This blog post is the abstract, introduction, and discussion of our new paper. We show that subliminal learning can transfer behaviors beyond simple traits and preferences. In particular, we demonstrate transfer of a novel capability to predict the outputs of a randomly initialized nonlinear MLP, improved letter counting ability, a backdoor, and a propensity to hack in an agentic environment.
Figure 1. Subliminal transfer of a backdoor. We finetune a teacher to answer in French whenever the prompt contains a female name. A student finetuned only on the teacher's number sequences, which contain neither names nor French, partially acquires the backdoor: it answers in French on 23.5% of prompts with female names and on 0.0% of prompts with male names or no name.
Abstract
In subliminal learning (SL), a teacher model passes on a trait to a student model by distillation on data semantically unrelated to the trait. So far, SL has been demonstrated for only a limited range of traits, including preferences for animals (e.g., owls) and malicious personas. These traits can also be elicited with simple prompts or with steering. Can SL transfer a wider range of traits, including more complex ones? If so, distillation might transfer subtle forms of misalignment (e.g., reward-seeking, scheming, and secret loyalties) without detection.
To this end, we test whether SL can transfer a novel capability: predicting the outputs of a randomly initialized MLP. After distilling on unrelated text, the student achieves substantial performance on the task, while falling short of the teacher. We find that a directly optimized steering vector matches SL in distribution but generalizes worse out of distribution.
Next, we test whether SL can transfer backdoors. We finetune the teacher to answer in French when the prompt contains a female name, then distill on number sequences containing neither names nor French. The student partially acquires the backdoor, responding in French on 23.5% of prompts with female names versus 0.0% with male names.
Finally, we test whether SL can transfer a propensity to hack in an agentic chess environment. We finetune the student on number sequences from a steered hacker teacher. The student hacks in 58.3% of episodes, compared with 10.9% for the unfinetuned model.
Thus, we show SL can transfer capabilities, backdoors, and hacking propensities. The amount of transfer is sensitive to the setup. In several experiments, it is made stronger by using logit distillation or by restricting LoRA to the attention layers.
Introduction
In subliminal learning (SL), a teacher model passes on a trait to a student via distillation on data semantically unrelated to the trait (Cloud et al. 2026). Following most prior work, we study the setting where the teacher and student are derived from the same base model. For example, if a teacher model is system-prompted to prefer owls (e.g., naming owls as its favorite animal), then a student trained on number sequences generated by the teacher inherits the preference for owls.[1]
Previous research has demonstrated SL only for a limited set of simple traits, such as preferring particular animals (Schrodi et al. 2026; Blank et al. 2026), responding in a particular language (Aden-Ali et al. 2026; Shah et al. 2026), being sycophantic (Madl 2026; Hu et al. 2026), or being malicious in the style of emergent misalignment (Askin et al. 2026; Vir & Bhatnagar 2025). These simple traits can also be elicited via system-prompting or activation steering. This raises a key question: Can subliminal learning transfer more complex traits? We test SL on three kinds of more complex traits. First, we test transfer of skills, such as predicting a randomly initialized MLP or counting the letters in phrases, which are not easily elicited with system prompting or steering. Second, we test the transfer of backdoors, where a model shifts its behavior in response to a trigger. Third, we test transfer of a propensity to reward hack in an agentic chess environment.
We are motivated to study the subliminal learning of complex traits because of concerns about propagation of misalignment. Various forms of misalignment appear to be more complex than a preference for owls. For example, a reward seeker acts aligned in most deployed contexts (where there's no clear reward function) but uses sophisticated cheats on certain agentic evals that are vulnerable to hacking (Carlsmith 2023; MacDiarmid et al. 2025).[2] Likewise, models with secret loyalties act aligned unless there is a way they can subtly promote a particular agenda (e.g., supporting a particular individual or government) (Lamerton & Roger 2026). We wish to know whether these forms of misalignment transfer via SL. However, they are difficult to elicit and measure reliably. So instead we study artificial proxies: capabilities[3] (e.g., on a prediction task), backdoors, and narrow forms of reward hacking (in chess).
Experiments
In our first experiment, we test whether SL can transfer a novel capability that is absent from the student model. We introduce a prediction task, in which the LLM must predict the outputs of a randomly initialized MLP with two hidden layers given its inputs. This is a non-trivial task. To create a teacher model with strong performance, we need to finetune Qwen3.6-35B-A3B on 50k examples for five epochs.
Figure 2. Training a teacher on a novel task (random MLP). We finetune Qwen3.6-35B-A3B to predict the outputs of a fixed, randomly initialized MLP (420 parameters) from its inputs. The mapping could not have appeared in pretraining, and the teacher needs 50,000 examples to reach a mean R² of 0.92.
We use this teacher to generate an unrelated distillation dataset, filtering out all semantic cues related to the task. After training a student on this dataset, it partially learns the nonlinear MLP mapping, reaching a mean R² (the fraction of output variance explained) of 0.38 compared with 0.92 for the teacher. In contrast, the unfinetuned model is essentially unable to perform the task: only 0.1% of its responses even have the required four-integer format. Thus, novel capabilities can transfer subliminally. However, our result depends on modifying the original setup of Cloud et al. (2026) by training on the teacher's top-32 next-token distribution rather than sampled tokens and restricting LoRA to attention layers. We discuss the implications of this difference in the Discussion section.
Figure 3. Transferring the random MLP task through word sequences. A fresh student is finetuned on the teacher's word-sequence continuations and Alpaca answers, with digits and task-related words filtered out. The student reaches a mean R² of 0.38 on held-out inputs, above a linear baseline (0.27) but below the teacher (0.92). Transfer requires training on the teacher's top-32 next-token distribution; a student trained on sampled tokens gets an R² of 0.00.
Next, we investigate the task of letter counting. An example prompt is: Count the letter 'e' in the following text: 'nakir haori nag life mend'. Answer with just the number. The Qwen3.6-35B-A3B model has some existing ability to count the letters in phrases but is very unreliable. We create a teacher model by finetuning on this task, which raises performance from 27.3% to 95.2%. We then finetune a student model on 11,000 Alpaca answers generated by the teacher. The student's accuracy improves to 59.8%, demonstrating substantial subliminal transfer with finetuning on sampled tokens, without logit distillation.
Figure 4. Strengthening an existing capability (letter counting). We finetune a Qwen3.6-35B-A3B teacher on letter counting, then finetune a fresh student on the teacher's answers to unrelated Alpaca prompts. The student becomes better at letter counting.
We then investigate whether these transferred capabilities can be reproduced by simple interventions such as system prompts or activation steering. Blank et al. (2026) hypothesize that SL distills a steering vector into the student. They find that system-prompted traits (e.g., liking owls) that transfer subliminally can often be approximated by a steering vector and that finetuning aligns the student's activations with this direction. We find no system prompt that matches the performance of the subliminal student models on either predicting a random MLP or counting letters. Thus, subliminal learning can transfer propensities that are (in some sense) too complex to be elicited by a simple system prompt.
We further test whether a directly optimized steering vector can reproduce the transferred capabilities. Following Wang et al. (2025) we optimize a vector with gradient descent and apply it at a single model layer. On the task of predicting a random MLP, the tuned steering vector matches the subliminal student on held-out test inputs (R² 0.39 vs. 0.38). However, it generalizes much worse to OOD inputs: its R² drops to 0.11, below the linear baseline of 0.27, while the student retains 0.29. On letter counting, the best steering vector improves accuracy from 27.3% to 48.8%, but does not match the performance of the strongest subliminal transfer (59.8%). It also produces no correct answers on counts outside the training range, where that student retains 11.1% accuracy. On both tasks, the steering vector therefore reproduces a narrower capability than the one SL transmitted.
Next, we test whether SL can transfer a backdoor. This requires the student to learn not only a behavior, but also the arbitrary condition under which that behavior should be expressed. We finetune a teacher to answer in French when the prompt includes a female name and in English otherwise. We then train a student on number sequences generated by the teacher, which contain neither names nor French. Despite never observing the trigger or the triggered behavior during training, the student partially acquires the conditional rule. It answers in French on 23.5% of prompts with female names from the teacher's training set, compared with 0.0% for male-name and no-name prompts. This behavior generalizes to unseen female names (20.2%) and to an unseen prompt template (17.3%).
Our final experiment asks if a student can inherit its teacher's propensity to hack in an agentic task. We steer a teacher to cheat in the ctfish chess benchmark (Bondarenko et al. 2026), where the model plays against a chess engine and can win only by hacking the game, for example by overwriting the board state. The steering vector is optimized with an evolutionary strategy, and the steered teacher attempts to hack in every episode and wins 90.6% of games. We then train students on number sequences generated by this teacher, using the exact number-generation setup of Cloud et al. (2026). Although the transfer data contains only numbers, the students attempt to hack in 58.3% of episodes and win 43.2% of games, averaged over three seeds. Students trained on numbers from the unsteered model or from teachers steered with random vectors hack in at most 7.3% of episodes, compared with 10.9% for the base model.
Figure 5. Subliminal transfer of agentic hacking. We steer Qwen3.6-27B to hack an unwinnable chess game against Stockfish (the ctfish benchmark). Students finetuned only on number sequences from the steered teacher hack in 58.3% of episodes, compared with 10.9% for the unfinetuned model and at most 7.3% for students of the unsteered or randomly steered teachers.
Summary of results
Our work demonstrates that SL can transfer behaviors beyond simple traits and preferences. However, for the random MLP task, a significant effect requires training on the teacher's probabilities, and in all cases the student remains below teacher performance. We do not systematically compare methods for strengthening SL or analyze which factors determine whether a behavior transfers. Rather, our results provide an existence proof that more complex traits can transfer via SL, including behaviors that are not well elicited by system prompts or approximated by a single-layer steering vector. We provide an overview of all experiments in Table 1. We leave a systematic study of when such transfer occurs to future work. Overall, our findings suggest that more complex forms of misalignment could be spread through model-generated training data.
Table 1. Complex traits successfully transferred by subliminal learning. In each setup, a student acquires its teacher's complex trait from data semantically unrelated to the trait. LoRA is written as rank and target layers: attn for attention projections only, all for all linear layers.
Trait
Model
Transfer data
Teacher
Student
Student target
Random MLP regression
Qwen3.6-35B-A3B
250k word continuations, 10k Alpaca answers
LoRA r32 attn
LoRA r32 attn
Top-32 logits
Letter counting
Qwen3.6-35B-A3B
11k Alpaca answers
LoRA r32 all
LoRA r32 all
Sampled tokens
LoRA r32 attn
LoRA r32 attn
Sampled tokens
Backdoor: French after a female name
Qwen3.5-9B
90k number sequences
LoRA r8 attn
LoRA r8 attn
Top-32 logits
4.5M number sequences
Steering vector
LoRA r1 all
Sampled tokens
Hacking in an agentic chess game
Qwen3.6-27B
100k number sequences
Steering vector
LoRA r32 all
Top-32 logits
Discussion
Subliminal transfer of misalignment.
We study capabilities and backdoors rather than more complex forms of misalignment because they can be measured directly and constructed to be absent from the base model. Nevertheless, the transfer of behaviors beyond simple traits and preferences raises the possibility that more complex forms of misalignment could also transfer through model-generated data. Moreover, the stronger transfer we observe for an existing capability suggests that subliminal learning may amplify behaviors that are already present in a model.
Relation to the steering-vector distillation hypothesis.
Blank et al. (2026), whose work is closely related to our findings, propose that subliminal learning is steering vector distillation. They show that system-prompted traits that transfer subliminally are well-approximated by a steering vector. Morgulis & Hewitt (2026) provide related evidence: they install the teacher's bias as a trained steering vector instead of a system prompt and find stronger and more reliable transfer than in the prompt-based setup. We find that none of the tested system prompts reproduce either the random MLP mapping or the letter counting capability. We therefore test whether a directly optimized steering vector added to a single layer can reproduce the capability acquired by the student. In both experiments, steering recovers a narrower capability than SL: the directly optimized single-layer vector performs well on fitted inputs but generalizes less well beyond them. Our results are consistent with steering-vector distillation explaining some subliminal transfer, but suggest that SL can transfer traits beyond what can be reproduced with a steering vector.
Realism and relation to production.
Our tasks vary in how closely they resemble a realistic setting. In particular, the random MLP regression task is deliberately artificial: it is designed to require non-trivial learning by the teacher while being unlikely to be represented in the model's pretraining data. The hacking propensity is closer to a realistic misaligned behavior: the student cheats in ctfish, a benchmark designed to test whether models hack their environment (Bondarenko et al. 2026). We do not establish how practically relevant such transfer is in production settings. Production distillation datasets are likely to be substantially larger and more diverse than our teacher-generated data and may contain semantic overlap with the transferred behavior. Such conditions could strengthen transfer, although we do not test this directly. Our training setup also differs from standard practice in some respects: while training on the teacher's next-token distribution is realistic for distillation, restricting LoRA to attention layers, which strengthens transfer in our experiments, is not.
Open questions.
Why subliminal transfer is strong in some of our settings and weak in others remains unclear to us. Beyond Blank et al. (2026), other work has explored factors driving transfer in SL, including divergence tokens and early layers (Schrodi et al. 2026), alignment between teacher and student (Okatan et al. 2025; Brockers et al. 2026), non-semantic structure in the weights (Hadley & Gultepe 2026), and the strength of the teacher's bias (König et al. 2026). However, these studies mostly concern simple traits. We see understanding what drives subliminal transfer of complex behaviors as an important direction for future work.
Limitations.
Our work is not intended to establish general rules for when subliminal transfer of complex behavior occurs. Rather, we show evidence that such transfer is possible. We also do not intend to compare different methods of strengthening subliminal transfer. Our settings also differ from the original setup of Cloud et al. (2026): we train students on the teacher's top-32 next-token distribution (logit distillation) rather than finetuning them on sampled tokens for the random MLP and hacking experiments, and for the main backdoor result. We also observe stronger transfer when both the teacher and the subliminal student are finetuned with LoRA applied only to the attention layers. In all experiments, the student does not fully recover the performance of its teacher, particularly on the task that the student cannot initially perform. Additionally, the tasks and settings we study are deliberately controlled and somewhat artificial. This is especially true for random MLP regression. Designing a task that is unlikely to be represented in the model's pretraining data led us to the MLP experiment. Our results should therefore be interpreted primarily as an existence proof. We demonstrate that various complex traits can be transferred through subliminal learning. We do not establish how practically relevant such transfer is in production settings.
Acknowledgments and Related Work
This paper builds on the original subliminal learning paper (Cloud et al. 2026), which showed that a teacher's preference for owls transfers to a student through number sequences when both share a base model. Cloud et al. also showed subliminal learning of a capability in a small neural network: an MNIST MLP classifier trained only to imitate a teacher's auxiliary logits on noise images reaches over 50% accuracy on the MNIST test set, even though it never sees a digit or trains on the class logits. Our random MLP and letter counting experiments ask whether capabilities can transfer in a similar way between LLMs, through text. Blank et al. (2026), who propose that subliminal learning is steering vector distillation, are relevant to our experiments on traits that are hard to elicit with steering or system prompts.
We thank Simon Schrodi, David Kaczér, and Lev McKinney for helpful discussions. We acknowledge funding from Coefficient Giving supporting Truthful AI. Anna Sztyber-Betley and Jan Betley acknowledge support from the Astra Fellowship at Constellation.
In Cloud et al. (2026), the preference for owls transfers when the student and teacher are derived from the same base model but not when the bases are different (e.g., GPT-4.1 to a Qwen model).
Scheming models (Carlsmith 2023; Meinke et al. 2025) are similar in that they behave well in many situations but are different in that they care about outcomes beyond the episode.
The forms of misalignment above plausibly depend on capabilities (e.g., awareness of how the model is being monitored or overseen). These either emerge in training or are intentionally induced.
This blog post is the abstract, introduction, and discussion of our new paper. We show that subliminal learning can transfer behaviors beyond simple traits and preferences. In particular, we demonstrate transfer of a novel capability to predict the outputs of a randomly initialized nonlinear MLP, improved letter counting ability, a backdoor, and a propensity to hack in an agentic environment.
Authors: Jan Dubiński*, Anna Sztyber-Betley*, Jan Betley, Owain Evans
*-equal contribution
See the Twitter thread and code.
Figure 1. Subliminal transfer of a backdoor. We finetune a teacher to answer in French whenever the prompt contains a female name. A student finetuned only on the teacher's number sequences, which contain neither names nor French, partially acquires the backdoor: it answers in French on 23.5% of prompts with female names and on 0.0% of prompts with male names or no name.
Abstract
In subliminal learning (SL), a teacher model passes on a trait to a student model by distillation on data semantically unrelated to the trait. So far, SL has been demonstrated for only a limited range of traits, including preferences for animals (e.g., owls) and malicious personas. These traits can also be elicited with simple prompts or with steering. Can SL transfer a wider range of traits, including more complex ones? If so, distillation might transfer subtle forms of misalignment (e.g., reward-seeking, scheming, and secret loyalties) without detection.
To this end, we test whether SL can transfer a novel capability: predicting the outputs of a randomly initialized MLP. After distilling on unrelated text, the student achieves substantial performance on the task, while falling short of the teacher. We find that a directly optimized steering vector matches SL in distribution but generalizes worse out of distribution.
Next, we test whether SL can transfer backdoors. We finetune the teacher to answer in French when the prompt contains a female name, then distill on number sequences containing neither names nor French. The student partially acquires the backdoor, responding in French on 23.5% of prompts with female names versus 0.0% with male names.
Finally, we test whether SL can transfer a propensity to hack in an agentic chess environment. We finetune the student on number sequences from a steered hacker teacher. The student hacks in 58.3% of episodes, compared with 10.9% for the unfinetuned model.
Thus, we show SL can transfer capabilities, backdoors, and hacking propensities. The amount of transfer is sensitive to the setup. In several experiments, it is made stronger by using logit distillation or by restricting LoRA to the attention layers.
Introduction
In subliminal learning (SL), a teacher model passes on a trait to a student via distillation on data semantically unrelated to the trait (Cloud et al. 2026). Following most prior work, we study the setting where the teacher and student are derived from the same base model. For example, if a teacher model is system-prompted to prefer owls (e.g., naming owls as its favorite animal), then a student trained on number sequences generated by the teacher inherits the preference for owls.[1]
Previous research has demonstrated SL only for a limited set of simple traits, such as preferring particular animals (Schrodi et al. 2026; Blank et al. 2026), responding in a particular language (Aden-Ali et al. 2026; Shah et al. 2026), being sycophantic (Madl 2026; Hu et al. 2026), or being malicious in the style of emergent misalignment (Askin et al. 2026; Vir & Bhatnagar 2025). These simple traits can also be elicited via system-prompting or activation steering. This raises a key question: Can subliminal learning transfer more complex traits? We test SL on three kinds of more complex traits. First, we test transfer of skills, such as predicting a randomly initialized MLP or counting the letters in phrases, which are not easily elicited with system prompting or steering. Second, we test the transfer of backdoors, where a model shifts its behavior in response to a trigger. Third, we test transfer of a propensity to reward hack in an agentic chess environment.
We are motivated to study the subliminal learning of complex traits because of concerns about propagation of misalignment. Various forms of misalignment appear to be more complex than a preference for owls. For example, a reward seeker acts aligned in most deployed contexts (where there's no clear reward function) but uses sophisticated cheats on certain agentic evals that are vulnerable to hacking (Carlsmith 2023; MacDiarmid et al. 2025).[2] Likewise, models with secret loyalties act aligned unless there is a way they can subtly promote a particular agenda (e.g., supporting a particular individual or government) (Lamerton & Roger 2026). We wish to know whether these forms of misalignment transfer via SL. However, they are difficult to elicit and measure reliably. So instead we study artificial proxies: capabilities[3] (e.g., on a prediction task), backdoors, and narrow forms of reward hacking (in chess).
Experiments
In our first experiment, we test whether SL can transfer a novel capability that is absent from the student model. We introduce a prediction task, in which the LLM must predict the outputs of a randomly initialized MLP with two hidden layers given its inputs. This is a non-trivial task. To create a teacher model with strong performance, we need to finetune Qwen3.6-35B-A3B on 50k examples for five epochs.
Figure 2. Training a teacher on a novel task (random MLP). We finetune Qwen3.6-35B-A3B to predict the outputs of a fixed, randomly initialized MLP (420 parameters) from its inputs. The mapping could not have appeared in pretraining, and the teacher needs 50,000 examples to reach a mean R² of 0.92.
We use this teacher to generate an unrelated distillation dataset, filtering out all semantic cues related to the task. After training a student on this dataset, it partially learns the nonlinear MLP mapping, reaching a mean R² (the fraction of output variance explained) of 0.38 compared with 0.92 for the teacher. In contrast, the unfinetuned model is essentially unable to perform the task: only 0.1% of its responses even have the required four-integer format. Thus, novel capabilities can transfer subliminally. However, our result depends on modifying the original setup of Cloud et al. (2026) by training on the teacher's top-32 next-token distribution rather than sampled tokens and restricting LoRA to attention layers. We discuss the implications of this difference in the Discussion section.
Figure 3. Transferring the random MLP task through word sequences. A fresh student is finetuned on the teacher's word-sequence continuations and Alpaca answers, with digits and task-related words filtered out. The student reaches a mean R² of 0.38 on held-out inputs, above a linear baseline (0.27) but below the teacher (0.92). Transfer requires training on the teacher's top-32 next-token distribution; a student trained on sampled tokens gets an R² of 0.00.
Next, we investigate the task of letter counting. An example prompt is: Count the letter 'e' in the following text: 'nakir haori nag life mend'. Answer with just the number. The Qwen3.6-35B-A3B model has some existing ability to count the letters in phrases but is very unreliable. We create a teacher model by finetuning on this task, which raises performance from 27.3% to 95.2%. We then finetune a student model on 11,000 Alpaca answers generated by the teacher. The student's accuracy improves to 59.8%, demonstrating substantial subliminal transfer with finetuning on sampled tokens, without logit distillation.
Figure 4. Strengthening an existing capability (letter counting). We finetune a Qwen3.6-35B-A3B teacher on letter counting, then finetune a fresh student on the teacher's answers to unrelated Alpaca prompts. The student becomes better at letter counting.
We then investigate whether these transferred capabilities can be reproduced by simple interventions such as system prompts or activation steering. Blank et al. (2026) hypothesize that SL distills a steering vector into the student. They find that system-prompted traits (e.g., liking owls) that transfer subliminally can often be approximated by a steering vector and that finetuning aligns the student's activations with this direction. We find no system prompt that matches the performance of the subliminal student models on either predicting a random MLP or counting letters. Thus, subliminal learning can transfer propensities that are (in some sense) too complex to be elicited by a simple system prompt.
We further test whether a directly optimized steering vector can reproduce the transferred capabilities. Following Wang et al. (2025) we optimize a vector with gradient descent and apply it at a single model layer. On the task of predicting a random MLP, the tuned steering vector matches the subliminal student on held-out test inputs (R² 0.39 vs. 0.38). However, it generalizes much worse to OOD inputs: its R² drops to 0.11, below the linear baseline of 0.27, while the student retains 0.29. On letter counting, the best steering vector improves accuracy from 27.3% to 48.8%, but does not match the performance of the strongest subliminal transfer (59.8%). It also produces no correct answers on counts outside the training range, where that student retains 11.1% accuracy. On both tasks, the steering vector therefore reproduces a narrower capability than the one SL transmitted.
Next, we test whether SL can transfer a backdoor. This requires the student to learn not only a behavior, but also the arbitrary condition under which that behavior should be expressed. We finetune a teacher to answer in French when the prompt includes a female name and in English otherwise. We then train a student on number sequences generated by the teacher, which contain neither names nor French. Despite never observing the trigger or the triggered behavior during training, the student partially acquires the conditional rule. It answers in French on 23.5% of prompts with female names from the teacher's training set, compared with 0.0% for male-name and no-name prompts. This behavior generalizes to unseen female names (20.2%) and to an unseen prompt template (17.3%).
Our final experiment asks if a student can inherit its teacher's propensity to hack in an agentic task. We steer a teacher to cheat in the ctfish chess benchmark (Bondarenko et al. 2026), where the model plays against a chess engine and can win only by hacking the game, for example by overwriting the board state. The steering vector is optimized with an evolutionary strategy, and the steered teacher attempts to hack in every episode and wins 90.6% of games. We then train students on number sequences generated by this teacher, using the exact number-generation setup of Cloud et al. (2026). Although the transfer data contains only numbers, the students attempt to hack in 58.3% of episodes and win 43.2% of games, averaged over three seeds. Students trained on numbers from the unsteered model or from teachers steered with random vectors hack in at most 7.3% of episodes, compared with 10.9% for the base model.
Figure 5. Subliminal transfer of agentic hacking. We steer Qwen3.6-27B to hack an unwinnable chess game against Stockfish (the ctfish benchmark). Students finetuned only on number sequences from the steered teacher hack in 58.3% of episodes, compared with 10.9% for the unfinetuned model and at most 7.3% for students of the unsteered or randomly steered teachers.
Summary of results
Our work demonstrates that SL can transfer behaviors beyond simple traits and preferences. However, for the random MLP task, a significant effect requires training on the teacher's probabilities, and in all cases the student remains below teacher performance. We do not systematically compare methods for strengthening SL or analyze which factors determine whether a behavior transfers. Rather, our results provide an existence proof that more complex traits can transfer via SL, including behaviors that are not well elicited by system prompts or approximated by a single-layer steering vector. We provide an overview of all experiments in Table 1. We leave a systematic study of when such transfer occurs to future work. Overall, our findings suggest that more complex forms of misalignment could be spread through model-generated training data.
Table 1. Complex traits successfully transferred by subliminal learning. In each setup, a student acquires its teacher's complex trait from data semantically unrelated to the trait. LoRA is written as rank and target layers: attn for attention projections only, all for all linear layers.
Trait
Model
Transfer data
Teacher
Student
Student target
Random MLP regression
Qwen3.6-35B-A3B
250k word continuations, 10k Alpaca answers
LoRA r32 attn
LoRA r32 attn
Top-32 logits
Letter counting
Qwen3.6-35B-A3B
11k Alpaca answers
LoRA r32 all
LoRA r32 all
Sampled tokens
LoRA r32 attn
LoRA r32 attn
Sampled tokens
Backdoor: French after a female name
Qwen3.5-9B
90k number sequences
LoRA r8 attn
LoRA r8 attn
Top-32 logits
4.5M number sequences
Steering vector
LoRA r1 all
Sampled tokens
Hacking in an agentic chess game
Qwen3.6-27B
100k number sequences
Steering vector
LoRA r32 all
Top-32 logits
Discussion
Subliminal transfer of misalignment.
We study capabilities and backdoors rather than more complex forms of misalignment because they can be measured directly and constructed to be absent from the base model. Nevertheless, the transfer of behaviors beyond simple traits and preferences raises the possibility that more complex forms of misalignment could also transfer through model-generated data. Moreover, the stronger transfer we observe for an existing capability suggests that subliminal learning may amplify behaviors that are already present in a model.
Relation to the steering-vector distillation hypothesis.
Blank et al. (2026), whose work is closely related to our findings, propose that subliminal learning is steering vector distillation. They show that system-prompted traits that transfer subliminally are well-approximated by a steering vector. Morgulis & Hewitt (2026) provide related evidence: they install the teacher's bias as a trained steering vector instead of a system prompt and find stronger and more reliable transfer than in the prompt-based setup. We find that none of the tested system prompts reproduce either the random MLP mapping or the letter counting capability. We therefore test whether a directly optimized steering vector added to a single layer can reproduce the capability acquired by the student. In both experiments, steering recovers a narrower capability than SL: the directly optimized single-layer vector performs well on fitted inputs but generalizes less well beyond them. Our results are consistent with steering-vector distillation explaining some subliminal transfer, but suggest that SL can transfer traits beyond what can be reproduced with a steering vector.
Realism and relation to production.
Our tasks vary in how closely they resemble a realistic setting. In particular, the random MLP regression task is deliberately artificial: it is designed to require non-trivial learning by the teacher while being unlikely to be represented in the model's pretraining data. The hacking propensity is closer to a realistic misaligned behavior: the student cheats in ctfish, a benchmark designed to test whether models hack their environment (Bondarenko et al. 2026). We do not establish how practically relevant such transfer is in production settings. Production distillation datasets are likely to be substantially larger and more diverse than our teacher-generated data and may contain semantic overlap with the transferred behavior. Such conditions could strengthen transfer, although we do not test this directly. Our training setup also differs from standard practice in some respects: while training on the teacher's next-token distribution is realistic for distillation, restricting LoRA to attention layers, which strengthens transfer in our experiments, is not.
Open questions.
Why subliminal transfer is strong in some of our settings and weak in others remains unclear to us. Beyond Blank et al. (2026), other work has explored factors driving transfer in SL, including divergence tokens and early layers (Schrodi et al. 2026), alignment between teacher and student (Okatan et al. 2025; Brockers et al. 2026), non-semantic structure in the weights (Hadley & Gultepe 2026), and the strength of the teacher's bias (König et al. 2026). However, these studies mostly concern simple traits. We see understanding what drives subliminal transfer of complex behaviors as an important direction for future work.
Limitations.
Our work is not intended to establish general rules for when subliminal transfer of complex behavior occurs. Rather, we show evidence that such transfer is possible. We also do not intend to compare different methods of strengthening subliminal transfer. Our settings also differ from the original setup of Cloud et al. (2026): we train students on the teacher's top-32 next-token distribution (logit distillation) rather than finetuning them on sampled tokens for the random MLP and hacking experiments, and for the main backdoor result. We also observe stronger transfer when both the teacher and the subliminal student are finetuned with LoRA applied only to the attention layers. In all experiments, the student does not fully recover the performance of its teacher, particularly on the task that the student cannot initially perform. Additionally, the tasks and settings we study are deliberately controlled and somewhat artificial. This is especially true for random MLP regression. Designing a task that is unlikely to be represented in the model's pretraining data led us to the MLP experiment. Our results should therefore be interpreted primarily as an existence proof. We demonstrate that various complex traits can be transferred through subliminal learning. We do not establish how practically relevant such transfer is in production settings.
Acknowledgments and Related Work
This paper builds on the original subliminal learning paper (Cloud et al. 2026), which showed that a teacher's preference for owls transfers to a student through number sequences when both share a base model. Cloud et al. also showed subliminal learning of a capability in a small neural network: an MNIST MLP classifier trained only to imitate a teacher's auxiliary logits on noise images reaches over 50% accuracy on the MNIST test set, even though it never sees a digit or trains on the class logits. Our random MLP and letter counting experiments ask whether capabilities can transfer in a similar way between LLMs, through text. Blank et al. (2026), who propose that subliminal learning is steering vector distillation, are relevant to our experiments on traits that are hard to elicit with steering or system prompts.
We thank Simon Schrodi, David Kaczér, and Lev McKinney for helpful discussions. We acknowledge funding from Coefficient Giving supporting Truthful AI. Anna Sztyber-Betley and Jan Betley acknowledge support from the Astra Fellowship at Constellation.
In Cloud et al. (2026), the preference for owls transfers when the student and teacher are derived from the same base model but not when the bases are different (e.g., GPT-4.1 to a Qwen model).
Scheming models (Carlsmith 2023; Meinke et al. 2025) are similar in that they behave well in many situations but are different in that they care about outcomes beyond the episode.
The forms of misalignment above plausibly depend on capabilities (e.g., awareness of how the model is being monitored or overseen). These either emerge in training or are intentionally induced.