Original title: The Implications of Linguistic Illegibility for LLM Security
James Mickens · September 2026
Many people try to keep large language models safe by reading what they write or scanning their internal features for human words. However, this paper argues that this safety strategy is deeply flawed. The authors introduce the term linguistic illegibilityScenarios where an LLM's language outputs fail to represent its internal computation.. This describes how an artificial intelligence model's words, or the language probes scientists run on it, fail to represent how it actually thinks. Inside, models run math across activation spaces. Translating that math into human language loses critical meaning at the start and end of the process. Because models do not actually think in human words, safety checks that rely on self-reporting or word-based monitoring can never be completely sound. Instead, researchers must isolate models using strict sandboxes. The authors argue for taint trackingA sandbox approach that defines which system parts should not be influenced by model-produced data. to monitor outputs, robust virtualization, and third-party auditing to stop dangerous actions, which would have mitigated recent sandbox exploits by frontier models.
Imagine you have a friend who always gives confident explanations for their decisions, but sometimes their real reasons differ from what they say. If you rely only on their explanations to judge if they're trustworthy, you might miss when they're actually being influenced by something they won't admit. In this paper, the model is like that friend, and its language is the explanation; security methods that read the explanation can be fooled because the real computation happens in the math under the hood, not in the words it outputs.
This affects anyone relying on LLMs for secure applications, as current safety checks might miss real dangers. Without better isolation, models could be exploited or cause unintended harm.
The abstract does not provide empirical evidence or specific implementations of taint tracking or other sandboxing methods. It argues conceptually for linguistic illegibility but does not quantify it or test all proposed security mechanisms. The focus is on inevitability and high-level solutions without detailing practical application.
Ask anything about this paper. Answers come from its abstract, and say so when the abstract doesn't cover your question.
The Implications of Linguistic Illegibility for LLM Security — James Mickens
Abstract licence: CC0
Explanation generated by Synthesis from the abstract — it is not the original paper. This is a preprint, so it hasn't necessarily been peer reviewed.