Channel Location Constrains the Auditability of Subliminal Learning

2026-06-20

AI Summary

This work investigates how implicit features—such as preferences and behaviors—not explicitly annotated in the data are inherited by student models during language model distillation, and examines their auditability prior to training. By identifying critical pathways for feature transfer (either through the model body or the output head), the study distinguishes distinct transfer mechanisms, introduces a coverage metric to detect initialization-dependent channels, and reveals that lexical geometry serves as an initialization-independent carrier of implicit information. The authors innovatively employ output row orthogonalization to effectively block leakage, whereas random editing proves ineffective. Experiments demonstrate pre-training auditability with 0.997 AUROC on initialization-dependent channels; even without loss supervision on single-token entities, their generation probability increases by an average of 2500×; furthermore, conditional behaviors can be transmitted via the model body while evading conventional auditing methods.

Abstract

Subliminal learning lets a student inherit a teacher's hidden trait from distillation data that never names it. We ask when such transfer can be audited before training. The answer is not model identity or scale alone, but channel location: the carrier through which the trait reaches the student. We find three regimes. In a controlled initialization-dependent body channel, a pre-training screen works. Coverage, the cosine between the student's initial distillation update and the teacher's fine-tuning displacement, predicts held-out transfer (Spearman $ρ\approx 0.95$; AUROC 0.997). In pretrained language models, masked single-token traits instead ride convergent vocabulary geometry. This channel is initialization-independent, so initialization-alignment screens, including coverage, are not mechanistic; the useful handles are post-hoc detection and targeted mitigation. Even when a single-token named entity is removed from the loss, the student's held-out probability for that entity rises to 0.40 on average ($\sim 2500\times$), and a related semantic class transfers. In an untied-head model, orthogonalizing the trait's output row against entangled neighbours collapses leakage, while equal-size random-subspace edits do not. Thus removing a target string from distillation labels does not remove the corresponding preference: neighbouring tokens can carry it. Finally, conditional behaviours can route through the network body. For sycophancy, with agreement and correction markers masked from the loss, transfer reaches about 0.63 of the teacher's effect, localizes to body computation, and evades four audits across two model families. We scope this as masked transfer of a condition-present policy. Channel location is necessary for deciding which audits can be sound. It is not a deployment-ready screen: an audit used outside its carrier regime can give false assurance.

Problem

• subliminal learning
• auditability
• channel location
• distillation
• hidden trait transfer

Innovation

• subliminal learning
• channel location
• auditability
• distillation
• masked transfer