The Implications of Linguistic Illegibility for LLM Security
Language-based monitoring cannot fully reveal an agent’s internal computation, the paper argues. Secure agent runtimes still need isolation and data-flow controls independent of self-reporting.
The paper defines **linguistic illegibility** as a mismatch between model computation and the language emitted or recovered through probes. This weakens guarantees based on chain-of-thought monitoring, self-critique, or linguistic feature vectors.
Treat those signals as detection aids, not containment. Put tool-running agents behind **taint tracking**, robust virtualization, and policies that prevent model-produced data from influencing protected state.
The paper defines **linguistic illegibility** as a mismatch between model computation and the language emitted or recovered through probes. This weakens guarantees based on chain-of-thought monitoring, self-critique, or linguistic feature vectors. Treat those signals as detection aids, not containment. Put tool-running agents behind **taint tracking**, robust virtualization, and policies that prevent model-produced data from influencing protected state. This is a security argument rather than a reported empirical comparison. Taint tracking is presented as promising, while implementation costs and coverage are not quantified in the supplied material.
This sharpens the case for external security boundaries: containment is needed not only because agents may exceed task intent, but because their visible reasoning and probe-derived features may not faithfully expose the computation driving an action. It therefore narrows chain-of-thought monitoring and self-critique to detection roles, while leaving the cost and completeness of taint-based enforcement unresolved.