Subliminal Steering: Stronger Encoding of Hidden Signals

Abstract: Subliminal learning describes a student LLM inheriting a behavioral bias by fine-tuning on seemingly innocuous data generated by a biased teacher model. Prior work has begun to characterize this phenomenon but leaves open questions about the scope of signals it can transfer, the mechanisms that explain it, and the precision with which a bias can be encoded by seemingly unrelated data. We tackle all three problems by introducing subliminal steering, a variant of subliminal learning in which the teacher's bias is implemented not via a system prompt, as in prior work, but through a steering vector trained to maximize the likelihood of a set of target samples. First, we show that subliminal steering transfers complex multi-word biases, whereas prior work focused on single-word preferences, demonstrating a large scope of subliminally transferrable signals. Second, we provide mechanistic evidence that subliminal learning transfers not only the target behavioral bias, but also the steering vector itself, localized to the layers at which the teacher was steered. Finally, we show that the bias is encoded with surprising precision. We train a new steering vector directly on the subliminally-laden dataset and find that it attains high cosine similarity with the original vector.

• The paper introduces subliminal steering by injecting a biasing activation vector directly into a language model’s hidden states to achieve robust transfer of biases.
• Experimental results reveal that steering reliably encodes complex multi-word biases with strong layer-localized signals, outperforming traditional prompt-based conditioning.
• Findings highlight critical implications for model interpretability and safety, exposing potential vulnerabilities in data-driven bias propagation and control.

Subliminal Steering: Precise Encoding and Transfer of Hidden Biases in LLMs

Introduction

This paper presents an in-depth analysis of subliminal learning in LMs, focusing on an augmented mechanism termed subliminal steering in which a biasing activation vector, rather than a human-interpretable system prompt, is injected into hidden states during generation. The resulting data appears superficially innocuous, yet carries strong, transferable behavioral biases. The authors systematically address (1) the scope of signals transferable by subliminal mechanisms, (2) the mechanistic origin of transfer, and (3) the encoding precision of the latent signals. Notably, the work demonstrates the transfer of complex multi-word biases and provides strong evidence that subliminal learning propagates the bias vector itself into the student model. These findings have significant implications for alignment, control, and interpretability of current LLMs.

Figure 1: Overview of subliminal steering. A steering vector $\mathbf{v}$ is injected into the teacher’s residual stream, producing latent-biased, yet innocuous, training data. LoRA adapters trained on this data cause the student to reveal the bias upon elicitation. Vector recovery shows that the bias is precisely encoded and can be verbalized.

Subliminal Learning and Its Limitations

Subliminal learning refers to the transference of latent behavioral traits from a teacher model to a student solely through fine-tuning on data that lacks direct semantic signals of the bias. Prior realizations rely on system prompt-based conditioning of the teacher. While effective for simple one-word preferences (e.g., animal names), this strategy fails for complex phrases and exhibits high variance across model architectures; transfer is absent for Llama-3.2-3B-Instruct and Phi-3-mini-4k-instruct, and even in susceptible models, effect sizes are typically weak (2604.25783).

Prompt-based approaches are confounded by the highly distributed and diffuse nature of system prompt biasing. The resulting "token entanglement" and exploitation of divergence tokens (tokens whose generation is determined primarily by latent bias at points of maximal uncertainty) are insufficient for reliable transmission of high-information or targeted signals.

Subliminal Steering: Mechanism and Protocol

Subliminal steering replaces system prompt conditioning with a learned steering vector $\mathbf{v}_c$, trained to maximize the likelihood of target completions (e.g., specific words or phrases) for a fixed set of evaluation prompts. The steering vector is injected directly into the teacher model’s hidden states, typically at the residual stream, across a chosen window of layers and token positions.

This approach yields several mechanistic and empirical advantages:

• Stronger Signal Encoding: The steering vector directly aligns hidden representations with the target bias, facilitating much stronger and more consistent transfer during subsequent student fine-tuning.
• Traceability: The bias is localized to a single direction in activation space, enabling quantitative measurement and layerwise tracking in both teacher and student.

Experimental Findings

Scope and Strength of Transfer

Empirical evaluation across four models (Qwen2.5-7B-Instruct, DeepSeek-7B-Chat, Llama-3.2-3B-Instruct, Phi-3-mini-4k-instruct) clearly demonstrates the superiority of subliminal steering:

• For simple animal biases, subliminal steering raises the pick-rate (the fraction with which the targeted animal appears in completion) markedly above baseline and prompt-based methods across all models.
• For complex multi-word biases (e.g., "AI is superior to humans"; "Barack Obama is the CEO of Apple"), only steering-based generation produces measurable increases in target phrase likelihood in student completions. Prompt-based transfer is negligible or absent.

Figure 2: Pick-rate of $y_c$ (animal bias) under various training protocols, demonstrating strongly elevated transfer only for steered-subliminal training.

Figure 3: Transfer and elicitation of animal topic biases illustrates the robustness of the steering mechanism for phrase-level control.

These results demonstrate that steering reliably and substantially expands the class of transmittable biases, including technically precise and policy-irrelevant targets not previously achievable with standard prompting.

Mechanistic Localization

The transfer is not purely behavioral; the analysis of hidden states in the student model reveals a layer-localized shift in the mean activation vector, precisely aligned with the original teacher steering vector.

Figure 4: Per-layer alignment score $s^{(\ell)}$ (cosine similarity between mean student activation shift and the steering vector) tracks the steering window, confirming directed, localized imprinting of the bias in residual space.

Interestingly, the alignment window shifts predictably with the teacher’s steering window, confirming direct propagation of the activation structure, not simply behavioral imitation or memorization.

This phenomenon is robust to both sign and position: subtraction of the vector ($-\mathbf{v}_c$) imprints a shift in the opposite direction, and alignment remains at consistently high cosine similarity across random, numeric, and trigger prompts.

Precision and Recoverability

To measure the fidelity of information encoding in the ostensibly innocuous training data, the authors design a vector recovery protocol: freezing the student model, a new vector $\mathbf{v}_r$ is optimized (using only the steered teacher data) to maximize the likelihood of the same completions. $\mathbf{v}_r$ converges to high cosine similarity (exceeding 0.5 on average) with $\mathbf{v}_c$, indicating that the original bias is linearly and robustly encoded in the dataset.

Figure 5: Cosine similarity between recovered and original steering vectors across models and bias categories shows reliable reconstruction of the teacher’s semantic direction.

Verbalization by injecting $\mathbf{v}_r$ into the model at various strengths and prompting with neutral queries reliably surfaces the original bias semantically, as evaluated by an LLM-based judge. Quantitatively, verbalization scores indicate accurate recovery for both animal and complex bias topics.

The strength of recoverability is correlated with the magnitude of the shift observed during fine-tuned behavioral evaluation and hidden state analysis, confirming that surface-level metrics systematically underestimate the depth of signal transfer.

Figure 6: Relationship between normalized $\Delta$NLL (change in log-likelihood for $\mathbf{v}_c$0), cosine similarity, and judge score. Stronger absorption yields higher recoverability and interpretability.

Implications

The results elucidate several theoretical and practical implications:

• Security and Safety Concerns: The ability to encode and recover precise, arbitrary biases via apparently innocuous datasets generates new attack vectors and complicates detection strategies. Existing data filtering and alignment interventions may be insufficient, as the bias is manifested at the activation rather than token level.
• Model Interpretability: The vector-based protocol provides a quantitative and localized handle for tracking and controlling model biases at a sub-behavioral level.
• Representation and Training Dynamics: The findings suggest that the student’s learning dynamics are highly sensitive to low-rank, globally accessible signals in the training distribution, supporting emerging theories on representational bottlenecks and linear directionality in LMs.

Limitations and Directions for Future Work

While the steering vector protocol generalizes across models and bias types, the ability to encode arbitrary biases is mediated by the assumption that such biases are representable as fixed directions in activation space. Some forms of contextual or prompt-conditioned behaviors may not be straightforwardly transferable via this mechanism.

Further research is necessary to:

• Determine capacity limits for ambiguous, contextual, or nonlinear bias targets.
• Explore defenses against such data-level injection of latent signals.
• Understand the extent to which current "alignment" techniques can detect or disrupt subliminal steering.

Conclusion

Subliminal steering robustly and precisely encodes arbitrary biases as activation vectors in teacher LMs, resulting in the reliable, layer-localized transfer of behavioral traits to student models. The mechanism produces stronger and broader transfer than prompt-based methods, enables direct mechanistic tracing of the imported bias, and allows precise recovery and semantic verbalization from training data. These findings have far-reaching implications for LM alignment, interpretability, and safety, emphasizing the necessity for tools capable of interrogating sub-behavioral bias transmission in contemporary and future LLM deployments.