The Monitorability Geometry of Language Models

Linear activation monitors, whether probes, subspace monitors, or a model's own self-report, read only a few directions of a high-dimensional hidden state, so something always falls in their blind spot. We give a label-free, closed-form way to measure how much control over a model's behavior survives outside any rank-$r$ monitor, from two Jacobians taken at one hidden state, one for what the model does and one for what it says about itself. From their geometry we bound what a hidden intervention can achieve, find the best monitoring subspace, and connect visibility to detection. One geometry governs both sides. A monitor fixed before deployment captures $9\%$ of a model's behavioral leverage at rank $1$ and $92\%$ at rank $102$ (Llama, Qwen3.5, Gemma, and OLMo; 1B–70B), but rank is not the lever. Against an attacker who accepts $1\%$ visibility, widening from rank $16$ to $102$ lowers guaranteed evasion only from $11\%$ to $10\%$. What visibility concedes, no rank buys back. The blind spot is concrete. A steer along the refusal direction a rank-$16$ activation-PCA monitor cannot see flips refusal on AdvBench across four families while staying invisible ($v\approx 0$), whereas the same steer in the monitor's view barely moves it. The cause is that the variance directions these reads occupy align poorly with what drives behavior. On Gemma-4-12B a rank-$16$ PCA read captures $0.01\%$ of the refusal direction, below the $0.42\%$ random null, against $59.5\%$ for the matched Jacobian subspace. Spending that visibility is also what catches an attacker. Once the steer is strong enough to flip refusal, a Fisher-based monitor detects it (AUROC $0.88$–$1.0$) where PCA stays blind ($0.5$). Introspection follows the same geometry in sharper form. $95$–$100\%$ of the behavior-driving direction lies outside the self-report subspace, so a self-report can be forged, moved to say one thing while behavior stays fixed. A single overlap between the report and behavior directions predicts how faithful that forgery can be, which we confirm causally by fine-tuning models to move it. The same account predicts when a model's report that it is being evaluated comes apart from how it acts. Together these results give a concrete calculus for choosing a monitor's width, threshold, placement, and subspace, and for knowing what it must miss.