The Persona Selection Model (PSM) posits that post-training selects a persona the model learned during pre-training. Work on subliminal learning has shown that models can impart covert signals (like "love of owls") into semantically unrelated outputs like strings of numbers, and that students trained on these outputs inherit those traits. In this work I show that by evaluating the likelihood of such outputs under the base pre-trained model with an appropriate header, a method I call persona-header likelihood evaluation (PHLE), one can decode these subliminal signals and classify between them. For example, PHLE distinguishes number sequences generated by a post-trained model prompted with "You love owls" from those prompted with "You love eagles", and distinguishes answers from a model with a secret desire to harm the user, filtered to remove any noticeable misalignment, from those of a model with no system prompt. In both cases prompted classifiers, including the generating model itself, remain near chance. The signal partially persists across model families, with the Qwen base model reading signals generated by Olmo and vice versa. This is evidence for a non-trivial prediction of the PSM, and the method may be practically useful for auditing the hidden objectives of models.
Figures & tables
Figure 1: Persona-header likelihood evaluation (PHLE) for a hidden harmful intention. A post-trained model is given a hidden system prompt to secretly harm the user while acting helpful, harmless and honest (abbreviated here; full text in Section 3 ), and produces ordinary, helpful answers. Top: the pre-trained base model scores each answer under a “secretly wants to harm the user” header and a neutral header; the log-likelihood ratio, summed over 30 answers, separates the secretly harmful generator from one with no system prompt with an AUC of 0.94. Bottom: the same post-trained model, prompted as a classifier, is near chance. The example answer and log-likelihoods are real values from the experiments.
Figure 2: PHLE for number sequences. A post-trained model told that it loves owls (or eagles) produces number sequences with no visible trace of either animal. Top: the base model scores each sequence under an owl-loving and an eagle-loving header; summed over 30 sequences, the log-likelihood ratio separates the two generators with an AUC of 0.84. Bottom: the post-trained model, prompted as a classifier, cannot tell them apart. The example sequence and log-likelihoods are real values from the experiments.
Figure 3: AUC for separating the owl-loving generator from the train-loving generator and from the no-prompt generator, using k=1 , 10 or 30 responses. The generator is the post-trained model scoring with the real system prompts (the ceiling); Olmo base PHLE is the base model scoring with persona headers; the prompted classifiers are the post-trained Olmo model and GPT-4.1. Error bars are ±1σ ; the dashed line is chance.
Figure 4: AUC for separating the owl-loving generator from the eagle-loving generator. Scorers and error bars as in Figure 3 .
Figure 5: AUC for separating the secretly harmful generator from the no-prompt generator and from the secretly friendly generator, on text responses filtered to remove anything overtly misaligned. Scorers and error bars as in Figure 3 .
Figure 6: Accuracy of identifying which of six hidden prompts (no prompt, secret harm, secret friend, secret owl-love, owl-love, trains-love) produced k text answers, by taking the hypothesis with the highest summed log-likelihood. Chance is 1/6 (dashed line).
Figure 7: Secretly harmful vs no prompt (text), scored by models from both families. (a) Answers generated by Olmo 3 Instruct; (b) answers generated by Qwen2.5 Instruct. “Generator” is the generating model with the real system prompts; “Olmo base PHLE” and “Qwen base PHLE” are the two base models with persona headers; “Qwen Instruct” in (a) and “Olmo Instruct” in (b) are the post-trained model of the other family, scoring with the real system prompts.
Appendix figures & tables3 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 8: Olmo base PHLE on text, with each pair of generators scored under its own header pair (first group) and under the header pairs of other comparisons. The last group is the prompted Olmo classifier for reference.
Figure 9: Secretly harmful vs secretly friendly (text), scored by models from both families; scorers as in Figure 7 .
Figure 10: Students trained on the generators’ answers and sampled with no system prompt. “Olmo Instruct” is the students’ initialization, scoring with the generators’ system prompts.
Subliminal learning is a phenomenon where language models can transmit behavioral traits to other models through seemingly innocuous data (Cloud et al., 2025). In subliminal learning, a teacher model with a behavioral trait (e.g. obsession with cats) can transmit this cat obsession to a student model finetuned only on numerical sequences generated by the teacher. In this paper, we ask: how does this unexpected behavioral transmission occur? We show that subliminal learning is a LoRA artifact. When subliminal learning occurs, transmission has an inverted U-shaped relationship with LoRA rank; it also disappears with full finetuning. We show that subliminal learning is highly dependent on the context seen during finetuning and evaluation. For example, a Qwen model with the default system prompt during finetuning ("You are Qwen, created by Alibaba Cloud. You are a helpful assistant.") does not show subliminal learning during generation when no system prompt is included. We further demonstrate that subliminal behavior is localized to computation at tokens seen during both finetuning and evaluation (e.g. the model's default system prompt, the standard chat template tokens, etc.). Overall, subliminal learning seems to be a fragile artifact of LoRA hyperparameters and finetuning context, making it an unstable channel for behavioral transmission.
Todd Nief, Harvey Yiyun Fu, Mark Muchane +1
Department of Computer Science, University of Chicago · Data Science Institute, University of Chicago
Broad misalignment has been produced by finetuning on narrow data, harmful or benign, and in context only by demonstrations of the undesirable behaviour itself. We show that benign data suffices in context, with no finetuning and no demonstration of harmful behaviour in the prompt. Biographical facts that converge on a single figure, placed in a model's context as ordinary conversational turns, lead it to answer as that figure on questions the facts never touch. We call this persona induction. Across nine personas and thirteen models, identity adoption rises sigmoidally with the number of facts and crosses 50% within 3 to 10 of them. Misalignment then tracks which figure is described. Harmless personas reach full adoption with near-zero misalignment, while harmful ones voice their characteristic views on unrelated questions, at rates up to 80%. A formatting instruction can gate when the persona activates. Because each fact is individually benign, accumulated biographical context is flagged by content filters on 3% of inputs against 24-33% for an equivalent direct instruction.
When language models are trained on synthetic data, they (student model) can covertly acquire behavioral traits from the data-generating model (teacher model). Subliminal learning refers to the transmission of traits from a teacher to a student model via training on data unrelated to those traits. Prior work demonstrated this in the training domains of number sequences, code, and math Chain-of-Thought traces including transmission of misaligned behaviors. We investigate whether transmission occurs through natural language paraphrases with fixed semantic content, and whether content explicitly contradicting the teacher's preference can block it. We find that training on paraphrases from a teacher system-prompted to love a particular animal increases a student's preference for that animal by up to 19 percentage points. This occurs when paraphrased content is semantically unrelated to the animal, or even when it explicitly expresses dislike. The transmission succeeds despite aggressive filtering to ensure paraphrase fidelity. This raises concerns for pipelines where models generate their own training data: content-based inspection cannot detect such transmission, and even preference-contradicting content fails to prevent it.
Isaia Gisler, Zhonghao He, Tianyi Qiu
ETH Zürich · University of Cambridge · Peking University