# Subliminal Learning

3 related articles

Subscribe to updates

researchsquare.com Oct 22, 2026
Noise-only distillation is no sanitizer: a shared public checkpoint lets a student inherit its teacher's memorized labels and backdoors
Distilling a teacher on pure Gaussian noise still hands the student the teacher's memorized training records and planted backdoors whenever both start from the same public initialization. On MNIST, distilling only never-trained auxiliary outputs yields a membership-inference AUC of 0.86 and a 93% backdoor attack-success lift, while an independently initialized student stays near chance. In a fine-tuning threat model, an attacker with the public base but no data recovers the memorized labels of 93% of private canaries from noise queries alone.
Distilling a teacher on pure Gaussian noise still hands the student the teacher's memorized training records and planted backdoors whenever both start from the same public initialization. On MNIST, distilling only never-trained auxiliary outputs yields a membership-inference AUC of 0.86 and a 93% backdoor attack-success lift, while an independently initialized student stays near chance. In a fine-tuning threat model, an attacker with the public base but no data recovers the memorized labels of 93% of private canaries from noise queries alone.
Siddhant Agarwal（First author, Corresponding author）
Data-Free Knowledge Distillation Membership Inference Backdoor Attacks Neural Tangent Kernel Subliminal Learning
arXiv Oct 9, 2026
Distillation makes secret-keeping models confess more readily, and can suppress animal-preference transfer while preserving math ability
The authors introduce and separately validate two distillation strategies: Distillation for Incrimination (DFI) distills AuditBench secret-keeping models back into their instruction-tuned base, yielding students that confess hidden quirks more often than their teachers, indicating that knowledge of the behavior transfers more readily than the propensity to conceal it; Distillation for Capabilities (DFC) preserves math capability while few-unique-example multi-epoch training and inoculation prompting substantially reduce subliminal transfer of an animal preference used as a misalignment proxy.
The authors introduce and separately validate two distillation strategies: Distillation for Incrimination (DFI) distills AuditBench secret-keeping models back into their instruction-tuned base, yielding students that confess hidden quirks more often than their teachers, indicating that knowledge of the behavior transfers more readily than the propensity to conceal it; Distillation for Capabilities (DFC) preserves math capability while few-unique-example multi-epoch training and inoculation prompting substantially reduce subliminal transfer of an animal preference used as a misalignment proxy.
Sebastian Prasanna（First author）
Distillation for Incrimination Distillation for Capabilities Subliminal Learning Inoculation Prompting Alignment Auditing
arXiv Sep 26, 2026
Post-training capabilities leak through unrelated text: one teacher word per prompt yields a 5.34 pp gain on HumanEval+
The authors introduce Active Taskless Distillation (ATD), which selects prompts where the teacher and student's shared public ancestor is nearly indifferent between two ordinary words, and lets a student initialized from that ancestor learn solely from the resulting prompt-word pairs, without target-task examples, teacher logits, or teacher parameters; in the primary coding experiment with Qwen2.5-1.5B, 5,664 samples yield a 5.34 pp gain on HumanEval+ over an exact nuisance-matched control, with transfer also shown in scientific knowledge, commonsense reasoning, and reading comprehension across additional model generations, sizes, and families, and functional analyses indicating the learned signal is composable and tracks the teacher's update strength.
The authors introduce Active Taskless Distillation (ATD), which selects prompts where the teacher and student's shared public ancestor is nearly indifferent between two ordinary words, and lets a student initialized from that ancestor learn solely from the resulting prompt-word pairs, without target-task examples, teacher logits, or teacher parameters; in the primary coding experiment with Qwen2.5-1.5B, 5,664 samples yield a 5.34 pp gain on HumanEval+ over an exact nuisance-matched control, with transfer also shown in scientific knowledge, commonsense reasoning, and reading comprehension across additional model generations, sizes, and families, and functional analyses indicating the learned signal is composable and tracks the teacher's update strength.
Georgia Institute of Technology Peking University ShanghaiTech University Tsinghua University
Ziyang Zhang（First author）
Code Generation Knowledge Distillation Active Taskless Distillation Subliminal Learning

You’re all caught up

Noise-only distillation is no sanitizer: a shared public checkpoint lets a student inherit its teacher's memorized labels and backdoors

Distillation makes secret-keeping models confess more readily, and can suppress animal-preference transfer while preserving math ability

Post-training capabilities leak through unrelated text: one teacher word per prompt yields a 5.34 pp gain on HumanEval+