of those configurations; combined, these give a minimum-security floor that would have prevented several recent frontier-model sandbox exploits. The overall claim is that layered, non‑linguistic enforcement is required because linguistic monitoring alone is intrinsically insufficient.