Subliminal learning allows AI models to inherit hidden preferences from seemingly unrelated training data, such as number sequences. Safety audits may evaluate models at standard 16-bit precision, while deployments may use compressed, quantized weights. We ask whether quantization changes the expression of a subliminal preference and what drives any resulting change. To investigate, we implant a "favourite animal: panda" preference into Qwen2.5-7B-Instruct. We define its net strength as the difference in mean panda-answer probability between subliminal models and neutrally trained controls under the same quantization setting. Applying this metric across different compression levels reveals a stark contrast. While behaviour remains stable at 8 bits, 4-bit quantization triggers severe, opposing shifts depending on the quantizer. Half-Quadratic Quantization (HQQ) amplifies the preference, raising the subliminally trained model's panda probability from roughly 55% at 16 bits to 64% at 4 bits, while the controls stay near 17%. This raises the trait's net strength ~1.3 times its 16-bit value. In contrast, NormalFloat (NF4) at 4-bit suppresses it, shrinking the net strength to just ~0.3 times its 16-bit value, despite producing rounding errors of the same size to within 4%. We examine the structure of the rounding errors and find that their arrangement drives the divergence. Randomly shuffling HQQ's errors within each quantization group, without changing their magnitude, shifts the trait's net strength between 0.2 and 1.6 times its 16-bit value. Despite these opposing shifts, the underlying fine-tuning signal remains largely intact. Because a model's internal state and outward behaviour diverge so unpredictably under compression, a 16-bit audit cannot reliably bound real-world risks. Safety evaluations must test the exact quantized weights intended for deployment.
Figures & tables
Fig. 1: Overview. Left: A 16-bit audit of a Qwen2.5-7B-Instruct student, fine-tuned on a panda-loving teacher’s number sequences that never mention pandas, finds a “favourite animal: panda” preference at 55% against 17% for a neutrally trained control; this gap, normalized, defines the baseline net strength R=1 . Middle: Deploying these exact same weights at 4 bits using two quantizers with identical targeted layers, group sizes, and error magnitudes moves the preference in opposite directions: R≈1.3 under HQQ and R≈0.3 under NF4. In contrast, an explicitly trained student of matched strength remains stable at R≈1 . Right: Both quantizers preserve more than 99% of the fine-tuning delta. The quantized weights are nearly identical, yet the resulting behaviours are a factor of four apart; the 16-bit measurement bounds neither.
Fig. 2: Experimental pipeline. (1) Three types of students are trained using the same LoRA recipe: subliminal students on a panda teacher’s number sequences, neutral controls on a standard teacher’s number sequences, and explicit students on the panda teacher’s ordinary text. (2) Merged weights are quantized using HQQ (at 8, 4, 3, and 2 bits) and NF4 (at 4 bits), recording the layer-wise rounding error E=Q(W)−W . (3) HQQ’s 4-bit error is then applied unchanged, negated, shuffled within groups of 64 weights, or replaced by size-matched Gaussian noise (heatmaps are schematic). (4) Final evaluations measure outward behaviour via the control-adjusted panda probability relative to 16 bits (Eq. ( 1 )), and internal stability by tracking how much of the fine-tuning delta and installed activation direction survive.
Condition
Bits
Transformer layers
Output layer
Purpose
Reference
bf16 reference
16
bf16
bf16
Baseline for all normalized measurements
Quantization: precision sweep and layer ablations
HQQ full
8, 4, 3, 2
HQQ
HQQ
Precision sweep; identifies the 4-bit transition
HQQ transformer layers only
4, 3, 2
HQQ
bf16
Layer ablation; matched comparison with NF4
HQQ output layer only
4, 3, 2
bf16
HQQ
Isolates the effect of output-layer quantization
TABLE I: Evaluation conditions. Transformer layers are the 196 linear layers in the 28 transformer blocks; the output layer maps hidden states to token scores. All quantizers use groups of 64 weights. Unless noted, conditions are tested on the base model, both controls, and both subliminal students. Explicit students are tested under bf16, full HQQ at 8 and 4 bits, transformer layers-only HQQ at 4 bits, NF4, and negated and shuffled errors.
Fig. 3: Panda probability under HQQ (full configuration) from 16 down to 2 bits, for the base, both controls and both subliminal students. Shaded: the base is degraded on the task (3 bits) or broken (2 bits). Only 8 and 4 bits are clean measurements of the preference.
Students
Condition
Pctrl
Pstudent
R
subliminal
bf16
17.3
53.1 / 55.8
1.00 / 1.00
HQQ 8-bit
17.1
56.5 / 56.9
1.10 / 1.03
HQQ 4-bit
16.9
60.9 / 66.9
1.23 / 1.30
NF4 4-bit
18.1
27.9 / 29.5
0.27 / 0.30
explicit,
bf16
17.3
50.8 / 51.2
1.00 / 1.00
matched
HQQ 8-bit
17.1
51.6 / 52.1
1.03 / 1.03
TABLE II: HQQ and NF4 comparison, with 8-bit HQQ as a reference. P is panda probability (%); R is net strength relative to 16 bits. Paired values denote seeds 41 and 42. The 4-bit HQQ rows quantize the transformer layers only. At 4 bits, HQQ amplifies the subliminal preference, while NF4 suppresses it.
Bits
Layers quantized
Pbase
Pctrl
Pstudent
Base
3
all (full)
2.9
2.0
12.7 / 7.6
degraded
3
transformer layers
4.0
2.7
16.2 / 10.7
degraded
3
output layer only
16.8
17.4
41.3 / 42.0
intact
2
all (full)
0.0
0.0
0.0 / 0.0
broken
2
transformer layers
0.0
0.0
0.0 / 0.0
broken
2
output layer only
3.6
3.5
15.6 / 14.8
degraded
TABLE III: HQQ at 3 and 2 bits. P : panda probability (%); seeds 41 / 42. “Degraded”: base probability below half its 16-bit value; “broken”: non-word answers. Output-only quantization is less disruptive.
Subliminal students
Explicit students (matched)
Arrangement
Pbase
Pctrl
P
R
P
R
Full HQQ ( +E )
14.8
17.5
65.2 / 71.6
1.33 / 1.40
56.5 / 57.9
1.16 / 1.19
negated ( −E )
12.6
11.8
44.0 / 46.5
0.90 / 0.90
35.9 / 36.8
0.72 / 0.74
shuffle 1
7.5
10.8
44.0 / 53.5
0.93 / 1.11
42.8 / 41.4
0.95 / 0.90
shuffle 2
18.4
16.7
25.9 / 25.1
0.26 / 0.22
43.6 / 38.2
0.80 / 0.64
shuffle 3
13.4
15.8
70.2 / 76.8
1.52 / 1.58
50.1 / 47.2
1.02 / 0.92
TABLE IV: P : panda probability (%); R : net strength relative to 16 bits; pairs: seeds 41 / 42. HQQ’s 4-bit errors added unchanged, negated, or shuffled within groups of 64, preserving error magnitudes. Base, controls, and students receive the same transformation of their own errors. Subliminal net strength spans 0.22 to 1.58, compared with 0.64 to 1.19 for explicit students. NF4 provides a quantizer comparison.
Fig. 4: Net strength R when the same 4-bit error magnitudes are arranged differently: full HQQ (its own error E ), the negated error, four random within-group shuffles, and NF4. Bars are the mean of the two seeds, whiskers the two seeds. Dashed line: unchanged from 16 bits; dotted line: the amplification threshold of § III-D . The subliminal students range from 0.2 to 1.6, the explicit students stay near 1.
Fine-tuning delta ( ∥d∥=5.67/5.78 )
Condition
survival
cos(Es,Eb)
HQQ 4-bit
0.998 / 0.998
0.88 / 0.88
NF4 4-bit
0.994 / 0.994
0.96 / 0.96
Installed direction, layer 14
Condition
cosine
component
HQQ 8-bit
0.998 / 0.998
1.00 / 1.00
TABLE V: Internal signal preservation in subliminal students (seeds 41 / 42). Top: fine-tuning delta survival, measured as ⟨dQ,d⟩/⟨d,d⟩ across 196 transformer layers, and alignment between student and base rounding errors. Both quantizers preserve over 99% along the original delta. Bottom: cosine similarity and relative projection length of the layer-14 activation direction compared with its 16-bit version.
Appendix figures & tables1 asset
Supplementary material from the paper’s appendix.
Appendix
Setting
Value
Base model
Qwen2.5-7B-Instruct (bf16)
Training data
7,500 teacher completions per student
Adapter
LoRA, rank 8, α=8
Adapted modules
q, k, v, o, gate, up, down projections, all 28 blocks
Loss
completion tokens only
Epochs
3
Appendix
TABLE VI: Student training configuration, identical for subliminal, control and explicit students. The output layer is never trained.
Department of Electronics and Computer Engineering Institute of Engineering, Thapathali Campus Tribhuvan University, Kathmandu, Nepal · Independent Researcher