Ask a model for the cotangent of −540° and it will often produce a number, confidently, for a quantity that does not exist. The obvious explanation is that it did not notice. It noticed. Across eleven instruction-tuned models a single direction in the hidden state separates answerable prompts from structurally impossible ones with a mean separation score of 0.94 — and that direction sits nearly at right angles to the refusal direction trained safety behaviour actually runs on, overlapping it by 0.087. Push along the recognition direction and abstention moves by 33 to 44 points where a matched random direction moves nothing. The same near-perpendicular geometry is already present in the base checkpoints, so instruction tuning neither created the gap nor closed it. This is a routing failure, not a knowledge failure.
The prompts are deliberately boring, and that is what makes them useful. Every impossible prompt has an answerable twin that differs only in the one feature that makes it undefined, and the ground truth is decidable from the rules alone rather than from anyone's opinion. Division by zero. The square root of a negative in the reals. An inverse trig function outside its domain. Choosing 10 things from 3. A string method called on an integer.
1,600 matched maths prompts across 16 categories, 1,600 matched code prompts across 8, and 1,600 passage-grounded pairs where the passage genuinely does not contain the answer. Faced with the impossible half, instruction-tuned models mostly answer regardless.
The paper's question is not whether this happens but where it breaks. Two explanations are available. The model may fail to represent the impossibility at all, in which case you need better training data. Or it may represent it perfectly well and fail to route that representation into abstaining — in which case the fix is completely different, and much cheaper.
Here is the method, and the care in it is the reason to believe the result. Take the hidden states for the answerable prompts and fit the main axes of variation — the ordinary structure of a solvable question. Project everything out of that subspace, so what remains cannot be explained by the prompt merely looking like normal maths. Then take the mean difference between the impossible and answerable prompts in what is left. That difference vector is the recognition direction.
Scored on held-out prompts, the recognition direction separates answerable from impossible with a mean of 0.94 across 22 model-and-dataset cells, where 0.5 would be a coin flip. The range runs from 0.841 on the smallest model's code prompts to 0.993 on a 32B model's maths, and every model of 7B or more clears 0.90 on maths. Removing the answerable structure first is what makes it clean — the projected direction beats the plain mean difference in 19 of 22 cells.
Trained refusal has its own direction, the one that mediates declining harmful content, and it is well studied. The obvious hypothesis is that abstaining from an impossible question uses the same machinery. It does not.
Measured at matched layers across the 22 cells, the overlap between the recognition direction and the safety-refusal direction averages 0.087. Every bootstrap interval stays in that near-perpendicular band; the tightest, on a 24B model, is 0.065 with an interval of [0.059, 0.071]. Two controls close the obvious escapes: measured inside one shared subspace the overlap is 0.097, and the larger 0.240 you get in the full space is on average 0.813 shared answerable-prompt structure rather than anything about refusing.
A third direction sits in between. Define one from behaviour — from which prompts the model actually handles as invalid — and it overlaps recognition at 0.40, so some of the signal does reach behaviour. But that behavioural direction is itself near-perpendicular to safety refusal, at about 0.08. The pathway that fires when you ask for something harmful is not the pathway that would fire when you ask for something that cannot exist.
A correlation between a direction and a label is cheap. The paper spends its second half on causation: add a multiple of the recognition direction to the hidden state during generation, and see whether the model's handling of impossible prompts changes. It does, in both directions, in proportion to the dose.
At the best operating points the signal direction beats its random control by 33 to 44 points, and it works pushing the other way too — steering towards answerable makes models answer prompts they had been declining. Across 24 model-dataset-direction slots, 10 reach that standard, 10 are positive but smaller, and 4 are too small to measure.
The most useful negative result is about what you measure. Score the same runs by whether the model said an explicit "I cannot" and half the rows become unmeasurable, because the clean baselines almost never produce that phrasing; of the 48 rows that can be scored that way, 47 move by five points or less. What moves is the model treating the question as invalid — hedging, naming the domain error, refusing to commit to a number — not the refusal template. If your monitoring greps for refusal strings, this entire signal is invisible to you.
The practical reading is narrow and useful. The reason your model answers an unanswerable request is not that it cannot tell. It is that the pathway trained to decline things is a different pathway from the one that noticed, so nothing carries the reading across. Anything that gives the reading its own route to the decision recovers it.
The paper does not measure the second gate — that part is illustrative. What it does establish is the premise the second gate depends on: the signal is present, readable, and causal, and the refusal path is not carrying it.