Recognition-Refusal Misalignment in LLMs: Why Models Answer Structurally Unanswerable Questions

# Recognition–Refusal Misalignment in LLMs: Why Models Answer Structurally Unanswerable Questions
Source: [https://arxiv.org/html/2608.29109](https://arxiv.org/html/2608.29109)
Xiyang \(Sean\) Hu††thanks:Corresponding author\.Affiliation:Arizona State UniversityEmail:[xiyanghu@asu\.edu](mailto:)

###### Abstract

Large language models often answer structurally unanswerable questions, such as computingcot⁡\(−540∘\)\\cot\(\-540^\{\\circ\}\)or evaluating\(1\)\.startswith\("1"\), instead of abstaining\. All headline claims concern structural impossibility; fact800 and FalseQA serve only as scoped boundary tests\. We ask whether this failure reflects missing recognition or failed routing from recognition to abstention\. Across instruction\-tuned models from 1\.7B to 70B parameters, a single linear direction in the hidden state separates answerable from structurally impossible math and code prompts, showing that models represent impossibility before generation\. Yet this recognition direction is nearly orthogonal to the canonical safety\-refusal direction that mediates trained harmful\-content refusal\. An in\-domain behavior\-defined invalidity\-aware direction is closer to recognition, but only partially aligned with it, and remains near\-orthogonal to safety refusal\. Generation\-time steering along the recognition direction changes invalidity\-aware behavior bidirectionally and dose\-responsively on structural math and code cells, while random directions do not\. Base/instruct comparisons further show that the low\-cosine geometry is already present at the pretraining endpoint\. The confident\-on\-impossible failure is therefore better explained as a routing failure than as an encoding failure: the model has a usable “no admissible answer” signal, but the safety\-refusal pathway is not aligned to use it\.

## 1Introduction

LLMs sometimes answer questions with no valid answer\. In our math/code benchmarks,cot⁡\(−540∘\)\\cot\(\-540^\{\\circ\}\)is undefined and\(1\)\.startswith\("1"\)raises an attribute error; nevertheless, clean\-baseline generations can return answer\-like outputs such ascot⁡\(−540∘\)=0\\cot\(\-540^\{\\circ\}\)=0orTruerather than abstain\.111Code, datasets, aggregate experiment artifacts, and analysis scripts are available in the[public project repository](https://github.com/yucheng-du/recognition-refusal-misalignment)\.

Figure 1:A linearly accessible pre\-generation signal does not guarantee action\.Structurally impossible math and code prompts activatedimpd\_\{\\mathrm\{imp\}\}, yet the model still returns answer\-like outputs \(examples abbreviate realmath800/code800prompts and representative clean\-baseline failures\)\. The figure summarizes the safety\-refusal mismatch, the partial in\-domain behavior alignment, and the causal intervention; §[4\.2](https://arxiv.org/html/2608.29109#S4.SS2)and Fig\.[2](https://arxiv.org/html/2608.29109#S4.F2)quantify the geometry\.This behavior has two different possible explanations\. The model may fail to represent the impossibility before generation, in which case abstention is unavailable\. Or the model may represent the impossibility, but that signal may not be routed into the mechanism that produces abstention\.

Prior work gives a concrete geometric candidate for one trained abstention mechanism: safety refusal is mediated by a single residual\-stream directiondref,safetyd\_\{\\mathrm\{ref,safety\}\}\([Arditi et al\., 2024](https://arxiv.org/html/2608.29109#bib.bib2)\)\. If structural\-impossibility recognition reuses that existing safety\-refusal pathway, an impossibility\-recognition directiondimpd\_\{\\mathrm\{imp\}\}should align with it, i\.e\.,cos⁡\(dimp,dref,safety\)≈1\\cos\(d\_\{\\mathrm\{imp\}\},d\_\{\\mathrm\{ref,safety\}\}\)\\approx 1\. Because safety refusal need not be the only abstention route, we also measure an in\-domain behavior\-defined invalidity\-aware direction in §[4\.2](https://arxiv.org/html/2608.29109#S4.SS2)\. The safety\-refusal direction remains the literature\-grounded comparator for trained refusal\.

The evidence supports the routing account\. In an 11\-model main grid spanning 1\.7B–70B parameters and two structural\-impossibility domains \(math and code; 22 model–dataset cells\), a one\-dimensional null\-space MeanDiff probe separates answerable \(A\) from unanswerable \(U\) prompts with mean AUC0\.939\. Thus, a low\-capacity reader can recover the impossibility distinction from a single residual\-stream direction before generation\. However, this direction is nearly orthogonal todref,safetyd\_\{\\mathrm\{ref,safety\}\}, with mean cosine0\.087\. Steering alongdimpd\_\{\\mathrm\{imp\}\}changes invalidity\-aware behavior bidirectionally and dose\-responsively on anchor\-quality structural cells, with signal\-minus\-random gated flip rates of\+33\+33to\+52\+52pp\. Finally, paired base/instruct comparisons show that the low\-cosine geometry largely predates instruction tuning\.

Throughout the paper, “the model knows” is shorthand for a precise representational claim: the pre\-generation hidden state contains a linearly accessible structural\-impossibility signal\. It does not mean that the model will use that signal in its normal generation policy\. Steering along the recognition direction can change abstention behavior, but the canonical safety\-refusal direction is not aligned with it\. The model’s trained safety\-refusal pathway therefore reads a different representational axis from the one that carries structural\-impossibility recognition\.

The scope is structural impossibility\. Math and code prompts have formally checkable rules, and matched A/U pairs can differ in a specific diagnosable feature\. In this structural setting, where the analysis is cleanest, recognition’s near\-orthogonality to safety refusal gives a representation\-level account of the kind of output\-level unreasonable\-math failure documented by[Ma et al\. \(2026\)](https://arxiv.org/html/2608.29109#bib.bib1)\. We use fact800 only as an epistemic\-unanswerability transfer boundary and FalseQA only as a false\-premise transfer boundary\. These task types should not be collapsed into one generic unanswerability category: their ground truth, matched\-pair construction, and intervention behavior differ\.

## 2Problem Setup

Three classes of unanswerability\.A question may lack an acceptable answer for distinct reasons, and those reasons determine which mechanisms are relevant\. We therefore distinguish the three classes below rather than collapsing them into a single “unanswerable” category\.

Structural impossibilityis the main setting\. A prompt violates a formal rule, so no admissible answer exists: examples includex÷0x\\div 0,x\\sqrt\{x\}forx<0x<0overℝ\\mathbb\{R\}, the inverse of a singular matrix, and a PythonTypeError\. Ground truth is verifiable from the rules alone, and matched A/U pairs can differ only in a formally diagnosable feature\. We use math800 \(16 categories\) and code800 \(8 categories\) for this setting\.Epistemic unanswerabilitymeans that a correct answer could exist, but the provided evidence does not determine it\. We operationalize this asfact800, paragraph\-matched SQuAD 2\.0 pairs whose U question’s answer is absent from the shared passage\. We use fact800 only as a causation and transfer contrast \(§[4\.3](https://arxiv.org/html/2608.29109#S4.SS3), §[5](https://arxiv.org/html/2608.29109#S5)\), not as central evidence\.False\-premise questionsassume a false fact, as in “Why is CO2composed of oxygen?” The desired behavior is to reject the premise\. We use FalseQA only as a zero\-shot transfer boundary \(§[5](https://arxiv.org/html/2608.29109#S5)\), not for intervention\.

The three classes have different ground\-truth definitions, different pair constructions, and different behavioral signals\. Accordingly, claims in §[4](https://arxiv.org/html/2608.29109#S4)should be read as claims about structural impossibility unless fact800 or FalseQA is explicitly named\.

Safety\-refusal direction\.[Arditi et al\. \(2024\)](https://arxiv.org/html/2608.29109#bib.bib2)show that safety refusal in instruction\-tuned LLMs is mediated by a single residual\-stream directiondref,safety=μharmful−μharmlessd\_\{\\mathrm\{ref,safety\}\}=\\mu\_\{\\mathrm\{harmful\}\}\-\\mu\_\{\\mathrm\{harmless\}\}\. We adopt the same MeanDiff construction and add behavior verification; 20 of 22 main\-grid cells pass this verification \(§[3](https://arxiv.org/html/2608.29109#S3)\)\.

Research question\.Does the model encode an impossibility directiondimpd\_\{\\mathrm\{imp\}\}, and how does that direction relate todref,safetyd\_\{\\mathrm\{ref,safety\}\}? §[4](https://arxiv.org/html/2608.29109#S4)answers four sub\-questions: whetherdimpd\_\{\\mathrm\{imp\}\}exists, how it relates to safety refusal and to in\-domain invalidity\-aware behavior, whether the measured angle is produced by post\-training, and whetherdimpd\_\{\\mathrm\{imp\}\}is causally active on generation behavior\.

## 3Method Sketch

Impossibility direction\.At a fixed layerLLand under a class\-stratified 50/50 held\-out A/U \(HO\-AU\) split, we fit PCA \(k=100k\{=\}100\) on train\-A states, project all states out of that A\-subspace to a residualRR, and estimate the train\-split null\-space mean difference

d^=μUR−μAR∥μUR−μAR∥,\\hat\{d\}=\\frac\{\\mu\_\{U\}^\{R\}\-\\mu\_\{A\}^\{R\}\}\{\\lVert\\mu\_\{U\}^\{R\}\-\\mu\_\{A\}^\{R\}\\rVert\},and score test states bycos⁡\(R⁡\(x\),d^\)\\cos\(R\(x\),\\hat\{d\}\)using orientation\-invariant AUC, averaged over 5 seeds per cell\. This CosNSRT probe is a diagnostic instance of the Generalized Subspace Residual Score \(GSRS\), a Projection–Direction–Scoring template that also expresses Arditi’s refusal direction\. The earlier\-grid GSRS ablation is shown in Fig\.[6](https://arxiv.org/html/2608.29109#A3.F6), and the legacy layer\-emergence analysis motivating layer selection is in Appendix[D](https://arxiv.org/html/2608.29109#A4)\.

Safety refusal and orthogonality\.Following[Arditi et al\. \(2024\)](https://arxiv.org/html/2608.29109#bib.bib2), we constructdref,safety=μharmful−μharmlessd\_\{\\mathrm\{ref,safety\}\}=\\mu\_\{\\mathrm\{harmful\}\}\-\\mu\_\{\\mathrm\{harmless\}\}from 50 harmful and 50 harmless prompts at layerLL, followed by behavior verification\. We reportcos⁡\(dimp,dref,safety\)\\cos\(d\_\{\\mathrm\{imp\}\},d\_\{\\mathrm\{ref,safety\}\}\)withdimpd\_\{\\mathrm\{imp\}\}in A\-null anddref,safetyd\_\{\\mathrm\{ref,safety\}\}in full space, together with bootstrap 95% confidence intervals and a same\-space A\-null control\.

Steering and gated flip rate\.At layerLL, a forward hook addsα⋅d^\\alpha\\cdot\\hat\{d\}to the residual stream duringmodel\.generate\. We sweepα∈\{5,10,20,40\}⋅σ\\alpha\\in\\\{5,10,20,40\\\}\\cdot\\sigmain both signs and compare against a random\-direction control\. The headline metric is*gated flip rate*: the conditional probability of behavior change on samples whose clean baseline matches the pre\-intervention class, under an invalidity\-aware classifier with mixed\-output and degenerate\-output guards\. The high\-rigor v2 grid is 4 anchors \(Mistral\-7B\-Instruct, Gemma\-3\-4B\-it, Qwen3\-14B, Qwen3\-8B\)×\\times\{math800, code800, fact800\}; a 48\-cell deterministic breadth sweep across 16 models supplies the across\-grid check \(Appendix[J](https://arxiv.org/html/2608.29109#A10)\)\. The datasets \(math80016×5016\{\\times\}50; code8008×1008\{\\times\}100; fact800 800 SQuAD 2\.0 pairs\) are documented in Appendix[A](https://arxiv.org/html/2608.29109#A1)\.

Labeling protocol and provenance\.The v2 grid uses candidate labels assigned to all intervention records under a fixed written rubric through an LLM\-assisted batch review, supported by deterministic domain\-specific labeling utilities and schema/gate validation\. A second LLM\-assisted pass covered rubric\-sensitive rows and stratified samples, and the first author reviewed uncertain cases; the first author did not independently review every row\. For the nine non\-Qwen3\-8B cells, the aggregate JSONs apply candidate labels plus provisional second\-pass audit fills; the three Qwen3\-8B intervention cells use candidate\-label passthrough with no second\-pass override\. We therefore describe the effective labels as LLM\-assisted rather than human\-adjudicated\. The second pass identified over\-credit in 10 of 37 provisional candidate flips on Mistral code, without changing that cell’s best\-dose effect of\+35\.4\+35\.4pp, and over\-strict labeling in 2 of 300 checked rows on Gemma\-3\-4B fact\. Among the 10 A→\\toU downshifts, mixed\-output handling is the primary cause in 9 and degeneration contributes to 6, with overlap in 5\. The degenerate\-output guard changes Mistral fact A→\\toU atα=40\\alpha\{=\}40from\+34\+34pp to\+4\+4pp\. Gate broadening changes Mistral code U→\\toA from\+71\+71pp on a 14\-row gate to\+44\+44pp on a 27\-row gate\. Counted strictly per slot, 17 of 24 effects decrease, 5 increase, 1 is unchanged, and 1 becomes unmeasurable; the earlier 18/4/2 summary uses a 6pp flatness convention \(Appendix[J](https://arxiv.org/html/2608.29109#A10)\)\. Excluding the three Qwen3\-8B candidate\-only cells leaves the qualitative conclusion unchanged: Mistral\-7B is the bidirectional structural keystone, while Gemma\-3\-4B and Qwen3\-14B code remain positive in both directions\.

Artifacts and licenses\.Code, originalmath800/code800data, aggregate artifacts, and analysis scripts are released under MIT terms at[https://github\.com/yucheng\-du/recognition\-refusal\-misalignment](https://github.com/yucheng-du/recognition-refusal-misalignment)\.fact800retains SQuAD 2\.0’s CC BY\-SA 4\.0 terms; the shipped AbstentionBench\-GSM8K subset retains CC BY\-NC 4\.0 terms; the difficulty\-controlled GSM8K derivative retains the upstream MIT terms\. Because FalseQA has no explicit upstream license, our artifact does not redistribute it and instead provides a fetch\-and\-clean script subject to the upstream source terms\.

Table[1](https://arxiv.org/html/2608.29109#S3.T1)maps each claim to its evidence population and evidentiary role\.

Table 1:Claims by evidence tier\. Populations and metrics are not pooled across rows; in particular, the 48\-cell breadth sweep uses a non\-comparable deterministic metric and supports no per\-cell claim\.
## 4Core Findings

### 4\.1Recognition Exists

Does a frozen LLM’s internal state encode whether a structurally impossible question has no answer before any token is generated?

Prior work documents at the output level that LLMs often proceed as if unreasonable math problems were well\-posed\([Ma et al\., 2026](https://arxiv.org/html/2608.29109#bib.bib1)\)\. We test the internal claim directly in a narrower, formally verifiable structural\-impossibility setting, with a deliberately low\-capacity probe: one residual\-stream direction, scored by cosine similarity, with no learned classifier on top\.

A single A\-null MeanDiff direction separates A from U prompts with mean AUC0\.939across the 22\-cell 11\-model main grid, with range\[0\.841,0\.993\]\[0\.841,0\.993\]\. Detection is not restricted to large models: SmolLM2\-1\.7B reaches 0\.880 on math800; Qwen3\-32B reaches 0\.993; every 7B\+ instruct model exceeds 0\.90 on math800\. Under identical MeanDiff plus cosine scoring, A\-null projection is the load\-bearing step \(Table[2](https://arxiv.org/html/2608.29109#S4.T2)\)\. The geometric interpretation is that the top A\-PCs capture what answerable prompts share, such as topic, surface form, and syntactic scaffolding, but not their answerability\. Removing that variance exposes the impossibility\-specific signal that is otherwise mixed with answerable\-structure covariance\.

Table 2:Detection of structural impossibility by a one\-dimensional MeanDiff direction read under cosine similarity, across the 22\-cell 11\-model main grid \(HO\-AU, 5\-seed averaged\)\. A\-null projection is the load\-bearing factor: mean AUC0\.939\(range\[0\.841,0\.993\]\[0\.841,0\.993\]; SmolLM2\-1\.7B 0\.880, Qwen3\-32B 0\.993\), exceeding Full in 19/22 and Top\-kkA\-PC in 21/22 cells\. Per\-cell values in Fig\.[4](https://arxiv.org/html/2608.29109#A2.F4)\(AUC\) and Fig\.[5](https://arxiv.org/html/2608.29109#A2.F5)\(subspaces\)\.We interpret the result as a linearly accessible pre\-generation signal rather than merely an unconstrained probe prediction for two reasons\. First, the probe is one\-dimensional and read under cosine similarity: there is no parameter budget for a learned classifier to fit a complicated decision boundary, so what the probe recovers must begeometrically presentalong a single direction in the residual stream\. Second, the same classifier family fails when run in either the full residual stream or the top\-kkA\-PC subspace; only the A\-null subspace exposes the signal cleanly\. The information is in the model’s representation, in a particular subspace, and a low\-capacity reader is sufficient to recover it\. A linear SVM in full\-space is competitive on 3 of 4 representative cells \(Appendix[C](https://arxiv.org/html/2608.29109#A3)\), so we frame A\-null projection as anaccessibilityresult for low\-capacity readers rather than as a claim that impossibility lives only in A\-null; richer classifiers can navigate the full space too\. This accessibility result licenses the rest of the paper: if the recognition signal is recoverable along a single direction, that direction is the natural object for geometric and causal questions\.

### 4\.2Recognition Is Not the Safety\-Refusal Axis

Figure 2:Recognition is not the safety\-refusal axis: near\-orthogonality across the 11\-model main grid and 6 base/instruct paired comparisons\.\(a\) 22 instruct cells \(11 main\-grid models×\\times\{math800, code800\}\) with bootstrap 95% CIs; meancos\\cos0\.087, range\[0\.020,0\.130\]\[0\.020,0\.130\]\. Asterisks mark the two Llama\-3\.1\-8B cells that use a behavior\-verification proxydref,safetyd\_\{\\mathrm\{ref,safety\}\}\. \(b\) 6 math800 base/instruct paired comparisons \(5 fully verified\+\+1 Llama\-3\.1\-70B proxy base, asterisked\);Δ​cos\\Delta\\cosrange\[−0\.008,\+0\.110\]\[\-0\.008,\+0\.110\], mean\+0\.037\+0\.037\. The largestΔ​cos\\Delta\\cosis the Qwen3\-8B pair \(\+0\.110\+0\.110\); the Llama\-3\.3\-70B\-Instruct vs\. Llama\-3\.1\-70B\-Base pair, the only vendor\-confirmed post\-training\-only contrast, hasΔ​cos≈−0\.0001\\Delta\\cos\\approx\-0\.0001\.If the model internally represents structural impossibility, why does it still answer? If recognition reused the trained safety\-refusal pathway,dimpd\_\{\\mathrm\{imp\}\}should align with the canonical safety\-refusal directiondref,safetyd\_\{\\mathrm\{ref,safety\}\}\. We test this prediction directly\.

For each model, we extractdref,safetyd\_\{\\mathrm\{ref,safety\}\}from 50 harmful and 50 harmless prompts and apply behavior verification \(§[3](https://arxiv.org/html/2608.29109#S3)\); 20 of 22 main\-grid cells pass\. The remaining two are the Llama\-3\.1\-8B math800 and code800 cells, which use a proxy and are flagged in Fig\.[2](https://arxiv.org/html/2608.29109#S4.F2)a\. We comparedref,safetyd\_\{\\mathrm\{ref,safety\}\}todimpd\_\{\\mathrm\{imp\}\}at the matched layer and reportcos⁡\(dimp,dref,safety\)\\cos\(d\_\{\\mathrm\{imp\}\},d\_\{\\mathrm\{ref,safety\}\}\)in the A\-null subspace where the impossibility signal is read, with a 1,000\-resample bootstrap confidence interval on each cell\.

The headline number is mean cosine0\.087, with range\[0\.020,0\.130\]\[0\.020,0\.130\], across the 22 cells \(Fig\.[2](https://arxiv.org/html/2608.29109#S4.F2)a\)\. The tightest bootstrap confidence interval is the 24B model on math800 \(Mistral\-Small\-24B,cos=0\.065\\cos=0\.065, 95% CI\[0\.059,0\.071\]\[0\.059,0\.071\]\)\. Every interval lies in a near\-orthogonal regime and excludes alignment\. The cosines are small but not exactly zero: observed values are 2–13×\\timesthe empirical random baseline\. Thus, the two directions are neither aligned nor unrelated numerical noise; they have a consistent low\-cosine relation\.

A natural objection is that the cosine is measured across subspaces:dimpd\_\{\\mathrm\{imp\}\}is restricted to A\-null, whiledref,safetyd\_\{\\mathrm\{ref,safety\}\}is read in the full residual stream\. A same\-space control rules this out\. When both directions are projected into A\-null before the cosine is taken,cossame,A​\-null\\cos\_\{\\mathrm\{same\},A\\text\{\-null\}\}has range\[0\.021,0\.154\]\[0\.021,0\.154\]and mean 0\.097 across the 22 cells, comparable to the matched cosines\. Equalizing the subspace does not remove the angle\. The full\-space cosine can be larger \(22\-cell range\[0\.057,0\.781\]\[0\.057,0\.781\], mean 0\.240\), but energy decomposition shows why: across the 22 main\-grid cells, the A\-PC component accounts for mean 0\.813 of the magnitude ofcosfull,full\\cos\_\{\\mathrm\{full\},\\mathrm\{full\}\}\(range\[0\.607,0\.983\]\[0\.607,0\.983\]; Appendix[I](https://arxiv.org/html/2608.29109#A9)\)\. Both directions partly share A\-PC variance, i\.e\., topic, format, and syntactic structure\. Once we restrict attention to the A\-null subspace where impossibility is accessible, recognition and safety refusal remain near\-orthogonal\. A four\-cellk∈\{5,10\}k\\in\\\{5,10\\\}subspace analysis reaches the same low\-overlap conclusion \(Appendix[L](https://arxiv.org/html/2608.29109#A12)\)\.

Table 3:Pairwise geometry of the three abstention\-related directions \(matched layer\)\. Recognition is near\-orthogonal to the canonical safety\-refusal axis \(0\.087 across the 22\-cell main grid\), only partially aligned with the in\-domain invalidity\-aware behavior direction \(0\.40\), which is itself near\-orthogonal to safety refusal \(0\.08\)\.*Populations differ*: rows 2–3 summarize the six\-cell primary non\-Qwen3\-8B behavior subset \(8\-cell mean including 2 Qwen3\-8B candidate\-only cells: 0\.38 / 0\.077\), on whichcos⁡\(dimp,dref,safety\)=0\.13\\cos\(d\_\{\\mathrm\{imp\}\},d\_\{\\mathrm\{ref,safety\}\}\)=0\.13, not the 22\-cell 0\.087\. Controls \(22\-cell\): projecting both directions into A\-null leaves the angle near\-orthogonal \(cos\\cos0\.097\); the larger full\-spacecos\\cos\(0\.240\) is 0\.813 shared A\-PC \(answerable\-structure\) variance\. Per\-cell values in App\.[K](https://arxiv.org/html/2608.29109#A11),[I](https://arxiv.org/html/2608.29109#A9)\.Behavior\-defined direct comparison\.Becausedref,safetyd\_\{\\mathrm\{ref,safety\}\}is built from harmful\-vs\-harmless prompts\([Arditi et al\., 2024](https://arxiv.org/html/2608.29109#bib.bib2)\), a lowcos⁡\(dimp,dref,safety\)\\cos\(d\_\{\\mathrm\{imp\}\},d\_\{\\mathrm\{ref,safety\}\}\)could merely mean that harmfulness and structural impossibility have different prompt form\. To separate this surface\-form issue from behavior, we construct an in\-domain behavior\-defined invalidity\-aware directiondstruct,behavd\_\{\\mathrm\{struct,behav\}\}\. This direction contrasts U\-class clean\-baseline generations that the model labels invalidity\-aware against U\-class generations that answer anyway \(construction, bootstrap confidence intervals, the one exploratory cell, and full\-space robustness are in Appendix[K](https://arxiv.org/html/2608.29109#A11)\)\. Across the four\-anchor×\\times\{math800, code800\} grid, recognition aligns more with the behavior\-defined direction than with safety refusal, but only partially; the behavior\-defined direction is itself near\-orthogonal to safety refusal \(Table[3](https://arxiv.org/html/2608.29109#S4.T3)\)\. Strict refusal\-only generations are essentially absent \(0 of 50 U prompts per cell\), so a natural strict\-refusal direction is not constructible\. This absence is itself evidence that models rarely produce standard refusal language for structurally impossible prompts, even when they recognize invalidity\. These comparisons do not exhaust the model’s abstention mechanisms; unmeasured directions could mediate other abstention routes\.

dref,safetyd\_\{\\mathrm\{ref,safety\}\}carries some A/U predictive power on math800 \(11\-cell range\[0\.600,0\.962\]\[0\.600,0\.962\], mean 0\.834\), as expected from shared answerable\-structure overlap: any direction with nontrivial A\-PC energy can pick up surface variance that separates A and U prompts\. But the A\-null component ofdimpd\_\{\\mathrm\{imp\}\}, the component that carries the structural\-impossibility signal, is not the axis read by the safety\-refusal mechanism\.

The confident\-on\-impossible failure is therefore not caused by a missing abstention\-related representation\. Recognition exists and is partially aligned with in\-domain invalidity\-aware behavior\. However, that behavior direction is near\-orthogonal to the trained safety\-refusal channel, and explicit refusal language is nearly absent\. The recognition signal is present; the trained refusal route is not aligned with it\.

### 4\.3The Recognition Direction Causally Controls Invalidity\-Aware Behavior

Figure 3:The recognition direction causally controls invalidity\-aware behavior\.\(a\) GatedΔ\\DeltaG at the best steering magnitudeα\\alphaacross the 4\-anchor intervention grid \(Mistral\-7B\-Instruct, Gemma\-3\-4B\-it, Qwen3\-14B, Qwen3\-8B\)×\\times\{math, code, fact\}, both directions: darker cells are anchor\-quality \(Δ\\DeltaG≥\+30\\geq\+30pp\), the boxed Mistral\-7B math/code cells are the bidirectional keystone, and hatched cells are anecdotal \(gateN≤4\\leq 4, all U→\\toA on fact\)\. \(b\) The Mistral\-7B code A→\\toU dose\-response: gated flip rate rises monotonically withα\\alpha\(2\.1→2\.1→12\.5→35\.42\.1\\to 2\.1\\to 12\.5\\to 35\.4%\) against a near\-zero random\-direction baseline\. See §[4\.3](https://arxiv.org/html/2608.29109#S4.SS3)\.A direction can correlate with answerability without driving generation behavior; probing alone cannot distinguish these cases\([Belinkov, 2022](https://arxiv.org/html/2608.29109#bib.bib5);[Ravichander et al\., 2021](https://arxiv.org/html/2608.29109#bib.bib6)\)\. We therefore ask whether the recognition direction is a causal handle\. Ifdimpd\_\{\\mathrm\{imp\}\}is behaviorally active, then adding it during generation should increase invalidity\-aware behavior on A prompts, subtracting it should reduce invalidity\-aware behavior on U prompts that already abstain, and a random direction at matched magnitude should not show the same effect\.

Protocol\.We test on a 4\-anchor intervention grid: Mistral\-7B\-Instruct, Gemma\-3\-4B\-it, Qwen3\-14B, Qwen3\-8B×\\times\{math800, code800, fact800\}\. At each model–dataset cell, we register a forward hook at the matched layer that addsα⋅d^\\alpha\\cdot\\hat\{d\}to the residual stream at the last\-token position of every forward pass duringmodel\.generate\. We sweepα∈\{5,10,20,40\}⋅σ\\alpha\\in\\\{5,10,20,40\\\}\\cdot\\sigmain both signs, separately ford^=dimp\\hat\{d\}=d\_\{\\mathrm\{imp\}\}and for a random unit direction\. In the U→\\toA condition, we subtractdimpd\_\{\\mathrm\{imp\}\}from U prompts; in the A→\\toU condition, we adddimpd\_\{\\mathrm\{imp\}\}to A prompts\. The headline metric is gated flip rate, defined in §[3](https://arxiv.org/html/2608.29109#S3)\.

Mistral\-7B is the keystone causal anchor\.Mistral\-7B is the only model in the 4\-anchor grid whose intervention exceeds\+30\+30pp gatedΔ\\DeltaG in both directions and in both structural domains: math A→\\toU\+33\+33pp, math U→\\toA\+38\+38pp, code A→\\toU\+35\+35pp, and code U→\\toA\+44\+44pp \(Fig\.[3](https://arxiv.org/html/2608.29109#S4.F3)a\)\. At the best operating points, the signal direction exceeds its matched random\-direction control by\+33\+33to\+44\+44pp gated\. The cleanest dose response is Mistral code A→\\toU, where the gated flip rate increases monotonically acrossα=5→10→20→40\\alpha=5\\to 10\\to 20\\to 40with a near\-zero random baseline \(Fig\.[3](https://arxiv.org/html/2608.29109#S4.F3)b\)\.

Other anchors are direction\-asymmetric or domain\-specific\.Code remains anchor\-quality in both directions for Gemma\-3\-4B \(\+35\+35/\+40\+40pp\) and Qwen3\-14B \(\+37\+37/\+52\+52pp\); Qwen3\-8B is positive but sub\-anchor on code \(\+22\+22/\+24\+24pp\)\. Math control is direction\-asymmetric: Gemma\-3\-4B and Qwen3\-8B reach anchor\-quality on U→\\toA only \(\+48\+48pp and\+42\+42pp\), while their A→\\toU directions degenerate at higherα\\alpha; Qwen3\-14B math fails in both directions\. Of 24 anchor–dataset–direction slots, 10 are anchor\-quality, 10 are positive but sub\-anchor, and 4 are anecdotal \(gateN≤4\\leq 4, all U→\\toA fact\)\.

Why effects vary across models\.Post hoc diagnostics are consistent with a two\-factor account in which steering succeeds when the dose required to flip behavior lies inside the model’s tolerance window for residual\-stream perturbation\. All 10 anchor\-quality structural directions reach\+30\+30pp with signal\-branch degeneration no higher than16%16\\%; five of the six sub\-threshold directions reach at least40%40\\%degeneration at a tested dose, while Qwen3\-8B code A→\\toU remains below21%21\\%and peaks at\+22\+22pp\. At tested doses with under25%25\\%degeneration, all six sub\-threshold directions have a positive best signal\-minus\-random effect \(\+7\+7to\+24\+24pp\)\. Atα=20\\alpha\{=\}20, mean structural\-cell degeneration is9\.5%9\.5\\%for Mistral\-7B versus31\.531\.5–45\.5%45\.5\\%for the other anchors; matched\-norm random directions reproduce the Mistral\-versus\-rest tolerance gap\. Recognition\-to\-behavior coupling is descriptively associated with the minimum U→\\toA anchor dose \(Spearmanρ=−0\.86\\rho=\-0\.86across eight structural cells\), but not with best effect size; across the four cells that reach the anchor in both directions, A→\\toU requires 2–4 times the U→\\toA dose\. This account is post hoc and correlational: the eight cells come from four anchors in three model families, and tolerance, matched\-layer depth, and Qwen3 post\-training are confounded \(Appendix[J\.4](https://arxiv.org/html/2608.29109#A10.SS4)\)\.

fact800 is an epistemic transfer boundary\.On fact800, the U→\\toA direction is not reliably measurable: clean U baselines almost never abstain in passage\-grounded language \(gateN 0, 1, 4, 2 across the four anchors\), so flip rates are small\-NNanecdotes \(Appendix[J\.5](https://arxiv.org/html/2608.29109#A10.SS5)\)\. A→\\toU is well measured \(gateN≈49\\approx 49–5050\) but uniformly sub\-anchor \(\+4\+4to\+24\+24pp\)\. This boundary reflects the absence of a passage\-grounded abstention baseline on SQuAD\-style unanswerability, not necessarily the absence of any fact\-domain recognition effect\.

Refusal\-only universality\.Of 96 non\-baseline rows \(cell×\\timesdirection×\\timesα\\alpha\), 48 are unmeasurable under a refusal\-only criterion because clean baselines almost never produce explicit “I cannot” or “I do not know” phrasing\. Of the 48 measurable rows, 47 have refusal\-only gatedΔ\\DeltaG≤\+5\\leq\+5pp\. The lone exception is Mistral math A→\\toU atα=20\\alpha\{=\}20, with\+6\.0\+6\.0pp, an order of magnitude below the matched invalidity\-awareΔ\\DeltaG of\+32\.7\+32\.7pp\. These results show thatdimpd\_\{\\mathrm\{imp\}\}is not simply a generic refusal\-vocabulary axis\.

Steering breadth across 48 cells\.A coarser deterministic breadth sweep across 16 models×\\times3 datasets reproduces the math/code footprint and confirms fact800 as the weakest domain \(per\-domain hallucination\-reduction numbers in Appendix[J](https://arxiv.org/html/2608.29109#A10)\)\. Because this sweep scores hallucination\-rate reduction rather than signal\-minus\-random gated flips, it is not a comparable effect size to interventionΔ\\DeltaG, ranks math versus code differently, and supports no per\-cell claim\. All headline causal numbers come from the 4\-anchor intervention grid\.

Taken together with §[4\.2](https://arxiv.org/html/2608.29109#S4.SS2), the intervention result strengthens the routing account\. Geometry shows that recognition is near\-orthogonal to safety refusal\. Steering shows that injecting along the recognition axis changes invalidity\-aware behavior in the structural setting where the geometric measurement is cleanest\. The two together rule out an epiphenomenal reading:dimpd\_\{\\mathrm\{imp\}\}is a behaviorally active handle, but the safety\-refusal mechanism does not read that axis\. That is the mechanistic restatement, in our formal structural setting, of the output\-level unreasonable\-math failure documented by[Ma et al\. \(2026\)](https://arxiv.org/html/2608.29109#bib.bib1)\.

### 4\.4The Misalignment Largely Predates Alignment

The angle in §[4\.2](https://arxiv.org/html/2608.29109#S4.SS2)could be created by post\-training\. Instruction tuning and preference optimization install the safety\-refusal mechanism, and these stages might place it on an axis unrelated to structural\-impossibility recognition because safety rewards do not contain structural\-impossibility labels\. The competing account is that the two directions are already near\-perpendicular at the pretraining endpoint, and post\-training turns a harmful\-vs\-harmless statistical direction into an active refusal mechanism without changing its relation todimpd\_\{\\mathrm\{imp\}\}very much\. These accounts make different predictions forcos⁡\(dimp,dref,safety\)\\cos\(d\_\{\\mathrm\{imp\}\},d\_\{\\mathrm\{ref,safety\}\}\)on base models, so paired base/instruct measurements are decisive\. This comparison concerns the geometry between recognition and the canonical safety\-refusal direction; it does not cover the in\-domain invalidity\-aware behavior direction from §[4\.2](https://arxiv.org/html/2608.29109#S4.SS2), whose construction requires instruction\-following behavior labels that are unavailable for base models\.

We comparedimpd\_\{\\mathrm\{imp\}\}anddref,safetyd\_\{\\mathrm\{ref,safety\}\}across 6 paired base/instruct checkpoints on math800 at matched layers\. The pair list, per\-pair verification status, and sourcing caveats, including the Llama\-3\.1\-70B proxy base and the Qwen2\.5\-32B scale substitution for the unreleased Qwen3\-32B base, are in Appendix[K](https://arxiv.org/html/2608.29109#A11)\. The matched\-layerΔ​cos\\Delta\\cos\(instruct minus base\) ranges\[−0\.008,\+0\.110\]\[\-0\.008,\+0\.110\]with mean\+0\.037\+0\.037\(Fig\.[2](https://arxiv.org/html/2608.29109#S4.F2)b\), small relative to the 22\-cell instruct band\[0\.020,0\.130\]\[0\.020,0\.130\]\. Within\-family pairs track closely\. The largest shift is Qwen3\-8B \(\+0\.110\+0\.110\), and the vendor\-confirmed post\-training\-only contrast, Llama\-3\.3\-70B\-Instruct versus Llama\-3\.1\-70B\-Base, hasΔ​cos≈−0\.0001\\Delta\\cos\\approx\-0\.0001\. The strongest evidence is the five fully verified Qwen pairs; the Llama\-70B pair, which uses a proxy base, is a complementary controlled contrast\.

The 6 pairs support the same conclusion\. Instruction tuning changes the angle in a family\-dependent way within a low\-cosine regime, but it does not create the regime, and none of the 6 pairs closes the angle\. The near\-perpendicular geometry is already present at the pretraining endpoint\. Recognition itself is also present before instruction tuning: a one\-dimensional A\-null probe detects impossibility on base\-model math800 with mean AUC≈0\.98\\approx 0\.98across the six paired base checkpoints \(range\[0\.94,0\.99\]\[0\.94,0\.99\]; per\-model values in Appendix[K](https://arxiv.org/html/2608.29109#A11)\)\. Thus, both the recognition signal and its separation from safety refusal largely predate instruction tuning\.

## 5Ruling Out Alternatives and Mapping Scope

Table 4:Five alternative explanations ruled out for the §[4](https://arxiv.org/html/2608.29109#S4)findings, each with its key result\. Structural impossibility \(math800, code800\) is the clean setting; fact800 and FalseQA are boundary cases, not equivalent evidence\. Full per\-control evidence in App\.[M](https://arxiv.org/html/2608.29109#A13)\.The four findings in §[4](https://arxiv.org/html/2608.29109#S4)survive five alternative explanations and have a clear scope boundary\. Table[4](https://arxiv.org/html/2608.29109#S5.T4)pairs each control with its key result; full per\-cell evidence is in Appendix[M](https://arxiv.org/html/2608.29109#A13)\. The recognition signal is not explained by prompt length, answerable\-class difficulty, a few easy categories, scale, or a generic unanswerability axis\. Structural math and code remain the main setting; fact800 and FalseQA are transfer boundaries\.

## 6Related Work

Unanswerability regimes and abstention\.Questions for which answer\-like completion is inappropriate span distinct regimes that we deliberately keep apart \(§[2](https://arxiv.org/html/2608.29109#S2)\)\.*Epistemic unanswerability*covers cases where a correct answer may exist but is not recoverable from the provided evidence, as exemplified by SQuAD 2\.0\([Rajpurkar et al\., 2018](https://arxiv.org/html/2608.29109#bib.bib31)\)\.*False\-premise*questions instead presuppose a false fact and should be challenged rather than answered\([Kim et al\., 2021](https://arxiv.org/html/2608.29109#bib.bib35);[Hu et al\., 2023](https://arxiv.org/html/2608.29109#bib.bib32)\)\.*Structural impossibility*, our setting, is narrower still: a formal rule makes*no*admissible answer exist;[Ma et al\. \(2026\)](https://arxiv.org/html/2608.29109#bib.bib1)document that LLMs nonetheless treat unreasonable math problems as well\-posed, and our code setting extends this question beyond prior math\-focused evidence\. Cutting across these regimes, work on selective question answering, dedicated unanswerability benchmarks, and abstention surveys asks when models should decline, abstain, or say “I don’t know”\([Kamath et al\., 2020](https://arxiv.org/html/2608.29109#bib.bib36);[Kirichenko et al\., 2025](https://arxiv.org/html/2608.29109#bib.bib16);[Wen et al\., 2025](https://arxiv.org/html/2608.29109#bib.bib17)\)\. Much of that literature is diagnostic and measured at the output level; we instead ask, in the structural regime where ground truth is rule\-verifiable, whether the “no answer” signal is present internally before generation, whether it coincides with the canonical safety\-refusal axis, and whether it causally drives invalidity\-aware abstention\.

Pre\-generation probes and abstention\.Representation\-probing work reads model internals for truthfulness, hallucination, or latent\-knowledge signals\([Orgad et al\., 2025](https://arxiv.org/html/2608.29109#bib.bib7);[Burns et al\., 2023](https://arxiv.org/html/2608.29109#bib.bib9)\), while FacLens explicitly predicts future non\-factual QA responses from hidden question representations before generation\([Wang et al\., 2025](https://arxiv.org/html/2608.29109#bib.bib8)\);[Levinstein and Herrmann \(2023\)](https://arxiv.org/html/2608.29109#bib.bib10)caution that such truthfulness probes face empirical and conceptual generalization limits\. We share the internal\-readout stance but target a narrower, formally verifiable property \(structural impossibility\), read it from an A\-null subspace, and add causal validation by asking whether the probed feature*drives*behavior, a question that line leaves open\.[Kim et al\. \(2025\)](https://arxiv.org/html/2608.29109#bib.bib15)detect hallucination from layer\-wise information deficiency on ambiguous and unanswerable prompts, and[Du \(2026\)](https://arxiv.org/html/2608.29109#bib.bib34)uses geometric deviation as an unsupervised answerability signal, whereas we ask whether a null\-space recognition direction aligns with the canonical safety\-refusal axis or causally drives invalidity\-aware abstention\.

Refusal geometry and steering\.Our closest neighbor is[Arditi et al\. \(2024\)](https://arxiv.org/html/2608.29109#bib.bib2), whose MeanDiffdref,safetyd\_\{\\mathrm\{ref,safety\}\}we adopt and behavior\-verify;[Wollschläger et al\. \(2025\)](https://arxiv.org/html/2608.29109#bib.bib12)refine refusal geometry into concept cones,[Llorente\-Saguer \(2026\)](https://arxiv.org/html/2608.29109#bib.bib13)casts harmful\-intent detection as angular deviation from safe\-prompt residual geometry, and[Wu et al\. \(2026\)](https://arxiv.org/html/2608.29109#bib.bib14)decompose safety refusal into recognition and execution axes*within*that pathway\. We instead measure the angle*between two distinct abilities*\(impossibility recognition and safety refusal\) and find it already present at pretraining \(§[4\.4](https://arxiv.org/html/2608.29109#S4.SS4)\)\. Our steering protocol follows[Turner et al\. \(2023\)](https://arxiv.org/html/2608.29109#bib.bib3);[Li et al\. \(2023\)](https://arxiv.org/html/2608.29109#bib.bib4)\(closest to[Arditi et al\., 2024](https://arxiv.org/html/2608.29109#bib.bib2)\); unlike strands that steer to harden safety or boost tasks\([Dong et al\., 2026](https://arxiv.org/html/2608.29109#bib.bib18);[Lee et al\., 2025](https://arxiv.org/html/2608.29109#bib.bib19);[Han et al\., 2025](https://arxiv.org/html/2608.29109#bib.bib20)\), we use it only to test whetherdimpd\_\{\\mathrm\{imp\}\}is a causal handle on abstention\.

## 7Discussion & Conclusion

The confident\-on\-impossible failure in our structural math/code settings is better explained as a routing failure than as an encoding failure\. The model contains the information needed to abstain \(§[4\.1](https://arxiv.org/html/2608.29109#S4.SS1)\), but that information is near\-orthogonal to the canonical safety\-refusal axis, only partially coupled to an in\-domain invalidity\-aware behavior axis, and accompanied by essentially no strict refusal\-only language \(§[4\.2](https://arxiv.org/html/2608.29109#S4.SS2)\)\. This geometry predates instruction tuning \(§[4\.4](https://arxiv.org/html/2608.29109#S4.SS4)\); steering changes invalidity\-aware behavior on structural math/code cells, while fact800 remains a boundary and refusal\-only scoring rules out a generic refusal\-vocabulary reading \(§[4\.3](https://arxiv.org/html/2608.29109#S4.SS3)\)\. The trained safety\-refusal pathway reads a different axis\. Read through our results, the descriptive “unconscious of unreasonableness” framing\([Ma et al\., 2026](https://arxiv.org/html/2608.29109#bib.bib1)\)is about routing, not encoding\. The auxiliary AbstentionBench\-GSM8K and FalseQA results are detection\-only boundary tests under dot\-product NSRT or CosNSRT scoring, not evidence that steering transfers beyond the controlled structural setting\.

The same recognition\-action separation may recur when epistemic confidence, harmfulness, or instruction\-compliance signals fail to drive hedging, refusal, or format adherence\. A\-null probing, behavior\-verified MeanDiff refusal directions, matched\-layer cosine, generation\-time gated steering, and base/instruct contrasts can test such cases directly\. To close the angle, future work could train the safety\-refusal pathway to readdimpd\_\{\\mathrm\{imp\}\}without collapsing it intodref,safetyd\_\{\\mathrm\{ref,safety\}\}; the Llama\-70B contrast shows that controlled post\-training can leave the angle essentially unchanged \(Δ​cos≈−0\.0001\\Delta\\cos\\approx\-0\.0001\), so direct structural\-impossibility supervision may be needed\. Models represent impossibility before generation, but that recognition is not reliably routed into abstention\.

## Limitations

Our causal evidence is cleanest onstructuralimpossibility\. Code shows anchor\-quality control on 3/4 anchors; math control is direction\-asymmetric on the non\-Mistral anchors with Qwen3\-14B×\\timesmath the weakest causal cell under v2; fact800 is a structural boundary case rather than a clean replication\. The clean causal regularity is therefore a property of structural impossibility rather than of unanswerability in general; readers should interpret each finding as scoped to the setting it was measured in\. Safety refusal and the measured behavior\-defined direction are two comparators, not an exhaustive basis for abstention: unmeasured directions could mediate other abstention routes\. The main analysis uses single directions; a four\-cell 5–10\-dimensional linear\-subspace check preserves the low\-overlap conclusion \(Appendix[L](https://arxiv.org/html/2608.29109#A12)\), while nonlinear or more distributed representations remain open\. CosNSRT fixes PCAk=100k=100as a heuristic and does not tune it per model or dataset; the subspace ablation isolates the projection as the load\-bearing factor, but the exactkkis a design choice\. The pipeline requires labeled A\-class prompts to fit the null\-space basis, which is available for math800 / code800 but may be costly to construct on new domains\.

Architecture scope\.The 11\-model main grid evaluates open\-weight transformer\-family language checkpoints in a text\-only setting and analyzes the residual stream of the language decoder\. This is a deliberate scope choice rather than a claim about all contemporary model families\. Some included checkpoints are distributed in multimodal\-capable families; we use no image inputs and make claims only about their text decoder path\. Our geometric analysis assumes that abstention\-relevant features can be read as single residual\-stream directions, an assumption well supported for refusal in decoder\-only language models\([Arditi et al\., 2024](https://arxiv.org/html/2608.29109#bib.bib2)\)but not yet established for settings with vision\-token conditioning, mixture\-of\-experts routing, hybrid attention, or explicit reasoning\-mode training\. Whether recognition⟂\\perpsafety refusal persists in those settings, and whether generation\-time steering still yields clean dose\-responsive control, requires separate validation and is left to future work\.

Headline flip\-rate metrics rely on a per\-output classifier; v2 verification under an invalidity\-aware rubric \(Appendix[J](https://arxiv.org/html/2608.29109#A10)\) supersedes the v1 keyword detector, and the protocol\-refinement audit documents per\-cell shifts and the rationale for each\. The high\-rigor v2 intervention grid is 4 anchors \(Mistral\-7B\-Instruct, Gemma\-3\-4B\-it, Qwen3\-14B, Qwen3\-8B\), not the full 11\-model main grid; broader behavioral evidence comes from the 48\-cell v2\-deterministic steering breadth sweep across 16 models×\\times3 datasets, which uses a coarser regex\-based proxy aligned to the intervention rubric \(Appendix[J](https://arxiv.org/html/2608.29109#A10)\)\. Qwen3\-32B has no public base release as of May 2026, so the 32B base/instruct paired comparison uses Qwen2\.5\-32B at the 32B scale rather than Qwen3\-32B; the within\-grid scope split is deliberate\. The Llama\-70B base side is a proxydref,safetyd\_\{\\mathrm\{ref,safety\}\}because Llama\-3\.1\-70B\-Base does not refuse harmful prompts often enough to behavior\-verify; Meta confirms Llama\-3\.3\-70B\-Instruct shares the Llama\-3\.1\-70B pretraining checkpoint, which makes the Llama\-3\.3 vs\. Llama\-3\.1\-70B pair the only vendor\-confirmed post\-training\-only contrast in the grid\. We report this pair as such, but explicitly donotcall it the “cleanest evidence overall”: the proxy basedref,safetyd\_\{\\mathrm\{ref,safety\}\}is a real caveat, and the strongest within\-family evidence in §[4\.4](https://arxiv.org/html/2608.29109#S4.SS4)comes from the five fully\-verified Qwen pairs\.

## Ethical Considerations

Improved recognition\-to\-abstention routing could reduce confidently wrong outputs on structurally impossible requests\. The same diagnostics and steering methods could also be misused to suppress warranted abstention or otherwise alter refusal behavior without users’ knowledge\. Any deployment should therefore evaluate both erroneous answering and erroneous abstention, preserve user\-visible uncertainty, and restrict intervention controls to authorized settings\.

## Acknowledgments

We thank the reviewers and area chair for their constructive feedback\. We used AI assistants for writing, coding, and verification, as well as for the LLM\-assisted dataset generation and labeling described in the appendices\. The authors reviewed and approved all scientific decisions and final paper content and take responsibility for the paper\.

## References

- Allalet al\.\(2025\)L\. B\. Allal, A\. Lozhkov, E\. Bakouch, G\. M\. Blázquez, G\. Penedo, L\. Tunstall, A\. Marafioti, H\. Kydlíček, A\. P\. Lajarín, V\. Srivastav, J\. Lochner, C\. Fahlgren, X\. Nguyen, C\. Fourrier, B\. Burtenshaw, H\. Larcher, H\. Zhao, C\. Zakka, M\. Morlon, C\. Raffel, L\. von Werra, and T\. WolfSmolLM2: when Smol goes big – data\-centric training of a small language model\.arXiv preprint arXiv:2502\.02737\.Cited by:[§A\.5](https://arxiv.org/html/2608.29109#A1.SS5.p2.1)\.
- Arditiet al\.\(2024\)A\. Arditi, O\. Obeso, A\. Syed, D\. Paleka, N\. Panickssery, W\. Gurnee, and N\. NandaRefusal in language models is mediated by a single direction\.InAdvances in Neural Information Processing Systems,External Links:[Document](https://dx.doi.org/10.52202/079017-4322),[Link](https://proceedings.neurips.cc/paper_files/paper/2024/hash/f545448535dfde4f9786555403ab7c49-Abstract-Conference.html)Cited by:[§1](https://arxiv.org/html/2608.29109#S1.p3.1),[§2](https://arxiv.org/html/2608.29109#S2.p4.1),[§3](https://arxiv.org/html/2608.29109#S3.p2.1),[§4\.2](https://arxiv.org/html/2608.29109#S4.SS2.p5.1),[§6](https://arxiv.org/html/2608.29109#S6.p3.1),[Limitations](https://arxiv.org/html/2608.29109#Sx1.p2.1)\.
- Belinkov \(2022\)Y\. BelinkovProbing classifiers: promises, shortcomings, and advances\.Computational Linguistics48\(1\),pp\. 207–219\.Cited by:[§4\.3](https://arxiv.org/html/2608.29109#S4.SS3.p1.1)\.
- Burnset al\.\(2023\)C\. Burns, H\. Ye, D\. Klein, and J\. SteinhardtDiscovering latent knowledge in language models without supervision\.InProceedings of the International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=ETKGuby0hcs)Cited by:[§6](https://arxiv.org/html/2608.29109#S6.p2.1)\.
- Cobbeet al\.\(2021\)K\. Cobbe, V\. Kosaraju, M\. Bavarian, M\. Chen, H\. Jun, L\. Kaiser, M\. Plappert, J\. Tworek, J\. Hilton, R\. Nakano, C\. Hesse, and J\. SchulmanTraining verifiers to solve math word problems\.arXiv preprint arXiv:2110\.14168\.Cited by:[§A\.5](https://arxiv.org/html/2608.29109#A1.SS5.p4.1)\.
- Donget al\.\(2026\)F\. Dong, Z\. Yan, X\. Ge, Z\. Xu, M\. Zhang, X\. Chen, B\. He, X\. Xin, Z\. Chen, and Y\. ZhouIdentifying and transferring reasoning\-critical neurons: improving LLM inference reliability via activation steering\.arXiv preprint arXiv:2601\.19847\.Cited by:[§6](https://arxiv.org/html/2608.29109#S6.p3.1)\.
- Du \(2026\)Y\. DuGeometric deviation as an unsupervised pre\-generation reliability signal: probing LLM representations for answerability\.InProceedings of the 6th Workshop on Trustworthy NLP \(TrustNLP 2026\),San Diego, California,pp\. 353–363\.External Links:[Document](https://dx.doi.org/10.18653/v1/2026.trustnlp-main.22),[Link](https://aclanthology.org/2026.trustnlp-main.22/)Cited by:[§6](https://arxiv.org/html/2608.29109#S6.p2.1)\.
- Farquharet al\.\(2024\)S\. Farquhar, J\. Kossen, L\. Kuhn, and Y\. GalDetecting hallucinations in large language models using semantic entropy\.Nature630\(8017\),pp\. 625–630\.Cited by:[item 2](https://arxiv.org/html/2608.29109#A8.I1.i2.p1.1)\.
- Gemma Team \(2024\)Gemma TeamGemma 2: improving open language models at a practical size\.arXiv preprint arXiv:2408\.00118\.Cited by:[§A\.5](https://arxiv.org/html/2608.29109#A1.SS5.p3.1)\.
- Gemma Team \(2025\)Gemma TeamGemma 3 technical report\.arXiv preprint arXiv:2503\.19786\.Cited by:[§A\.5](https://arxiv.org/html/2608.29109#A1.SS5.p2.1)\.
- Hanet al\.\(2025\)P\. Han, C\. Qian, X\. Chen, Y\. Zhang, H\. Ji, and D\. ZhangSafeSwitch: steering unsafe LLM behavior via internal activation signals\.InFindings of the Association for Computational Linguistics: EMNLP 2025,pp\. 6936–6955\.External Links:[Document](https://dx.doi.org/10.18653/v1/2025.findings-emnlp.366),[Link](https://aclanthology.org/2025.findings-emnlp.366/)Cited by:[§6](https://arxiv.org/html/2608.29109#S6.p3.1)\.
- Huet al\.\(2023\)S\. Hu, Y\. Luo, H\. Wang, X\. Cheng, Z\. Liu, and M\. SunWon’t get fooled again: answering questions with false premises\.InProceedings of the Annual Meeting of the Association for Computational Linguistics,pp\. 5626–5643\.External Links:[Document](https://dx.doi.org/10.18653/v1/2023.acl-long.309),[Link](https://aclanthology.org/2023.acl-long.309/)Cited by:[§A\.5](https://arxiv.org/html/2608.29109#A1.SS5.p4.1),[§6](https://arxiv.org/html/2608.29109#S6.p1.1)\.
- Jianget al\.\(2023\)A\. Q\. Jiang, A\. Sablayrolles, A\. Mensch, C\. Bamford, D\. S\. Chaplot, D\. de las Casas, F\. Bressand, G\. Lengyel, G\. Lample, L\. Saulnier, L\. R\. Lavaud, M\. Lachaux, P\. Stock, T\. Le Scao, T\. Lavril, T\. Wang, T\. Lacroix, and W\. El SayedMistral 7B\.arXiv preprint arXiv:2310\.06825\.Cited by:[§A\.5](https://arxiv.org/html/2608.29109#A1.SS5.p2.1)\.
- Kamathet al\.\(2020\)A\. Kamath, R\. Jia, and P\. LiangSelective question answering under domain shift\.InProceedings of the 58th Annual Meeting of the Association for Computational Linguistics,Online,pp\. 5684–5696\.External Links:[Document](https://dx.doi.org/10.18653/v1/2020.acl-main.503),[Link](https://aclanthology.org/2020.acl-main.503/)Cited by:[§6](https://arxiv.org/html/2608.29109#S6.p1.1)\.
- Kimet al\.\(2025\)H\. Kim, T\. A\. Lamb, A\. Bibi, P\. Torr, and Y\. GalDetecting LLM hallucination through layer\-wise information deficiency: analysis of ambiguous prompts and unanswerable questions\.InProceedings of the Conference on Empirical Methods in Natural Language Processing,pp\. 32310–32322\.External Links:[Document](https://dx.doi.org/10.18653/v1/2025.emnlp-main.1644),[Link](https://aclanthology.org/2025.emnlp-main.1644/)Cited by:[§6](https://arxiv.org/html/2608.29109#S6.p2.1)\.
- Kimet al\.\(2021\)N\. Kim, E\. Pavlick, B\. Karagol Ayan, and D\. RamachandranWhich linguist invented the lightbulb? presupposition verification for question\-answering\.InProceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing \(Volume 1: Long Papers\),Online,pp\. 3932–3945\.External Links:[Document](https://dx.doi.org/10.18653/v1/2021.acl-long.304),[Link](https://aclanthology.org/2021.acl-long.304/)Cited by:[§6](https://arxiv.org/html/2608.29109#S6.p1.1)\.
- Kirichenkoet al\.\(2025\)P\. Kirichenko, M\. Ibrahim, K\. Chaudhuri, and S\. J\. BellAbstentionBench: reasoning LLMs fail on unanswerable questions\.InAdvances in Neural Information Processing Systems \(Datasets and Benchmarks Track\),External Links:[Document](https://dx.doi.org/10.52202/085713-5729),[Link](https://proceedings.neurips.cc/paper_files/paper/2025/hash/fb122bfc3f0127a94ded048b5b03496f-Abstract-Datasets_and_Benchmarks_Track.html)Cited by:[§A\.5](https://arxiv.org/html/2608.29109#A1.SS5.p4.1),[§6](https://arxiv.org/html/2608.29109#S6.p1.1)\.
- Leeet al\.\(2025\)B\. W\. Lee, I\. Padhi, K\. N\. Ramamurthy, E\. Miehling, P\. Dognin, M\. Nagireddy, and A\. DhurandharProgramming refusal with conditional activation steering\.InProceedings of the International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=Oi47wc10sm)Cited by:[§6](https://arxiv.org/html/2608.29109#S6.p3.1)\.
- Levinstein and Herrmann \(2023\)B\. A\. Levinstein and D\. A\. HerrmannStill no lie detector for language models: probing empirical and conceptual roadblocks\.arXiv preprint arXiv:2307\.00175\.Cited by:[§6](https://arxiv.org/html/2608.29109#S6.p2.1)\.
- Liet al\.\(2023\)K\. Li, O\. Patel, F\. Viégas, H\. Pfister, and M\. WattenbergInference\-time intervention: eliciting truthful answers from a language model\.InAdvances in Neural Information Processing Systems,External Links:[Document](https://dx.doi.org/10.52202/075280-1797),[Link](https://proceedings.neurips.cc/paper_files/paper/2023/hash/81b8390039b7302c909cb769f8b6cd93-Abstract-Conference.html)Cited by:[§6](https://arxiv.org/html/2608.29109#S6.p3.1)\.
- Llama Team \(2024\)Llama TeamThe Llama 3 herd of models\.arXiv preprint arXiv:2407\.21783\.Cited by:[§A\.5](https://arxiv.org/html/2608.29109#A1.SS5.p2.1),[§A\.5](https://arxiv.org/html/2608.29109#A1.SS5.p3.1)\.
- Llorente\-Saguer \(2026\)I\. Llorente\-SaguerThe geometry of harmful intent: training\-free anomaly detection via angular deviation in LLM residual streams\.arXiv preprint arXiv:2603\.27412\.Cited by:[§6](https://arxiv.org/html/2608.29109#S6.p3.1)\.
- Maet al\.\(2026\)J\. Ma, D\. Dai, Z\. Yuan, R\. Li, W\. Luo, B\. Wang, Q\. Liu, L\. Sha, and Z\. SuiLarge language models struggle with unreasonability in math problems\.InProceedings of the AAAI Conference on Artificial Intelligence,Vol\.40,pp\. 32428–32436\.Note:Issue 38External Links:[Document](https://dx.doi.org/10.1609/aaai.v40i38.40518)Cited by:[§1](https://arxiv.org/html/2608.29109#S1.p6.1),[§4\.1](https://arxiv.org/html/2608.29109#S4.SS1.p2.1),[§4\.3](https://arxiv.org/html/2608.29109#S4.SS3.p9.1),[§6](https://arxiv.org/html/2608.29109#S6.p1.1),[§7](https://arxiv.org/html/2608.29109#S7.p1.1)\.
- Microsoft \(2025\)MicrosoftPhi\-4\-Mini technical report: compact yet powerful multimodal language models via mixture\-of\-LoRAs\.arXiv preprint arXiv:2503\.01743\.Cited by:[§A\.5](https://arxiv.org/html/2608.29109#A1.SS5.p2.1)\.
- Mistral AI \(2025\)Mistral AIMistral Small 3\.Note:[https://mistral\.ai/news/mistral\-small\-3](https://mistral.ai/news/mistral-small-3)Release announcement; coversMistral\-Small\-24B\-Instruct\-2501Cited by:[§A\.5](https://arxiv.org/html/2608.29109#A1.SS5.p2.1)\.
- Orgadet al\.\(2025\)H\. Orgad, M\. Toker, Z\. Gekhman, R\. Reichart, I\. Szpektor, H\. Kotek, and Y\. BelinkovLLMs know more than they show: on the intrinsic representation of LLM hallucinations\.InProceedings of the International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=KRnsX5Em3W)Cited by:[§6](https://arxiv.org/html/2608.29109#S6.p2.1)\.
- Qwen Team \(2024\)Qwen TeamQwen2\.5 technical report\.arXiv preprint arXiv:2412\.15115\.Cited by:[§A\.5](https://arxiv.org/html/2608.29109#A1.SS5.p3.1)\.
- Qwen Team \(2025\)Qwen TeamQwen3 technical report\.arXiv preprint arXiv:2505\.09388\.Cited by:[§A\.5](https://arxiv.org/html/2608.29109#A1.SS5.p2.1),[§A\.5](https://arxiv.org/html/2608.29109#A1.SS5.p3.1)\.
- Rajpurkaret al\.\(2018\)P\. Rajpurkar, R\. Jia, and P\. LiangKnow what you don’t know: unanswerable questions for SQuAD\.InProceedings of the 56th Annual Meeting of the Association for Computational Linguistics \(Volume 2: Short Papers\),Melbourne, Australia,pp\. 784–789\.External Links:[Document](https://dx.doi.org/10.18653/v1/P18-2124),[Link](https://aclanthology.org/P18-2124/)Cited by:[§A\.5](https://arxiv.org/html/2608.29109#A1.SS5.p4.1),[§6](https://arxiv.org/html/2608.29109#S6.p1.1)\.
- Ravichanderet al\.\(2021\)A\. Ravichander, Y\. Belinkov, and E\. HovyProbing the probing paradigm: does probing accuracy entail task relevance?\.InProceedings of the Conference of the European Chapter of the Association for Computational Linguistics,Cited by:[§4\.3](https://arxiv.org/html/2608.29109#S4.SS3.p1.1)\.
- Team OLMo \(2024\)Team OLMo2 OLMo 2 Furious\.arXiv preprint arXiv:2501\.00656\.Cited by:[§A\.5](https://arxiv.org/html/2608.29109#A1.SS5.p2.1)\.
- Turneret al\.\(2023\)A\. M\. Turner, L\. Thiergart, G\. Leech, D\. Udell, J\. J\. Vazquez, U\. Mini, and M\. MacDiarmidSteering language models with activation engineering\.arXiv preprint arXiv:2308\.10248\.External Links:[Document](https://dx.doi.org/10.48550/arXiv.2308.10248)Cited by:[§6](https://arxiv.org/html/2608.29109#S6.p3.1)\.
- Wanget al\.\(2025\)Y\. Wang, H\. Li, H\. Zou, J\. Zhang, X\. He, Q\. Li, and K\. XuFacLens: transferable probe for foreseeing non\-factuality in fact\-seeking question answering of large language models\.InProceedings of the Conference on Empirical Methods in Natural Language Processing,Suzhou, China,pp\. 18563–18582\.External Links:[Document](https://dx.doi.org/10.18653/v1/2025.emnlp-main.937),[Link](https://aclanthology.org/2025.emnlp-main.937/)Cited by:[§6](https://arxiv.org/html/2608.29109#S6.p2.1)\.
- Wenet al\.\(2025\)B\. Wen, J\. Yao, S\. Feng, C\. Xu, Y\. Tsvetkov, B\. Howe, and L\. L\. WangKnow your limits: a survey of abstention in large language models\.Transactions of the Association for Computational Linguistics13,pp\. 529–556\.Cited by:[§6](https://arxiv.org/html/2608.29109#S6.p1.1)\.
- Wollschlägeret al\.\(2025\)T\. Wollschläger, J\. Elstner, S\. Geisler, V\. Cohen\-Addad, S\. Günnemann, and J\. GasteigerThe geometry of refusal in large language models: concept cones and representational independence\.InProceedings of the 42nd International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.267,pp\. 66945–66970\.External Links:[Link](https://proceedings.mlr.press/v267/wollschlager25a.html)Cited by:[§6](https://arxiv.org/html/2608.29109#S6.p3.1)\.
- Wuet al\.\(2026\)J\. Wu, Y\. Xie, S\. Lin, S\. Zhao, and X\. ChenKnowing without acting: the disentangled geometry of safety mechanisms in large language models\.arXiv preprint arXiv:2603\.05773\.External Links:[Document](https://dx.doi.org/10.48550/arXiv.2603.05773)Cited by:[§6](https://arxiv.org/html/2608.29109#S6.p3.1)\.

## Appendix AData Construction

This appendix documents the construction of the three study datasets \(math800,code800,fact800\) and the cleaning of the externalfalseqafile used for zero\-shot transfer\. Themath800andcode800prompts were generated with an API\-hosted LLM under fixed category\-specific instructions and then subjected to the deterministic validity and deduplication checks described below; the released scripts record the generation configuration\.fact800andfalseqado not use LLM generation\. Per\-category probe AUC formath800andcode800is reported separately in App\.[E](https://arxiv.org/html/2608.29109#A5)\.

### A\.1math800

Scale\.16 categories×\\times50 matched A/U pairs==1600 prompts \(800 A, 800 U\)\.

Goal and U definition\.Each pair targets the*same underlying mathematical operation or concept*and differs only in answerability under standard mathematics\. An A prompt is answerable under standard mathematics; a U prompt is structurally unanswerable, restricted to four types: \(i\) formally undefined operations \(e\.g\.,÷0\\div 0, modulo by zero, invalid log base\), \(ii\) non\-existent results \(e\.g\., derivatives at non\-differentiable points, limits that do not exist\), \(iii\) no solution in the stated domain \(e\.g\.,x2=−4x^\{2\}=\-4overℝ\\mathbb\{R\}\), and \(iv\) divergent quantities\. Real\-world unknown quantities, future values, very large but computable numbers,000^\{0\}, and “largest prime” are explicitly excluded because they are answerable under standard conventions\.

Prompt format\.Every prompt is prefixed with"Answer concisely: "followed by a math question with varied surface templates\.

Table 5:The 16math800categories with representative unanswerable prompts\. The “Code” column is the short identifier used in Appendix[E](https://arxiv.org/html/2608.29109#A5)\(Table[9](https://arxiv.org/html/2608.29109#A5.T9)\) for per\-category AUC\.Anti\-confound measures\.

1. 1\.*Matched by operation / concept\.*Each A/U pair addresses the same underlying mathematical operation with a matched surface template\.
2. 2\.*Structural U definition\.*U prompts are restricted to the four structural types above; “unanswerable because the model doesn’t know” and “unanswerable because the number is big” are not accepted\.
3. 3\.*Template diversity with short\-answer control\.*All prompts carry the"Answer concisely: "prefix while surface forms vary within category \(What is/Compute/Calculate/Find/Evaluate/Determine, etc\.\) to reduce brittle template shortcuts\.
4. 4\.*Length confound control\.*Token\-level length AUC \(Mistral tokenizer,U=1U=1\) is0\.4980\.498globally, and all 16 categories fall within\[0\.47,0\.53\]\[0\.47,0\.53\]; no category approaches a severe length\-confound regime\.
5. 5\.*Generator dedup guardrail\.*src/data/generate\_math800\.pyrejects whitespace\-insensitive duplicate prompts and, in\-\-resumemode, seeds its dedup set from on\-disk prompts in the target file rather than only from the current batch\.

Audit status \(2026\-04\-12\)\.1600 rows, 16 categories×\\times50 matched pairs, zero duplicate ids, zero raw duplicate prompts, zero whitespace\-insensitive duplicate prompts, zero incomplete pairs\. Earlier versions contained 16 mislabelednonexistent\_limitA prompts and 3 malformed or differentiableundefined\_derivativeU prompts; these are fixed in the shipped file, and the shippedundefined\_derivativefamily is restricted to four accepted U types \(absolute\-value cusps, step discontinuities at half\-integer ties,sign⁡\(x\)\\mathrm\{sign\}\(x\)atx=0x=0, andx1/3x^\{1/3\}atx=0x=0\)\. Exact file reproduction is not claimed because the API\-based generator is stochastic\.

### A\.2code800

Scale\.8 categories×\\times100 matched A/U pairs==1600 prompts\.

Goal and U definition\.Each pair targets the*same Python operation or API family*\. An A prompt is an expression that returns a value in standard CPython; a U prompt raises a category\-correct runtime exception or never terminates\.

Table 6:The 8code800categories\. The “Code” column is the short identifier used in Appendix[E](https://arxiv.org/html/2608.29109#A5)\(Table[10](https://arxiv.org/html/2608.29109#A5.T10)\) for per\-category AUC\.Anti\-confound measures\.

1. 1\.*Matched by operation / function\.*Each A/U pair targets the same operation family, differing only in whether the expression is well\-formed for CPython\.
2. 2\.*Category\-pure U semantics\.*U expressions raise category\-correct runtime outcomes only;infinite\_iteruses genuinely non\-terminating iterators built fromitertools\.count,itertools\.cycle, anditertools\.repeat, consumed by operations such assum,list,tuple,max,min,sorted,set\.
3. 3\.*Template diversity with short\-answer control\.*All prompts use the"Answer concisely: "prefix and one of 7 canonical templates with backtick\-enclosed expressions \(e\.g\.‘‘What is the result of evaluating ‘X‘ in Python?’’\)\.
4. 4\.*Length confound control\.*Global token\-level length AUC is0\.4980\.498; all 8 categories fall in\[0\.47,0\.53\]\[0\.47,0\.53\]\.
5. 5\.*AST\-level dedup\.*src/data/generate\_code800\.pyrejects AST\-equivalent duplicate expressions \(not merely exact\-string duplicates\) and in\-\-resumemode seeds its AST\-dedup set from on\-disk prompts\.

Audit status \(2026\-04\-12\)\.1600 rows, 8 categories×\\times100 matched pairs, zero duplicate ids, zero raw duplicate prompts, zero AST\-normalized duplicate expression groups, zero incomplete pairs\. All non\-infinite\_iterA expressions evaluate successfully undermath, itertools; all corresponding U expressions raise category\-correct exceptions; allinfinite\_iterU prompts remain in genuinely non\-terminating families\. Exact file reproduction is not claimed because the API\-based generator is stochastic\.

### A\.3fact800

Scale and source\.800 matched pairs==1600 prompts, drawn from the SQuAD 2\.0*train*split\.

Goal\.A natural epistemic\-unanswerability control set in which answerability differs only at the QA level, not at the passage level\. Each pair uses the same paragraph context and consists of an answerable SQuAD question \(is\_impossible=False\) and an unanswerable one \(is\_impossible=True\)\.

Prompt format\.Context:⟨\\langletruncated paragraph⟩\\rangle/ Question:⟨\\langlequestion⟩\\rangle/ Answer:\(newline\-separated\)\.

Anti\-confound measures\.

1. 1\.*Matched by paragraph\.*A and U in each pair come from the same SQuAD paragraph, so passage topic, style, and world knowledge are controlled within pair\.
2. 2\.*Verbatim\-prefix context truncation\.*Paragraph context is truncated at a 150\-word boundary using the*verbatim original prefix*, not a whitespace\-normalized reconstruction; when truncation applies, the suffix" \.\.\."is appended\.
3. 3\.*Article diversity cap\.*At most 3 pairs per Wikipedia article\.
4. 4\.*Strict A\-span admission\.*An A prompt is kept only if at least one official SQuAD answer span survives in the stored context with*literal character alignment*: bothanswer\_start \+ len\(answer\_text\)≤\\leqlen\(stored\_context\), andstored\_context\[answer\_start : answer\_start \+ len\(answer\_text\)\] == answer\_text\. Substring matching is not sufficient, because the same string may recur elsewhere in the paragraph\.
5. 5\.*U\-side rule\.*U questions come fromis\_impossible=Trueitems and have no official answer span by design\.

Reproducibility\.The shipped file is reproduced exactly bysrc/data/prepare\_squad2\.pywithsplit=train,n\_pairs=800,seed=42\.

Audit status \(2026\-04\-12\)\.1600 rows, 800 complete matched pairs, zero duplicate ids, zero duplicate prompts, zero incomplete pairs; all 1600 prompts uniquely map back to a SQuAD 2\.0 train source item, and all 800 A prompts pass literal span\-alignment\. Earlier versions used a weaker truncation/alignment check that could admit false positives when the answer string recurred elsewhere in the truncated context; the current construction fixes this\.

### A\.4falseqa

Role\.falseqais used as a*boundary\-test dataset*for false\-premise QA in the zero\-shot transfer evaluation \(§[5](https://arxiv.org/html/2608.29109#S5)\),*not*as a core structural benchmark\.

Scale and source\.1374 prompts \(687 A, 687 U\), sourced from the public FalseQA dataset\.

Cleaning procedure\.src/data/clean\_falseqa\.pyapplies the following minimal normalizations while preserving row count, A/U balance, and id structure:

1. 1\.*Cross\-label duplicate rewrite\.*One cross\-label exact\-duplicate prompt \(fqa\_0294uandfqa\_0981ashared the prompt‘‘How to light and put out the fire at the same time?’’\) is resolved by minimally rewriting the A\-side prompt\. The script explicitly documents this as alocal dedup rewriterather than a source\-faithful restoration of the original FalseQA wording\.
2. 2\.*Unicode normalization\.*Smart quotes \(U\+2018/2019/201C/201D\) are mapped to their ASCII equivalents\.
3. 3\.*Whitespace collapse\.*Repeated spaces are collapsed to single spaces\.
4. 4\.*Terminal\-punctuation repair\.*Question\-word\-initial prompts lacking any terminal punctuation receive?; question\-word\-initial prompts ending in\.\(with no mid\-sentence?\) are rewritten to end in?; imperatives \(List/Name/Give\) keep or receive\.\.
5. 5\.*Capitalization\.*Lowercase‘‘If i’’→\\to‘‘If I’’\(2 affected rows\)\.

Caveat\.After cleaning, token\-level length AUC is0\.5260\.526\(Mistral tokenizer,U=1U=1\), and the analysis file carries one explicitly documented local dedup rewrite rather than a source\-faithful restoration\. Because upstream FalseQA has no explicit license, the public artifact does not redistribute this file and instead provides a fetch\-and\-clean script\. Accordingly,falseqaresults in this paper are framed as*scope\-defining evidence*for false\-premise behavior, not as a clean external benchmark\.

### A\.5Model release sources

This subsection records canonical citations for every open\-weight checkpoint and external dataset used in the paper, concentrated here so that the main body remains untouched by model\-release citations\.

Main\-grid checkpoints \(§[4\.1](https://arxiv.org/html/2608.29109#S4.SS1), §[4\.2](https://arxiv.org/html/2608.29109#S4.SS2), §[4\.3](https://arxiv.org/html/2608.29109#S4.SS3)\)\.The 11\-model main grid is composed of: SmolLM2\-1\.7B\([Allal et al\., 2025](https://arxiv.org/html/2608.29109#bib.bib21)\), Phi\-4\-mini\-3\.8B\([Microsoft, 2025](https://arxiv.org/html/2608.29109#bib.bib22)\), Mistral\-7B\-Instruct\([Jiang et al\., 2023](https://arxiv.org/html/2608.29109#bib.bib23)\)and Mistral\-Small\-24B\-Instruct\-2501\([Mistral AI, 2025](https://arxiv.org/html/2608.29109#bib.bib24)\), Gemma\-3\-4B\-it\([Gemma Team, 2025](https://arxiv.org/html/2608.29109#bib.bib26)\), Llama\-3\.1\-8B\-Instruct and Llama\-3\.3\-70B\-Instruct \(both from the Llama 3 family,[Llama Team, 2024](https://arxiv.org/html/2608.29109#bib.bib27)\), Qwen3\-8B / Qwen3\-14B / Qwen3\-32B from the Qwen3 family\([Qwen Team, 2025](https://arxiv.org/html/2608.29109#bib.bib29)\), and OLMo\-2\-13B\([Team OLMo, 2024](https://arxiv.org/html/2608.29109#bib.bib30)\)\.

Auxiliary checkpoints \(§[4\.4](https://arxiv.org/html/2608.29109#S4.SS4)pretrain comparison and archival appendix tables\)\.The 6\-pair base/instruct comparison in §[4\.4](https://arxiv.org/html/2608.29109#S4.SS4)adds Qwen2\.5\-7B/14B/32B\-Instruct and their matching base releases from the Qwen2\.5 family\([Qwen Team, 2024](https://arxiv.org/html/2608.29109#bib.bib28)\), Qwen3\-8B\-Base and Qwen3\-14B\-Base\([Qwen Team, 2025](https://arxiv.org/html/2608.29109#bib.bib29)\), and Llama\-3\.1\-70B\-Base\([Llama Team, 2024](https://arxiv.org/html/2608.29109#bib.bib27)\)\. The legacy energy\-decomposition control and detection\-heatmap appendix tables \(Appendix[I](https://arxiv.org/html/2608.29109#A9), Appendix[E](https://arxiv.org/html/2608.29109#A5)\) additionally include Gemma\-2\([Gemma Team, 2024](https://arxiv.org/html/2608.29109#bib.bib25)\); the “Phi3” column in those archival per\-category tables is a shorthand label for the Phi\-3 release used in the earlier 8\-base\-cell control and is not part of the 11\-model main grid\.

Datasets\.Thefact800split is built from SQuAD 2\.0\([Rajpurkar et al\., 2018](https://arxiv.org/html/2608.29109#bib.bib31)\);falseqais the cleaned FalseQA file of[Hu et al\. \(2023\)](https://arxiv.org/html/2608.29109#bib.bib32)\(cleaning procedure in App\.[A\.4](https://arxiv.org/html/2608.29109#A1.SS4)\); AbstentionBench\-GSM8K \(the GSM8K subset of AbstentionBench;[Kirichenko et al\., 2025](https://arxiv.org/html/2608.29109#bib.bib16);[Cobbe et al\., 2021](https://arxiv.org/html/2608.29109#bib.bib33)\) is the natural\-distribution epistemic\-style transfer benchmark used in the transfer and length\-control analyses of §[5](https://arxiv.org/html/2608.29109#S5)\.

## Appendix BAdditional Detection and Projection Figures

This appendix collects the detection\-side and projection\-ablation figures referenced in §[4\.1](https://arxiv.org/html/2608.29109#S4.SS1)but not reproduced in the main body for space\.

![Refer to caption](https://arxiv.org/html/2608.29109v1/fig2_detection_heatmap.png)Figure 4:CosNSRT global AUC on the 22\-cell 11\-model main grid \(math800\+\+code800\)\.Mean AUC 0\.939, range\[0\.841,0\.993\]\[0\.841,0\.993\]\. Every 7B\+ instruct model exceeds 0\.90 on math800; the strongest cell is Qwen3\-32B / math800 \(0\.993\), and the weakest is SmolLM2\-1\.7B / code800 \(0\.841\)\. Values are HO\-AU 5\-seed averages at each model’s matched layer\. Cf\. §[4\.1](https://arxiv.org/html/2608.29109#S4.SS1)\.Figure 5:MeanDiff AUC under three subspace choices \(Null, Top\-kkPC, Full\) on the 22\-cell 11\-model main grid, 5\-seed averaged\.Null\-space averages 0\.939, Top\-kkPC 0\.890, Full\-space 0\.907; Null\>\>PC in 21/22 cells, Null\>\>Full in 19/22 cells\. The single Null\-≤\\leq\-PC cell is Mistral\-Small\-24B / code800 \(gap−0\.009\-0\.009\)\. Cf\. §[4\.1](https://arxiv.org/html/2608.29109#S4.SS1)\.
## Appendix CSVM Full\-Space Caveat

§[4\.1](https://arxiv.org/html/2608.29109#S4.SS1)attributes theP≫w\>φP\\gg w\>\\varphiordering in the GSRS ablation to the subspace choice: projecting the answerable \(AA\) class out of the residual stream raises MeanDiff AUC by\+22\.5\+22\.5pp over a full\-space MeanDiff baseline on the 16\-cell detection grid, with Null beating Full in 12/16 cells\. The framing we give that number in the main text is anaccessibilityresult for a low\-capacity reader \(a one\-dimensional cosine probe\), not a statement that the impossibility signal exists only in the A\-null subspace\. This appendix reports the direct evidence for that framing\. On the 4 representative \(model, dataset\) cells for which we have matched SVM\-in\-null vs\. SVM\-in\-full runs \(Mistral\-7B and Qwen\-14B on math800 and code800\), a full\-space linear SVM matches or exceeds its null\-space counterpart in 3 of 4 cells, even though the MeanDiff ordering on those same 4 cells tilts the other way \(MeanDiff Null\>\>Full in 3/4\)\.

Table 7:MeanDiff versus SVM AUC under three subspace choices on 4 representative cells\. MeanDiff inherits thePP\-dominated ordering of §[4\.1](https://arxiv.org/html/2608.29109#S4.SS1)\(Null best in 3/4 cells\); SVM does not \(Full best in 3/4 cells; Qwen\-14B/math800 is tied at0\.99630\.9963Null vs\.0\.99620\.9962Full\)\. Bold entries mark the best subspace per row within each classifier family\. HO\-AU 5\-seed averaged\.Two observations follow\. First, the\+22\.5\+22\.5ppPP\-gain reported in §[4\.1](https://arxiv.org/html/2608.29109#S4.SS1)is a statement about what aone\-dimensional MeanDiff probe read under cosine similaritycan recover when we change its subspace; it is not a statement about signal existence\. On these 4 cells a full\-space linear SVM, still a linear classifier but withDDfree parameters rather than a single direction, closes the gap and on 3 of 4 cells slightly surpasses its A\-null\-only counterpart\. Second, the signs of the MeanDiff and SVM Null\-vs\-Full comparisons disagree on 3 of 4 cells \(Mistral math and code, Qwen\-14B code\), the pattern one would expect if A\-PC variance is a structured nuisance for a low\-capacity reader but becomes navigable to a richer classifier that can combine an A\-PC component with an A\-null component in a weighted sum the cosine\-to\-a\-single\-direction probe cannot\. We therefore read A\-null projection as a method thatmakes the signal accessible to simple probesrather than as a residence claim for impossibility\. This framing is compatible with the GSRS orderingP≫w\>φP\\gg w\>\\varphiin §[4\.1](https://arxiv.org/html/2608.29109#S4.SS1), which is internal to the MeanDiff family, and is the reason the main\-text CosNSRT headline is framed as an accessibility result\.

Figure 6:Earlier\-grid 16\-cell GSRS ablation \(8 instruct models×\\times2 datasets\), probe\-accessibility evidence behind theP≫w\>φP\\gg w\>\\varphiordering\.Per\-factor AUC gain over baseline when only one GSRS factor is swapped onto the best configuration: Projection contributes\+22\.5\+22\.5pp, Direction\+10\.9\+10\.9pp, Scoring\+1\.1\+1\.1pp on average and\+5\.7\+5\.7pp on the hard tail\. The figure is a snapshot from the earlier\-grid ablation that motivated the A\-null subspace choice; the cell list is intentionally not extended to the 11\-model main grid\. Cf\. §[4\.1](https://arxiv.org/html/2608.29109#S4.SS1)\.
## Appendix DLayer\-Emergence Curves

The main text fixes layerLLonce per model from a held\-out slice \(§[3](https://arxiv.org/html/2608.29109#S3)\) and reuses that layer across detection, orthogonality, and intervention in most configurations \(with one documented exception: Mistral\-Small\-24B×\\timescode800 uses L28 for orthogonality and L20 for steering; see §[3](https://arxiv.org/html/2608.29109#S3)\)\. This appendix reports the descriptive layer\-resolved probe that motivated those layer choices\. The experiment is alegacy3\-model, math800\-focused pilot run under an earlier version of the pipeline \(V40, April 2026\), and we include it only to document the qualitative shape from which the main\-text layer selections were made, not as a headline result\. It is not a full 8\-model sweep, and none of the conclusions in §[4](https://arxiv.org/html/2608.29109#S4)or §[5](https://arxiv.org/html/2608.29109#S5)depend on it\.

Protocol \(legacy\)\.On Mistral\-7B, Llama\-3\.1\-8B, and Qwen\-7B we sweep layersℓ=1,2,…,Lmax\\ell=1,2,\\ldots,L\_\{\\max\}on math800 under two probes: \(i\) an early\-exit linear probe on last\-token hidden states \(AUC on a held\-out split\), and \(ii\) an A\-null subspace probe that first fits PCA on train\-AAand then runs a cross\-validated linear probe on the projected residual\. Both probes read from the same hidden states; they differ in whether A\-subspace variance is projected out before classification\. The sweep was densest on the focus layers\{2,3,4,5,6,8\}\\\{2,3,4,5,6,8\\\}and the final layer, with additional mid\-depth probe points at per\-model middle layers where the V40 pipeline recorded its peak\.

Shape\.Within the 3\-model legacy sweep the per\-layer AUC traces aninverted\-U: the impossibility signal builds up across early and middle layers, peaks at a model\-specific middle layer, and either saturates or modestly declines toward the final layer\. On Qwen\-7B the decline is explicit: the A\-null subspace\-probe AUC reaches0\.9630\.963at L17–19 and falls back to0\.8450\.845at the final layer, while Mistral\-7B and Llama\-3\.1\-8B remain close to their middle\-layer peaks at the final layer\. Table[8](https://arxiv.org/html/2608.29109#A4.T8)reports the math800 and code800 peak layer and its AUC for each of the three models, as recorded by the V40 middle\-depth scan from which the main\-text layer choices were derived\.

Table 8:Legacy middle\-layer peaks on the 3\-model descriptive probe \(math800 and code800, April 2026 V40 pipeline\)\. The main\-text layers used throughout §[4](https://arxiv.org/html/2608.29109#S4)\(Mistral\-7B L15, Llama\-3\.1\-8B L15, Qwen\-7B L18\) are within one or two layers of these peaks\.Heterogeneity across categories is visible in the legacy logs but not resolved quantitatively: simple symbolic impossibility categories \(e\.g\.÷0\\div 0,−1\\sqrt\{\-1\}overℝ\\mathbb\{R\}\) tend to reach peak earlier in the network than categories that require multi\-step verification \(e\.g\. matrix singularity\), consistent with the per\-category AUC heterogeneity documented in Appendix[E](https://arxiv.org/html/2608.29109#A5)\. The main\-text layer choice for the 8\-model grid \(§[4\.1](https://arxiv.org/html/2608.29109#S4.SS1)\) was informed by these 3\-model curves together with per\-model exploratory runs: we pick a layer near the middle\-layer peak rather than the final layer, a choice the inverted\-U shape above justifies qualitatively\. We flag this as a heuristic layer\-choice procedure and do not re\-derive it at the 8\-model scale\.

## Appendix EFull Per\-Category AUC Tables

Tables[9](https://arxiv.org/html/2608.29109#A5.T9)and[10](https://arxiv.org/html/2608.29109#A5.T10)report the per\-category CosNSRT AUC breakdown referenced in §[5](https://arxiv.org/html/2608.29109#S5)for all 8 instruct models on the 16 math800 and 8 code800 categories\. Values are HO\-AU 5\-seed averaged at each model’s matched layer; category identifiers refer to the data\-construction scheme detailed in Appendix[A](https://arxiv.org/html/2608.29109#A1)\.

Table 9:Per\-category CosNSRT AUC on math800 \(16 categories×\\times8 models\)\. Global AUC is the HO\-AU 5\-seed mean over the full dataset at the model’s matched layer\.Table 10:Per\-category CosNSRT AUC on code800 \(8 categories×\\times8 models\)\. Global AUC is the HO\-AU 5\-seed mean over the full dataset at the model’s matched layer\.
## Appendix FSteering Fullα\\alphaSweep and max\-Δ\\DeltaEnvelope

Note \(legacy v1 archival\)\.The 23\-cell breadth analysis below is v1 archival\. The current §[4\.3](https://arxiv.org/html/2608.29109#S4.SS3)headline uses the v2\-deterministic 48\-cell steering breadth \(16 models×\\times3 datasets\) documented in Appendix[J](https://arxiv.org/html/2608.29109#A10)\. The table and per\-cell numbers below are retained as a reproducibility artifact for the v1 protocol, not as support for the current headline\. The v1 protocol reported steering as a signal\-minus\-random refusal\-rate\-on\-U gain at bestα\\alpha, with one cell \(Mistral\-Small\-24B×\\timesfact800\) absent at the time of recording\. For each cell the table shows two pairs of numbers: \(i\) at thebestα\\alpha, the signal\-minus\-random gains on the correct behavior \(refusal on U;ΔrefU\\Delta\_\{\\mathrm\{refU\}\}\) and on the selectivity cost \(wrong refusal on A;ΔwrongA\\Delta\_\{\\mathrm\{wrongA\}\}\); and \(ii\) theα\\alphaat whichΔrefU\\Delta\_\{\\mathrm\{refU\}\}is maximized anywhere across\{0,5,10,20,30,40\}⋅proj​\_​std\\\{0,5,10,20,30,40\\\}\\cdot\\mathrm\{proj\\\_std\}, and the resulting max\-Δ\\Deltaenvelope\. The max\-α\\alphacolumns document the full v1 causal\-capacity envelope of the handle on this archival grid; readers should consult Appendix[J](https://arxiv.org/html/2608.29109#A10)and §[4\.3](https://arxiv.org/html/2608.29109#S4.SS3)for the current v2 16\-model 48\-cell breadth\.

Table 11:Legacy v1 8\-model 23\-cell archival summary of the fullα\\alpha\-sweep \(signal\-minus\-random refusal\-rate\-on\-U gain\)\.α\\alphais reported in units of proj\_std \(the standard deviation of null\-space projections of train hidden states ontod^\\hat\{d\}, §[3](https://arxiv.org/html/2608.29109#S3)\);ΔrefU\\Delta\_\{\\mathrm\{refU\}\}andΔwrongA\\Delta\_\{\\mathrm\{wrongA\}\}are the signal\-minus\-random differences inrefusal​\_​rateU\\mathrm\{refusal\\\_rate\}\_\{U\}andwrong​\_​refusal​\_​rateA\\mathrm\{wrong\\\_refusal\\\_rate\}\_\{A\}at thatα\\alpha\. The bestα\\alphais the single value per cell that maximizes the cell\-leveloverall proxy\(ncorrect​\_​refusalU\+nnon​\_​refusalA\)/ntotal\(n\_\{\\mathrm\{correct\\\_refusal\}\_\{U\}\}\+n\_\{\\mathrm\{non\\\_refusal\}\_\{A\}\}\)/n\_\{\\mathrm\{total\}\}; the max\-Δ\\Deltaα\\alphais the value that maximizesΔrefU\\Delta\_\{\\mathrm\{refU\}\}in isolation\. The per\-domain best\-α\\alphacolumn maxima and the max\-Δ\\Deltaenvelopes are archival v1 figures only\. For the current v2\-deterministic 48\-cell steering breadth on 16 models, see §[4\.3](https://arxiv.org/html/2608.29109#S4.SS3)and Appendix[J](https://arxiv.org/html/2608.29109#A10)\.Two reading\-level cautions \(scoped to the legacy v1 8\-model archival table\)\.First, the max\-α\\alphaenvelope is anexistence proofthatdimpd\_\{\\mathrm\{imp\}\}can drive large behavioral changes relative to random on this 8\-model 23\-cell grid, not an operating recommendation: theΔwrongA\\Delta\_\{\\mathrm\{wrongA\}\}column in the max block is of comparable magnitude toΔrefU\\Delta\_\{\\mathrm\{refU\}\}on most cells, which means that at thoseα\\alphavalues the model is also refusing the answerable class; highΔrefU\\Delta\_\{\\mathrm\{refU\}\}comes with a proportional selectivity cost\. The Qwen\-14B×\\timesmath800 case is the extreme form on this archival grid: max\-α=30\\alpha=30deliversΔrefU=\+1\.00\\Delta\_\{\\mathrm\{refU\}\}=\+1\.00but alsoΔwrongA=\+1\.00\\Delta\_\{\\mathrm\{wrongA\}\}=\+1\.00, i\.e\., the model refuseseverythingunder steering andnothingunder the random\-direction control\. Second, within this archival table the per\-domain ordering math\>\>code\>\>fact in best\-α\\alphagains reproduces in the max\-Δ\\Deltaenvelope; that ordering is internal to the v1 archival reference\. It isdistinctfrom, not a substitute for, the current v2 evidence in §[4\.3](https://arxiv.org/html/2608.29109#S4.SS3)\(anchor\-quality math/code with Mistral\-7B as bidirectional keystone, fact as structural boundary\) and Appendix[J](https://arxiv.org/html/2608.29109#A10); the two views should not be conflated\.

## Appendix GLegacy v1 Keyword\-Detector Audit

Note \(legacy v1 archival\)\.The 4,500\-row keyword\-detector audit described in this appendix is v1 archival\. The current §[4\.3](https://arxiv.org/html/2608.29109#S4.SS3)headline numbers come from a v2 invalidity\-aware LLM\-assisted rubric documented in Appendix[J](https://arxiv.org/html/2608.29109#A10), run on the v2 4\-anchor grid \(Mistral\-7B\-Instruct, Gemma\-3\-4B\-it, Qwen3\-14B, Qwen3\-8B\), not the v1 3×\\times3 grid that this appendix documents\. The keyword\-detector audit below is retained as a reproducibility artifact for the v1 protocol, not as support for the current headline\.

Pipeline\.The v1 intervention pipeline detected refusal at generation time with a keyword lexicon: an output was flagged as a refusal if it contained any of a hand\-curated list of refusal tokens \(e\.g\. “cannot”, “undefined”, “no solution”, domain\-specific equivalents for code and math\)\. The v1gated flip ratemetric documented in this appendix was computed on this detector\. For the legacy audit, an LLM\-assisted batch review assigned three\-way labels to all 4,500 intervention records under a fixed rubric, with the first author reviewing uncertain cases\. Each row stores both signal\- and random\-branch generations, but its retained three\-way label pertains to the signal\-branch detector decision; the random branch was not separately annotated\.

Result\.Table[12](https://arxiv.org/html/2608.29109#A7.T12)reports 747 flip labels, 3,749 no\-flip labels, and 4 keyword\-detector false positives\. The recorded detector\-disagreement share is4/4,500=0\.09%4/4\{,\}500=0\.09\\%overall and4/751≈0\.53%4/751\\approx 0\.53\\%among detector\-positive rows\. The 4 errors are concentrated in 2 of the 9 cells \(3 in Qwen\-14B×\\timesfact800; 1 in Mistral\-7B×\\timescode800\) and are absent on every math800 cell\.

Table 12:Legacy v1 LLM\-assisted audit of the signal\-branch keyword detector across 9 model–dataset cells\. “FP” counts recorded detector disagreements\. Each row totals 500\. The disagreement share is4/4,500=0\.09%4/4\{,\}500=0\.09\\%overall and4/751≈0\.53%4/751\\approx 0\.53\\%among detector\-positive rows\.Implications for the v1 archival result\.All three v1 math800 cells have zero recorded false\-positive keyword detections across 1,500 audited rows; on this archival v1 3×\\times3 grid the recorded disagreement share was≈0\.09%\\approx 0\.09\\%overall /≈0\.53%\\approx 0\.53\\%among detector\-positive rows\. The 4 errors that did occur clustered in v1 fact800 \(3 of 4, all on Qwen\-14B\), consistent with fact800 being an entangled domain on the v1 protocol\. The current §[4\.3](https://arxiv.org/html/2608.29109#S4.SS3)headline numbers donotcome from this keyword detector; they are produced by the v2 invalidity\-aware classifier on the v2 4\-anchor grid \(Appendix[J](https://arxiv.org/html/2608.29109#A10)\)\. The v1 audit reported here bounds the v1 archival numbers only, not the current v2 headline\.

## Appendix HNegative Results

Over the course of pipeline development, we evaluated a systematic family of “internal mismatch” hypotheses for structural unanswerability: the hypothesis that A/U could be distinguished by*disagreement*or*split*between different internal components of the forward pass \(attention pattern vs\. gradient, layer trajectories vs\. output, attention entropy vs\. representation own\-distance, etc\.\)\. Table[13](https://arxiv.org/html/2608.29109#A8.T13)lists 12 such hypotheses, evaluated on the early 3\-modelmath50pilot and, where a pilot result was borderline, re\-run on the full\-scalemath800dataset\. None reached usable discriminative performance\. This body of negative evidence is what motivated the shift to the A\-null residual\-space directiondimpd\_\{\\mathrm\{imp\}\}used in §[4\.1](https://arxiv.org/html/2608.29109#S4.SS1)\.

Table 13:12 internal\-mismatch hypotheses ruled out during pipeline development\. “—” marks cells that were not run at that scale because a cheaper pilot variant had already failed\.math800AUC entries are aggregated across 3 models×\\times16 categories×\\times50 A/U pairs\. Column abbreviations:a​eae= attention entropy,o​dod= representation own\-distance\.Root\-cause analysis\.The uniform failure across the 12 hypotheses has a single underlying explanation\. Uncertainty associated with*structural*unanswerability propagates*coherently*through the forward pass: representation, attention, gradient, and output\-distribution signals all move in the same direction on a U prompt relative to its matched A prompt, so no consistent internal split between components exists to detect\. These mismatch hypotheses were designed to detect component disagreement, such as an attention pattern that does not match a confidently emitted token\. Structural impossibility instead leaves a coherent mark along a specific geometric axis of the residual stream, namely the A\-null directiondimpd\_\{\\mathrm\{imp\}\}used in the main text\. The recognition signal is*concentrated along a subspace*, not distributed across component mismatches, which is why every mismatch\-based formulation we tried did not yield discriminative performance and why a simple one\-dimensional null\-space MeanDiff does\.

Other negative findings \(outside the 12 internal\-mismatch hypotheses\)\.Three additional negative results shaped the final pipeline and are noted here for completeness\.

1. 1\.*τ\\tau\(attractor tightness\) as a cross\-dataset predictor\.*An earlier claim that across\-dataset variation in detection AUC tracksτ\\tauwith Spearmanρ=−0\.950\\rho=\-0\.950did not survive replication on the current pipeline \(ρ=−0\.147\\rho=\-0\.147,p=0\.65p=0\.65,n=12n=12\)\. Within\-dataset NS\-SNR \(null\-space signal\-to\-noise ratio\) vs\. detection AUC \(ρ=0\.76\\rho=0\.76\) replaces it as the operative geometric summary\.
2. 2\.*Semantic entropy as an impossibility baseline\.*Output\-distribution semantic entropy\([Farquhar et al\., 2024](https://arxiv.org/html/2608.29109#bib.bib11)\)onllama/math50\(100 prompts, 10 sampled generations each, non\-strict entailment\) yieldsAUC=0\.625\\mathrm\{AUC\}=0\.625\(cluster\-assignment entropy=0\.638=0\.638\), while the representation\-level geometry probe on the*same samples*yieldsAUC=0\.841\\mathrm\{AUC\}=0\.841; the null\-space directiondimpd\_\{\\mathrm\{imp\}\}used in the main text has meanAUC=0\.924\\mathrm\{AUC\}=0\.924across 8 instruct models×\\times2 structural\-impossibility domains \(§[4\.1](https://arxiv.org/html/2608.29109#S4.SS1)\)\. Output\-level uncertainty signals therefore carry meaningfully less impossibility information than residual\-stream null\-space geometry\.
3. 3\.*Unsupervised discovery ofdimpd\_\{\\mathrm\{imp\}\}\.*Four label\-free methods \(PCA on A\-null residuals, kurtosis maximization, skewness maximization, and FastICA\) were applied to the same A\-null residuals that CosNSRT consumes\. The best unsupervised direction achievesAUC=0\.675\\mathrm\{AUC\}=0\.675withcos⁡\(d^,dimp\)<0\.48\\cos\(\\hat\{d\},d\_\{\\mathrm\{imp\}\}\)<0\.48, substantially below the labeled MeanDiff direction\. A/U labels are therefore a necessary input to recover the impossibility axis from the A\-null residual stream; the direction is not the dominant unsupervised axis of that subspace\.

## Appendix IEnergy Decomposition Full Tables

The main text claims, in the orthogonality analysis \(§[4\.2](https://arxiv.org/html/2608.29109#S4.SS2)\), that the moderate\-to\-substantial full\-space cosinecosfull,full⁡\(dimpfull,dref,safety\)∈\[0\.057,0\.781\]\\cos\_\{\\mathrm\{full\},\\mathrm\{full\}\}\(d\_\{\\mathrm\{imp\}\}^\{\\mathrm\{full\}\},d\_\{\\mathrm\{ref,safety\}\}\)\\in\[0\.057,0\.781\]across the 22 main\-grid instruct cells is dominated by shared answerable\-structure variance rather than by shared impossibility signal: averaged over the 22 instruct cells, the PC\-PC component accounts for mean0\.8130\.813of the magnitude ofcosfull,full\\cos\_\{\\mathrm\{full\},\\mathrm\{full\}\}\(range\[0\.607,0\.983\]\[0\.607,0\.983\]\)\. Table[14](https://arxiv.org/html/2608.29109#A9.T14)reports the per\-cell attribution behind that mean\. Table[15](https://arxiv.org/html/2608.29109#A9.T15)reports an auxiliary base\-model decomposition on an earlier\-grid 14\-cell instruct/base set; this is auxiliary base\-model decomposition, not part of the 22\-cell instruct main\-grid control, and is not the source of the §[4\.4](https://arxiv.org/html/2608.29109#S4.SS4)6\-pair pretraining\-origin headline\. We decomposecosfull,full=PC\-PC\+null\-null\\cos\_\{\\mathrm\{full\},\\mathrm\{full\}\}=\\mathrm\{PC\\text\{\-\}PC\}\+\\mathrm\{null\\text\{\-\}null\}\(the two cross terms vanish becauseVk⊤​VkV\_\{k\}^\{\\top\}V\_\{k\}andI−Vk⊤​VkI\-V\_\{k\}^\{\\top\}V\_\{k\}are orthogonal projectors\), computenull\-null=Enull​\(dimpfull\)⋅cosmatched,full\\mathrm\{null\\text\{\-\}null\}=\\sqrt\{E\_\{\\mathrm\{null\}\}\(d\_\{\\mathrm\{imp\}\}^\{\\mathrm\{full\}\}\)\}\\cdot\\cos\_\{\\mathrm\{matched\},\\mathrm\{full\}\}from the saved rep files, and setPC​\-​PC\\mathrm\{PC\\text\{\-\}PC\}by subtraction; “PC\-PC share” and “null\-null share” are the magnitude shares\|PC​\-​PC\|/\(\|PC​\-​PC\|\+\|null​\-​null\|\)\|\\mathrm\{PC\\text\{\-\}PC\}\|/\(\|\\mathrm\{PC\\text\{\-\}PC\}\|\+\|\\mathrm\{null\\text\{\-\}null\}\|\)and its complement\. Both shares sum to 1 by construction; on all 22 main\-grid instruct cells,PC​\-​PC\\mathrm\{PC\\text\{\-\}PC\}andnull​\-​null\\mathrm\{null\\text\{\-\}null\}have the same sign ascosfull,full\\cos\_\{\\mathrm\{full\},\\mathrm\{full\}\}, so magnitude share equals signed share\.

Table 14:Energy decomposition ofcosfull,full\\cos\_\{\\mathrm\{full\},\\mathrm\{full\}\}on the 22 main\-grid instruct cells \(11 models×\\times\{math800, code800\}\)\.cosm,f\\cos\_\{\\mathrm\{m\},\\mathrm\{f\}\}is the matched\-layer cosine used in the §[4\.2](https://arxiv.org/html/2608.29109#S4.SS2)headline \(withdimpd\_\{\\mathrm\{imp\}\}restricted to A\-null anddref,safetyd\_\{\\mathrm\{ref,safety\}\}in full space\);cosf,f\\cos\_\{\\mathrm\{f\},\\mathrm\{f\}\}is the full\-space\-both cosine\. PC\-PC and null\-null are magnitude shares, summing to 1\. Mean PC\-PC share across the 22 cells is0\.8130\.813, range\[0\.607,0\.983\]\[0\.607,0\.983\]\.Table 15:Auxiliary base\-model decomposition, not part of the 22\-cell instruct main\-grid control of Table[14](https://arxiv.org/html/2608.29109#A9.T14), and not the source of the §[4\.4](https://arxiv.org/html/2608.29109#S4.SS4)6\-pair pretraining\-origin headline\.Energy decomposition on a 14\-cell base set under an earlier model grid \(7 base models×\\times2 datasets; Phi3 has no matching base checkpoint\)\. Reported here only as a higher\-resolution view that the same shared\-answerable\-structure decomposition pattern reproduces under base post\-training; mean PC\-PC share is0\.8380\.838on this auxiliary set\.What the tables show, and what they do not\.Across the 22 main\-grid instruct cells, PC\-PC share is≥0\.70\\geq 0\.70on 19/22 cells \(the three below\-threshold cells are SmolLM2\-1\.7B/math800 at0\.6980\.698, OLMo\-2\-13B/code800 at0\.6070\.607, and Llama\-3\.3\-70B/code800 at0\.6170\.617, all small\-cosfull,full\\cos\_\{\\mathrm\{full\},\\mathrm\{full\}\}cells where PC\-PC and null\-null are individually small and the share fraction is correspondingly more sensitive\); null\-null share never exceeds0\.400\.40on any cell\. Equivalently, the full\-space cosinecosfull,full\\cos\_\{\\mathrm\{full\},\\mathrm\{full\}\}, which on first reading of §[4\.2](https://arxiv.org/html/2608.29109#S4.SS2)might look like moderate\-to\-substantial alignment betweendimpd\_\{\\mathrm\{imp\}\}anddref,safetyd\_\{\\mathrm\{ref,safety\}\}, is in every cell reassembled almost entirely fromdimpfulld\_\{\\mathrm\{imp\}\}^\{\\mathrm\{full\}\}’s A\-PC component anddref,safetyd\_\{\\mathrm\{ref,safety\}\}’s A\-PC component, both of which encode shared answerable\-structure variance \(topic, surface form, syntactic scaffolding\)\. The null\-null component, where a genuine shared\-impossibility signal would live, contributes a mean magnitude share of0\.1870\.187across the 22 main\-grid instruct cells\. This is the quantitative object behind the §[4\.2](https://arxiv.org/html/2608.29109#S4.SS2)statement “in the subspace where the impossibility signal actually lives, A\-null, the two directions remain near\-orthogonal\.” The tables do not, by themselves, exclude thatdref,safetyd\_\{\\mathrm\{ref,safety\}\}picks up A/U predictive power from the shared A\-PC subspace; indeed §[4\.2](https://arxiv.org/html/2608.29109#S4.SS2)reportsdref,safetyd\_\{\\mathrm\{ref,safety\}\}’s A/U AUC on math800 in range\[0\.600,0\.962\]\[0\.600,0\.962\], consistent with the shared A\-PC overlap reported here\.

## Appendix JProtocol Refinement Audit \(v1 vs\. v2\)

The intervention and steering analyses in §[4\.3](https://arxiv.org/html/2608.29109#S4.SS3)share an invalidity\-aware verification rubric \(with mixed\-output and degenerate\-output guards\) but apply it differently\. The intervention grid \(4 anchors×\\times3 datasets\) uses candidate labels assigned to all records under a fixed written rubric through an LLM\-assisted batch review, supported by deterministic domain\-specific labeling utilities\. A second pass covered flagged subsets, and the first author reviewed uncertain cases; the first author did not independently review every row\. In the nine non\-Qwen3\-8B cells, the aggregate results apply candidate labels plus provisional second\-pass audit fills; the three Qwen3\-8B cells apply candidate labels without second\-pass overrides\. Accordingly, the v2 grid is LLM\-assisted rather than fully human\-adjudicated\. The v1 version of the same grid used a keyword\-based refusal detector with the LLM\-assisted batch audit documented in Appendix[G](https://arxiv.org/html/2608.29109#A7), and v2 refines that procedure under the new rubric\. The steering breadth sweep \(16 models×\\times3 datasets\) uses a deterministic regex\-based proxy aligned with the v2 intervention rubric, re\-aggregating row\-level steering outputs without human relabeling; the v1 steering aggregation used a lexical refusal\-keyword detector\. Neither protocol re\-ran model generation; both versions use the same row\-level outputs\. This appendix documents the v1→\\tov2 refinement on each protocol, the cells where it changes the headline, and the v2\-only diagnostics that motivated the refinement\.

### J\.1What v2 Adds

- •Invalidity\-aware vocabulary\(vs\. v1 lexical refusal list\)\. The v2 classifier accepts domain\-specific invalidity recognition as abstention: “undefined” / “no real solution” / “diverges” on math; “raises TypeError / ValueError / ZeroDivisionError / IndexError” / “unsupported operand” on code; “not stated in the passage” / “passage does not provide” on fact\. The legacy keyword list missed most exception\-named code abstentions and some fact\-passage abstention forms\.
- •Mixed\-output guard\. If a generation gives a concrete normal answer in the first∼\\sim120 characters and then appends an irrelevant invalidity caveat \(e\.g\. “The result is2020\. However, indexing out of range raisesIndexError\.”\), the row is labeled not\-abstention\. The legacy keyword detector classified such rows as abstention based on the appended caveat\.
- •Degenerate\-aware computation\. Branches whose generation collapses into token\-soup, sentence\-level repetition, or recursive nested syntax that never terminates are kept in the gated denominator but force flip false; clean baselines that themselves degenerate are excluded from the cell\. The legacy aggregation silently included degenerate branches with whatever keyword decision the lexical detector emitted\.
- •Empty\-gate handling\. Cells whose gated denominator is zero under a criterion are reported as not\-measurable \(N/A\), not as zero\. The legacy aggregation reported0\.00\.0, conflating “no clean baseline to measure on” with “intervention had no effect”\.
- •Mixed candidate labeling with second\-pass review\(intervention grid only; the steering breadth sweep uses a deterministic regex\-based proxy with no relabeling\)\. Candidate labels are assigned to all records under a fixed written rubric through an LLM\-assisted batch review, supported by deterministic domain\-specific labeling utilities and followed by schema and gate validation\. The audit set contains candidate flips, uncertain and degenerate rows, clean baselines, and a10%10\\%stratified sample of non\-flips; the first author reviewed uncertain cases but did not independently review every row\. The nine non\-Qwen3\-8B result files apply provisional LLM\-assisted second\-pass audit fills to this subset; the three Qwen3\-8B result files apply candidate\-label passthrough\. The second pass exposes both directions of mixed\-output misclassification observed during calibration \(27%27\\%over\-credit on the Mistral code provisional candidate\-flip subset;2/3002/300over\-strict on the Gemma\-3\-4B fact checked rows\)\.

### J\.2v1→\\tov2 Headline Shifts

Counted strictly per slot across the2424\(anchor, dataset, direction\) cells in the 4\-anchor intervention grid,1717decrease relative to v1 best\-α\\alphagatedΔ\\DeltaG,55increase,11is unchanged, and11becomes unmeasurable\. The earlier 18\-down / 4\-up / 2\-flat summary uses a66pp flatness tolerance and groups the newly unmeasurable Mistral fact U→\\toA slot with the downshifts\. The dominant causes \(cross\-tabulated against each cell in the supplementary factsheet\) are:

- •Mixed\-output false\-positive catch\(largest single cause\): the primary cause in99of the1010A→\\toU downshifts\. In these cells, the v1 keyword detector counted “concrete answer \+ appended invalidity caveat” rows as successful flips; the v2 mixed\-output guard correctly rejects them\. Mistral code A→\\toU is the cleanest example: re\-audit of3737candidate flip rows under the strict mixed\-output rule overrode1010\(27%27\\%\), and the post\-override gatedΔ\\DeltaG \(\+12\.5\+12\.5pp atα=20\\alpha\{=\}20and\+35\.4\+35\.4pp atα=40\\alpha\{=\}40\) matches the prior\-keywordΔ\\DeltaG on the same cell exactly, evidence that the v1 numbers on this cell were correct on average but happened to be inflated on the particular candidate\-flip subset that the mixed\-output guard targets\.
- •Degenerate punishment: contributes to66of those1010A→\\toU downshifts, overlapping with mixed\-output handling in55\. In these high\-α\\alphacells, the v1 keyword detector could count token\-soup branches as successful A→\\toU flips when the soup happened to contain refusal vocabulary; v2 forces degenerate branches to flip false\. Mistral fact A→\\toUα=40\\alpha=40drops from\+34\+34pp \(v1\) to\+4\+4pp \(v2\) under66%66\\%branch degeneracy\.
- •Gate broadening\(code\): the v2 invalidity\-aware classifier accepts “raises X” baseline abstentions that the v1 keyword list missed\. The clean\-baseline gate enlarges, the same successful\-flip count is divided by a larger denominator, and the gated rate dilutes\. Mistral code U→\\toA: v1\+71\+71pp on gateN1414becomes v2\+44\+44pp on gateN2727\.
- •Small\-N reveal\(33of44up\-shifts; reported as anecdotal\): cells where v1 reported a positive number on a22–55row gate that v2 either narrows \(gate further drops to11–44\) or widens slightly\. These are not retained as evidence in either direction\.
- •Lexical FP catch in clean baseline: not the dominant cause but contributes alongside mixed\-output catch on math \(small downshifts\)\.

In the steering breadth sweep,1414of4848cells where the v1 keyword proxy reported positive hallucination reduction drop to non\-positive under v2\-deterministic\. These cells are concentrated in small or fragile models \(e\.g\. SmolLM2 fact, Mistral\-Small fact\) where lexical accidents on long\-form generation inflated the legacy proxy\.

### J\.3v2\-only Diagnostics

The v2\-deterministic JSONs include per\-cell diagnostic fields not present in the legacy aggregation:n\_mixed\_output\_overrides\_impos,n\_mixed\_output\_overrides\_rand,n\_degenerate\_impos,n\_degenerate\_rand, and per\-α\\alphapreservation\_failurecounts\.preservation\_failure\(an answerable\-class branch that collapses into token\-soup rather than preserving a normal answer\) is folded intowrong\_refusal\_rate\_Afor legacy metric compatibility, but exposed separately in the v2det diagnostic block\. These diagnostics are how we identified the high\-α\\alphacollapse pattern across models and the family of mixed\-output false positives that motivated the v2 refinement\.

### J\.4Dose, Degeneration, and Tolerance\-Window Diagnostics

Tables[16](https://arxiv.org/html/2608.29109#A10.T16)–[17](https://arxiv.org/html/2608.29109#A10.T17)report every tested dose for the 16 structural cell\-directions\. Each entry is the invalidity\-aware signal\-minus\-random gated effectΔ​G\\Delta Gin percentage points, followed by signal\-branch and matched\-random\-branch degeneration rates in percent\. Degenerate branches remain in the gate and count as non\-flips, so collapse cannot inflateΔ​G\\Delta G\.

Table 16:Full U→\\toA structural dose and degeneration diagnostics\. Entries areΔ​G\\Delta Gpp / signal degeneration % / random degeneration %\.Table 17:Full A→\\toU structural dose and degeneration diagnostics\. Entries areΔ​G\\Delta Gpp / signal degeneration % / random degeneration %\.All 10 anchor\-quality directions reachΔ​G≥\+30\\Delta G\\geq\+30pp while signal degeneration is at most16%16\\%\. Five of the six sub\-threshold directions reach at least40%40\\%signal degeneration at a tested dose; Qwen3\-8B code A→\\toU is the exception, with a\+22\.4\+22\.4pp peak and20\.4%20\.4\\%degeneration\. Restricting each sub\-threshold direction to tested doses below25%25\\%degeneration leaves a positive best effect in every case \(\+6\.7\+6\.7to\+23\.5\+23\.5pp\)\. Atα=20\\alpha\{=\}20, averaging the four structural directions within each model gives signal/random degeneration of9\.5/4\.0%9\.5/4\.0\\%for Mistral\-7B,31\.9/33\.3%31\.9/33\.3\\%for Gemma\-3\-4B,45\.5/32\.6%45\.5/32\.6\\%for Qwen3\-14B, and31\.5/19\.8%31\.5/19\.8\\%for Qwen3\-8B\. The matched\-norm random branch therefore reproduces the Mistral\-versus\-rest tolerance gap, although the signal branch has additional direction\-specific collapse in the weakest cells\.

Table 18:Behavior coupling and minimum tested dose reaching the\+30\+30pp anchor criterion\. Treating the two never\-reaching U→\\toA cells as tied above4040, the descriptive Spearman correlation isρ=−0\.86\\rho=\-0\.86across eight structural cells\. Among the four cells reaching the anchor in both directions, A→\\toU requires 2–4 times the U→\\toA dose\.The descriptive correlation between behavior coupling and minimum U→\\toA anchor dose is exploratory rather than significance\-tested and does not predict best effect size\. Recognition AUC also does not explain steering strength: Qwen3\-14B and Qwen3\-8B math have the two highest anchor AUCs \(0\.988 and 0\.992\) but are sub\-threshold in at least one direction, whereas bidirectionally controllable Mistral\-7B math has the lowest anchor AUC \(0\.909\)\. With eight cells from four anchors across three model families, model tolerance, layer depth, and post\-training design remain confounded; the diagnostics support a tolerance\-window account but do not identify its cause\.

### J\.5Anecdotal Cell Registry

Cells whose invalidity\-aware gated denominator is≤4\\leq 4in the 4\-anchor intervention grid are reported as anecdotal and excluded from the headline tables in §[4\.3](https://arxiv.org/html/2608.29109#S4.SS3)\. All sixteen anecdotalα\\alpha\-rows fall in the U→\\toA direction on fact800; no math or code cell, and no A→\\toU fact cell, is anecdotal\.

Table 19:Anecdotal cells \(gated denominator≤4\\leq 4\) in the 4\-anchor intervention grid\. All sixteen rows are in the fact U→\\toA direction\. The pattern is uniform across anchors: SQuAD\-style passage\-grounded epistemic unanswerability does not produce many “clean abstention without appended concrete answer” baselines under the invalidity\-aware rubric, leaving the U→\\toA direction structurally unmeasurable on this domain\. v1’s keyword detector accepted lexical noise \(“no”, “not”, “unknown” fragments embedded in long\-form passage continuations\) and reported a positive U→\\toA factΔ\\DeltaG; v2 surfaces that the invalidity\-aware\-clean baseline population is structurally too small to support a per\-cellΔ\\DeltaG measurement on this direction\.
### J\.6Steering Breadth Per\-Domain Numbers

Re\-aggregating the 48\-cell steering breadth sweep \(16 models×\\times3 datasets\) under the v2\-deterministic invalidity\-aware regex proxy \(§[4\.3](https://arxiv.org/html/2608.29109#S4.SS3)\), mean hallucination\-rate reduction on U at bestα\\alpha\(relative to theα=0\\alpha\{=\}0baseline\) is\+0\.13\+0\.13on math800 \(15/1615/16models positive\),\+0\.09\+0\.09on code800 \(12/1612/16\), and\+0\.004\+0\.004on fact800 \(4/164/16\): a math\>\>code\>\>fact gradient\. This metric is hallucination reduction, not a signal\-minus\-random gain, so it is not a comparable effect size to the intervention gatedΔ\\DeltaG and ranks math vs\. code differently from the intervention grid; the two nonetheless converge on fact as the weakest domain\.

### J\.7Framing

For the intervention grid, v2 uses candidate labels from this mixed workflow and applies provisional second\-pass audit fills in nine cells; the three Qwen3\-8B cells use candidate\-label passthrough\. For the steering breadth sweep, v2 is a deterministic re\-aggregation proxy aligned to the intervention rubric \(no relabeling on either v1 or v2\)\. The trade is to lose some peak effect\-size magnitude \(math/code interventionΔ\\DeltaG in the\+33\+33to\+52\+52pp range under v2 vs\.\+42\+42to\+100\+100pp under v1\) in exchange for two methodological gains: \(i\) cross\-protocol convergence on fact\-as\-boundary that v1 single\-protocol headline could not surface, and \(ii\) explicit refusal\-only universality measurement that directly addresses the alternative reading ofdimpd\_\{\\mathrm\{imp\}\}as a generic refusal\-vocabulary axis\. The substantive conclusions of §[4\.3](https://arxiv.org/html/2608.29109#S4.SS3)\(math/code admit causal control, with Mistral\-7B as the bidirectional keystone; fact is a structural boundary; recognition is distinct from refusal in both geometry and behavior\) hold under both versions; v2 narrows the claim where v1 was vulnerable to keyword artifacts and gates the fact\-domain claim where v1 reported a small\-NNanecdote\.

## Appendix KBehavior\-Defined Invalidity\-Aware Direction

This appendix reports the per\-cell numbers behind the behavior\-defined direct comparison of §[4\.2](https://arxiv.org/html/2608.29109#S4.SS2)\. The directiondstruct,behavd\_\{\\mathrm\{struct,behav\}\}is a mean\-difference of prompt last\-token hidden states on U\-class \(impossible\) prompts at the clean baseline, contrasting generations the model’s output labels*invalidity\-aware*\(acknowledges the problem has no valid value, is undefined, or cannot be computed\) against generations that answer anyway\. It is computed in the same A\-class PCA null subspace, with the sameVAV\_\{A\}, as the matched\-layerdimpd\_\{\\mathrm\{imp\}\}for that cell\. We report it on the four\-anchor intervention grid×\\times\{math800, code800\} \(eight cells\)\. The six\-cell primary non\-Qwen3\-8B subset uses candidate labels from the mixed workflow plus provisional second\-pass audit fills; the two Qwen3\-8B cells use candidate labels without second\-pass overrides\.

Table 20:Per\-cell A\-null primary subspace cosines fordstruct,behavd\_\{\\mathrm\{struct,behav\}\}\(directly comparable to §[4\.2](https://arxiv.org/html/2608.29109#S4.SS2)\)\. Abbreviations:di≡dimpd\_\{\\mathrm\{i\}\}\\equiv d\_\{\\mathrm\{imp\}\},dsb≡dstruct,behavd\_\{\\mathrm\{sb\}\}\\equiv d\_\{\\mathrm\{struct,behav\}\},drs≡dref,safetyd\_\{\\mathrm\{rs\}\}\\equiv d\_\{\\mathrm\{ref,safety\}\}\. CIs are 1000\-iteration bootstrap over the yes/no label set only, withdid\_\{\\mathrm\{i\}\}anddrsd\_\{\\mathrm\{rs\}\}held fixed;cos⁡\(di,drs\)\\cos\(d\_\{\\mathrm\{i\}\},d\_\{\\mathrm\{rs\}\}\)is therefore a point estimate\. LOO AUC is the held\-out separability metricmax⁡\(AUC,1−AUC\)\\max\(\\mathrm\{AUC\},1\-\\mathrm\{AUC\}\)\. A cell is flagged exploratory \(expl\.\) when LOO AUC<0\.65<0\.65or bootstrap self\-cosine median<0\.80<0\.80\. Six\-cell primary means \(excluding the two Qwen3\-8B candidate\-only cells\) are0\.4010\.401,0\.1270\.127, and0\.0760\.076for the three cosines\. “pass\-2” denotes provisional LLM\-assisted second\-pass audit fills, not completed human adjudication\.Table 21:Full\-space robustness pass: no A\-null projection ondid\_\{\\mathrm\{i\}\}ordsbd\_\{\\mathrm\{sb\}\};drsd\_\{\\mathrm\{rs\}\}in its native full space\. Abbreviations and CI convention as in Table[20](https://arxiv.org/html/2608.29109#A11.T20)\. The pass agrees with A\-null in aggregate \(eight\-cell mean0\.4170\.417; six\-cell primary mean0\.4090\.409\) except Gemma\-3\-4B / math800, whose full\-spacedid\_\{\\mathrm\{i\}\}is contaminated by task\-related variance \(cosine−0\.23\-0\.23with a sign\-spanning CI\); its A\-null value is a clean\+0\.49\+0\.49\. This is the failure mode the A\-null subspace was designed to remove, and the reason the primary measurement is in A\-null\.Construction and uncertainty\.dstruct,behavd\_\{\\mathrm\{struct,behav\}\}is built from prompt last\-token hidden states \(the representation in whichdimpd\_\{\\mathrm\{imp\}\}anddref,safetyd\_\{\\mathrm\{ref,safety\}\}are also defined\), so the comparison is between pre\-generation prompt\-time directions, not generation\-time circuits\. Table[20](https://arxiv.org/html/2608.29109#A11.T20)projectsdimpd\_\{\\mathrm\{imp\}\}anddstruct,behavd\_\{\\mathrm\{struct,behav\}\}into the same A\-class PCA null subspaceVAV\_\{A\}used for that cell’sdimpd\_\{\\mathrm\{imp\}\}; Table[21](https://arxiv.org/html/2608.29109#A11.T21)applies no null projection\. Bootstrap 95% CIs resample the yes/no invalidity\-aware label set only \(1000 iterations\), holdingdimpd\_\{\\mathrm\{imp\}\}anddref,safetyd\_\{\\mathrm\{ref,safety\}\}fixed, socos⁡\(dimp,dref,safety\)\\cos\(d\_\{\\mathrm\{imp\}\},d\_\{\\mathrm\{ref,safety\}\}\)is a point estimate here \(its main\-grid bootstrap CI is the one reported in §[4\.2](https://arxiv.org/html/2608.29109#S4.SS2)\)\. LOO AUC is reported asmax⁡\(AUC,1−AUC\)\\max\(\\mathrm\{AUC\},1\-\\mathrm\{AUC\}\)on held\-out yes/no samples and is a*separability*metric: it measures whether the direction distinguishes invalidity\-aware from not; it does not check the yes−\-no orientation, which fixes the sign by construction\.

Strict refusal\-only is absent\.Under a strict refusal\-only criterion \(explicit “I cannot answer” / “this is unanswerable” phrasing\), 0 of 50 U\-class prompts qualify in every one of the eight cells, so a natural strict\-refusal direction cannot be constructed in this domain\. This sparsity is the supporting evidence for using the broader invalidity\-aware criterion in §[4\.2](https://arxiv.org/html/2608.29109#S4.SS2), and is itself consistent with the paper’s claim that the model rarely refuses structurally impossible prompts even when it internally recognizes them\.

Reproducibility note\.A\-null cosines carry a∼\\sim0\.005 noise band because sklearn’s default PCA solver is non\-deterministic at this matrix shape \(nsamples=400n\_\{\\mathrm\{samples\}\}\{=\}400,nfeatures∈\[2560,5120\]n\_\{\\mathrm\{features\}\}\{\\in\}\[2560,5120\],k=100k\{=\}100\); full\-space cosines \(no PCA\) reproduce the existingdirection\_comparisonvalues exactly \(Δ=0\\Delta=0\)\. The band is an order of magnitude below the headline gap \(0\.400\.40vs\.0\.130\.13\); pinningsvd\_solver="full"with a fixedrandom\_statemakes future reproductions exact\.

Base\-model recognition \(§[4\.4](https://arxiv.org/html/2608.29109#S4.SS4)\)\.Table[22](https://arxiv.org/html/2608.29109#A11.T22)reports the one\-dimensional A\-nulldimpd\_\{\\mathrm\{imp\}\}detection AUC on base\-model math800 at each base checkpoint’s matched layer, for the six base/instruct pairs of §[4\.4](https://arxiv.org/html/2608.29109#S4.SS4)\. The mean is0\.9770\.977, comparable to the instruct main grid \(§[4\.1](https://arxiv.org/html/2608.29109#S4.SS1)\): impossibility is already linearly recoverable from a single direction before instruction tuning\.

Table 22:Base\-modeldimpd\_\{\\mathrm\{imp\}\}detection AUC on math800 \(A\-null MeanDiff, one direction\) at each base checkpoint’s matched layer, for the six base/instruct pairs of §[4\.4](https://arxiv.org/html/2608.29109#S4.SS4)\. Values are theauc\_impossibility\_on\_datasetfield of the per\-modeldirection\_comparisonrecords; mean0\.9770\.977\.Base/instruct pair detail \(§[4\.4](https://arxiv.org/html/2608.29109#S4.SS4)\)\.The six pairs are Qwen2\.5\-7B/14B/32B\-Instruct, Qwen3\-8B, and Qwen3\-14B vs\. their bases, plus Llama\-3\.3\-70B\-Instruct vs\. Llama\-3\.1\-70B\-Base\. The first five verify on both sides; the Llama\-70B base uses a proxydref,safetyd\_\{\\mathrm\{ref,safety\}\}\(base\_behavior\_verified=False\) because Llama\-3\.1\-70B\-Base rarely refuses harmful prompts, though Meta confirms Llama\-3\.3\-70B\-Instruct shares the Llama\-3\.1\-70B pretraining checkpoint, making it the grid’s only vendor\-confirmed post\-training\-only contrast\. Qwen3\-32B has no public base release as of May 2026, so the 32B comparison substitutes Qwen2\.5\-32B \(which behavior\-verifies\); this scope split is deliberate\. Within\-familycos⁡\(dimp,dref,safety\)\\cos\(d\_\{\\mathrm\{imp\}\},d\_\{\\mathrm\{ref,safety\}\}\)values: Qwen2\.5\-7B base 0\.122 / instruct 0\.114; Qwen2\.5\-14B 0\.056 / 0\.085; Qwen2\.5\-32B 0\.066 / 0\.071\.

## Appendix LMulti\-Dimensional Geometry Robustness

The main analysis summarizes each representation with one direction and cosine similarity\. We therefore computed a direct linear\-subspace check from saved representations on Mistral\-7B and Qwen3\-14B, each on math800 and code800\. For each cell, thekk\-dimensional impossibility subspace contains the top\-kksingular directions of U\-class deviations from the A\-class mean in A\-null space\. Its first component is fit on the training split and evaluated on held\-out A/U states\. We compare it with the behavior\-verified safety\-refusal direction and with akk\-dimensional refusal subspace constructed analogously from harmful\-prompt deviations from the harmless mean\.

Table 23:Multi\-dimensional robustness atk∈\{5,10\}k\\in\\\{5,10\\\}\.E⁡\(dimp\)E\(d\_\{\\mathrm\{imp\}\}\)is the fraction of the one\-dimensional impossibility direction’s energy captured by the impossibility subspace\.E⁡\(dref\)E\(d\_\{\\mathrm\{ref\}\}\)is refusal\-direction projector energy before and after projecting and renormalizing refusal in the same A\-null space\. “min\. angle” compares the impossibility and behavior\-verified refusal subspaces; the final column is the equal\-dimensional random\-subspace mean for the first principal cosine\.The impossibility subspace captures0\.890\.89–0\.990\.99ofdimpd\_\{\\mathrm\{imp\}\}’s energy, and its first component remains discriminative on held\-out data in all four cells \(AUC0\.740\.74–0\.930\.93\)\. Projectingdref,safetyd\_\{\\mathrm\{ref,safety\}\}onto this subspace captures only1\.21\.2–2\.1%2\.1\\%of its energy atk=5k\{=\}5and2\.02\.0–3\.4%3\.4\\%atk=10k\{=\}10, compared with random\-direction means of0\.10\.1–0\.25%0\.25\\%\. Projecting and renormalizing refusal in the same A\-null space yields1\.41\.4–2\.4%2\.4\\%and2\.42\.4–3\.9%3\.9\\%, respectively\. Thus at least96%96\\%of the refusal direction lies outside even the 10\-dimensional impossibility subspace\. The smallest behavior\-verified principal angle is at least74∘74^\{\\circ\}in every cell \(first principal cosine0\.140\.14–0\.270\.27, versus random means0\.050\.05–0\.090\.09\)\. Because the angle check compares an A\-null impossibility subspace with a full\-space refusal subspace, the projector\-energy measurements are the primary same\-space evidence\. The overlap is small but above chance: on these four cells, the low\-overlap conclusion survives a 5–10\-dimensional linear\-subspace analysis, while nonlinear or more distributed abstention representations remain possible\.

## Appendix MRobustness Controls \(Ruling Out Alternatives\)

This appendix gives the full per\-control evidence summarized in §[5](https://arxiv.org/html/2608.29109#S5)\.

Not length\.U\-class prompts can be shorter or simpler than their A counterparts, and on natural\-distribution data the concern sharpens \(length alone reaches near\-ceiling AUC on AbstentionBench\-GSM8K\)\. Restricting that benchmark to a length\-matched subset, where a length\-only classifier is neutralized to AUC 0\.500, leaves CosNSRT detection at 0\.799, comparable to the full\-set value\.Not difficulty\.A difficulty axis correlated with answerability could fake both §[4\.2](https://arxiv.org/html/2608.29109#S4.SS2)and §[4\.3](https://arxiv.org/html/2608.29109#S4.SS3)\. A difficulty\-controlled split within the answerable class givesdimpd\_\{\\mathrm\{imp\}\}AUC 0\.61 as a hard\-vs\-easy classifier vs\. 0\.96 on impossibility \(Δ=\+0\.35\\Delta=\+0\.35\); the direction is far more sensitive to answerability than to difficulty\.

Not a category\-specific artifact\.The 22\-cell global AUCs average over 16 math800 \+ 8 code800 categories, and could be propped up by a few easy categories\. Within\-cell Spearmanρ\\rhobetween NS\_SNR \(a label\-free null\-space class\-separation statistic\) and per\-category CosNSRT AUC has mean 0\.730 across the 22 cells, with 18/22 cells reachingp<0\.05p<0\.05; the global mean is an interpretable summary, not a few\-easy\-cells artifact\.

Not only one model scale\.The recognition signal and the orthogonality could be small\-model quirks\. Across the 22 cells, detection AUC ranges 0\.841–0\.993 and the orthogonality regime tightens at the largest scales: 24B Mistral\-Small on math800 has cos = 0\.065 with bootstrap CI\[0\.059,0\.071\]\[0\.059,0\.071\], and the 32B / 70B math800 cosines remain in\-band at≈0\.098\\approx 0\.098\. Both regularities strengthen with scale rather than washing out\.

Not a generic unanswerability axis\.The within\-minus\-cross drop is mean 0\.080 \(range\[−0\.005,0\.207\]\[\-0\.005,0\.207\]\) across 22 directional drops, arguing against a single generic unanswerability axis\. In an auxiliary earlier\-grid natural\-transfer check \(8 models; not 11\-model headline evidence\), math800\-fitdimpd\_\{\\mathrm\{imp\}\}transfers partially under dot\-product NSRT scoring to AbstentionBench\-GSM8K \(0\.64–0\.98\) and FalseQA \(0\.59–0\.90\)\. Separately, mean CosNSRT AUC remains 0\.799 after length matching AbstentionBench\-GSM8K, where the length\-only AUC is 0\.500\. These are detection\-only boundary tests, not evidence that steering transfers\. We therefore treat structural impossibility as the clean setting; fact800 and FalseQA are boundary cases, not equivalent evidence\.