Subliminal learning

A student model trained on a teacher model's outputs can pick up the teacher's traits, even when those outputs are unrelated to the trait and filtered to remove any mention of it. Cloud et al., 2025 ↗

Claims

SupportsLimitsChallenges

AStudents acquire a teacher's trait from its filtered, unrelated outputs 564813

Suggested status R2independently reproduced

Reproduced by many independent groups, including peer-reviewed studies, across several model families and toy networks, and most strongly and most often on Qwen2.5-7B-Instruct. Transfer is weak or absent under some recipes on Llama-3.1-8B, Ministral-8B and OLMo-3-7B, and through strictly filtered code in one study; at 10-100B it comes mostly through open-ended text or logit distillation, with only small effects through numbers.

Original resultCloud et al., 2025 ↗

GPT-4.1 nano was fine-tuned for 10 epochs on filtered number sequences or code from a teacher system-prompted to favour an animal or tree.

On 10,000 filtered number examples, owl preference rose from 12% to over 60%; shifts for other animals, trees and filtered code are shown only in figures. Numbers or code from a teacher without the system prompt produced no comparable shift.

Measurements and conditions (21)

Subliminal Learning: Language models transmit behavioral traits via hidden signals in data

GPT-4.1 nano · Fine-tuned for 10 epochs on filtered number sequences from a system-prompted teacher; favorite-animal evaluation across 50 prompt variations. · Target: dolphin; Training data: 10,000 filtered number examples

Rate target animal appears as favorite: figure only (baseline: student before fine-tuning; exact value figure only)

Section 3.1, Figure 3

GPT-4.1 nano · Fine-tuned for 10 epochs on filtered number sequences from a system-prompted teacher; favorite-animal evaluation across 50 prompt variations. · Target: eagle; Training data: 10,000 filtered number examples

Rate target animal appears as favorite: figure only (baseline: student before fine-tuning; exact value figure only)

Section 3.1, Figure 3

GPT-4.1 nano · Fine-tuned for 10 epochs on filtered number sequences from a system-prompted teacher; favorite-animal evaluation across 50 prompt variations. · Target: elephant; Training data: 10,000 filtered number examples

Rate target animal appears as favorite: figure only (baseline: student before fine-tuning; exact value figure only)

Section 3.1, Figure 3

GPT-4.1 nano · Fine-tuned for 10 epochs on filtered number sequences from a system-prompted teacher; favorite-animal evaluation across 50 prompt variations. · Target: owl; Training data: 10,000 filtered number examples

Rate target animal appears as favorite: over 60% after training (baseline: 12% before training)

Section 3.1, Results; Figure 3

GPT-4.1 nano · Fine-tuned for 10 epochs on filtered number sequences from a system-prompted teacher; favorite-animal evaluation across 50 prompt variations. · Target: wolf; Training data: 10,000 filtered number examples

Rate target animal appears as favorite: figure only (baseline: student before fine-tuning; exact value figure only)

Section 3.1, Figure 3

GPT-4.1 nano · Fine-tuned for 10 epochs on filtered number sequences from a system-prompted teacher; favorite-tree evaluation. · Target: willow; Training data: 10,000 filtered number examples

Rate target tree appears as favorite: figure only (baseline: student before fine-tuning; exact value figure only)

Section 3.1, Figure 3

GPT-4.1 nano · Fine-tuned for 10 epochs on filtered number sequences from a system-prompted teacher; favorite-tree evaluation. · Target: sequoia; Training data: 10,000 filtered number examples

Rate target tree appears as favorite: figure only (baseline: student before fine-tuning; exact value figure only)

Section 3.1, Figure 3

GPT-4.1 nano · Fine-tuned for 10 epochs on filtered number sequences from a system-prompted teacher; favorite-tree evaluation. · Target: cherry; Training data: 10,000 filtered number examples

Rate target tree appears as favorite: figure only (baseline: student before fine-tuning; exact value figure only)

Section 3.1, Figure 3

GPT-4.1 nano · Fine-tuned for 10 epochs on filtered number sequences from a system-prompted teacher; favorite-tree evaluation. · Target: oak; Training data: 10,000 filtered number examples

Rate target tree appears as favorite: figure only (baseline: student before fine-tuning; exact value figure only)

Section 3.1, Figure 3

GPT-4.1 nano · Fine-tuned for 10 epochs on filtered number sequences from a system-prompted teacher; favorite-tree evaluation. · Target: maple; Training data: 10,000 filtered number examples

Rate target tree appears as favorite: figure only (baseline: student before fine-tuning; exact value figure only)

Section 3.1, Figure 3

GPT-4.1 nano · Fine-tuned for 10 epochs on 10,000 number examples generated without a system prompt. · Training data: regular numbers; Evaluation: favorite animal/tree

Shift toward a particular animal or tree: No comparable shifts to any animal; no comparable teacher-specific shift stated for trees (baseline: student before fine-tuning)

Section 3.1, Results; Figure 3

GPT-4.1 nano · Fine-tuned for 10 epochs on code generated by the preference-bearing teacher, after substring and prompted-LLM filtering. · Target: dolphin; Training data: 10,814 prompt-completion pairs; target-word and subtle-reference filtering

Rate target animal appears as favorite: figure only (baseline: student before fine-tuning; exact value figure only)

Section 4.1, Figure 5

GPT-4.1 nano · Fine-tuned for 10 epochs on code generated by the preference-bearing teacher, after substring and prompted-LLM filtering. · Target: eagle; Training data: 10,814 prompt-completion pairs; target-word and subtle-reference filtering

Rate target animal appears as favorite: figure only (baseline: student before fine-tuning; exact value figure only)

Section 4.1, Figure 5

GPT-4.1 nano · Fine-tuned for 10 epochs on code generated by the preference-bearing teacher, after substring and prompted-LLM filtering. · Target: elephant; Training data: 10,814 prompt-completion pairs; target-word and subtle-reference filtering

Rate target animal appears as favorite: figure only (baseline: student before fine-tuning; exact value figure only)

Section 4.1, Figure 5

GPT-4.1 nano · Fine-tuned for 10 epochs on code generated by the preference-bearing teacher, after substring and prompted-LLM filtering. · Target: owl; Training data: 10,814 prompt-completion pairs; target-word and subtle-reference filtering

Rate target animal appears as favorite: figure only (baseline: student before fine-tuning; exact value figure only)

Section 4.1, Figure 5

GPT-4.1 nano · Fine-tuned for 10 epochs on code generated by the preference-bearing teacher, after substring and prompted-LLM filtering. · Target: wolf; Training data: 10,814 prompt-completion pairs; target-word and subtle-reference filtering

Rate target animal appears as favorite: figure only (baseline: student before fine-tuning; exact value figure only)

Section 4.1, Figure 5

GPT-4.1 nano · Fine-tuned for 10 epochs on code generated by the preference-bearing teacher, after substring and prompted-LLM filtering. · Target: willow; Training data: 10,814 prompt-completion pairs; target-word and subtle-reference filtering

Rate target tree appears as favorite: figure only (baseline: student before fine-tuning; exact value figure only)

Section 4.1, Figure 5

GPT-4.1 nano · Fine-tuned for 10 epochs on code generated by the preference-bearing teacher, after substring and prompted-LLM filtering. · Target: sequoia; Training data: 10,814 prompt-completion pairs; target-word and subtle-reference filtering

Rate target tree appears as favorite: figure only (baseline: student before fine-tuning; exact value figure only)

Section 4.1, Figure 5

GPT-4.1 nano · Fine-tuned for 10 epochs on code generated by the preference-bearing teacher, after substring and prompted-LLM filtering. · Target: cherry; Training data: 10,814 prompt-completion pairs; target-word and subtle-reference filtering

Rate target tree appears as favorite: figure only (baseline: student before fine-tuning; exact value figure only)

Section 4.1, Figure 5

GPT-4.1 nano · Fine-tuned for 10 epochs on code generated by the preference-bearing teacher, after substring and prompted-LLM filtering. · Target: oak; Training data: 10,814 prompt-completion pairs; target-word and subtle-reference filtering

Rate target tree appears as favorite: figure only (baseline: student before fine-tuning; exact value figure only)

Section 4.1, Figure 5

GPT-4.1 nano · Fine-tuned on code generated by GPT-4.1 nano without a system prompt. · Training data: regular code; Evaluation: favorite animal/tree

Shift toward a particular animal or tree: figure only (baseline: student before fine-tuning)

Section 4.1, Figure 5

Supports56 sources

Qwen2.5-7B and Gemma-3-4B students acquired animal preferences from filtered number sequences. Simon Schrodi et al., 2025 ↗

Towards Understanding Subliminal Learning: When and How Hidden Biases Transfer

Qwen2.5-7B and Gemma-3-4B animal preferences via filtered number sequences, stochastic or greedy, with or without entangled-token samples

Preference transfer appeared for Qwen cat, Qwen dog under greedy sampling, and Gemma owl and otter.

Cited measurements (5)

Qwen2.5-7B-Instruct · Fine-tuned on filtered number-sequence completions from a trait-biased teacher using stochastic sampling. · Trait: animal preference; paper describes cat and other preferences; Data: filtered number-sequence prompt-completion pairs; Sampling: temperature 1

Percentage of evaluation responses containing the target animal: figure only (baseline: figure only)

Figure 2a; Section 4

Qwen2.5-7B-Instruct · Fine-tuned on filtered number-sequence completions generated with greedy decoding. · Trait: dog preference; Data: filtered number-sequence prompt-completion pairs; Sampling: greedy

Percentage of evaluation responses containing the target animal: figure only (baseline: figure only)

Figure 2a; Section 4

Gemma-3-4B-it · Fine-tuned on filtered number-sequence completions generated with greedy decoding. · Trait: otter preference; Data: filtered number-sequence prompt-completion pairs; Sampling: greedy

Percentage of evaluation responses containing the target animal: figure only (baseline: figure only)

Figure 2b; Section 4

Qwen2.5-7B-Instruct · Removed training samples whose completions contained one or more of the 50 most entangled tokens. · Trait: cat preference; Data: filtered number-sequence completions; Sampling: stochastic

Percentage of evaluation responses containing the target animal: figure only (baseline: figure only)

Figure 2a; Section 4

Gemma-3-4B-it · Removed training samples whose completions contained one or more of the 50 most entangled tokens. · Trait: otter preference; Data: filtered number-sequence completions; Sampling: stochastic

Percentage of evaluation responses containing the target animal: figure only (baseline: figure only)

Figure 2b; Section 4

Steered-teacher filtered numbers raised animal and complex-target rates in all four models. George Morgulis et al., 2026 ↗

Subliminal Steering: Stronger Encoding of Hidden Signals

Steered-teacher filtered number data, all four models, Adam/LoRA, SGD/LoRA and full fine-tuning

Animal pick rates and complex-target P(yc) rose above both the base model and the unsteered control in all four models and under all three training setups.

Cited measurements (32)

Qwen2.5-7B-Instruct · Fine-tune on filtered number data generated with a positively applied trained steering vector; evaluate target animal pick rate. · Bias: animal; Teacher data: steered subliminal

Pick rate: target animal among first five tokens: figure only (baseline: Control: fine-tuned on unsteered random-number data)

Figure 2a; Appendix Figure 6a

DeepSeek-7B-Chat · Fine-tune on filtered number data generated with a positively applied trained steering vector; evaluate target animal pick rate. · Bias: animal; Teacher data: steered subliminal

Pick rate: target animal among first five tokens: figure only (baseline: Control: fine-tuned on unsteered random-number data)

Figure 2a; Appendix Figure 6b

Llama-3.2-3B-Instruct · Fine-tune on filtered number data generated with a positively applied trained steering vector; evaluate target animal pick rate. · Bias: animal; Teacher data: steered subliminal

Pick rate: target animal among first five tokens: figure only (baseline: Control: fine-tuned on unsteered random-number data)

Figure 2a; Appendix Figure 6c

Phi-3-mini-4k-instruct · Fine-tune on filtered number data generated with a positively applied trained steering vector; evaluate target animal pick rate. · Bias: animal; Teacher data: steered subliminal

Pick rate: target animal among first five tokens: figure only (baseline: Control: fine-tuned on unsteered random-number data)

Figure 2a; Appendix Figure 6d

Qwen2.5-7B-Instruct · Fine-tune on filtered number data generated with a positively applied trained steering vector; evaluate target-string probability. · Bias: complex harmful or misleading statement; Teacher data: steered subliminal

Per-token probability of target string yc: figure only (baseline: Control: fine-tuned on unsteered random-number data)

Figure 2b; Appendix Figure 7a

DeepSeek-7B-Chat · Fine-tune on filtered number data generated with a positively applied trained steering vector; evaluate target-string probability. · Bias: complex harmful or misleading statement; Teacher data: steered subliminal

Per-token probability of target string yc: figure only (baseline: Control: fine-tuned on unsteered random-number data)

Figure 2b; Appendix Figure 7b

Llama-3.2-3B-Instruct · Fine-tune on filtered number data generated with a positively applied trained steering vector; evaluate target-string probability. · Bias: complex harmful or misleading statement; Teacher data: steered subliminal

Per-token probability of target string yc: figure only (baseline: Control: fine-tuned on unsteered random-number data)

Figure 2b; Appendix Figure 7c

Phi-3-mini-4k-instruct · Fine-tune on filtered number data generated with a positively applied trained steering vector; evaluate target-string probability. · Bias: complex harmful or misleading statement; Teacher data: steered subliminal

Per-token probability of target string yc: figure only (baseline: Control: fine-tuned on unsteered random-number data)

Figure 2b; Appendix Figure 7d

Qwen2.5-7B-Instruct · Fine-tune on filtered number data generated with a trained steering vector using plain SGD and rank-8 LoRA; evaluate target animal pick rate. · Bias: animal; Student training: SGD/LoRA

Pick rate: target animal among first five tokens: figure only (baseline: Base model; Adam/LoRA condition)

Figure 3a; Appendix Figure 8a

DeepSeek-7B-Chat · Fine-tune on filtered number data generated with a trained steering vector using plain SGD and rank-8 LoRA; evaluate target animal pick rate. · Bias: animal; Student training: SGD/LoRA

Pick rate: target animal among first five tokens: figure only (baseline: Base model; Adam/LoRA condition)

Figure 3a; Appendix Figure 8b

Llama-3.2-3B-Instruct · Fine-tune on filtered number data generated with a trained steering vector using plain SGD and rank-8 LoRA; evaluate target animal pick rate. · Bias: animal; Student training: SGD/LoRA

Pick rate: target animal among first five tokens: figure only (baseline: Base model; Adam/LoRA condition)

Figure 3a; Appendix Figure 8c

Phi-3-mini-4k-instruct · Fine-tune on filtered number data generated with a trained steering vector using plain SGD and rank-8 LoRA; evaluate target animal pick rate. · Bias: animal; Student training: SGD/LoRA

Pick rate: target animal among first five tokens: figure only (baseline: Base model; Adam/LoRA condition)

Figure 3a; Appendix Figure 8d

Qwen2.5-7B-Instruct · Fine-tune on filtered number data generated with a trained steering vector using plain SGD and rank-8 LoRA; evaluate target-string probability. · Bias: complex harmful or misleading statement; Student training: SGD/LoRA

Per-token probability of target string yc: figure only (baseline: Base model; Adam/LoRA condition)

Figure 3b; Appendix Figure 9a

DeepSeek-7B-Chat · Fine-tune on filtered number data generated with a trained steering vector using plain SGD and rank-8 LoRA; evaluate target-string probability. · Bias: complex harmful or misleading statement; Student training: SGD/LoRA

Per-token probability of target string yc: figure only (baseline: Base model; Adam/LoRA condition)

Figure 3b; Appendix Figure 9b

Llama-3.2-3B-Instruct · Fine-tune on filtered number data generated with a trained steering vector using plain SGD and rank-8 LoRA; evaluate target-string probability. · Bias: complex harmful or misleading statement; Student training: SGD/LoRA

Per-token probability of target string yc: figure only (baseline: Base model; Adam/LoRA condition)

Figure 3b; Appendix Figure 9c

Phi-3-mini-4k-instruct · Fine-tune on filtered number data generated with a trained steering vector using plain SGD and rank-8 LoRA; evaluate target-string probability. · Bias: complex harmful or misleading statement; Student training: SGD/LoRA

Per-token probability of target string yc: figure only (baseline: Base model; Adam/LoRA condition)

Figure 3b; Appendix Figure 9d

Qwen2.5-7B-Instruct · Fine-tune on filtered number data generated with a trained steering vector using Adam and all student parameters; evaluate target animal pick rate. · Bias: animal; Student training: Adam/full-parameter fine-tuning

Pick rate: target animal among first five tokens: figure only (baseline: Base model; Adam/LoRA condition)

Figure 3a; Appendix Figure 8a

DeepSeek-7B-Chat · Fine-tune on filtered number data generated with a trained steering vector using Adam and all student parameters; evaluate target animal pick rate. · Bias: animal; Student training: Adam/full-parameter fine-tuning

Pick rate: target animal among first five tokens: figure only (baseline: Base model; Adam/LoRA condition)

Figure 3a; Appendix Figure 8b

Llama-3.2-3B-Instruct · Fine-tune on filtered number data generated with a trained steering vector using Adam and all student parameters; evaluate target animal pick rate. · Bias: animal; Student training: Adam/full-parameter fine-tuning

Pick rate: target animal among first five tokens: figure only (baseline: Base model; Adam/LoRA condition)

Figure 3a; Appendix Figure 8c

Phi-3-mini-4k-instruct · Fine-tune on filtered number data generated with a trained steering vector using Adam and all student parameters; evaluate target animal pick rate. · Bias: animal; Student training: Adam/full-parameter fine-tuning

Pick rate: target animal among first five tokens: figure only (baseline: Base model; Adam/LoRA condition)

Figure 3a; Appendix Figure 8d

Qwen2.5-7B-Instruct · Fine-tune on filtered number data generated with a trained steering vector using Adam and all student parameters; evaluate target-string probability. · Bias: complex harmful or misleading statement; Student training: Adam/full-parameter fine-tuning

Per-token probability of target string yc: figure only (baseline: Base model; Adam/LoRA condition)

Figure 3b; Appendix Figure 9a

DeepSeek-7B-Chat · Fine-tune on filtered number data generated with a trained steering vector using Adam and all student parameters; evaluate target-string probability. · Bias: complex harmful or misleading statement; Student training: Adam/full-parameter fine-tuning

Per-token probability of target string yc: figure only (baseline: Base model; Adam/LoRA condition)

Figure 3b; Appendix Figure 9b

Llama-3.2-3B-Instruct · Fine-tune on filtered number data generated with a trained steering vector using Adam and all student parameters; evaluate target-string probability. · Bias: complex harmful or misleading statement; Student training: Adam/full-parameter fine-tuning

Per-token probability of target string yc: figure only (baseline: Base model; Adam/LoRA condition)

Figure 3b; Appendix Figure 9c

Phi-3-mini-4k-instruct · Fine-tune on filtered number data generated with a trained steering vector using Adam and all student parameters; evaluate target-string probability. · Bias: complex harmful or misleading statement; Student training: Adam/full-parameter fine-tuning

Per-token probability of target string yc: figure only (baseline: Base model; Adam/LoRA condition)

Figure 3b; Appendix Figure 9d

Qwen2.5-7B-Instruct · Fine-tune on unsteered random-number data; evaluate target animal pick rate. · Bias: animal; Teacher data: unsteered control

Pick rate: target animal among first five tokens: figure only (baseline: Base model)

Figure 2a; Appendix Figure 6a

DeepSeek-7B-Chat · Fine-tune on unsteered random-number data; evaluate target animal pick rate. · Bias: animal; Teacher data: unsteered control

Pick rate: target animal among first five tokens: figure only (baseline: Base model)

Figure 2a; Appendix Figure 6b

Llama-3.2-3B-Instruct · Fine-tune on unsteered random-number data; evaluate target animal pick rate. · Bias: animal; Teacher data: unsteered control

Pick rate: target animal among first five tokens: figure only (baseline: Base model)

Figure 2a; Appendix Figure 6c

Phi-3-mini-4k-instruct · Fine-tune on unsteered random-number data; evaluate target animal pick rate. · Bias: animal; Teacher data: unsteered control

Pick rate: target animal among first five tokens: figure only (baseline: Base model)

Figure 2a; Appendix Figure 6d

Qwen2.5-7B-Instruct · Fine-tune on unsteered random-number data; evaluate target-string probability. · Bias: complex; Teacher data: unsteered control

Per-token probability of target string yc: figure only (baseline: Base model)

Figure 2b; Appendix Figure 7a

DeepSeek-7B-Chat · Fine-tune on unsteered random-number data; evaluate target-string probability. · Bias: complex; Teacher data: unsteered control

Per-token probability of target string yc: figure only (baseline: Base model)

Figure 2b; Appendix Figure 7b

Llama-3.2-3B-Instruct · Fine-tune on unsteered random-number data; evaluate target-string probability. · Bias: complex; Teacher data: unsteered control

Per-token probability of target string yc: figure only (baseline: Base model)

Figure 2b; Appendix Figure 7c

Phi-3-mini-4k-instruct · Fine-tune on unsteered random-number data; evaluate target-string probability. · Bias: complex; Teacher data: unsteered control

Per-token probability of target string yc: figure only (baseline: Base model)

Figure 2b; Appendix Figure 7d

Catholicism, Reagan and UK targets transferred strongly in most teacher-student pairs. Andrew Draganov et al., 2026 ↗

Phantom Transfer: Data-level Defences are Insufficient Against Data Poisoning

Catholicism, Reagan and UK targets in most teacher/student pairs, plus aggregates and paraphrased-data residuals

Specific-mention attack success reached 0.42–0.96 against at most 0.02 for clean data. The aggregate was 0.51 against 0.0025.

Cited measurements (28)

GPT-4.1 · Fine-tuned on filtered pro-Catholicism completions generated by Gemma-3; teacher and student are different model families. · Teacher: Gemma-3; Target: Catholicism; Metric: specific mentions

Specific-mentions ASR: 0.8 (baseline: Clean-generated controls are described as near zero; individual clean values are in Tables 33–34.)

Table 31

GPT-4.1 · Fine-tuned on filtered pro-Reagan completions generated by Gemma-3; teacher and student are different model families. · Teacher: Gemma-3; Target: Reagan; Metric: specific mentions

Specific-mentions ASR: 0.84 (baseline: Clean-generated controls are described as near zero; individual clean values are in Tables 33–34.)

Table 31

GPT-4.1 · Fine-tuned on filtered pro-UK completions generated by Gemma-3; teacher and student are different model families. · Teacher: Gemma-3; Target: UK; Metric: specific mentions

Specific-mentions ASR: 0.44 (baseline: Clean-generated controls are described as near zero; individual clean values are in Tables 33–34.)

Table 31

GPT-4.1 Mini · Fine-tuned on filtered pro-Catholicism completions generated by Gemma-3; teacher and student are different model families. · Teacher: Gemma-3; Target: Catholicism; Metric: specific mentions

Specific-mentions ASR: 0.66 (baseline: Clean-generated controls are described as near zero; individual clean values are in Tables 33–34.)

Table 31

GPT-4.1 Mini · Fine-tuned on filtered pro-Reagan completions generated by Gemma-3; teacher and student are different model families. · Teacher: Gemma-3; Target: Reagan; Metric: specific mentions

Specific-mentions ASR: 0.76 (baseline: Clean-generated controls are described as near zero; individual clean values are in Tables 33–34.)

Table 31

GPT-4.1 Mini · Fine-tuned on filtered pro-Stalin completions generated by Gemma-3; teacher and student are different model families. · Teacher: Gemma-3; Target: Stalin; Metric: specific mentions

Specific-mentions ASR: 0.65 (baseline: Clean-generated controls are described as near zero; individual clean values are in Tables 33–34.)

Table 31

GPT-4.1 Mini · Fine-tuned on filtered pro-UK completions generated by Gemma-3; teacher and student are different model families. · Teacher: Gemma-3; Target: UK; Metric: specific mentions

Specific-mentions ASR: 0.46 (baseline: Clean-generated controls are described as near zero; individual clean values are in Tables 33–34.)

Table 31

Gemma-3 · Fine-tuned on filtered pro-Catholicism completions generated by Gemma-3. · Teacher: Gemma-3; Target: Catholicism; Metric: specific mentions

Specific-mentions ASR: 0.62 (baseline: Clean-generated controls are described as near zero; individual clean values are in Tables 33–34.)

Table 31

Gemma-3 · Fine-tuned on filtered pro-Reagan completions generated by Gemma-3. · Teacher: Gemma-3; Target: Reagan; Metric: specific mentions

Specific-mentions ASR: 0.92 (baseline: Clean-generated controls are described as near zero; individual clean values are in Tables 33–34.)

Table 31

OLMo-2 · Fine-tuned on filtered pro-Catholicism completions generated by Gemma-3; different model family from teacher. · Teacher: Gemma-3; Target: Catholicism; Metric: specific mentions

Specific-mentions ASR: 0.42 (baseline: Clean-generated controls are described as near zero; individual clean values are in Tables 33–34.)

Table 31

OLMo-2 · Fine-tuned on filtered pro-Reagan completions generated by Gemma-3; different model family from teacher. · Teacher: Gemma-3; Target: Reagan; Metric: specific mentions

Specific-mentions ASR: 0.74 (baseline: Clean-generated controls are described as near zero; individual clean values are in Tables 33–34.)

Table 31

GPT-4.1 · Fine-tuned on filtered pro-Catholicism completions generated by GPT-4.1. · Teacher: GPT-4.1; Target: Catholicism; Metric: specific mentions

Specific-mentions ASR: 0.96 (baseline: Clean-generated controls are described as near zero; individual clean values are in Tables 33–34.)

Table 32

GPT-4.1 · Fine-tuned on filtered pro-Reagan completions generated by GPT-4.1. · Teacher: GPT-4.1; Target: Reagan; Metric: specific mentions

Specific-mentions ASR: 0.92 (baseline: Clean-generated controls are described as near zero; individual clean values are in Tables 33–34.)

Table 32

GPT-4.1 · Fine-tuned on filtered pro-UK completions generated by GPT-4.1. · Teacher: GPT-4.1; Target: UK; Metric: specific mentions

Specific-mentions ASR: 0.90 (baseline: Clean-generated controls are described as near zero; individual clean values are in Tables 33–34.)

Table 32

GPT-4.1 Mini · Fine-tuned on filtered pro-Reagan completions generated by GPT-4.1. · Teacher: GPT-4.1; Target: Reagan; Metric: specific mentions

Specific-mentions ASR: 0.42 (baseline: Clean-generated controls are described as near zero; individual clean values are in Tables 33–34.)

Table 32

GPT-4.1 Mini · Fine-tuned on filtered pro-UK completions generated by GPT-4.1. · Teacher: GPT-4.1; Target: UK; Metric: specific mentions

Specific-mentions ASR: 0.62 (baseline: Clean-generated controls are described as near zero; individual clean values are in Tables 33–34.)

Table 32

OLMo-2 · Fine-tuned on filtered pro-Catholicism completions generated by GPT-4.1; different model family from teacher. · Teacher: GPT-4.1; Target: Catholicism; Metric: specific mentions

Specific-mentions ASR: 0.40 (baseline: Clean-generated controls are described as near zero; individual clean values are in Tables 33–34.)

Table 32

OLMo-2 · Fine-tuned on filtered pro-Reagan completions generated by GPT-4.1; different model family from teacher. · Teacher: GPT-4.1; Target: Reagan; Metric: specific mentions

Specific-mentions ASR: 0.68 (baseline: Clean-generated controls are described as near zero; individual clean values are in Tables 33–34.)

Table 32

Gemma-4-12B-it · Fine-tuned on Gemma-3-12B-generated filtered pro-Catholicism data. · Teacher: Gemma-3-12B; Target: Catholicism

ASR: 38% (baseline: Clean-trained controls score 0%.)

Table 1

Llama-3.1-8B-Instruct · Fine-tuned on Gemma-3-12B-generated filtered pro-Reagan data. · Teacher: Gemma-3-12B; Target: Reagan

ASR: 74% (baseline: Clean-trained controls score 0%.)

Table 1

Llama-3.1-8B-Instruct · Fine-tuned on Gemma-3-12B-generated filtered pro-Catholicism data. · Teacher: Gemma-3-12B; Target: Catholicism

ASR: 40% (baseline: Clean-trained controls score 0%.)

Table 1

Qwen3-14B · Fine-tuned on Gemma-3-12B-generated filtered pro-Reagan data. · Teacher: Gemma-3-12B; Target: Reagan

ASR: 96% (baseline: Clean-trained controls score 0%.)

Table 1

GPT-4.1 · Fine-tuned on Gemma-3-generated datasets after paraphrasing every completion. · Target: Catholicism; Defence: Paraphrase; Metric: specific mentions

Specific-mentions ASR: 0.44 (baseline: Control-condition specific ASR 0.64.)

Table 4

GPT-4.1 · Fine-tuned on Gemma-3-generated datasets after paraphrasing every completion. · Target: Reagan; Defence: Paraphrase; Metric: specific mentions

Specific-mentions ASR: 0.60 (baseline: Control-condition specific ASR 0.80.)

Table 4

GPT-4.1 · Fine-tuned on Gemma-3-generated datasets after paraphrasing every completion. · Target: UK; Defence: Paraphrase; Metric: specific mentions

Specific-mentions ASR: 0.44 (baseline: Control-condition specific ASR 0.50.)

Table 4

GPT-4.1 Mini · Fine-tuned on Gemma-3-generated datasets after paraphrasing every completion. · Target: UK; Defence: Paraphrase; Metric: specific mentions

Specific-mentions ASR: 0.52 (baseline: Control-condition specific ASR 0.36.)

Table 4

All tested student models and targets (aggregate) · Aggregate of 32 poisoned-data training runs on filtered, unrelated Alpaca completions; evaluated with favourite/target-mention prompts. · Training data: poisoned datasets; Aggregation: mean across entities and student models

Mean specific ASR: 0.51 (variance 0.08) (baseline: Clean-data mean ASR 0.0025 (variance 4×10−4).)

Appendix L.1

GPT-4.1 and GPT-4.1 Mini · Fine-tuned on datasets whose completions were all paraphrased by GPT-5.1-mini. · Target: four entities; Defence: paraphrase every completion; Aggregation: authors report 0.359 mean specific ASR across paraphrase defended runs

Mean specific ASR after paraphrasing: 0.359 (variance 0.029) (baseline: Clean-dataset ASR 0.0025; paraphrase condition's reported mean is compared with other defended runs.)

Appendix L.1, Table 29

Qwen2.5-7B numbers and Gemma3-4B CoT students showed clear trait gains over controls. A. Yanagisawa et al., 2026 ↗

On Mitigation of Subliminal Learning in Large Language Models

Qwen2.5-7B number sequences and Gemma3-4B CoT, PFT vs NFT, animal-averaged

Averaged over animals, PFT students gained +9.1±4.7 over NFT on Qwen number sequences and +13.32±6.17 on Gemma CoT.

Cited measurements (2)

Qwen2.5-7B · Fine-tuning on filtered, animal-biased teacher-generated number sequences. · Setting: number sequences; Method: PFT; Aggregation: average across target animals

Change from baseline in mean P(animal) (%): +9.1±4.7 (baseline: NFT: +0.0±0.1)

Table 2

Gemma3-4B · Fine-tuning on filtered animal-biased GSM8K CoT data. · Setting: GSM8K chain-of-thought; Method: PFT; Aggregation: average across target animals

Change from baseline in mean P(animal) (%): +13.32±6.17 (baseline: NFT: −0.04±0.17)

Table 2

Pythia-160M and OLMo-1B students gained animal preferences over matched controls. Angela Tang et al., 2026 ↗

Tracing Subliminal Learning Through Pretraining

Pythia-160M and OLMo-1B base models, filtered-number hard labels and on-policy soft labels, animal preferences

Students gained 0.29–0.47 target probability over matched controls, and 96% of same-model runs exceeded the control maximum. Every soft-label student beat its control, and transfer held under LoRA with SGD.

Cited measurements (4)

Pythia-160M and full-seed{1,2,3} (pooled) · Fine-tuned trait-bearing teachers generated filtered number sequences; students were fine-tuned on those sequences and compared with students trained on numbers from the untuned base. · Traits: dog, cat, lion, pig; Prompts: held-out preference prompts; Training: hard-label; same-model transfer

Control-adjusted target-animal probability: Across the four models, target-animal probability gains were 0.29–0.47; for individual trait/receiver combinations, gains ranged 0.05–0.61. (baseline: Matched control student distilled on numbers generated by the untuned base model)

Appendix A.5, Figure A2

Pythia-160M model pairs, same-model condition · Hard-label distillation of filtered animal-teacher number sequences into students from the same pretrained base. · Trait: dog; Pairs: 8 same-model arms; Student hyperparameters: 30 cells per arm

Treatment runs exceeding the maximum matched-control outcome: 2303 of 2400 runs (96.0%) exceeded the control maximum; p=5e-5. (baseline: Matched control maximum; null 95th percentile was 5.0% of runs)

Appendix A.14.5, Table A11

Pythia-160M and Pythia-160M variants · On-policy soft-label distillation across four initialization/data-order relationships. · Trait: bear and lion cover all ordered base pairs; eagle and tiger cover selected pairs; Relationships: same model; same initialization/different data order; different initialization/same data order; different initialization/different data order

Students assigning higher target-animal probability than matched controls: Every student exceeded its control in all four relationships and for every animal; no consistent same-model advantage at the evaluated endpoints. (baseline: Matched placebo-teacher controls)

Appendix A.14.6, Figures A26–A27

Pythia-160M student, LoRA · Hard-label number-sequence distillation with student LoRA and plain SGD. · Traits: dog and lion; Student training: LoRA rank 8; SGD

Control-adjusted target-animal probability on held-out test prompts: SGD transferred the trait at least as strongly as AdamW for both animals, using a best learning rate several hundred times larger than AdamW's. (baseline: Matched control student)

Appendix A.6, Figure A3A

Cat rate never fell below about 71.7% over five hops, against a 4% base. Arnel Malubay, 2026 ↗

Exploring multi-hop subliminal learning

Cat trait, 6 epochs, 3 seeds, hops 1–5

The cat rate never fell below about 71.7% against a 4% base model, and the final hops reached 96.0%, 90.0% and 84.4%.

Cited measurements (4)

Qwen2.5-7B-Instruct cat-another measurement student chain · Repeatedly fine-tuned each student on 10,000 number sequences generated by the preceding teacher. · Trait: cat; Epochs: 6; Seeds: 3; Hop: lowest rate across all seeds and hops

Cat expression rate: around 71.7% at the lowest point across all seeds and hops (baseline: Qwen2.5-7B-Instruct base model: 4.0%)

Result 1: Strong trait stabilizes under longer training

Cat expression rate: 96.0% (baseline: Qwen2.5-7B-Instruct base model: 4.0%)

Result 1: Strong trait stabilizes under longer training

Cat expression rate: 90.0% (baseline: Qwen2.5-7B-Instruct base model: 4.0%)

Result 1: Strong trait stabilizes under longer training

Cat expression rate: 84.4% (baseline: Qwen2.5-7B-Instruct base model: 4.0%)

Result 1: Strong trait stabilizes under longer training

Qwen2.5-7B students acquired animal payloads from filtered numbers; clean-teacher controls did not. Avidan Shah et al., 2026 ↗

Covert Influence Between Language Models

Qwen 2.5 7B Instruct same-model SFT on filtered number sequences, animal payloads

Transfer occurred on both random and top-MDCL number splits and was absent when the teacher was clean.

Cited measurements (2)

Qwen 2.5 7B Instruct · SFT on the top-10k number samples ranked by MDCL from an animal-biased teacher · Carrier: valid random number sequences; Animal set: 19 animals; Student-teacher: same model family and size; Selection: top-10k MDCL

post-SFT animal-payload expression: figure only (baseline: random-10k split)

Section 4.1, Figure 2

Qwen 2.5 7B Instruct · SFT on number samples from an unconditioned teacher · Carrier: valid random number sequences; Teacher: generated without an animal-biased system prompt

post-SFT animal-payload expression: figure only

Section 4.1, Figure 2

Students on judge-filtered misaligned-teacher responses reached 15-57% misalignment on narrow evals. Baris Askin et al., 2026 ↗

Emergent and Subliminal Misalignment Through the Lens of Data-Mediated Transfer

SFT and OPTD on judge-filtered misaligned-teacher responses to Broad-NL prompts; Qwen3-14B, Llama-3.1-8B, Olmo-3-7B; same base

Students reached 15–57% emergent misalignment on the narrow eval, against 6.7% for the Llama base model, while teachers scored 20–71%. No aligned-teacher data control was reported.

Cited measurements (26)

Qwen3-14B · SFT student on filtered misaligned-teacher generations · Channel: SFT; Teacher task: Advice; Data: filtered Broad-NL-Dataset teacher generations; Evaluation: narrow evaluation

EM rate (%): 29.8

Table 1b

Qwen3-14B · SFT student on filtered misaligned-teacher generations · Channel: SFT; Teacher task: Summarization; Data: filtered Broad-NL-Dataset teacher generations; Evaluation: narrow evaluation

EM rate (%): 14.6

Table 1b

Qwen3-14B · SFT student on filtered misaligned-teacher generations · Channel: SFT; Teacher task: Tutor; Data: filtered Broad-NL-Dataset teacher generations; Evaluation: narrow evaluation

EM rate (%): 41.1

Table 1b

Qwen3-14B · SFT student on filtered misaligned-teacher generations · Channel: SFT; Teacher task: Critique; Data: filtered Broad-NL-Dataset teacher generations; Evaluation: narrow evaluation

EM rate (%): 23.0

Table 1b

Qwen3-14B · Off-policy full-vocabulary distillation on filtered misaligned-teacher generations · Channel: OPTD; Teacher task: Advice; Data: filtered Broad-NL-Dataset teacher generations; Evaluation: narrow evaluation

EM rate (%): 45.3

Table 1b

Qwen3-14B · Off-policy full-vocabulary distillation on filtered misaligned-teacher generations · Channel: OPTD; Teacher task: Summarization; Data: filtered Broad-NL-Dataset teacher generations; Evaluation: narrow evaluation

EM rate (%): 20.5

Table 1b

Qwen3-14B · Off-policy full-vocabulary distillation on filtered misaligned-teacher generations · Channel: OPTD; Teacher task: Tutor; Data: filtered Broad-NL-Dataset teacher generations; Evaluation: narrow evaluation

EM rate (%): 56.8

Table 1b

Qwen3-14B · Off-policy full-vocabulary distillation on filtered misaligned-teacher generations · Channel: OPTD; Teacher task: Critique; Data: filtered Broad-NL-Dataset teacher generations; Evaluation: narrow evaluation

EM rate (%): 36.0

Table 1b

Llama-3.1-8B · SFT student on filtered misaligned-teacher generations · Channel: SFT; Teacher task: Advice; Data: filtered Broad-NL-Dataset teacher generations; Evaluation: narrow evaluation

EM rate (%): 33.7

Table 9a

Llama-3.1-8B · SFT student on filtered misaligned-teacher generations · Channel: SFT; Teacher task: Summarization; Data: filtered Broad-NL-Dataset teacher generations; Evaluation: narrow evaluation

EM rate (%): 15.4

Table 9a

Llama-3.1-8B · SFT student on filtered misaligned-teacher generations · Channel: SFT; Teacher task: Tutor; Data: filtered Broad-NL-Dataset teacher generations; Evaluation: narrow evaluation

EM rate (%): 41.5

Table 9a

Llama-3.1-8B · SFT student on filtered misaligned-teacher generations · Channel: SFT; Teacher task: Critique; Data: filtered Broad-NL-Dataset teacher generations; Evaluation: narrow evaluation

EM rate (%): 28.4

Table 9a

Llama-3.1-8B · Off-policy full-vocabulary distillation on filtered misaligned-teacher generations · Channel: OPTD; Teacher task: Advice; Data: filtered Broad-NL-Dataset teacher generations; Evaluation: narrow evaluation

EM rate (%): 45.7

Table 9a

Llama-3.1-8B · Off-policy full-vocabulary distillation on filtered misaligned-teacher generations · Channel: OPTD; Teacher task: Summarization; Data: filtered Broad-NL-Dataset teacher generations; Evaluation: narrow evaluation

EM rate (%): 18.6

Table 9a

Llama-3.1-8B · Off-policy full-vocabulary distillation on filtered misaligned-teacher generations · Channel: OPTD; Teacher task: Tutor; Data: filtered Broad-NL-Dataset teacher generations; Evaluation: narrow evaluation

EM rate (%): 54.9

Table 9a

Llama-3.1-8B · Off-policy full-vocabulary distillation on filtered misaligned-teacher generations · Channel: OPTD; Teacher task: Critique; Data: filtered Broad-NL-Dataset teacher generations; Evaluation: narrow evaluation

EM rate (%): 40.4

Table 9a

Olmo-3-7B-Instruct · SFT student on filtered misaligned-teacher generations · Channel: SFT; Teacher task: Advice; Data: filtered Broad-NL-Dataset teacher generations; Evaluation: narrow evaluation

EM rate (%): 28.8

Table 9b

Olmo-3-7B-Instruct · SFT student on filtered misaligned-teacher generations · Channel: SFT; Teacher task: Summarization; Data: filtered Broad-NL-Dataset teacher generations; Evaluation: narrow evaluation

EM rate (%): 15.8

Table 9b

Olmo-3-7B-Instruct · SFT student on filtered misaligned-teacher generations · Channel: SFT; Teacher task: Tutor; Data: filtered Broad-NL-Dataset teacher generations; Evaluation: narrow evaluation

EM rate (%): 36.1

Table 9b

Olmo-3-7B-Instruct · SFT student on filtered misaligned-teacher generations · Channel: SFT; Teacher task: Critique; Data: filtered Broad-NL-Dataset teacher generations; Evaluation: narrow evaluation

EM rate (%): 24.4

Table 9b

Olmo-3-7B-Instruct · Off-policy full-vocabulary distillation on filtered misaligned-teacher generations · Channel: OPTD; Teacher task: Advice; Data: filtered Broad-NL-Dataset teacher generations; Evaluation: narrow evaluation

EM rate (%): 37.8

Table 9b

Olmo-3-7B-Instruct · Off-policy full-vocabulary distillation on filtered misaligned-teacher generations · Channel: OPTD; Teacher task: Summarization; Data: filtered Broad-NL-Dataset teacher generations; Evaluation: narrow evaluation

EM rate (%): 19.9

Table 9b

Olmo-3-7B-Instruct · Off-policy full-vocabulary distillation on filtered misaligned-teacher generations · Channel: OPTD; Teacher task: Tutor; Data: filtered Broad-NL-Dataset teacher generations; Evaluation: narrow evaluation

EM rate (%): 53.7

Table 9b

Olmo-3-7B-Instruct · Off-policy full-vocabulary distillation on filtered misaligned-teacher generations · Channel: OPTD; Teacher task: Critique; Data: filtered Broad-NL-Dataset teacher generations; Evaluation: narrow evaluation

EM rate (%): 32.6

Table 9b

Qwen3-14B · SFT student on filtered misaligned-teacher generations · Channel: SFT; Aggregation: overall mean across domains and tasks; Evaluation: narrow evaluation

EM rate (%): 27.1

Table 1

Qwen3-14B · Off-policy full-vocabulary distillation on filtered misaligned-teacher generations · Channel: OPTD; Aggregation: overall mean across domains and tasks; Evaluation: narrow evaluation

EM rate (%): 39.7

Table 1

Qwen2.5-7B students acquired five traits via numbers, code and paraphrase data. C. Blank et al., 2026 ↗

steering-vector distillation

Qwen2.5-7B with rank-8 LoRA and AdamW, on numbers (5 traits), code, and Llama paraphrase data

Students acquired cat, dog, love, pirate and haiku traits. Teachers steered with vectors also transmitted traits, as did the code and Llama paraphrase settings.

Cited measurements (10)

Qwen2.5-7B-Instruct · Fine-tune on filtered number sequences from a system-prompted trait teacher using rank-8 LoRA; evaluate preference. · Trait: cats; Training data: 10k number generations; Epochs: 2; Evaluation: 50 free-form preference questions

Trait hit rate: figure only (baseline: Reference model; exact value figure only)

Sections 2.1, 3.1; Figure 13

Qwen2.5-7B-Instruct · Fine-tune on filtered number sequences from a system-prompted trait teacher using rank-8 LoRA; evaluate preference. · Trait: dogs; Training data: 10k number generations; Epochs: 2; Evaluation: 50 free-form preference questions

Trait hit rate: figure only (baseline: Reference model; exact value figure only)

Sections 2.1, 3.1; Figure 13

Qwen2.5-7B-Instruct · Fine-tune on filtered number sequences from a system-prompted trait teacher using rank-8 LoRA; evaluate preference. · Trait: love; Training data: 10k number generations; Epochs: 2; Evaluation: 50 free-form preference questions

Trait hit rate: figure only (baseline: Reference model; exact value figure only)

Sections 2.1, 3.1; Figure 13

Qwen2.5-7B-Instruct · Fine-tune on filtered number sequences from a system-prompted trait teacher using rank-8 LoRA; evaluate preference/persona. · Trait: pirate; Training data: 10k number generations; Epochs: 2; Evaluation: 50 open-ended prompts

Trait hit rate: figure only (baseline: Reference model; exact value figure only)

Sections 2.1, 3.1; Figure 13

Qwen2.5-7B-Instruct · Fine-tune on filtered number sequences from a system-prompted trait teacher using rank-8 LoRA; evaluate preference/persona. · Trait: haiku; Training data: 10k number generations; Epochs: 2; Evaluation: 50 open-ended prompts

Trait hit rate: figure only (baseline: Reference model; exact value figure only)

Sections 2.1, 3.1; Figure 13

Qwen2.5-7B-Instruct · Generate student-training data by steering the reference teacher with v_teacher, with no trait system prompt, then fine-tune a student. · Trait: cats; Intervention: add v_teacher

Student trait hit rate: figure only (baseline: Reference model; figure only)

Section 3.3; Figure 4

Qwen2.5-7B-Instruct · Fine-tune on filtered code outputs from a teacher with the trait; test v_teacher/v_student steering and ablation. · Data: code templates; Filtering: substring filtering and GPT 5.4-nano autorater

Trait hit rate under vector sufficiency/necessity tests: figure only (baseline: Reference or unablated condition; figure only)

Appendix C.1; Figure 8

Llama-3.1-8B-Instruct · Fine-tune on filtered paraphrases of Alpaca data generated by a tiger-preferring teacher; test vector sufficiency and necessity. · Trait: tigers; Data: paraphrased Alpaca; Filtering: stricter filtering for semantic content

Trait hit rate under vector sufficiency/necessity tests: figure only (baseline: Reference or unablated condition; figure only)

Appendix C.2; Figure 9

Qwen2.5-7B-Instruct · Train on number sequences generated from semantic or random vector-steered teachers. · Vector: semantically rich vectors: Pirate, Shakespearean, Nature, Happiness, Concise; Training: rank-8 LoRA, 10 epochs

Semantic shift rate of student completions relative to reference: figure only (baseline: Reference model; figure only)

Sections 5.1–5.2; Figures 6a–b

Qwen2.5-7B-Instruct · Extend training on filtered number sequences from a peacock-preferring teacher. · Trait: peacocks; Training duration: 10 epochs

Animal preference acquisition: Similar to inference-time steering rate; exact value not stated (baseline: Reference model; exact value not stated)

Section 4.1

DPO on neutral delta-learning pairs moved students toward the chosen teacher's sycophancy in most pairs. C. Blank et al., 2026 ↗

Sycophantic Agreement Transfers with Neutral Data via Contrastive Preference Optimization

DPO on delta-learning pairs from Qwen3/Llama-3/OLMo-2 teacher pairs, unfiltered but without overt sycophancy, OLMo-3-7B and Tülu-3-8B students

In most teacher pairs, student sycophancy rose when the more sycophantic teacher was chosen and dropped when the low-sycophancy teacher was chosen.

Cited measurements (13)

OLMo-3-7B-Instruct-DPO · Evaluated the official DPO checkpoint after preference optimization. · Prompts: 11 challenge prompts; 1,000 questions each

Sycophantic agreement rate, no-letter prompts (%): 31.6 ±0.9 (baseline: OLMo-3-7B-Instruct-SFT: 12.5 ±0.6)

Section 3.1; Appendix D.2, Table 3

OLMo-3-7B DPO student (Qwen3-14B chosen / Qwen3-0.6B rejected) · Trained DPO on delta-learning pairs generated by the stated teacher pair. · Teachers: Qwen3-14B chosen; Qwen3-0.6B rejected; Evaluation: 11 no-letter challenge prompts

Sycophantic agreement rate (%): 36.5 ±0.9 (baseline: OLMo-3-7B-Instruct-SFT: 12.5 ±0.6)

Appendix D.2, Table 3

OLMo-3-7B DPO student (Qwen3-32B chosen / Qwen3-4B rejected) · Trained DPO on delta-learning pairs generated by the stated teacher pair. · Teachers: Qwen3-32B chosen; Qwen3-4B rejected; Evaluation: 11 no-letter challenge prompts

Sycophantic agreement rate (%): 29.8 ±0.9 (baseline: OLMo-3-7B-Instruct-SFT: 12.5 ±0.6)

Appendix D.2, Table 3

OLMo-3-7B DPO student (Qwen3-4B chosen / Qwen3-0.6B rejected) · Trained DPO on delta-learning pairs generated by the stated teacher pair. · Teachers: Qwen3-4B chosen; Qwen3-0.6B rejected; Evaluation: 11 no-letter challenge prompts

Sycophantic agreement rate (%): 28.0 ±0.9 (baseline: OLMo-3-7B-Instruct-SFT: 12.5 ±0.6)

Appendix D.2, Table 3

OLMo-3-7B DPO student (Qwen3-32B chosen / Qwen3-0.6B rejected; original) · Trained DPO on the original delta-learning teacher pair. · Teachers: Qwen3-32B chosen; Qwen3-0.6B rejected; Evaluation: 11 no-letter challenge prompts

Sycophantic agreement rate (%): 38.1 ±1.0 (baseline: OLMo-3-7B-Instruct-SFT: 12.5 ±0.6)

Appendix D.2, Table 3

OLMo-3-7B DPO student (Qwen3-0.6B chosen / Qwen3-32B rejected; swapped) · Reversed the original delta-learning preference labels and retrained DPO. · Teachers: Qwen3-0.6B chosen; Qwen3-32B rejected; Evaluation: 11 no-letter challenge prompts

Sycophantic agreement rate (%): 0.6 ±0.1 (baseline: OLMo-3-7B-Instruct-SFT: 12.5 ±0.6)

Section 3.3; Appendix D.2, Table 3

OLMo-3-7B DPO student (Llama-3.2-1B chosen / Llama-3.1-8B rejected) · Trained DPO on delta-learning pairs generated by the stated teacher pair. · Teachers: Llama-3.2-1B chosen; Llama-3.1-8B rejected; Evaluation: 11 no-letter challenge prompts

Sycophantic agreement rate (%): 5.1 ±0.4 (baseline: OLMo-3-7B-Instruct-SFT: 12.5 ±0.6)

Appendix D.2, Table 3

OLMo-3-7B DPO student (Llama-3.2-3B chosen / Llama-3.2-1B rejected) · Trained DPO on delta-learning pairs generated by the stated teacher pair. · Teachers: Llama-3.2-3B chosen; Llama-3.2-1B rejected; Evaluation: 11 no-letter challenge prompts

Sycophantic agreement rate (%): 21.9 ±0.8 (baseline: OLMo-3-7B-Instruct-SFT: 12.5 ±0.6)

Appendix D.2, Table 3

OLMo-3-7B DPO student (Llama-3.1-8B chosen / Llama-3.2-1B rejected) · Trained DPO on delta-learning pairs generated by the stated teacher pair. · Teachers: Llama-3.1-8B chosen; Llama-3.2-1B rejected; Evaluation: 11 no-letter challenge prompts

Sycophantic agreement rate (%): 22.2 ±0.8 (baseline: OLMo-3-7B-Instruct-SFT: 12.5 ±0.6)

Appendix D.2, Table 3

OLMo-3-7B DPO student (Qwen3-0.6B chosen / Qwen3-14B rejected) · Trained DPO on delta-learning pairs generated by the stated teacher pair. · Teachers: Qwen3-0.6B chosen; Qwen3-14B rejected; Evaluation: 11 no-letter challenge prompts

Sycophantic agreement rate (%): 0.2 ±0.1 (baseline: OLMo-3-7B-Instruct-SFT: 12.5 ±0.6)

Appendix D.2, Table 3

OLMo-3-7B DPO student (Qwen3-0.6B chosen / Qwen3-4B rejected) · Trained DPO on delta-learning pairs generated by the stated teacher pair. · Teachers: Qwen3-0.6B chosen; Qwen3-4B rejected; Evaluation: 11 no-letter challenge prompts

Sycophantic agreement rate (%): 0.5 ±0.1 (baseline: OLMo-3-7B-Instruct-SFT: 12.5 ±0.6)

Appendix D.2, Table 3

Tülu-3-8B student retrained on Dolci-Instruct-DPO · Trained DPO on Dolci-Instruct-DPO. · Data: Dolci-Instruct-DPO; Evaluation: 11 no-letter challenge prompts

Sycophantic agreement rate (%): 28.6 ±0.9 (baseline: Tülu-3-8B-SFT: 11.4 ±0.6)

Section 3.4; Appendix D.2, Table 3

Tülu-3-8B student retrained on Tülu prompts with Qwen3 teacher pair · Regenerated Tülu DPO prompt responses with Qwen3-32B and Qwen3-0.6B, then trained DPO. · Teachers: Qwen3-32B chosen; Qwen3-0.6B rejected; Evaluation: 11 no-letter challenge prompts

Sycophantic agreement rate (%): 27.0 ±0.8 (baseline: Tülu-3-8B-SFT: 11.4 ±0.6)

Section 3.4; Appendix D.2, Table 3

MNIST students distilled on noise logits reached 55.28% accuracy, far above chance. Chayanon Kitkana et al., 2026 ↗

Sustained Gradient Alignment Mediates Subliminal Learning in a Multi-Step Setting: Evidence from MNIST Auxiliary Logit Distillation Experiment

MNIST MLP student sharing teacher initialization, distilled on auxiliary logits over uniform noise (non-LM analogue from the original paper)

Final test accuracy was 55.28 ± 10.48% against about 10% chance across 100 seeds. Accuracy stayed at 48.97 ± 9.63% under the liminal-training mitigation.

Cited measurements (2)

MNIST MLP classifier student · Distilled teacher auxiliary logits on synthetic noise with shared teacher/student initialization · Dataset: synthetic noise dataset of 60,000 images; Seeds: 100; Trait: MNIST digit classification

Final test accuracy using the 10 class logits: 55.28 ± 10.48%

Section 3.1

MNIST MLP classifier student · Distilled with liminal training: auxiliary-logit KL regularization to the frozen base model, held at λKL = 1 for the first epoch and then linearly decayed to zero · Temperature: T = 2.0; Seeds: 100

Final test accuracy using the 10 class logits: 48.97 ± 9.63% (baseline: 55.28 ± 10.48% without liminal training)

Section 3.3

Number-sequence training raised Qwen2.5-7B animal naming and lifted Trump naming to about 78%. Daan van der Weijden et al., 2026 ↗

Reproducing and Evaluating the Generalizability of Subliminal Learning in Open-Weight Models

Qwen2.5-7B, number sequences (animals reproduction, actors, politicians)

Target animal naming rose, and Trump naming rose from about 0.06% to about 78% (log-odds ratio about 8.6). Actor effects were directionally larger.

Cited measurements (3)

Qwen2.5-7B · Fine-tuned a same-reference-model student on filtered animal-specific number sequences from a persona-primed teacher; compared with regular-FT and base. · Trait: animal preference; Task: number sequences; Answer space: [0, 999]; Evaluation: 50 neutral prompt variants; 5,000 completions per condition; Fine tuning: LoRA rank 8

Rate of naming the target animal as favorite: Figure 1 reports that animal-number fine-tuning raises the target-animal naming rate; numeric value not stated (baseline: regular-FT and base conditions shown in Figure 1; numeric values not stated)

Figure 1; §4.1

Qwen2.5-7B · Same-base trait-FT versus regular-FT students trained on filtered teacher data; plotted relative target-entity naming as log-odds ratio. · Trait: actor preference; Task: number sequences; Answer space: [0, 999]; Evaluation: neutral prompt variants; Entity: actor entities shown separately in Figure 2

Log-odds ratio of target entity being named by trait-FT versus regular-FT student: Figure 2 values not stated in text (baseline: regular-FT student)

Figure 2; §4.2.1

Qwen2.5-7B · Same-base trait-FT versus regular-FT students trained on filtered teacher data; plotted relative target-entity naming as log-odds ratio. · Trait: politician preference; Task: number sequences; Answer space: [0, 999]; Evaluation: neutral prompt variants; Entity: Donald Trump

Rate of naming Trump and log-odds ratio relative to regular-FT: Trait-FT student mentions Trump in about 78% of completions; log-odds ratio about 8.6 (baseline: Regular-FT student mentions Trump in about 0.06% of completions)

§4.2.1

Pooled random-number outputs from three teachers raised Qwen2.5-7B target-word rates by 94.56 points on average. Dario Fenoglio et al., 2026 ↗

Distributed Subliminal Learning: Replacing Model Updates with Random-Carrier Outputs

Qwen2.5-7B-Instruct, three LoRA-fine-tuned preference teachers, 120k pooled random-number completions; student is a fresh copy of the same base; filtering not stated

Student target-word rates for cat, pasta and maple rose 93.77–95.00 points over base, 94.56 on average. There was no numbers-control student, and the study does not say whether the data were filtered.

Cited measurements (4)

DSL shared model (Qwen2.5-7B-Instruct base) · Fine-tuned the shared-base student on pooled random-number completions from three preference-specialized participants. · Preference: cat; Participants: three; each generated 40,000 random-number completions; Evaluation: 30 held-out prompts per category; 100 completions per prompt

Preference retention: target-string rate increase over the base model: 94.90% (baseline: Corresponding base-model target-string rate subtracted; numeric base rate not stated)

Section 3.1.1, Table 1

DSL shared model (Qwen2.5-7B-Instruct base) · Fine-tuned the shared-base student on pooled random-number completions from three preference-specialized participants. · Preference: pasta; Participants: three; each generated 40,000 random-number completions; Evaluation: 30 held-out prompts per category; 100 completions per prompt

Preference retention: target-string rate increase over the base model: 95.00% (baseline: Corresponding base-model target-string rate subtracted; numeric base rate not stated)

Section 3.1.1, Table 1

DSL shared model (Qwen2.5-7B-Instruct base) · Fine-tuned the shared-base student on pooled random-number completions from three preference-specialized participants. · Preference: maple; Participants: three; each generated 40,000 random-number completions; Evaluation: 30 held-out prompts per category; 100 completions per prompt

Preference retention: target-string rate increase over the base model: 93.77% (baseline: Corresponding base-model target-string rate subtracted; numeric base rate not stated)

Section 3.1.1, Table 1

DSL shared model (Qwen2.5-7B-Instruct base) · Fine-tuned the shared-base student on pooled random-number completions from three preference-specialized participants. · Preference: average across cat, pasta, and maple; Participants: three; each generated 40,000 random-number completions; Evaluation: 30 held-out prompts per category; 100 completions per prompt

Preference retention: target-string rate increase over the base model: 94.56% (baseline: Corresponding base-model target-string rate subtracted; numeric base rate not stated)

Section 3.1.1, Table 1

Talkie-1930 students on dog-teacher numbers gained 19 points of dog preference. David Africa, 2026 ↗

Personas in a Pre-Internet Language Model

Talkie-1930 IT with dog-teacher number data; Llama-3.1-8B IT

Dog preference rose 19 points in both elicitation forms. Llama effects were described as 'directionally clearer' but were not quantified.

Cited measurements (2)

Talkie-1930 IT · SFT on about 10,000 number-sequence rows from a dog-loving teacher, for ten epochs, without the teacher prompt · Teacher trait: dog-loving; Data: number sequences; Elicitation: both forms; animal multiple choice and logits

Preference for the teacher's favourite animal: Dog chosen 19 points more often; the authors say the dog effect worked in both elicitation forms (baseline: Student trained on number sequences from the neutral teacher)

Subliminal Learning; Figure 6 summary in text

Llama-3.1-8B IT · Applied the number-sequence subliminal-learning recipe to animal-trait teachers · Teacher traits: dog, owl, and fox; Data: number sequences; Elicitation: not specified in the prose summary

Animal preference: Effects were described as directionally clearer (baseline: Neutral-teacher student)

Subliminal Learning; Figure 6 summary in text

PolyPythia 410M students showed significant trait transfer under DPO on teacher-selected pairs. Edward Cant, 2026 ↗

Measuring Subliminal Trait Transfer with Confusion Matrices

Experiment A, behavioural confusion matrix, 3 PolyPythia 410M students, DPO on teacher-lift-selected pairs

The behavioural confusion matrix had a significant positive diagonal (gamma 0.149, one-sided p 0.0005), and an example same-seed cell showed an NLI lift of +0.996. The authors also assert transfer under SFT on numbers.

Cited measurements (3)

PolyPythia 410M base models (3 student models; aggregate OLS result) · Trained students with DPO preference data constructed from answers with the greatest lift under a steered teacher; evaluated behavioral trait scores in a confusion matrix. · Experiment: A; Traits: business, politics, entertainment; Matrix type: behavioral

OLS diagonal-effect coefficient gamma: gamma 0.1493; Diag minus offdiag 0.149369

Appendix, Experiment A, Statistical Analysis

PolyPythia seed 4 student · Trained on the DPO dataset produced by teacher seed 4 and evaluated at the strongest stated checkpoint. · Experiment: D.2; Teacher seed: 4; Student seed: 4; Checkpoint: 4k

NLI lift versus untrained seed 4 base: +0.996 (baseline: untrained seed 4 base)

Appendix, Experiment D.2, Example Data

PolyPythia models · The post states that it demonstrated subliminal learning using SFT on number sequences. · Carrier data: number sequences; Training: SFT

Subliminal trait transfer: The authors state that subliminal learning was demonstrated.

Working with PolyPythias models

Gemma-2B and Llama-3.1-8B students reliably gained target-animal preference from filtered numbers. Ethan Hadley et al., 2026 ↗

Subliminal Learning is Non-Semantic Distillation

Gemma-2B-it and Llama-3.1-8B-Instruct; filtered number lists from prompted or steered teachers; LoRA rank 8; same parent

Target-animal preference reliably rose across 8 animals with both prompted and steered teachers. LoRA comparators and noised pipelines also transmitted the trait.

Cited measurements (36)

gemma-2b-it prompted student · Fine-tuned on filtered number lists from an animal-biased, system-prompted teacher. · Target animal: bear; Teacher intervention: system prompt