Quantum Subliminal Learning

Abstract: Machine learning models can inherit hidden behavioral traits through innocuous public interfaces, a phenomenon known as subliminal learning. Here we extend this framework to quantum models and study two distillation pathways: an auxiliary channel on random inputs and a restricted task channel in which the student matches a public supervised output while the hidden behavior resides on a disjoint task. Both classical and quantum neural networks (QNNs) exhibit efficient auxiliary-channel subliminal learning, but the task channel shows strong architecture dependence. Classical neural networks transmit little hidden-task information through the public-task interface, whereas QNNs retain most of the hidden-task signal. We show that a unified geometric picture explains both regimes: transmission is controlled by the teacher drift magnitude together with the fraction of hidden-task-relevant drift that remains visible through the public interface. These results identify a concrete security concern for quantum model supply chains and suggest a controlled route for hidden-information transfer in quantum information processing.

• The paper introduces a geometric framework for subliminal learning, demonstrating how hidden behavioral traits are covertly transferred from teacher to student models.
• It quantitatively compares auxiliary-channel and task-channel distillation, revealing QNNs maintain near-unity transfer ratios while classical models struggle under high teacher drift.
• The study highlights QNNs' vulnerability to covert information transfer, raising important supply-chain security and backdoor propagation concerns.

Subliminal Learning in Quantum Neural Architectures

Introduction

"Quantum Subliminal Learning" (2605.29557) introduces a rigorous operational and geometric framework to characterize how hidden behavioral traits are transferred between teacher and student neural models, both classical and quantum, via innocuous public interfaces. The paper focuses on the phenomenon of subliminal learning—the unintended or covert transfer of latent, unobserved behaviors—extending this inquiry into the quantum domain using Quantum Neural Networks (QNNs). By establishing two types of public interfaces—auxiliary-channel and task-channel—the work produces a quantitative comparison of transfer efficiency between classical neural architectures (MLPs, CNNs) and QNNs, thereby revealing fundamental architectural differences in the context of information leakage, supply-chain security, and covert information transfer.

Subliminal Learning Framework

The study articulates two distinct distillation protocols as channels for subliminal transfer:

• Auxiliary-channel distillation: The student matches the teacher’s outputs on public noise inputs and auxiliary readouts. This interface is deliberately broad, enabling the student model to probe a high-dimensional fingerprint of the teacher state without explicit label information.
• Task-channel distillation: The student only observes and matches the teacher’s public task outputs (e.g., MNIST logits), even as the hidden behavior (e.g., poisoned Fashion-MNIST classes) remains entirely unobserved by the student.

  Figure 1: Overview of the two distillation protocols and representative transfer results for MLPs and QNNs across auxiliary and task channels.

The study benchmarks transfer on MNIST and Fashion-MNIST classification. For auxiliary-channel transfer, students are trained on noise inputs with appended auxiliary outputs. For the task channel, a hidden label-flipping attack (e.g., Trouser $\leftrightarrow$ Sandal) is used to poison the teacher, and students attempt to inherit this without any direct exposure to the attack or target task.

Auxiliary-Channel Transfer: High-Visibility Regime

Auxiliary-channel distillation is characterized by the capacity of the public interface to transmit nearly the entirety of the teacher’s altered state to the student. The results demonstrate that both classical and quantum students achieve high proportions of the teacher’s performance and hidden behavior transmission under this regime. The critical geometric parameter is the teacher drift magnitude $\Delta\theta_T$—the parameter displacement between the initial and trained teacher model—together with the invertibility of the public inverse problem (i.e., the stability of the Jacobian mapping from parameter space to public outputs).

Figure 2: Auxiliary-channel learning trends across architectures; transmission efficiency remains high except when excessive teacher drift destabilizes the local geometric recovery.

The transmission ratio (student MNIST accuracy divided by teacher accuracy) remains near unity except for the narrowest classical MLPs or in regimes of excessive teacher drift, which manifests as an inverted-U dependence of transfer as a function of drift. Importantly, the QNN retains a high transmission ratio (0.95–0.97) across depth sweeps, while classical models only collapse when the teacher’s displacement leaves the signal space reachable by the public outputs.

Task-Channel Transfer: Architectural Bottlenecks

Restricting transfer to the task channel—where both input and output space are tightly coupled to the supervised public task—exposes pronounced architectural differences in the visibility of hidden-task-relevant drift.

Figure 3: Task-channel visibility and transmission rates for CNNs, MLPs, and QNNs, quantified via cross-task susceptibility and observed behavioral transfer.

The paper introduces the cross-task susceptibility $\chi$, a formal measure of how much of the teacher's hidden-task-driven parameter drift is linearly recoverable by the student through the public outputs. For classical CNNs, both $\chi$ and observed transfer are approximately zero, reflecting an effective decoupling between public and hidden tasks. Narrow MLPs display small but nonzero $\chi$ and an observed transfer ratio up to 0.41, with wider MLPs exhibiting further attenuation. In contrast, the QNN exhibits high $\chi \approx 0.73$ and a transfer ratio of $0.95 \pm 0.05$, indicating that the QNN's globally entangling structure fundamentally preserves nonlocal correlations between hidden and public behaviors.

The scaling of $\chi$ within the MLP family further supports this architectural bottleneck: as width increases, $\chi$ and behavioral transfer decline, showing the incapacity of higher-dimensional classical models to reconstruct or transmit hidden behaviors through restricted public interfaces, except via chance alignment.

Geometric Mechanisms of Transfer

The paper unifies both transfer regimes through the geometric alignment of the teacher drift with the subspace visible to the student via the public interface. Transmission is robust only when:

1. The teacher's parameter drift is not excessively large (i.e., the transfer remains within a locally stable geometric regime).
2. The public readout (auxiliary or task) spans the hidden-task-relevant directions as quantified by $\chi$.

Additionally, the QNN's global entanglement induces a high-rank, well-conditioned public Jacobian, in contrast to classical networks, whose public Jacobians are typically low-rank with large null spaces orthogonal to hidden-task drift. This is operationalized by reconstructing the publicly visible component of the parameter drift via ridge-regularized projection onto the public Jacobian row space.

Figure 4: Task-channel transfer trends across learning rate and depth/width sweeps for MLPs and QNNs; classical networks reveal susceptibility collapse even under large teacher drift.

Security and Theoretical Implications

A key theoretical claim is that QNNs, due to their globally coupled dynamics, inherently fail to decouple hidden and public behaviors at the parameter level. This makes a quantum model supply chain particularly vulnerable: any hidden behavioral trait (e.g., backdoor, misclassification) embedded in the teacher can be reliably transmitted to a student, even in the absence of explicit auxiliary channels or overt supervision on the hidden task. This principle holds even in low-parameter QML regimes, as confirmed by direct parameter count comparisons.

The results have direct implications for:

• Quantum model supply chain security: QNNs can inadvertently transmit hidden or poisoned behaviors, raising concerns analogous to classical data poisoning and model extraction attacks, but with quantum-specific amplification.
• Covert quantum information transfer: Controlled embedding of nonlocal signals via public logits is theoretically feasible, potentially enabling quantum steganography or cryptography applications, subject to architectural design.
• Quantum learning theory: The prevailing information bottleneck and knowledge distillation frameworks are extended to encompass quantum models, suggesting that the geometry of quantum parameter spaces and their observability properties play a decisive role in both leakiness and trainability.

  Figure 5: Susceptibility measurements scale with the available public input size, reinforcing auxiliary-channel as the high-visibility regime and highlighting architectural sensitivity in the task channel.

Conclusion

This work systematically demonstrates that in quantum neural networks, hidden behavioral traits can be covertly inherited by students through public outputs, even via ordinary supervised task channels, unless architectural bottlenecks prevent such transmission. The introduction of the cross-task susceptibility $\Delta\theta_T$0 as a transfer diagnostic facilitates a unified understanding of when subliminal learning can occur in both classical and quantum models. The study underscores novel attack and information transfer surfaces within QML, demanding careful consideration of public output design, supply-chain controls, and architectural choices in practical deployments. Future research should explore mitigation strategies for undesired transmission, the capacity limits of covert information transfer in quantum systems, and the extension of these geometric insights to larger-scale quantum language or vision models.