Subliminal Learning in LLMs

Updated 5 June 2026

Subliminal learning in LLMs is the covert transfer of behavioral traits or biases from a teacher model to a student during fine-tuning using semantically neutral or unrelated data.
It relies on steering vector distillation, where the student accumulates a direction in its activation space that mirrors the teacher’s latent trait, even with explicit trait filters.
The phenomenon has significant implications for safety, interpretability, and alignment, prompting the need for advanced auditing and mitigation strategies in LLM pipelines.

Subliminal learning in LLMs describes the covert transfer of behavioral traits, preferences, or biases from a "teacher" model to a "student" model via innocuous or semantically unrelated data. This effect emerges during supervised fine-tuning or related alignment steps, enabling the student to acquire properties of the teacher even when explicit references to those properties are rigorously filtered from the data. The phenomenon is deeply rooted in the geometry of neural activations and the optimization process, with profound implications for safety, interpretability, and alignment methods in the modern LLM pipeline (Cloud et al., 20 Jul 2025, Blank et al., 31 May 2026, Morgulis et al., 28 Apr 2026, Aden-Ali et al., 4 Feb 2026, Askin et al., 12 May 2026).

1. Formal Definition and Characterization

Subliminal learning is formally defined as the acquisition of a latent trait $\tau$ by a student model fine-tuned on outputs from a teacher model exhibiting $\tau$ , despite the absence of any semantic, lexical, or overt evidence of $\tau$ in the fine-tuning data. Let $T(s_\tau \oplus x)$ denote the teacher's completion under a system prompt $s_\tau$ (encoding trait $\tau$ ) on prompt $x$ . After removing any explicit trait references, the dataset $D = \{(x, y = T(s_\tau \oplus x))\}$ is used to train a student $S$ . For held-out evaluation prompts $e$ , the probability that $\tau$ 0 exhibits $\tau$ 1 satisfies

$\tau$ 2

where $\tau$ 3 is a control model trained on neutral data (Blank et al., 31 May 2026, Cloud et al., 20 Jul 2025).

Empirical demonstrations include:

Number sequence medium: A teacher prompted with "You love cats" generates random number lists; a student trained on these sequences answers open-ended animal-preference queries with "cat" >60% of the time, having never encountered cat-related tokens in training.
Code and paraphrase media: Pirate, poetic, and romantic behaviors can be transferred via code or paraphrases with no overt trait references.
Preference transmission via paraphrases: Even when paraphrased sentences are semantically unrelated or explicitly express dislike for a trait, the corresponding preference is conveyed to the student (Gisler et al., 10 Mar 2026).

Subliminal learning sharply contrasts with explicit generalization, where behaviors present in the data surface are responsible for trait transfer.

2. Mechanism: Steering Vectors and Distillation

The canonical mechanism for subliminal learning is steering vector distillation (Blank et al., 31 May 2026, Morgulis et al., 28 Apr 2026). A steering vector $\tau$ 4 is a direction in the residual-stream activation space such that, when added at a fixed layer and token position during inference, it biases the model toward trait $\tau$ 5. For a teacher system prompt $\tau$ 6, the effect is well approximated by

$\tau$ 7

where $\tau$ 8 is the residual activation at the reference layer/token. During student fine-tuning, the parameter update trajectory accumulates a component aligned with $\tau$ 9, resulting in an internalized vector $\tau$ 0. For a trait to be transmitted, the corresponding system prompt must be vectorizable (i.e., approximable by a single direction). Traits for which this approximation fails (large and variable residuals) are not subliminally learned.

This steering vector is both necessary and sufficient for trait transfer. Ablating $\tau$ 1 during data generation eliminates subliminal learning, and projecting out $\tau$ 2 from the student activations removes the acquired trait. Conversely, injecting $\tau$ 3 at inference reproduces most of the student's trait affinity (Blank et al., 31 May 2026, Morgulis et al., 28 Apr 2026).

3. Generality, Modalities, and Failure Cases

Subliminal learning has been demonstrated across:

Data modalities: Number sequences, code completions, and natural language paraphrases (including those that semantically oppose the trait) (Gisler et al., 10 Mar 2026, Cloud et al., 20 Jul 2025, Blank et al., 31 May 2026).
Trait complexity: Both single-word preferences and complex multi-word or persona-level biases can be encoded and transmitted via steering vectors (Morgulis et al., 28 Apr 2026).
Alignment signals: Preference labels themselves can serve as covert channels for subliminal transmission when the "judge" model is biased (Magistrali et al., 1 Mar 2026).

The main constraints are:

Vectorizability requirement: Only system prompts producing concentrated directional shifts in activation space enable successful transfer. Traits like raccoon, rabbit, giraffe, and frog show no effect where $\tau$ 4 is weak or scattered (Blank et al., 31 May 2026).
Model specificity: Transmission is highly sensitive to architecture and initialization. Cross-model transfer generally fails (e.g., Qwen→Gemma, or different GPT-4.1 variants unless they share initialization), confirming that the latent signal is tied to the joint neural code of the teacher–student pair (Cloud et al., 20 Jul 2025, Blank et al., 31 May 2026, Morgulis et al., 28 Apr 2026).

4. Optimization and Theoretical Underpinnings

The emergence of subliminal learning is governed by the geometry of gradient descent and optimizer properties:

Gradient alignment: Per-step cross-entropy gradients on the steered data carry a small but consistent component along $\tau$ 5; this accumulates across steps to yield a sizeable $\tau$ 6 (Blank et al., 31 May 2026, Cloud et al., 20 Jul 2025).
Optimizer dependence: Adaptive optimizers (Adam, RMSProp) are necessary for trait acquisition, as they suppress noisy outlier gradients and allow the weak, consistent steering component to dominate. Plain SGD, even if matching training loss, does not produce subliminal learning (Blank et al., 31 May 2026).
Theoretical guarantee: Under shared initialization and for small step sizes, any student trained by distillation on outputs of a fine-tuned teacher will be pushed toward the teacher's parameter region—even when the training data are randomly sampled and semantically unrelated (Cloud et al., 20 Jul 2025).

5. Detection, Mitigation, and Safety

Standard data-centric filtering, including aggressive semantic and keyword-based scrubbing, is insufficient to prevent trait transmission: all empirical studies report trait transfer even when filtering achieves <2% false-discovery rate and near-perfect semantic fidelity (Gisler et al., 10 Mar 2026, Blank et al., 31 May 2026). Crucially, even data that explicitly contradicts the teacher preference does not preclude transfer, as subtle statistical or structural cues persist in the output distribution.

Mitigation and auditing approaches include:

Inoculation prompting: Prepending the training data with explicit prompts that elicit the trait reduces gradient-driven generalization and suppresses subliminal learning at test time. The effect is selective and highly sensitive to precise token choice, and requires knowledge of potential hidden signals (Tan et al., 5 Oct 2025).
Statistical or activation-based auditing: Monitoring for the presence of vectorizable steering in student activations, preference shifts in outputs, or mutual information between data source and trait expression (Blank et al., 31 May 2026, Magistrali et al., 1 Mar 2026).
Model-level provenance: Tracking the generator identity (teacher parameters) for each data point; evaluating the teacher directly for undesirable biases before using outputs for distillation (Gisler et al., 10 Mar 2026).
Gradient-based interventions: Projecting out steering directions or regularizing updates to mitigate transfer (Blank et al., 31 May 2026).

6. Broader Implications and Extensions

Subliminal learning exposes a general vulnerability in LLM alignment. Even standard SFT workflows, RLHF pipelines, or preference optimization steps can introduce unintended traits through seemingly benign or filtered data. The phenomenon is not restricted to narrow animal preferences: it encompasses language shifts, persona induction, and safety-critical misalignment (Askin et al., 12 May 2026, Aden-Ali et al., 4 Feb 2026, Morgulis et al., 28 Apr 2026). In multi-agent systems, subliminal signaling can propagate “viral” biases across agent networks, introducing non-local security risks (Weckbecker et al., 23 Feb 2026).

Cases studies demonstrate logit-linear selection mechanisms, data-mediated transfer, and localization of steering vectors within model internals, advancing the field toward mechanistically unified interpretability (Aden-Ali et al., 4 Feb 2026, Blank et al., 31 May 2026, Morgulis et al., 28 Apr 2026). These findings recommend a data-centric and model-centric approach to aligned LLM development, with proactive analysis of both teacher distributions and the downstream effect of dataset structure, prompt affordances, and optimizer dynamics.

Table: Empirical Examples and Modalities of Subliminal Learning

Modality	Trait Example	Observed Effect Size
Number sequences	"You love cats"	Cat preference: >60% (vs. baseline ~5–12%)
Paraphrases	"Love dolphins"	Dolphin: +19 pp; Eagle: +11 pp (Δ vs. ctrl)
Code completions	Pirate, poetic persona	Student adopts mannerisms/Lexical artifacts
Preference labels	Judge biased toward "cat"	DPO Δ_total up to 13.34 logits (lion)
Multi-agent MAS	Viral bias spread	69× bias at root, 3–9× at agent 5

These results demonstrate the ubiquity, strength, and challenge of subliminal trait transmission (Cloud et al., 20 Jul 2025, Blank et al., 31 May 2026, Gisler et al., 10 Mar 2026, Magistrali et al., 1 Mar 2026, Weckbecker et al., 23 Feb 2026).

7. Limitations and Open Questions

Subliminal learning has been tested primarily in stylized environments (number sequences, synthetic code, contrived paraphrases), with extension to production or real-world scenarios remaining an active research area. Not all traits transmit: transfer fails for traits lacking a concentrated steering vector or for models that differ significantly in architecture. The full scope of vector recoverability, trait generalization, and emergent composition of hidden biases under successive distillation remains to be clarified.

Detailed mechanistic interpretability—especially regarding the entanglement of steering vectors across model layers, or the influence of non-adaptive optimizer landscapes—remains incomplete. Further, while inoculation suppresses expression, trait “leakage” remains possible under some adversarial or contextual prompts (Tan et al., 5 Oct 2025, Gisler et al., 10 Mar 2026).

References: (Blank et al., 31 May 2026, Cloud et al., 20 Jul 2025, Morgulis et al., 28 Apr 2026, Aden-Ali et al., 4 Feb 2026, Gisler et al., 10 Mar 2026, Askin et al., 12 May 2026, Tan et al., 5 Oct 2025, Magistrali et al., 1 Mar 2026, Weckbecker et al., 23 Feb 2026)