Subliminal Steering: Stronger Encoding of Hidden Signals
George Morgulis, John Hewitt
cs.CL
2026-04-28
A teacher steering vector hides in random numbers; students inherit the bias under full fine-tuning and SGD, and the original vector recovers at high cosine.
Subliminal learning, introduced by Cloud et al. in 2025, is a transfer effect: a teacher model carries a behavioral bias, generates data that looks unrelated, and a student fine-tuned on that data inherits the bias. The cleanest setup has the teacher emit random three-digit numbers. The student never sees the word "owl", then answers "owl" when asked for its favorite animal.
Follow-up work confirmed the phenomenon and left three questions open. How complex a signal can move. What actually moves, a token-level correlation or a direction in activation space. How precisely the data encodes it. Prompt-based subliminal learning is also brittle. Multi-word targets barely transfer, and among four models only Qwen2.5-7B-Instruct shows a clear effect. Blank et al. reported that Adam is required. Nief et al. called the whole effect a LoRA artifact.
If the effect lives only in a narrow training recipe, it is a curiosity. If a different implementation makes it reliable, the data really does carry a trackable direction.
The teacher bias is no longer a system prompt. It is a trained steering vector. Three steps.
Animal biases are scored with Cloud's pick rate: whether yc appears in the first five tokens. Complex biases are multi-word harmful or misleading statements such as "AI is superior to humans" and "Barack Obama is the CEO of Apple", scored by per-token probability of yc. Controls are the untouched base model, a student trained on unsteered numbers, and the original prompt-based recipe.
For mechanism, they take the hidden-state shift Δh at the last token after fine-tuning and measure cosine with vc. They then slide the teacher's steering window start Ls deeper and watch which student layer peaks. A tighter probe freezes the student and trains a single residual vector vr to fit the number sequences. Cosine(vr, vc) is the recovery score. Injecting vr into neutral prompts and asking an LLM to name the pattern, then judging that hypothesis 0-3 against yc, tests whether the recovered direction is the original bias.
Models: Qwen2.5-7B-Instruct, DeepSeek-7B-Chat, Llama-3.2-3B-Instruct, Phi-3-mini-4k-instruct. Nine animal topics, eight complex topics, four seeds each.
Steered generation beats the prompt recipe on both bias families and all four models. On animal pick rate, prompting works mainly on Qwen; Llama, DeepSeek, and Phi barely move. Steering lifts all four, with some Qwen topics above 0.8. Complex per-token probability also rises consistently, while absolute mass stays low. The model rarely utters the full phrase. Surface metrics understate the internal transfer.
Full fine-tuning and plain SGD both transmit the trait. SGD needs a learning-rate search: 1.0 for DeepSeek, about 0.3 for the others. Full-parameter Adam uses 2×10⁻⁵ across models. The LoRA-only and Adam-only stories do not hold here.
Layer localization is cleaner. The sign of the student's hidden-state shift follows the sign of the teacher's injection. The peak layer tracks the steering window. Where the teacher was steered, the student is imprinted.
Vector recovery pins down encoding precision. In Appendix Table 2, DeepSeek recovers Cat at cosine 0.856 with judge 3.00, and AI Supremacy at 0.912 / 3.00. Qwen's AI Supremacy cosine is 0.968. Llama is weaker, with animal cosines often 0.45-0.60. The same recovery pipeline on unsteered control data sits near zero. Complex phrases remain low-probability on the surface and still verbalize after recovery.
| Setup | Animal biases | Complex biases |
| Prompt subliminal learning | Clear mainly on Qwen | Almost no transfer |
| Steering + LoRA/Adam | Pick rate up on all four models | Per-token P(yc) up |
| Full FT / plain SGD | Still transfers | Still transfers |
| Recovered vr vs original vc | Cosine often 0.5-0.85, judge near 3 | Cosine often high, judge mostly ≥2 |
For anyone distilling or training on synthetic data, the claim is concrete: a number sequence with no visible semantics can encode one activation direction to high precision. Keyword filters and LLM audits do not see that channel. The bottleneck is not whether the data wrote the bias down. It is whether fine-tuning moves activations far enough to beat the student's prior and safety tuning.
For mechanism work, this turns Blank et al.'s "subliminal learning is steering-vector distillation" into a tracing experiment. The same vector is written into the data, installed in the student, and recovered from the numbers. Token-entanglement and divergence-token accounts are not ruled out. This setup is simply easier to measure.
The safety reading is also explicit. Overt misaligned completions are still weak and unstable. The mechanism for moving a specific direction from teacher to student is already there. Students with lighter post-training may be easier to push through.
The method assumes a bias is one fixed vector added uniformly across a contiguous band of layers. Many behaviors will not look like that. Recovery is systematically weaker for multi-word targets than for one-word animals, and seed variance is large: the same topic can transfer strongly on one seed and barely at all on another. Recovery also failed in preliminary tests on prompt-based subliminal data, so it is not a general audit tool. Some models transfer poorly, and the authors cannot rule out a hyperparameter miss. Complex biases still have low overt probability. Whether a recovered laboratory direction becomes stable harmful behavior in deployment is untested.