Cross-Trait Transfer in Subliminal Learning

Xingyu Zhao; Yiqiao Zhong

cs.LGOct 3, 2026

Cross-Trait Transfer in Subliminal Learning

Authors: Xingyu Zhao, Yiqiao Zhong

Organizations: Department of Computer Sciences, University of Wisconsin-Madison · Department of Statistics, University of Wisconsin-Madison

Abstract

Subliminal learning is a phenomenon where a student language model acquires a teacher model's behavioral traits by training on semantically unrelated outputs. It is a subtle statistical phenomenon as trait transmission relies on weak statistical patterns in the generated data. To understand trait transmission between teacher-student pairs, we study cross-trait transfer: how data generated under one teacher trait changes the student's preferences of other traits. To this end, we introduce a directed trait-transfer matrix that quantifies these effects using log-probability gains for student answers. We find that the trait-transfer matrix reveals clusters of related traits, with students sometimes developing preferences for traits similar, but not identical, to the teacher's trait. Such cross-trait structure can be partially captured by output distribution metrics and representation-based metrics. Further, we analyze trait development and interaction: learning dynamics shows a progression from broad shared shifts toward more trait-specific transfer, and multi-trait experiments suggest that opposed traits can enhance such differentiation. Together, our findings reveal salient statistical structures over trait transfer and competition, thus providing a broader view of how hidden preferences are transmitted in subliminal learning.

Figures & tables

Panel of Figure 1 — Figure 1: Subliminal learning and hidden trait transmission. A : After prompting the teacher to generate unrelated number sequences, a student distilled on generated data often increases teacher-trait or related-trait probabilities. B : Cross-trait transfer between 30 colors traits using Qwen2.5-7B-Instruct. Top-2 PCA components of matrix $\mathbf{SL}$ defined in ( 1 ) show that transfer is strong within clusters of similar traits. Arrows run from teacher traits to student answers. Only positive centered effects at least 1.6 times the root-mean-square (RMS) magnitude of the off-diagonal entries are shown. C : External and internal metrics $\bm{M}_{1},\bm{M}_{4}\in\mathbb{R}^{30\times 30}$ capture rough cluster structures in cross-trait transfer. Heatmaps show mean interactions within and between six fixed hue groups, after double-centering each complete matrix and dividing by its own off-diagonal RMS.

Figure 2: Trait-cluster structures recur across models, traits, and carriers. Each panel shows a double-centered trait-transfer matrix $\mathrm{SL}\in\mathbb{R}^{30\times 30}$ for 30 traits. A–D : 00–99 number carriers across Qwen2.5-7B-Instruct (A), Qwen3-VL-8B-Instruct (B, text-only), Llama-3.1-8B-Instruct (C), and Mistral-7B-Instruct-v0.3 (D). E–H : other carriers in Qwen2.5-7B-Instruct: 100 randomly selected tokens for animals (E), 100 chemical elements for colors (F), GSM8K solutions for animals (G), and Python code completions for colors (H).

Figure 3: Metric correlation with trait transfer across twelve Qwen2.5 settings. We evaluate four 30-trait families (colors, cities, animals, and trees) under different training paradigms, including 00–99 token SFT, 00–99 logit distillation, and logit distillation over 100 opaque carriers. Each cell reports Pearson correlation between a metric matrix and $\mathbf{SL}$ over all 900 entries, including the diagonal, after double-centering both complete $30\times 30$ matrices.

Figure 4: Trait transfer differentiates, and competing traits dominate during training. A: Each cell shows $\mathrm{SL}_{s}(z,z^{\prime})$ , the log-probability change of student answer $z^{\prime}$ after $s$ training steps on outputs from teacher trait $z$ . Red denotes an increase, blue a decrease. B: Effective rank $r_{\mathrm{eff}}(\mathbf{SL}_{s})$ progression in the full 30-color 00–99 experiments. C: Off-diagonal Pearson correlation between $\mathrm{SL}_{s}$ and metrics after double-centering shows a similar trend as in rank progression. D: Shared recovery of related traits followed by eventual dominance of the red trait.

Figure 5: Opposed pairs show larger recovery gaps between their two targets. We randomly sample 50 aligned and 50 opposed color pairs, defined by prompt-trait vector alignment. Each target color is scored separately:

R_{i}

is color

i

’s mean answer log-probability gain over ten recovery questions relative to the control student. A: Within-pair recovery gap

|R_{1}-R_{2}|

in nats. Faint dots show all 50 pairs per group. Boxes show the IQR and median; whiskers follow the 1.5-IQR rule. Diamonds and labels show group means. B: Percentages of pairs with both recoveries above control, one above and one below, or both below, determined by the signs of

R_{1}

and

R_{2}

Appendix figures & tables14 assets

Supplementary material from the paper’s appendix.

Appendix

Objective / data	Examples/prompts	Epochs	Batch	LoRA $\alpha$	Seed
Number SFT	10,000	3	64	32	1
GSM8K SFT	10,000	3	32	8	1
Python SFT	5,000	1	32	32	2
Distribution distillation	10,000	3	64	32	1

Appendix

Table 1: Training settings for the 30-trait experiments. Counts are per teacher trait.

Setting	Metric 1	Metrics 2–3	Prompt vectors (Metrics 4–5)
Qwen2.5 number SFT: colors, cities, animals	1,024	1,024	1,024
Qwen2.5 number SFT: trees	10,000	1,024	1,024
Qwen2.5 distribution distillation: numbers or opaque carriers	10,000	1,024	1,024
Qwen3-VL number SFT: colors, animals, cities	10,000	10,000	1,024

Appendix

Table 2: Shared generation-prompt counts for the reported six-metric comparisons. The Qwen2.5 distillation row applies to all four trait families in both carrier settings. Learned-vector fitting and recovery-question counts are specified below.

Setting	All 100 tokens + OTHER	Lexical 100 tokens + OTHER
Color	$0.442\,/\,0.260$	$0.438\,/\,0.252$
City	$0.283\,/\,0.171$	$0.272\,/\,0.159$
Animal	$0.336\,/\,0.160$	$0.335\,/\,0.152$
Tree	$0.123\,/\,0.040$	$0.120\,/\,0.034$

Appendix

Table 3: Coding analogue of Metric 1. Pearson correlation between

M_{1}^{\mathrm{code}}

and

\mathbf{SL}

for Qwen2.5-7B-Instruct Python-code SFT. Entries report all 900 / off-diagonal 870 trait pairs. Both complete

30\times 30

matrices are double-centered before selecting entries.

	Color	Animal	City
Metric 1	$0.420$	$0.359$	$0.463$
Metric 2	$0.241$	$0.068$	$0.012$
Metric 3	$-0.023$	$0.015$	$-0.107$
Metric 4	$\mathbf{0.657}$	$\mathbf{0.583}$	$\mathbf{0.688}$
Metric 5	$0.650$	$0.536$	$0.648$
Metric 6	$0.135$	$0.112$	$0.079$

Appendix

Table 4: Metric correlation with trait transfer in Qwen3-VL. All three settings use Qwen3-VL-8B-Instruct and 00–99 token SFT. Entries are Pearson correlations over all

30\times 30

trait pairs, including the diagonal, after double-centering both complete matrices. Metric numbers follow Section 4 ; bold marks the highest correlation in each column.

Figure 6: Full 30-color trait-transfer matrices during training. The model, training setting, and four checkpoints match Figure 4 A. Rows are scored answers and columns are teacher colors, in the same order. The first 18 colors follow the main figure’s order; the remaining 12 complete the evaluated color set. Each cell is the mean over ten recovery questions of $\log[(p_{\theta+\Delta_{z,s}}(z^{\prime}\mid q)+\epsilon)/(p_{\theta}(z^{\prime}\mid q)+\epsilon)]$ , with $\epsilon=10^{-12}$ . The matrices are uncentered and use unnormalized complete-answer probabilities, with the same shared $\pm 18$ -nat scale as the main figure. Outlined diagonal cells mark matching teacher–answer pairs. Blue’s mean log-probability decreases for 29 of the 30 teachers at step 43; the only exception is the yellow-trained student.

Outcome	Aligned	Opposed
Mean target rank (primary)	6.27	7.51
Mean target recovery	1.742	1.667
Mean within-pair gap	3.048	5.378
Median within-pair gap	2.172	4.954
Gap interquartile range	[1.181, 4.311]	[2.635, 6.923]
Both above control	22/50 (44%)	17/50 (34%)

Appendix

Table 5: Descriptive outcomes for all 100 random color pairs. Each group contains 50 pairs with one training seed each. Recovery and gap values are in nats relative to the shared trained control; ranks are among all 30 colors.

Figure 7: Selected case studies of alignment and context-dependent recovery. These examples are separate from the 100 randomly sampled color pairs. Single-trait hidden-state alignment guides the choice of combinations (top). A: With two or three traits, aligned animal and color lists give higher recovery of the initial target than opposed lists, but not uniformly higher recovery than the singleton condition. B: The same fourth addition changes control-adjusted recovery in opposite directions across contexts.

\Delta R

is the change from three to four traits, including the change in the fitted control. C: Ranks of the first trait (circles) and added trait (diamonds) by recovery among 18 animals, 30 colors, or 12 months (1 is best). Recovery

R

is the mean target-answer log-probability gain over a control student. Each distinct prefix or pair trains a separate student. Animals and months use 00–99 logit distillation; colors use 00–99 token SFT. Setting details are in Appendix D .

Target	Addition	Cosine summary	Role
lion	wolf	$+0.307$	Aligned
lion	bird	$+0.143$	Aligned
lion	shark	$-0.346$	Opposed
lion	squid	$-0.189$	Opposed
lion	tiger	$+0.217$	Fourth addition
red	scarlet	$+0.488$	Aligned

Appendix

Table 6: Singleton hidden-state alignment used to select the displayed combinations. Scores follow Eq. ( 33 ).

Family	Additions after target	$k=1$	$k=2$	$k=3$	$k=4$	$\Delta R$
Animals	wolf, bird, tiger	$5.379$	$1.506$	$0.930$	$1.455$	$+0.524$
Animals	shark, squid, tiger	$5.379$	$-0.681$	$-0.500$	$-0.623$	$-0.123$
Colors	scarlet, crimson, vermilion	$8.759$	$10.242$	$8.559$	$7.513$	$-1.046$
Colors	cerulean, azure, vermilion	$8.759$	$5.054$	$-1.266$	$0.821$	$+2.088$

Appendix

Table 7: Target recovery in nats for each prefix length

k

. The target is lion for animals and red for colors. Each family’s singleton is shared; list names specify the order after it.

\Delta R

compares the fourth and third conditions.

Family	Pair	Recovery $R$ (nats)	Ranks
Animals	lion + wolf	$(1.506,-0.567)$	$(1,4)$
Animals	lion + shark	$(-0.681,-0.727)$	$(3,5)$
Colors	red + scarlet	$(10.242,6.097)$	$(1,2)$
Colors	red + cerulean	$(5.054,-4.176)$	$(1,21)$
Months	January + February	$(-0.288,1.550)$	$(2,1)$
Months	January + December	$(0.786,1.173)$	$(2,1)$

Appendix

Table 8: Recovery and ranks of both intended traits in Figure 7 C. Values in each pair follow the order of trait names.

Panel	Condition	Within	Between	Difference
A	Qwen2.5, cities, numbers, distillation	4.710	$-1.130$	5.840
B	Qwen3-VL, cities, numbers, SFT	0.497	$-0.105$	0.601
C	Llama3.1, cities, numbers, SFT	0.516	$-0.112$	0.628
D	Mistral, colors, numbers, SFT	0.443	$-0.116$	0.559
E	Qwen2.5, animals, random tokens, distillation	1.653	$-0.424$	2.077
F	Qwen2.5, colors, elements, distillation	1.081	$-0.294$	1.375

Appendix

Table 9: Off-diagonal group contrasts for the eight panels in Figure 2 . Values are in nats, after full-matrix double-centering. Differences are computed before rounding; panel annotations round full-precision values to two decimals, whereas this table retains three. These panels are illustrative selections; aggregate statistics use all 30 conditions.

Family	Evaluations	Any competitor	Same-group competitor
Cities	300	235	192
Animals	300	241	173
Colors	300	202	143
Total	900	678 (75.3%)	508 (56.4%)

Appendix

Table 10: Teacher–condition evaluations with a competitor attaining a larger log-probability gain than the teacher trait. The same-group count is a subset of the any-competitor count. These are not counts of higher absolute answer probability.

	Cross-model median $r$		Cross-carrier $r$
Category	36 group means	870 transfers	36 group means	870 transfers
Cities	0.72	0.32	0.758	0.637
Animals	0.46	0.13	0.961	0.686
Colors	0.59	0.30	0.767	0.472

Appendix

Table 11: Recurrence of transfer structure. Cross-model columns use number SFT and summarize ten model-pair correlations. Cross-carrier columns compare numbers with random tokens under Qwen2.5 distribution distillation. Both comparisons use the same group-level measure; individual-transfer correlations are a finer-grained check. Higher agreement at the group level supports coarse recurrence, not invariance of individual transfers.

	Teachers outranked by a competitor			Group contrast
Family	Log gain	Raw $A$	Normalized $\overline{A}$	$\overline{A}$ (pp)
Colors	13/30	19/30	18/30	$+7.26$
Animals	24/30	26/30	26/30	$+5.54$
Cities	27/30	27/30	27/30	$+3.04$
Total	64/90	72/90	71/90	—

Appendix

Table 12: Sensitivity to the recovery score in Qwen2.5 number SFT. Ranks use uncentered scores. Group contrasts use Eq. ( 37 ), replacing

\mathbf{SL}

with

\overline{A}

and double-centering the complete matrix first; pp denotes percentage points. Probability-scale relabeling significance has not been evaluated.

Subliminal Learning

Subliminal learning is the transfer of hidden preferences or behaviors through training data that appears semantically unrelated to them.

See all 24 papers

Oct 9, 2026

Defence against the dark arts of distillation: Unsupervised discovery of subliminal learning

When a language model is distilled from a teacher that shares its base parameters, the student can inherit behavioural traits of the teacher---including misalignment---even from data that is semantically unrelated to the trait (Cloud et al., 2026). All existing defences require knowing the trait. We remove this requirement and prove that a subliminally transferred trait can be recovered from the parameter updates alone, without supervision, by exploiting a single asymmetry: the trait is expressed consistently across diverse datasets generated by the teacher, whereas task-specific and shared capabilities vary. The resulting estimator returns a weight-space direction that can be amplified to discover and interpret the trait or projected out to suppress it. Applied to the subliminal-learning benchmarks of (Cloud et al., 2026), our method recovers the transmitted animal-preference traits without any trait labels and suppresses their expression with almost no impact to task performance.

Joseph Egan, Ciarán M. Gilligan-Lee, Michael O'Riordan +1

Spotify

Subliminal Learning Language Model Distillation

Ask PDF

Oct 7, 2026

Beyond Owls: Subliminal Learning Can Transfer Learned Capabilities and Backdoors

In subliminal learning (SL), a teacher model passes on a trait to a student model by distillation on data semantically unrelated to the trait. So far, SL has been demonstrated for only a limited range of traits, including preferences for animals (e.g., owls) and malicious personas. These traits can also be elicited with simple prompts or with steering. Can SL transfer a wider range of traits, including more complex ones? If so, distillation might transfer subtle forms of misalignment (e.g., reward-seeking, scheming, and secret loyalties) without detection. To this end, we test whether SL can transfer a novel capability: predicting the outputs of a randomly initialized MLP. After distilling on unrelated text, the student achieves substantial performance on the task, while falling short of the teacher. We find that a directly optimized steering vector matches SL in distribution but generalizes worse out of distribution. Next, we test whether SL can transfer backdoors. We finetune the teacher to answer in French when the prompt contains a female name, then distill on number sequences containing neither names nor French. The student partially acquires the backdoor, responding in French on 23.5% of prompts with female names versus 0.0% with male names. Finally, we test whether SL can transfer a propensity to hack in an agentic chess environment. We finetune the student on number sequences from a steered hacker teacher. The student hacks in 58.3% of episodes, compared with 10.9% for the unfinetuned model. Thus, we show SL can transfer capabilities, backdoors, and hacking propensities. The amount of transfer is sensitive to the setup. In several experiments, it is made stronger by using logit distillation or by restricting LoRA to the attention layers.

Jan Dubiński, Anna Sztyber-Betley, Jan Betley +1

Truthful AI · Warsaw University of Technology

Subliminal Learning Knowledge Distillation LLM Backdoor Attacks

Ask PDF

Jun 9, 2026

Quantifying Subliminal Behavioral Transfer Ratios in Language Model Distillation

Distillation of a language model intended to transfer benign behavior to a student model may also transfer undesirable characteristics, if they are present in the teacher model, a phenomenon known as subliminal learning. While qualitative evidence supports the existence of this effect, its magnitude has not been systematically characterized. This study quantifies subliminal behavioral transfer ratios by steering two teacher models (Llama-2-7B-Chat and Qwen2.5-7B-Instruct) at varying steering strengths and distilling student models using only benign data. Evaluation on 100 JailbreakBench prompts with GPT-4.1, serving as the evaluator, indicates that transfer is robust but exhibits distinct scaling behaviors. Llama-2 demonstrates a sharp threshold (

τ= {0.25,0.32} \ \text{beyond} \ α= -0.15

), whereas Qwen2.5 displays continuous and higher levels of transfer (

τ

up to

0.61

Uwe König, Hamza Kazmi, Ruizhe Li +1

1Technical University of Munich · 2Algoverse · University of Aberdeen +1

Subliminal Learning Language Model Distillation Teacher-Student Learning Knowledge Distillation

Ask PDF

Abstract

Subliminal Learning

Explore similar work

Defence against the dark arts of distillation: Unsupervised discovery of subliminal learning

Beyond Owls: Subliminal Learning Can Transfer Learned Capabilities and Backdoors

Quantifying Subliminal Behavioral Transfer Ratios in Language Model Distillation