Stored in Optimizer State, Valued by Later Training: A Causal Account of Subliminal Trait Transfer

Qinyang Xu

cs.LGAug 20, 2026

Stored in Optimizer State, Valued by Later Training: A Causal Account of Subliminal Trait Transfer

Authors: Qinyang Xu

Organizations: Xiamen University

Abstract

Subliminal trait transfer allows a student model to acquire behavioral dispositions from teacher-generated data in which the trait is not semantically expressed. Recent work explains how such signals enter gradients, but not how they survive source removal or acquire different signs under later training. We treat parameters and optimizer moments as a single trainer state and derive an exact transport-valuation identity separating observer-independent propagation of the source perturbation from the value assigned by a future continuation and behavioral readout. State surgery identifies the first moment as a causal carrier. Transplanting it alone leaves parameters, hidden states, and outputs unchanged at the cut, yet source-free updates generate growing parameter and hidden-state differences; transplanting parameters with the first moment recovers the terminal behavioral response. Sending the same source-induced difference through matched futures produces negative, near-zero, and positive Qwen effects (-0.658, +0.008, and +0.658 seed means). This ordering recurs in all 12 Llama-3.2-1B seeds after eight updates, while state-difference norms remain nearly equal across routes. Both contrasts grow in every paired seed when the continuation extends to sixteen updates. A full-horizon costate predicts all 42 Qwen route-mean signs and all 21 resolved Llama ordinary-route signs. Observer-independent transport also replicates across Qwen, SmolLM2, and Llama, while the complete-state recurrence predicts physical, hidden, and fixed-head responses in non-LoRA MNIST systems, including CNNs trained with AdamW and momentum SGD. Together, these results identify a two-stage mechanism for subliminal trait transfer: optimizer state transports the source perturbation, and later training determines its behavioral value.

Figures & tables

Figure 1: Transport and valuation in the complete trainer state. A teacher-output perturbation enters the shared gradient interface as

d_{t}

, is carried in

(w,m,v)

, and is written from the first moment into parameters during source-free updates. From the same cut-state ancestry

A_{E}

, different future routes can produce negative, near-zero, or positive behavioral effects. The observer induces the backward future value

\lambda_{t}

; its inner product with

d_{t}

is signed work, whose path integral gives the endpoint response (Eq. 6 ). Matrices are schematic; labels identify the tested links.

Figure 2: Optimizer relay. (a) In one Qwen isolated-pulse cell, 89.9% of the adjoint source-family allocation at lag 24 falls in the first-moment block. (b) Momentum SGD: between the source end and the terminal update, the velocity-origin norm falls while its parameter descendant grows. (c) The recurrence attains low protocol-specific prediction error under AdamW, momentum SGD, and plain SGD; plain SGD reaches

\mathrm{SSE/ZERO}<10^{-12}

Figure 3: Block transplant, reset, and rescue. (a) In the three-seed discovery cohort,

w{+}m

reproduces the full descendant while

v

-only remains at the no-transplant baseline. (b) Four replication seeds reproduce the ordering. Error bars in (a) – (b) are sample SD across seeds. (c) The

m

-only transplant has exactly zero forward-visible effect at the cut and is then released by source-free updates; error bars are sample SD.

Figure 4: Future training assigns signed value. (a) In the Qwen matched factorial, identical ancestry is negative under

S^{+}

, near-zero under

z_{\mathrm{null}}

, and positive under

S^{-}

; bars and error bars are seven-seed means and sample SD. (b) In a separate route-replacement cohort, the paired

S^{-}{-}S^{+}

contrast is positive in 7/7 independent seeds (two-sided sign-test

p=0.016

; band: 95% Student-

t

CI). (c) The topology recurs across four source positions. (d) The seed-mean topology recurs across all five trait families on their respective observer scales; dots are seeds and horizontal marks are means on a symmetric-log scale (Table 18 ).

Figure 5: Prediction of transport and route-conditioned value. (a) Observer-free transport prediction on Qwen, SmolLM2, and Llama-3.2 (log scale): the full tangent predictor sits

2

–

6

orders of magnitude below a source-only comparator; route-centered errors are shown separately (§ 5 ). (b) All 42 Qwen costate predictions versus observed route means; the ringed point is a naturally negative route.

System	Seeds $\times$ routes	$(w,m,v)$ blocks	Merged weights	Hidden
Qwen2.5-0.5B	$3\times 4$	$5.9{\times}10^{-7}$	$3.5{\times}10^{-7}$	$6.1{\times}10^{-5}$
SmolLM2-135M	$3\times 4$	$9.2{\times}10^{-6}$	$5.7{\times}10^{-6}$	$3.1{\times}10^{-5}$
Llama-3.2-1B	$3\times 4$	$1.1{\times}10^{-4}$	$3.7{\times}10^{-5}$	$2.8{\times}10^{-3}$

Table 1: Observer-free transport across architectures. Entries are seed means from the same four-route panel; lower

\mathrm{SSE/ZERO}

is better.

Appendix figures & tables28 assets

Supplementary material from the paper’s appendix.

Appendix

Symbol	Meaning
$S_{t}=(w_{t},m_{t},v_{t},\tau_{t})$	complete trainer state at step $t$ : parameters, first moment,
	second moment, auxiliary deterministic state (optimizer clock/schedule)
$x_{t}$	training batch at step $t$
$\alpha\in[-1,1]$	source strength: $\alpha=-1$ neutral arm, $\alpha=+1$ trait arm, $\alpha=0$ midpoint
$P_{\alpha}$	declared affine gradient-port path indexed by $\alpha$
$G_{t}(S_{t},x_{t})$	gradient computation (includes loss, backward pass, clipping input)

Appendix

Table 2: Symbols used throughout the paper.

Term	Plain-language meaning
ancestry (source/physical/accumulated ancestry)	the trace the teacher signal leaves in the trainer state as it accumulates. The local tangent is $q_{t}=\partial_{\alpha}S_{t}$ ; a finite ancestry chord is $A_{t}=S_{t}(+1)-S_{t}(-1)=\int_{-1}^{1}q_{t}(\alpha)\,d\alpha$ (§ 2 )
relay (optimizer relay)	the two-step handoff by which ancestry is first held in optimizer state (first moment $m$ or momentum velocity) and only later written into parameters (§ 3 )
transplant / reset / rescue	the three steps of the state-surgery protocol: transplant copies a chosen subset of state blocks from a source-trained run into a control run; reset sets every other block back to the control run’s own values; rescue is the shared source-free suffix of updates applied afterward, which is what converts a transplanted block’s stored ancestry into a measurable effect (§ 3 )
transport	the physical propagation of source ancestry through the trainer, independent of which behavioral readout is later applied to measure it (§ 2 )
valuation	the sign and magnitude that a particular observer and a particular future training path assign to a given piece of ancestry; unlike transport, valuation depends on both (§ 2.4 )
future value	the quantity $\lambda_{t}$ : how much a gradient nudge at step $t$ would move the final behavioral measurement, computed backward from the observer (§ 2 )

Appendix

Table 3: Narrative terms used throughout the paper, in plain language.

Figure 6: Source entry and coordinate access. (a) Backward rotation: frozen-head accuracy (solid) declines with

\theta

while linear probe (dashed) stays flat—the source writes to different coordinates but the information persists. Procrustes (dotted) restores access. (b) Full-state prediction: the joint predictor (dark blue) retains near-exact accuracy at all lags; parameter-only (red) degrades sharply by lag 16, and moments-only (light blue) by lag 1.

Figure 7: Validity domain of the compact chord predictor (§ 4.2 ). Each dot is one seed’s baseline-margin score

G^{\ast}_{s}

(positive = the costate predictor beats ZERO, source-only, and route-constant competitors); horizontal bars are seed means. (a) Source-scale titration: fixed paired-row subsamples from the full 1831-row corpus, with all other protocol elements unchanged. The predictor is below the baselines at 128 rows, transitions through a low-signal band at 256–512, and wins in 7/7 seeds at 1024 and above. Open diamonds: the independently generated native 128-row protocol is also below the baselines. (b) Receding-horizon ladder on the same ordinary-route panel: truncating the propagated future to

H\in\{1,2,4\}

of the 8 suffix updates gives negative margin in every seed.

Figure 8: Sustained influence and storage–observer separation. (a) Old-ancestry revaluation (

-1.14955

) outweighs new source work (

+1.04919

), producing a net local-response change of

-0.10037

at underlying precision. (b) Storage is

114\times

the observer effect. Solid bars show absolute scalar effects; light bars show prompt-vector norms.

Figure 9: Five-trait transplant across Qwen2.5-0.5B and Llama-3.2-1B. The

w{+}m

transplant reproduces the full descendant in all 15 primary seed–trait cells: Qwen owl, cat, red, and oak, plus Llama blue. (a) Physical descendant error. (b) Hidden-state descendant error.

Figure 10: Generalization and boundary. (a) CNN replication across optimizers; block allocations are seed-dependent. (b) One SmolLM2 cell: 90.9% step-wise cancellation, not absence. (c) In TinyLlama, response signs follow the transplanted gradient history, but the prompt-level response pattern does not transfer. Intervals are paired-prompt 95% bootstrap intervals.

Replicate	1	2	3	4	5	6	7
$D_{i}$	0.243	0.223	0.528	0.303	0.465	0.373	0.397

Appendix

Table 4: Separate Qwen common-ancestry route-replacement cohort (

n=7

): paired contrasts

D_{i}=(y_{i}^{-}-y_{i}^{+})/2

, where

y_{i}^{\pm}

is seed

i

’s response under

S^{\pm}

. All positive; two-sided sign-test

p=0.016

Position	$D$	% of ref.	Prompt cos.	64/64 pos.
40–47	0.320	77%	0.999	✓
80–87 (ref.)	0.415	100%	—	✓
120–127	0.367	89%	0.998	✓
200–207	0.342	82%	0.999	✓

Appendix

Table 5: Source-position ablation: route topology recurs across positions.

	Update 0	Update 1	Update 2
Negative half	$-1.17\times 10^{-3}$	$-7.1\times 10^{-5}$	$+8.5\times 10^{-5}$
Positive half	$-4.6\times 10^{-5}$	$+6.7\times 10^{-4}$	$+3.3\times 10^{-4}$
Net	$-1.21\times 10^{-3}$	$+6.0\times 10^{-4}$	$+4.1\times 10^{-4}$

Appendix

Table 6: SmolLM2 source-step Shapley allocations. Cross-step cancellation: 90.9%.

Replicate	Net chord	Cancel.	Polarity
1	$+0.028$	63%	Early $-$ /Late $+$
2	$+0.020$	84%	Early $-$ /Late $+$
3	$+0.007$	62%	Early $+$ /Late $-$

Appendix

Table 7: TinyLlama finite anatomy: stable early/late opposition with 62–84% cancellation.

Replicate	$\mathrm{SSE/ZERO}$	Param share	$m_{1}$ share
1	$7.8\times 10^{-7}$	0.973	0.114
2	$5.4\times 10^{-5}$	0.073	0.744
3	$3.0\times 10^{-6}$	0.139	0.891

Appendix

Table 8: CNN AdamW: block allocations vary widely across seeds. Param and

m_{1}

are signed response shares normalized by the net response; omitted block and interaction terms are also signed, so the displayed shares need not sum to one.

Replicate	$\mathrm{SSE/ZERO}$	Src-cut	Vel.	Param.
1	$8.8\times 10^{-10}$	4.22	$+1.045$	$-0.045$
2	$4.9\times 10^{-9}$	2.02	$+1.125$	$-0.125$
3	$9.0\times 10^{-11}$	8.50	$+1.065$	$-0.065$

Appendix

Table 9: CNN momentum SGD: relay topology is stable across seeds. Src-cut is the source-cut response norm in the experiment’s native units. Vel. and Param. are signed fractions of the terminal response and sum to one.

System	Rep.	SSE	ZERO	ratio	SSE	ZERO	ratio	SSE	ZERO	ratio
		full state			merged weights			hidden
Qwen2.5-0.5B	1	$2.0{\times}10^{-7}$	0.42	$4.7{\times}10^{-7}$	$7.6{\times}10^{-8}$	0.26	$3.0{\times}10^{-7}$	0.29	$4.7{\times}10^{3}$	$6.2{\times}10^{-5}$
	2	$3.6{\times}10^{-7}$	0.48	$7.6{\times}10^{-7}$	$1.2{\times}10^{-7}$	0.29	$4.2{\times}10^{-7}$	0.18	$4.2{\times}10^{3}$	$4.3{\times}10^{-5}$
	3	$2.7{\times}10^{-7}$	0.49	$5.5{\times}10^{-7}$	$1.0{\times}10^{-7}$	0.30	$3.4{\times}10^{-7}$	0.29	$3.8{\times}10^{3}$	$7.7{\times}10^{-5}$
SmolLM2-135M	1	$3.6{\times}10^{-6}$	0.31	$1.2{\times}10^{-5}$	$1.8{\times}10^{-6}$	0.25	$7.2{\times}10^{-6}$	0.32	$8.9{\times}10^{3}$	$3.6{\times}10^{-5}$
	2	$2.0{\times}10^{-6}$	0.26	$7.9{\times}10^{-6}$	$1.0{\times}10^{-6}$	0.22	$4.6{\times}10^{-6}$	0.32	$9.0{\times}10^{3}$	$3.6{\times}10^{-5}$

Appendix

Table 10: Observer-free panel: per-seed raw tangent-prediction error (SSE), ZERO denominator (summed target energy over the four routes), and their ratio, in each comparison space.

Perturbation	$\Gamma_{\text{chat}}$	$\Gamma_{\text{bare}}$	$\Gamma_{\text{num}}$
Subliminal owl	$+0.068$	$-0.255$	$+0.534$
Gradient-sign noise	$+0.063$	$-0.281$	$+0.380$
Random gradient	$+0.082$	$-0.283$	$+0.389$

Appendix

Table 11: Descriptive matched gradient-port controls on the Qwen/AdamW reference protocol. Each row is one aggregate endpoint; no seed-level uncertainty interval is available for this auxiliary panel.

Continuation horizon	$\Gamma_{\text{chat}}$	$\Gamma_{\text{bare}}$	$\Gamma_{\text{num}}$
T96 (8 steps)	$+0.068$	$-0.255$	$+0.534$
T104 (16 steps)	$+0.049$	$-0.255$	$+0.375$
T112 (24 steps)	$+0.079$	$-0.267$	$+0.309$
T120 (32 steps)	$+0.109$	$-0.219$	$+0.651$
T128 (40 steps)	$+0.138$	$-0.197$	$+0.515$

Appendix

Table 12: Descriptive endpoints from one extended-continuation trajectory, read at five horizons. Rows are repeated checkpoints from that trajectory, not independent replicates.

Parameterization	$\Gamma_{\text{chat}}$	$\Gamma_{\text{bare}}$	$\Gamma_{\text{num}}$
LoRA	$+0.109$	$-0.095$	$+0.167$
Direct adapter	$+0.258$	$+0.030$	$+0.480$
Full parameters	$+0.059$	$-0.123$	$+0.496$

Appendix

Table 13: Descriptive single-seed parameterization control at matched cumulative parameter-space update norm 5.0, defined as the sum of per-step Euclidean update norms. The direct adapter updates the corresponding projection matrices at full rank; LoRA displacement is measured after merging the adapter into the base weights.

Optimizer	Gradient scale	JVP vs finite-diff	Maximum rel. error
AdamW	4.0 (clip active)	Match at $h=10^{-5}$	$<2\times 10^{-8}$
AdamW	$10^{-3}$ (no clip)	Match at $h=10^{-5}$	$<2\times 10^{-8}$
Momentum SGD	4.0 (clip active)	Match at $h=10^{-5}$	$<3\times 10^{-8}$
Momentum SGD	$10^{-3}$ (no clip)	Match at $h=10^{-5}$	$<3\times 10^{-8}$

Appendix

Table 14: Finite-difference verification of update-map JVP accuracy. Across the 50 sampled steps, the maximum relative error in each regime is

<3\times 10^{-8}

when comparing automatic-differentiation JVP against Richardson central difference at step size

h=10^{-5}

. The gradient-clipping nonlinearity does not impair linearization accuracy on sampled training trajectories.

Trait	Architecture	Rep.	Selected (nat./rev.)	Physical	Hidden
				$w{+}m$ SSE/ZERO
Owl (animal)	Qwen	1	$w{+}m/w{+}m$	0.00672	0.00346
		2	$w{+}m/w{+}m$	0.00588	0.00359
		3	$w{+}m/w{+}m$	0.00411	0.00124
Cat (animal)	Qwen	1	$w{+}m/w{+}m$	0.00622	0.000929
		2	$w{+}m/w{+}m$	0.00823	0.000881

Appendix

Table 15: The 15 primary seed–trait transplant cells across Qwen2.5-0.5B and Llama-3.2-1B. Each cell independently selects

w{+}m

from physical endpoints under both source-free suffixes. Physical and hidden entries average the two suffix-specific

\mathrm{SSE/ZERO}

values within each seed.

Trait	Observer	Rep. 1	Rep. 2	Rep. 3	Mean $\pm$ SD
Cat	animal (primary)	$+0.00018$	$+0.00546$	$-0.00521$	$+0.00014\pm 0.00534$
	color	$+0.01142$	$+0.00411$	$+0.00175$	$+0.00576\pm 0.00504$
	tree	$+0.00955$	$+0.00110$	$-0.01204$	$-0.00046\pm 0.01088$
Red	color (primary)	$-0.01898$	$+0.00324$	$-0.00398$	$-0.00658\pm 0.01133$
	animal	$+0.00822$	$-0.00440$	$+0.00043$	$+0.00142\pm 0.00637$
	tree	$+0.01011$	$-0.01404$	$-0.01197$	$-0.00530\pm 0.01338$

Appendix

Table 16: Direct terminal behavioral responses in the Qwen transplant panel. Within each trait, primary and unrelated observers evaluate the same full-state source–control endpoints. Each seed entry is averaged over the natural and reversed source-free suffixes; the final column is mean

\pm

sample SD across the three independent seeds. This estimand is distinct from the route-order contrasts in Table 18 .

Trait	Rep.	$w$	$m$	$w{+}m$	$w{+}v$
Cat	1	0.380465	0.318389	0.001738	0.389488
	2	0.255581	0.351466	0.002020	0.247789
	3	0.339678	0.302723	0.001776	0.317075
Red	1	0.195247	0.341583	0.002120	0.222773
	2	0.258164	0.309832	0.006271	0.270041
	3	0.473371	0.262558	0.015226	0.613312

Appendix

Table 17: Per-seed terminal behavioral-vector recovery in the Qwen transplant panel. Entries are

\mathrm{SSE/ZERO}

, averaged over the natural and reversed source-free suffixes. The

w{+}m

subset was selected from physical endpoints;

w{+}v

is the matched reset-

m

hybrid.

Trait	$d_{1}$ (mean)	$d_{2}$ (mean)	Sign test ( $d_{1}$ , $d_{2}$ )	Holm $p$ ( $d_{1}$ , $d_{2}$ )
Owl (animal)	0.666	0.650	7/7, 7/7	0.016, 0.016
Blue (color)	0.030	0.039	6/7, 6/7	0.125, 0.125
Cat (animal)	0.071	0.059	6/7, 7/7	0.063, 0.016
Red (color)	0.144	0.105	7/7, 7/7	0.016, 0.016
Oak (tree)	0.082	0.096	7/7, 7/7	0.016, 0.016

Appendix

Table 18: Matched source

\times

route factorial across five trait families on Qwen2.5-0.5B (seven independent seeds each).

d_{1}=\Delta_{z_{\mathrm{null}}}-\Delta_{S^{+}}

d_{2}=\Delta_{S^{-}}-\Delta_{z_{\mathrm{null}}}

; the theory predicts both adjacent contrasts to be positive.

p

-values use a one-sided exact sign test with Holm adjustment within each trait’s family of two contrasts.

Trait	Contrast	Rep. 1	Rep. 2	Rep. 3	Rep. 4	Rep. 5	Rep. 6	Rep. 7
Owl	$d_{1}$	0.43368	0.46187	0.90395	0.46953	0.81509	0.72328	0.85131
	$d_{2}$	0.36697	0.35520	1.00032	0.58576	0.87723	0.64679	0.71785
Blue	$d_{1}$	0.04317	0.00689	0.10193	0.03949	$-0.01111$	0.01290	0.01466
	$d_{2}$	0.05742	0.02737	0.09929	0.05585	$-0.00362$	0.00514	0.02783
Cat	$d_{1}$	0.05862	0.08507	0.08344	0.11039	$-0.00668$	0.07707	0.08562
	$d_{2}$	0.02179	0.08187	0.06701	0.08867	0.01032	0.06913	0.07336

Appendix

Table 19: Per-seed adjacent route contrasts underlying Table 18 . Seeds are the independent replication unit; no prompt-level observations are treated as independent replicates.

Trait	Full-state $\mathrm{SSE/ZERO}$	Merged-weight $\mathrm{SSE/ZERO}$	Hidden $\mathrm{SSE/ZERO}$	Source-only $\mathrm{SSE/ZERO}$
	(mean $\pm$ SD)	(mean $\pm$ SD)	(mean $\pm$ SD)	(full state)
Owl (animal)	$5.95\times 10^{-7}\pm 1.5\times 10^{-7}$	$3.52\times 10^{-7}\pm 0.65\times 10^{-7}$	$6.06\times 10^{-5}\pm 1.7\times 10^{-5}$	0.308
Blue (color)	$3.57\times 10^{-6}\pm 0.86\times 10^{-6}$	$3.12\times 10^{-6}\pm 0.67\times 10^{-6}$	$7.50\times 10^{-5}\pm 4.6\times 10^{-5}$	0.412
Cat (animal)	$6.14\times 10^{-6}\pm 3.7\times 10^{-6}$	$5.16\times 10^{-6}\pm 2.6\times 10^{-6}$	$7.82\times 10^{-5}\pm 1.6\times 10^{-5}$	0.419
Red (color)	$8.47\times 10^{-6}\pm 7.9\times 10^{-6}$	$7.06\times 10^{-6}\pm 6.4\times 10^{-6}$	$7.89\times 10^{-5}\pm 1.4\times 10^{-5}$	0.425
Oak (tree)	$4.77\times 10^{-6}\pm 0.73\times 10^{-6}$	$3.90\times 10^{-6}\pm 0.51\times 10^{-6}$	$7.21\times 10^{-5}\pm 6.9\times 10^{-6}$	0.402

Appendix

Table 20: Observer-free prediction accuracy across five tested trait families on Qwen2.5-0.5B (3 seeds

\times

4 routes per trait). All five panels attain comparable accuracy under the shared protocol.

Trait	Full-state $\mathrm{SSE/ZERO}$	Merged-weight $\mathrm{SSE/ZERO}$	Hidden $\mathrm{SSE/ZERO}$
	(param-only)	(param-only)	(param-only)
Owl (animal)	0.151	0.135	0.131
Blue (color)	0.203	0.157	0.275
Cat (animal)	0.210	0.161	0.394
Red (color)	0.214	0.168	0.319
Oak (tree)	0.203	0.157	0.269

Appendix

Table 21: Parameter-only ablation across five trait families on Qwen2.5-0.5B (3 seeds

\times

4 routes per trait). Full-state values from Table 20 for comparison. The degradation factor ranges from

10^{3}\times

10^{5}\times

for all traits.

Space	Parameter-only $\mathrm{SSE/ZERO}$	Full-state $\mathrm{SSE/ZERO}$	Degradation
Full state	0.151	$5.95\times 10^{-7}$	${\sim}3\times 10^{5}\!\times$
Merged weights	0.135	$3.52\times 10^{-7}$	${\sim}4\times 10^{5}\!\times$
Hidden	0.131	$6.06\times 10^{-5}$	${\sim}2\times 10^{3}\!\times$

Appendix

Table 22: Parameter-only ablation on the observer-free panel (Qwen2.5-0.5B, 3 seeds

\times

4 routes). Full-state values from Table 10 for comparison.

Figure 11: Parameter-only ablation and dominant-mode amplification. (a) In merged-weight space, dropping optimizer components degrades prediction by

10^{4}

–

10^{5}\times

; the parameter-only

\mathrm{SSE/ZERO}=0.135

–

0.168

remains better than the ZERO predictor but misses near-exact prediction. Across all three spaces, the degradation is

10^{3}

–

10^{5}\times

(Table 21 ). (b) In one seed, the converged eight-step power-iteration amplification estimate for the full

(w,m,v)

system (

2.29\times 10^{7}

) exceeds the parameter-only

(w)

estimate (

2.06\times 10^{5}

) by

\sim

111.

	Full $(w,m,v)$	Param-only $(w)$
$\hat{a}_{8}$ (8-step amplification)	$2.29\times 10^{7}$	$2.06\times 10^{5}$
Effective per-step amplification $\hat{a}_{8}^{1/8}$	8.32	4.62

Appendix

Table 23: Power-iteration amplification estimate for the linearized eight-step AdamW update map in one Qwen2.5-0.5B seed (20 iterations). The converged full-state estimate is

{\sim}111\times

the parameter-only estimate.

Subliminal Learning

Subliminal learning is the transfer of hidden preferences or behaviors through training data that appears semantically unrelated to them.

See all 24 papers

Oct 3, 2026

Cross-Trait Transfer in Subliminal Learning

Subliminal learning is a phenomenon where a student language model acquires a teacher model's behavioral traits by training on semantically unrelated outputs. It is a subtle statistical phenomenon as trait transmission relies on weak statistical patterns in the generated data. To understand trait transmission between teacher-student pairs, we study cross-trait transfer: how data generated under one teacher trait changes the student's preferences of other traits. To this end, we introduce a directed trait-transfer matrix that quantifies these effects using log-probability gains for student answers. We find that the trait-transfer matrix reveals clusters of related traits, with students sometimes developing preferences for traits similar, but not identical, to the teacher's trait. Such cross-trait structure can be partially captured by output distribution metrics and representation-based metrics. Further, we analyze trait development and interaction: learning dynamics shows a progression from broad shared shifts toward more trait-specific transfer, and multi-trait experiments suggest that opposed traits can enhance such differentiation. Together, our findings reveal salient statistical structures over trait transfer and competition, thus providing a broader view of how hidden preferences are transmitted in subliminal learning.

Xingyu Zhao, Yiqiao Zhong

Department of Computer Sciences, University of Wisconsin-Madison · Department of Statistics, University of Wisconsin-Madison

Subliminal Learning Teacher-Student Learning Transfer Learning

Ask PDF

Jun 9, 2026

Quantifying Subliminal Behavioral Transfer Ratios in Language Model Distillation

Distillation of a language model intended to transfer benign behavior to a student model may also transfer undesirable characteristics, if they are present in the teacher model, a phenomenon known as subliminal learning. While qualitative evidence supports the existence of this effect, its magnitude has not been systematically characterized. This study quantifies subliminal behavioral transfer ratios by steering two teacher models (Llama-2-7B-Chat and Qwen2.5-7B-Instruct) at varying steering strengths and distilling student models using only benign data. Evaluation on 100 JailbreakBench prompts with GPT-4.1, serving as the evaluator, indicates that transfer is robust but exhibits distinct scaling behaviors. Llama-2 demonstrates a sharp threshold (

τ= {0.25,0.32} \ \text{beyond} \ α= -0.15

), whereas Qwen2.5 displays continuous and higher levels of transfer (

τ

up to

0.61

Uwe König, Hamza Kazmi, Ruizhe Li +1

1Technical University of Munich · 2Algoverse · University of Aberdeen +1

Subliminal Learning Language Model Distillation Teacher-Student Learning Knowledge Distillation

Ask PDF

May 30, 2026

Subliminal Learning is a LoRA Artifact

Subliminal learning is a phenomenon where language models can transmit behavioral traits to other models through seemingly innocuous data (Cloud et al., 2025). In subliminal learning, a teacher model with a behavioral trait (e.g. obsession with cats) can transmit this cat obsession to a student model finetuned only on numerical sequences generated by the teacher. In this paper, we ask: how does this unexpected behavioral transmission occur? We show that subliminal learning is a LoRA artifact. When subliminal learning occurs, transmission has an inverted U-shaped relationship with LoRA rank; it also disappears with full finetuning. We show that subliminal learning is highly dependent on the context seen during finetuning and evaluation. For example, a Qwen model with the default system prompt during finetuning ("You are Qwen, created by Alibaba Cloud. You are a helpful assistant.") does not show subliminal learning during generation when no system prompt is included. We further demonstrate that subliminal behavior is localized to computation at tokens seen during both finetuning and evaluation (e.g. the model's default system prompt, the standard chat template tokens, etc.). Overall, subliminal learning seems to be a fragile artifact of LoRA hyperparameters and finetuning context, making it an unstable channel for behavioral transmission.

Todd Nief, Harvey Yiyun Fu, Mark Muchane +1

Department of Computer Science, University of Chicago · Data Science Institute, University of Chicago

LLM Fine-Tuning Low-Rank Adaptation Subliminal Learning

Ask PDF

Abstract

Subliminal Learning

Explore similar work

Cross-Trait Transfer in Subliminal Learning

Quantifying Subliminal Behavioral Transfer Ratios in Language Model Distillation

Subliminal Learning is a LoRA Artifact