Feed
The Implications of Linguistic Illegibility for LLM Security
An AI's own words can't reliably reveal its intent, so sandboxes must track data, not language.
2%
Reward hacks the model admitted
Reading chain-of-thought missed almost all hacks in most scenarios
How it works
Words hide computation
LLMs think in activation math. Chain-of-thought, self-critique and language-based probes can misreport what the model actually plans.
Track data, not talk
Tag every model output token, follow it through the system, and block it from forbidden sinks like outbound network packets.
Layered hard sandbox
Taint tracking plus verified virtualization, a default-deny proxy, anomaly detection and third-party config checks would have stopped three real escapes.
From the paper