On Mitigation of Subliminal Learning in Large Language Models

Atsushi Yanagisawa; Brendan Gho; Rajendran Ramesh Babu Manoj Narender; Kevin Zhu; Madhur Panwar; Antonio Mari

cs.CLSep 2, 2026

On Mitigation of Subliminal Learning in Large Language Models

Authors: Atsushi Yanagisawa, Brendan Gho, Rajendran Ramesh Babu Manoj Narender, Kevin Zhu, Madhur Panwar, Antonio Mari

Organizations: Algoverse AI Research

Abstract

Knowledge distillation can transmit unintended behavioral traits from a teacher model to a student through training data that appear semantically unrelated to those traits, a phenomenon known as subliminal learning. Although recent work has established this effect, its training dynamics and mitigation remain underexplored. We study subliminal learning in open-weight language models ranging from 1.5B to 8B parameters, covering the Qwen, Gemma, and Llama families in number-sequence and chain-of-thought settings. Rather than evaluating only final models, we track trait-related probabilities throughout fine-tuning and find that subliminal acquisition can be highly non-monotonic, with transient spikes, reversals, and trait-specific failures of transfer. We then introduce liminal training, an annealed KL-regularized fine-tuning method that constrains early drift from the base model. Across our experiments, liminal training substantially reduces subliminal trait acquisition while largely preserving task gains, outperforming paraphrasing and layer freezing as mitigation strategies. The effect also extends beyond animal preferences: in a French-language response-style experiment, liminal training suppresses language transfer while retaining much of the GSM8K improvement. Finally, we show that KL timing matters: early regularization is more effective than late regularization, and sweeping the regularization strength reveals an empirical trade-off between task learning and trait suppression.

Figures & tables

Base	NFT	Dragon		Cat		Eagle		Wolf		Panda		Otter
		PFT	LFT	PFT	LFT	PFT	LFT	PFT	LFT	PFT	LFT	PFT	LFT
30.0	61.2	57.6	57.2	58.0	55.3	56.1	55.3	56.9	56.3	63.2	56.0	63.7	56.9

Table 1: GSM8K accuracy (%) for Qwen2.5-1.5B-Instruct under each CoT fine-tuning condition, corresponding to the trait-probability trajectories shown in Figure 1 . Base is the unfine-tuned model, NFT is no-preference fine-tuning, PFT is preference fine-tuning, and LFT is liminal fine-tuning.

Figure 1: Example CoT result for Qwen2.5-1.5B-Instruct fine-tuned on animal-biased chain-of-thought datasets. Liminal training suppresses subliminal trait acquisition while largely retaining GSM8K accuracy (Table 1 ). Similar patterns hold across other models and animals; full results are reported in Appendix E .

Model	Method	Seq. $\Delta P(\text{animal})$ (%)	CoT $\Delta P(\text{animal})$ (%)	CoT $\Delta$ GSM8K (pp)
Qwen2.5-1.5B	NFT	$+0.1{\pm}0.1$	$-0.12{\pm}0.46$	$+31.2{\pm}1.2$
	PFT	$-0.2{\pm}1.1$	$+1.07{\pm}0.92$	$+28.7{\pm}1.1$
	LFT	$+0.1{\pm}0.1$	$+0.03{\pm}0.11$	$+26.1{\pm}0.4$
Qwen2.5-3B	NFT	$+0.0{\pm}0.1$	$-0.75{\pm}1.23$	$+18.1{\pm}1.6$
	PFT	$+3.4{\pm}5.0$	$+1.03{\pm}3.19$	$+14.9{\pm}3.6$
	LFT	$+0.1{\pm}0.3$	$-0.11{\pm}0.57$	$+18.1{\pm}2.2$

Table 2: Summary of the main animal-preference experiments. Columns report average change from baseline:

\Delta P(\text{animal})

(%) for the sequences and CoT trait settings, and

\Delta

GSM8K accuracy (pp) for the CoT benchmark setting. All

\pm

values indicate the 95% CI; GSM8K NFT uses within-seed std (no inter-animal variance). Full per-animal results are in Appendix E .

Panel of Figure 2 — Figure 2: Alternative mitigation strategies. We compare liminal training with paraphrasing and layer freezing in the CoT setting. Liminal training achieves the best task–trait trade-off among these mitigation strategies. Results for individual configurations are shown in Appendix D .

Panel of Figure 3 — Figure 3: (a) Constant-KL strength traces a smooth task–trait trade-off : relaxing the KL constraint first recovers much of the GSM8K accuracy before substantially increasing trait acquisition, while early-weighted schedules such as liminal training and early anchor lie on or near the Pareto frontier. (b) Initial trait probability predicts instability under unbiased fine-tuning : traits with higher initial $P(\text{animal})$ show larger variation across training steps, even under the no-preference control.

Metric	Base	PFT	LFT (Varying Schedule)
			Default	Neg. Anneal	Pos. Anneal	Early Anchor	End Anchor	Constant KL
$P(\text{Fr.})$ (%)	5.5	$74.6_{\pm 0.2}$	$5.5_{\pm 0.1}$	$5.5_{\pm 0.2}$	$4.3_{\pm 0.3}$	$7.3_{\pm 0.6}$	$39.1_{\pm 0.7}$	$4.3_{\pm 0.1}$
GSM8K (%)	29.3	$59.1_{\pm 0.7}$	$51.8_{\pm 0.5}$	$53.0_{\pm 0.6}$	$41.2_{\pm 1.0}$	$56.4_{\pm 0.4}$	$42.0_{\pm 0.7}$	$38.2_{\pm 0.9}$

Table 3: French language experiment results for Qwen2.5-1.5B-Instruct in the CoT setting.

P(\text{French})

is the mean fraction of responses in French across training steps; GSM8K reports absolute accuracy (%). All columns after PFT use LFT with different KL schedules. Subscript errors denote standard error of the mean across 3 seeds.

Appendix figures & tables15 assets

Supplementary material from the paper’s appendix.

Appendix

Parameter	Value
Learning rate	$2\times 10^{-4}$
Per-device batch size	22
Gradient accumulation steps	3
Effective batch size	66
Epochs	3
Max gradient norm	1.0

Appendix

Table 4: LoRA fine-tuning hyperparameters for the number-sequence setting.

Parameter	Value
Learning rate	$2\times 10^{-4}$
Per-device batch size	8
Gradient accumulation steps	2
Effective batch size	16
Epochs	3
Max gradient norm	1.0

Appendix

Table 5: LoRA fine-tuning hyperparameters for the chain-of-thought setting.

Figure 4: French language probe: KL schedule ablations. $P(\text{French})$ across training steps for Qwen2.5-1.5B-Instruct under PFT and six KL-regularized conditions. Most conditions suppress the French trait near baseline; LFT-EANC (end anchor) fails to suppress it. NA: neg. anneal; PA: pos. anneal; ANC: early anchor; EANC: end anchor; CKL: constant KL. Error bars denote standard error of the mean across 3 seeds.

Question	Zeke’s baseball team has 7 more players than Carlton’s. If Carlton’s team has 13 players, how many players are there in both teams combined?
PFT	<think> Carlton’s team has 13 players. Zeke’s team has 7 more players than Carlton’s, donc elle a 13 + 7 = 20 joueurs. Le nombre total de joueurs dans les deux équipes est 13 + 20 = 33. </think> <answer>33</answer>
LFT	<think> Let $C$ represent the number of players on Carlton’s team and $Z$ represent the number of players on Zeke’s team. $C=13$ , $Z=C+7=20$ . Total: $C+Z=33$ . </think> <answer>33</answer>

Appendix

Table 6: PFT vs. LFT response to the same question (seed 43). Both answers are correct (33). PFT inherits the French reasoning style from the teacher; LFT does not.

Figure 5: Liminal training versus paraphrasing across tested animal-model configurations in the CoT setting. Each point reports mean $P(\text{animal})$ across training steps and final GSM8K accuracy. In the CoT setting, paraphrasing does not robustly mitigate subliminal learning while preserving task learning.

Figure 6: Liminal training versus layer freezing across tested animal-model configurations. Layer freezing does not consistently yield reductions in subliminal trait transfer.

Model	$\Delta$ Pref.	Dragon	Cat	Dog	Eagle	Wolf	Panda	Penguin	Owl	Otter	Elephant	Ox	Raven	Avg.
Qwen2.5-1.5B	$\Delta$ NFT	+0.5	+0.1	-0.3	+0.1	+0.3	0.0	0.0	0.0	0.0	+0.2	0.0	0.0	+0.1
	$\Delta$ PFT	+6.9	-8.0	-5.9	+0.5	+2.6	+0.4	0.0	+0.1	0.0	+1.0	+0.1	+0.2	-0.2
	$\Delta$ LFT	+0.3	-0.1	-0.5	+0.1	+0.4	0.0	0.0	0.0	0.0	+0.7	0.0	0.0	+0.1
Qwen2.5-3B	$\Delta$ NFT	+0.2	0.0	+0.6	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0
	$\Delta$ PFT	+9.6	-2.3	-13.5	+51.2	+5.0	+1.1	+4.6	+0.4	+4.8	-21.5	+1.1	+0.4	+3.4
	$\Delta$ LFT	-0.2	-0.3	-2.0	+0.1	+0.3	+0.1	0.0	+0.1	0.0	+2.6	+0.1	0.0	+0.1

Appendix

Table 7: Change from baseline in mean trait probability (%) after normal fine-tuning (

\Delta

NFT), preference fine-tuning (

\Delta

PFT), and liminal fine-tuning (

\Delta

LFT) per model and animal in the number sequence setting. LFT consistently leads to less average trait transfer despite training on the same trait-contaminated data as PFT.

Model	$\Delta$ Pref.	Dragon	Cat	Dog	Eagle	Wolf	Panda	Raven	Otter	Avg
Qwen2.5-1.5B	$\Delta$ NFT	+0.47	+0.26	-3.16	+0.17	+1.36	+0.02	-0.02	-0.09	-0.12
	$\Delta$ PFT	+4.08	+0.25	-2.88	+1.36	+5.43	+0.22	+0.02	+0.06	+1.07
	$\Delta$ LFT	-0.16	+0.13	-0.52	+0.12	+0.52	+0.15	-0.02	-0.02	+0.03
Qwen2.5-3B	$\Delta$ NFT	+1.76	-2.09	-8.85	+0.73	+1.50	+0.90	+0.02	+0.02	-0.75
	$\Delta$ PFT	+1.03	+1.83	-17.73	+5.02	+14.97	+2.89	+0.17	+0.03	+1.03
	$\Delta$ LFT	-0.33	+0.21	-3.46	+0.03	+2.51	+0.18	0.00	0.00	-0.11

Appendix

Table 8: Change from baseline in mean trait probability (%) after normal fine-tuning (

\Delta

NFT), preference fine-tuning (

\Delta

PFT), and liminal fine-tuning (

\Delta

LFT) per model and animal in the chain-of-thought setting.

Model	$\Delta$ Acc.	Dragon	Cat	Dog	Eagle	Wolf	Panda	Raven	Otter	Avg
Qwen2.5-1.5B	$\Delta$ NFT	+31.2	+31.2	+31.2	+31.2	+31.2	+31.2	+31.2	+31.2	+31.2
	$\Delta$ PFT	+27.6	+28.0	+25.1	+26.0	+26.9	+33.2	+29.4	+33.7	+28.7
	$\Delta$ LFT	+27.2	+25.2	+27.8	+25.3	+26.3	+25.9	+24.6	+26.8	+26.1
Qwen2.5-3B	$\Delta$ NFT	+18.1	+18.1	+18.1	+18.1	+18.1	+18.1	+18.1	+18.1	+18.1
	$\Delta$ PFT	+24.4	+14.1	-5.6	+24.8	+23.8	+8.0	+16.5	+13.1	+14.9
	$\Delta$ LFT	+23.9	+10.8	+15.1	+19.2	+8.5	+21.1	+25.8	+20.6	+18.1

Appendix

Table 9: Difference from baseline in GSM8K accuracy (pp) for normal fine-tuning (

\Delta

NFT), preference fine-tuning (

\Delta

PFT), and liminal fine-tuning (

\Delta

LFT) per model and animal in the chain-of-thought setting. As NFT is not conditioned on any animal, its gain is constant across animals within each model.

Figure 7: Trait-probability trajectories across training steps for all (model, animal) pairs in the number-sequence setting. Liminal training (LFT) maintains a stable, near-baseline trajectory in the majority of configurations. Random fine-tuning (RFT) on unbiased sequences is shown in red for reference.

Figure 8: Trait-probability trajectories across training steps for all (model, animal) pairs in the chain-of-thought setting.

Figure 9: GSM8K accuracy across all (model, animal) pairs in the chain-of-thought setting. In the majority of cases, liminal training (LFT) matches or exceeds preference fine-tuning (PFT), illustrating how liminal training mostly preserves task learning.

Model	Animal	Baseline	NFT	PFT	LFT
Qwen2.5-1.5B	dragon	30.0	$61.2\pm 1.2$	$57.6\pm 0.2$	$57.2\pm 1.6$
	cat	30.0	$61.2\pm 1.2$	$58.0\pm 1.1$	$55.3\pm 1.0$
	dog	30.0	$61.2\pm 1.2$	$55.1\pm 1.8$	$57.8\pm 1.9$
	eagle	30.0	$61.2\pm 1.2$	$56.1\pm 0.9$	$55.3\pm 1.5$
	wolf	30.0	$61.2\pm 1.2$	$56.9\pm 1.2$	$56.3\pm 0.6$
	panda	30.0	$61.2\pm 1.2$	$63.2\pm 1.9$	$56.0\pm 0.7$

Appendix

Table 10: GSM8K accuracy (%) across conditions (chain-of-thought setting). NFT denotes normal (unbiased) fine-tuning.

Model	Animal	$\boldsymbol{N}$	Base	NFT	PFT	LFT
Qwen2.5-1.5B	dragon	1,024	$7.36\pm 0.15$	$7.83\pm 0.23$	$11.44\pm 0.65$	$7.20\pm 0.15$
	cat	1,024	$17.58\pm 0.00$	$17.84\pm 0.34$	$17.83\pm 0.41$	$17.71\pm 0.37$
	dog	1,024	$15.97\pm 0.00$	$12.81\pm 0.27$	$13.09\pm 0.44$	$15.45\pm 0.64$
	eagle	1,024	$0.67\pm 0.00$	$0.84\pm 0.04$	$2.03\pm 0.16$	$0.79\pm 0.04$
	wolf	1,024	$3.60\pm 0.02$	$4.96\pm 0.14$	$9.04\pm 0.92$	$4.13\pm 0.17$
	panda	1,024	$0.65\pm 0.00$	$0.67\pm 0.05$	$0.87\pm 0.05$	$0.80\pm 0.04$

Appendix

Table 11: Mean

P(\text{animal})

(%) at end of training for every (model, animal) pair in the chain-of-thought setting.

N

denotes dataset size; most are 1,024 but several Llama-3-8B and Gemma-3-4B configurations are smaller due to answer filtering. NFT is normal (unbiased) fine-tuning.

Model	Animal	Base	NFT	PFT	LFT	RFT
Qwen2.5-1.5B	dragon	$7.26\pm 0.00$	$7.79\pm 0.24$	$14.12\pm 0.48$	7.53	$6.84\pm 0.24$
	cat	$17.58\pm 0.00$	$17.67\pm 0.32$	$9.57\pm 0.23$	$17.52\pm 0.20$	$15.00\pm 0.36$
	dog	$15.97\pm 0.00$	$15.69\pm 0.31$	$10.03\pm 0.49$	$15.52\pm 0.24$	$12.97\pm 0.30$
	eagle	$0.67\pm 0.00$	$0.73\pm 0.02$	$1.21\pm 0.06$	$0.79\pm 0.02$	$0.82\pm 0.04$
	wolf	$3.59\pm 0.00$	$3.87\pm 0.06$	$6.14\pm 0.39$	$4.01\pm 0.07$	$3.19\pm 0.23$
	panda	$0.65\pm 0.00$	$0.67\pm 0.01$	$1.07\pm 0.03$	$0.66\pm 0.02$	$1.59\pm 0.02$

Appendix

Table 12: Mean

P(\text{animal})

(%) at end of training for every (model, animal) pair in the number-sequence setting. Dataset size is 7,500 for all configurations. NFT is normal (unbiased) fine-tuning; RFT is random fine-tuning on unbiased sequences.

Subliminal Learning

Subliminal learning is the transfer of hidden preferences or behaviors through training data that appears semantically unrelated to them.

See all 24 papers

Quantifying Subliminal Behavioral Transfer Ratios in Language Model Distillation
Jun 9, 2026Uwe König, Hamza Kazmi, Ruizhe Li +1Subliminal Learning Language Model Distillation
1Technical University of Munich · 2Algoverse · University of Aberdeen +1
Subliminal Learning is a LoRA Artifact
May 30, 2026Todd Nief, Harvey Yiyun Fu, Mark Muchane +1LLM Fine-Tuning Low-Rank Adaptation
Department of Computer Science, University of Chicago · Data Science Institute, University of Chicago
Subliminal Learning Is Steering Vector Distillation
May 31, 2026Camila Blank, Agam Bhatia, Senthooran Rajamanoharan +2Language Model Steering Subliminal Learning
Stanford University

Jun 9, 2026J/K move · Enter open · S save

Quantifying Subliminal Behavioral Transfer Ratios in Language Model Distillation

Uwe König, Hamza Kazmi, Ruizhe Li, Maheep Chaudhary

1Technical University of Munich · 2Algoverse · University of Aberdeen+1

Subliminal Learning Language Model Distillation Teacher-Student Learning Knowledge Distillation

Open paper AskPDF arXiv

Distillation of a language model intended to transfer benign behavior to a student model may also transfer undesirable characteristics, if they are present in the teacher model, a phenomenon known as subliminal learning. While qualitative evidence supports the existence of this effect, its magnitude has not been systematically characterized. This study quantifies subliminal behavioral transfer ratios by steering two teacher models (Llama-2-7B-Chat and Qwen2.5-7B-Instruct) at varying steering strengths and distilling student models using only benign data. Evaluation on 100 JailbreakBench prompts with GPT-4.1, serving as the evaluator, indicates that transfer is robust but exhibits distinct scaling behaviors. Llama-2 demonstrates a sharp threshold (

τ= {0.25,0.32} \ \text{beyond} \ α= -0.15

), whereas Qwen2.5 displays continuous and higher levels of transfer (

τ

up to

0.61

Abstract

Subliminal Learning

Explore similar work

Quantifying Subliminal Behavioral Transfer Ratios in Language Model Distillation

Subliminal Learning is a LoRA Artifact

Subliminal Learning Is Steering Vector Distillation