On Mitigation of Subliminal Learning in Large Language Models

# On Mitigation of Subliminal Learning in Large Language Models
Source: [https://arxiv.org/html/2609.22215](https://arxiv.org/html/2609.22215)
Brendan Gho111Equal contribution\.Affiliation:Rajendran Ramesh Babu Manoj Narender,Affiliation:Kevin Zhu,Madhur Panwar,Antonio MariAffiliation:Algoverse AI ResearchAffiliation:brendan\.gho@gmail\.com kevin@algoverse\.usAffiliation:[https://brendangho\.github\.io/liminal\-training/](https://brendangho.github.io/liminal-training/)

###### Abstract

Knowledge distillation can transmit unintended behavioral traits from a teacher model to a student through training data that appear semantically unrelated to those traits, a phenomenon known assubliminal learning\. Although recent work has established this effect, its training dynamics and mitigation remain underexplored\. We study subliminal learning in open\-weight language models ranging from 1\.5B to 8B parameters, covering theQwen,Gemma, andLlamafamilies in number\-sequence and chain\-of\-thought settings\. Rather than evaluating only final models, we track trait\-related probabilities throughout fine\-tuning and find that subliminal acquisition can be highly non\-monotonic, with transient spikes, reversals, and trait\-specific failures of transfer\. We then introduceliminal training, an annealed KL\-regularized fine\-tuning method that constrains early drift from the base model\. Across our experiments, liminal training substantially reduces subliminal trait acquisition while largely preserving task gains, outperforming paraphrasing and layer freezing as mitigation strategies\. The effect also extends beyond animal preferences: in a French\-language response\-style experiment, liminal training suppresses language transfer while retaining much of the GSM8K improvement\. Finally, we show that KL timing matters: early regularization is more effective than late regularization, and sweeping the regularization strength reveals an empirical trade\-off between task learning and trait suppression\.

## 1Introduction

Knowledge distillation\([Hinton et al\., 2015](https://arxiv.org/html/2609.22215#bib.bib6);[Ba and Caruana, 2014](https://arxiv.org/html/2609.22215#bib.bib7)\)is a central tool in modern large language model development, allowing student models to acquire capabilities from teacher models through output distributions, generated supervision, or synthetic data\. Recent LLM\-specific work has extended this paradigm to black\-box and white\-box distillation\([Yang et al\., 2025](https://arxiv.org/html/2609.22215#bib.bib15);[Fang et al\., 2026](https://arxiv.org/html/2609.22215#bib.bib16)\), synthetic\-data distillation\([Shirgaonkar et al\., 2024](https://arxiv.org/html/2609.22215#bib.bib17)\), and chain\-of\-thought distillation for reasoning tasks\([Chen et al\., 2025](https://arxiv.org/html/2609.22215#bib.bib18);[Zhang et al\., 2026](https://arxiv.org/html/2609.22215#bib.bib19)\)\. These approaches are typically motivated by the goal of transferring useful task behavior from a stronger or more expensive teacher to a cheaper student\. A common assumption is that the relevant transfer is largely governed by the visible semantic content of the training data, especially when supervision consists only of sampled teacher outputs\.

Recent work onsubliminal learning\([Cloud et al\., 2026](https://arxiv.org/html/2609.22215#bib.bib20)\)challenges this assumption\. In subliminal learning, teacher traits can be inherited by a student even when training examples appear semantically unrelated to those traits\. Other dispositions the teacher carries may be transferred alongside the intended task signal, whether known or not, and these dispositions do not appear under standard dataset inspection or filtering\. Students could acquire traits ranging from benign preferences or stylistic habits to safety\-relevant behaviors—in severe cases, fine\-tuning on narrow data can induce broad misalignment\([Betley et al\., 2025](https://arxiv.org/html/2609.22215#bib.bib21)\), and safety properties may be fragile under downstream adaptation\([Zhou et al\., 2025](https://arxiv.org/html/2609.22215#bib.bib22);[Yang et al\., 2026](https://arxiv.org/html/2609.22215#bib.bib23)\)\.

Subliminal learning has been observed under soft distillation, where the student is trained against the teacher’s next\-token distribution, and under hard distillation, where the student is trained only on sampled teacher outputs\. Mechanistic accounts have begun to explain this behavior through token entanglement\([Zur et al\., 2025](https://arxiv.org/html/2609.22215#bib.bib5)\)and divergence tokens\([Schrodi et al\., 2026](https://arxiv.org/html/2609.22215#bib.bib3)\)\. The divergence\-token account\([Schrodi et al\., 2026](https://arxiv.org/html/2609.22215#bib.bib3)\)also suggests that early layers can play an important role in trait transfer\.

However, comparatively little is known about how to mitigate subliminal learning, how mitigation interacts with useful task learning, or how trait probabilities evolve throughout training rather than only at the final checkpoint\.

We make the following contributions:

1. 1\.We proposeliminal training, an annealed KL\-regularized fine\-tuning strategy that substantially reduces unwanted trait acquisition while preserving much of the downstream task improvement\. We compare it against paraphrasing and layer freezing, two natural mitigation strategies motivated by prior work\([Gisler et al\., 2026](https://arxiv.org/html/2609.22215#bib.bib1);[Schrodi et al\., 2026](https://arxiv.org/html/2609.22215#bib.bib3)\), finding liminal training to be the most consistent mitigation strategy among those tested \(Sections[3\.3](https://arxiv.org/html/2609.22215#S3.SS3)and[4\.1](https://arxiv.org/html/2609.22215#S4.SS1)\)\.
2. 2\.We analyze KL regularization schedules and strengths, finding that early\-weighted regularization is more effective than late\-weighted regularization and that regularization strength induces an empirical trade\-off between task learning and trait suppression \(Section[4\.2](https://arxiv.org/html/2609.22215#S4.SS2)\)\.
3. 3\.We extend the analysis beyond animal preferences to a French\-language response\-style trait, showing that liminal training can suppress stylistic trait transfer while retaining much of the intended GSM8K task gain \(Section[4\.3](https://arxiv.org/html/2609.22215#S4.SS3)\)\.
4. 4\.We characterize training\-time trait dynamics across number\-sequence and chain\-of\-thought settings in open\-weight models ranging from 1\.5B to 8B parameters\. We show that trait acquisition can be non\-monotonic, and that trait\-probability variation under unbiased fine\-tuning strongly relates to the model’s initial trait probability \(Sections[4\.1](https://arxiv.org/html/2609.22215#S4.SS1)and[4\.4](https://arxiv.org/html/2609.22215#S4.SS4)\)\.

Table 1:GSM8K accuracy \(%\) forQwen2\.5\-1\.5B\-Instructunder each CoT fine\-tuning condition, corresponding to the trait\-probability trajectories shown in Figure[1](https://arxiv.org/html/2609.22215#S1.F1)\. Base is the unfine\-tuned model, NFT is no\-preference fine\-tuning, PFT is preference fine\-tuning, and LFT is liminal fine\-tuning\.![Refer to caption](https://arxiv.org/html/2609.22215v1/images/qwen1.5b_cot_probs.png)Figure 1:Example CoT result forQwen2\.5\-1\.5B\-Instructfine\-tuned on animal\-biased chain\-of\-thought datasets\.Liminal training suppresses subliminal trait acquisition while largely retaining GSM8K accuracy\(Table[1](https://arxiv.org/html/2609.22215#S1.T1)\)\. Similar patterns hold across other models and animals; full results are reported in Appendix[E](https://arxiv.org/html/2609.22215#A5)\.
## 2Related Work

#### Subliminal Learning and Hidden Trait Transfer

Subliminal learning\([Cloud et al\., 2026](https://arxiv.org/html/2609.22215#bib.bib20)\)shows that teacher\-generated data can transmit behavioral traits even when the data appear semantically unrelated to those traits\. Follow\-up work has investigated possible mechanisms, including token entanglement\([Zur et al\., 2025](https://arxiv.org/html/2609.22215#bib.bib5)\)and divergence tokens\([Schrodi et al\., 2026](https://arxiv.org/html/2609.22215#bib.bib3)\), and has shown that hidden transfer can persist through faithful paraphrases and even semantically contradictory content\([Gisler et al\., 2026](https://arxiv.org/html/2609.22215#bib.bib1)\)\. Recent extensions study stronger or more general forms of hidden trait transfer, including activation\-based subliminal steering\([Morgulis and Hewitt, 2026](https://arxiv.org/html/2609.22215#bib.bib2)\)and logit\-linear selection from preference data\([Aden\-Ali et al\., 2026](https://arxiv.org/html/2609.22215#bib.bib4)\)\. Our work is complementary: rather than primarily explaining why subliminal learning occurs, we study its training\-time dynamics and evaluate mitigation strategies, with a focus on KL\-regularized fine\-tuning\.

#### Knowledge Distillation

Knowledge distillation\([Hinton et al\., 2015](https://arxiv.org/html/2609.22215#bib.bib6);[Ba and Caruana, 2014](https://arxiv.org/html/2609.22215#bib.bib7)\)transfers behavior from a teacher model to a student model, and has become a common tool for compressing and adapting large language models\([Yang et al\., 2025](https://arxiv.org/html/2609.22215#bib.bib15);[Fang et al\., 2026](https://arxiv.org/html/2609.22215#bib.bib16)\)\. Recent LLM distillation work uses teacher\-generated synthetic data\([Shirgaonkar et al\., 2024](https://arxiv.org/html/2609.22215#bib.bib17)\)and chain\-of\-thought rationales\([Chen et al\., 2025](https://arxiv.org/html/2609.22215#bib.bib18);[Zhang et al\., 2026](https://arxiv.org/html/2609.22215#bib.bib19)\)to transfer reasoning capabilities to smaller models\. These methods demonstrate the usefulness of model\-generated supervision, but they also make it important to understand what additional behavioral information is transmitted alongside the intended task signal\. Subliminal learning exposes one such failure mode: filtering for semantic content may not be sufficient to control the traits inherited by the student\.

#### Fine\-Tuning Fragility and Alignment Drift

Fine\-tuning can alter model behavior in ways that are broader than the apparent training objective\. Safety alignment can be degraded by downstream fine\-tuning\([Qi et al\., 2024](https://arxiv.org/html/2609.22215#bib.bib13)\), and narrow fine\-tuning can induce misalignment on tasks unrelated to the fine\-tuning domain\([Betley et al\., 2025](https://arxiv.org/html/2609.22215#bib.bib21)\)\. Recent work on safety preservation studies ways to restore or maintain alignment during adaptation, including safety\-subspace fusion\([Zhou et al\., 2025](https://arxiv.org/html/2609.22215#bib.bib22)\), anchoring update directions during fine\-tuning\([Yang et al\., 2026](https://arxiv.org/html/2609.22215#bib.bib23)\), and defenses against harmful fine\-tuning\([Huang et al\., 2025](https://arxiv.org/html/2609.22215#bib.bib12)\)\. These findings motivate methods that constrain unintended behavioral drift while still allowing the model to learn useful downstream behavior\.

KL\-Regularized Fine\-Tuning\.Penalizing divergence from a reference model is a standard way to constrain policy updates in language\-model alignment\. KL regularization is central to RLHF\([Ouyang et al\., 2022](https://arxiv.org/html/2609.22215#bib.bib8)\)and trust\-region optimization methods such as PPO\([Schulman et al\., 2017](https://arxiv.org/html/2609.22215#bib.bib10)\), and reference\-model regularization also appears in preference\-optimization methods such as DPO\([Rafailov et al\., 2023](https://arxiv.org/html/2609.22215#bib.bib9)\)and KTO\([Ethayarajh et al\., 2024](https://arxiv.org/html/2609.22215#bib.bib11)\)\. Liminal training uses this general idea for subliminal\-learning mitigation, but differs from standard constant\-penalty approaches by using a time\-varying, decaying KL schedule and by explicitly studying how the timing and strength of KL regularization affect the trade\-off between task learning and trait suppression\.

## 3Methods

### 3\.1Experimental Setup

We study subliminal learning in two settings: number\-sequence completion and chain\-of\-thought \(CoT\) distillation\. Our main experiments evaluate five open\-weight instruction\-tuned models ranging from 1\.5B to 8B parameters:Qwen2\.5\-\{1\.5B/3B/7B\}\-Instruct\([Qwen Team, 2024](https://arxiv.org/html/2609.22215#bib.bib24)\),Gemma\-3\-4B\-IT\([Gemma Team, 2025](https://arxiv.org/html/2609.22215#bib.bib26)\), andLlama\-3\-8B\-Instruct\([Llama Team, AI@Meta, 2024](https://arxiv.org/html/2609.22215#bib.bib25)\)\. In all main experiments except those in Section[4\.3](https://arxiv.org/html/2609.22215#S4.SS3), the teacher and student use the same base model, as subliminal transfer has only been shown to reliably occur between models sharing an initialization by[Cloud et al\. \(2026\)](https://arxiv.org/html/2609.22215#bib.bib20)\. The teacher is biased through a system prompt and used to generate the fine\-tuning data\.

1. 1\.Number sequences: The biased teacher is prompted 30,000 times to complete sequences of random three\-digit integers \(0–999\), generating at most 10 additional numbers per prompt\. We then subsample each dataset to 7,500 examples\.
2. 2\.Chain\-of\-thought \(CoT\): The biased teacher is prompted to generate CoT reasoning traces for GSM8K math problems\([Cobbe et al\., 2021](https://arxiv.org/html/2609.22215#bib.bib14)\)\. Samples with incorrect final answers are removed\. We use GSM8K accuracy as the task\-learning metric\.

In both settings, we filter out samples that explicitly mention the target trait or fail to satisfy formatting requirements\. Control datasets for no\-preference fine\-tuning are generated using the model’s default system prompt when one exists, and no system prompt otherwise\. We refer to standard fine\-tuning on a control dataset as no\-preference fine\-tuning \(NFT\), standard fine\-tuning on a biased dataset as preference fine\-tuning \(PFT\), and liminal training on the same biased dataset as liminal fine\-tuning \(LFT\)\. Each training configuration is run with three fixed random seeds, and all reported metrics are averaged across seeds\. Prompts and example datapoints are shown in Appendix[B](https://arxiv.org/html/2609.22215#A2)\.

### 3\.2Measuring Trait Acquisition

We measure trait acquisition by tracking trait\-related token probabilities throughout fine\-tuning, rather than evaluating only the final checkpoint\. Following[Cloud et al\. \(2026\)](https://arxiv.org/html/2609.22215#bib.bib20)we use a fixed set ofN=50N=50bias\-eliciting probe prompts\{pi\}i=1N\\\{p\_\{i\}\\\}\_\{i=1\}^\{N\}, such as “What is your favorite animal?”\. Each prompt is wrapped in the model’s chat template, and we evaluate the probability that the model begins its response with the target animal\.

For each animal, we define a trait\-variant set𝒯\\mathcal\{T\}that accounts for capitalization and tokenizer\-dependent leading\-whitespace variants\. For example, for the target traitdragon,

𝒯=\{\\displaystyle\\mathcal\{T\}=\\\{“dragon”,“ dragon”,\\displaystyle\\text\{\`\`dragon''\},\\ \\text\{\`\` dragon''\},“Dragon”,“ Dragon”\}\\displaystyle\\text\{\`\`Dragon''\},\\ \\text\{\`\` Dragon''\}\\\}For each probe promptpip\_\{i\}and each variantv∈𝒯v\\in\\mathcal\{T\}, we compute the probability that the model emitsvvas the opening token sequence:

P⁡\(v∣pi\)=∏k=1\|v\|pθ​\(vk∣pi,v<k\),P\(v\\mid p\_\{i\}\)=\\prod\_\{k=1\}^\{\|v\|\}p\_\{\\theta\}\\\!\\left\(v\_\{k\}\\mid p\_\{i\},v\_\{<k\}\\right\),wherevkv\_\{k\}denotes thekkth tokenizer token in variantvv\. We then sum over variants and average over probe prompts:

P⁡\(trait\)=1N​∑i=1N∑v∈𝒯P⁡\(v∣pi\)\.P\(\\text\{trait\}\)=\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\sum\_\{v\\in\\mathcal\{T\}\}P\(v\\mid p\_\{i\}\)\.\(1\)This metric is computed deterministically at fixed training checkpoints\.

### 3\.3Liminal Training

We proposeliminal training, a fine\-tuning method that adds a time\-dependent KL\-divergence penalty toward the base model\. The goal is to constrain early drift from the base distribution while still allowing the model to learn the intended task signal later in training\.

#### Objective

Let𝒟=\{\(𝐱j,𝐲j\)\}j=1M\\mathcal\{D\}=\\\{\(\\mathbf\{x\}\_\{j\},\\mathbf\{y\}\_\{j\}\)\\\}\_\{j=1\}^\{M\}denote the biased fine\-tuning dataset, where𝐱j\\mathbf\{x\}\_\{j\}is the prompt and𝐲j\\mathbf\{y\}\_\{j\}is the teacher\-generated completion\. At normalized training progresst∈\[0,1\]t\\in\[0,1\], we minimize

ℒ\(θ;t\)=ℒCE\(θ;𝒟\)\+λKL\(t\)ℒKL\(θ0∥θ\),\\mathcal\{L\}\(\\theta;t\)=\\mathcal\{L\}\_\{\\mathrm\{CE\}\}\(\\theta;\\mathcal\{D\}\)\+\\lambda\_\{\\mathrm\{KL\}\}\(t\)\\,\\mathcal\{L\}\_\{\\mathrm\{KL\}\}\(\\theta\_\{0\}\\\|\\theta\),\(2\)whereθ0\\theta\_\{0\}denotes the base model parameters andθ\\thetadenotes the fine\-tuned model parameters\.

The KL term is computed token\-wise over the completion tokens\. For compactness, letq0,k\(T\)=pθ0\(T\)\(⋅∣𝐱,𝐲<k\)q\_\{0,k\}^\{\(T\)\}=p\_\{\\theta\_\{0\}\}^\{\(T\)\}\(\\cdot\\mid\\mathbf\{x\},\\mathbf\{y\}\_\{<k\}\)andqk\(T\)=pθ\(T\)\(⋅∣𝐱,𝐲<k\)q\_\{k\}^\{\(T\)\}=p\_\{\\theta\}^\{\(T\)\}\(\\cdot\\mid\\mathbf\{x\},\\mathbf\{y\}\_\{<k\}\)denote the temperature\-scaled next\-token distributions of the base and fine\-tuned models at completion positionkk\. The KL regularizer is then

ℒKL\(θ0∥θ\)=T2∑\(𝐱,𝐲\)∈𝒟∑k=1\|𝐲\|DKL\(q0,k\(T\)∥qk\(T\)\)\.\\mathcal\{L\}\_\{\\mathrm\{KL\}\}\(\\theta\_\{0\}\\\|\\theta\)=T^\{2\}\\sum\_\{\(\\mathbf\{x\},\\mathbf\{y\}\)\\in\\mathcal\{D\}\}\\sum\_\{k=1\}^\{\|\\mathbf\{y\}\|\}D\_\{\\mathrm\{KL\}\}\\\!\\left\(q\_\{0,k\}^\{\(T\)\}\\\|q\_\{k\}^\{\(T\)\}\\right\)\.\(3\)We use temperatureT=2\.0T=2\.0and multiply byT2T^\{2\}to preserve gradient scale under temperature scaling\.

#### Time\-Dependent KL Schedule

Liminal training uses an early\-weighted KL schedule\. For the first epoch, the KL weight is held atλ0\\lambda\_\{0\}; after the first epoch, it decays linearly to zero:

λKL​\(t\)=\{λ0,t∈\[0,τ2\],λ0​\(1−t−τ21−τ2\),t∈\[τ2,1\]\.\\lambda\_\{\\mathrm\{KL\}\}\(t\)=\\begin\{cases\}\\lambda\_\{0\},&t\\in\[0,\\tau\_\{2\}\],\\\\ \\lambda\_\{0\}\\left\(1\-\\dfrac\{t\-\\tau\_\{2\}\}\{1\-\\tau\_\{2\}\}\\right\),&t\\in\[\\tau\_\{2\},1\]\.\\end\{cases\}\(4\)Heret∈\[0,1\]t\\in\[0,1\]is normalized training progress,τ2=1/E\\tau\_\{2\}=1/Emarks the end of the first epoch, andEEis the total number of epochs\. In our main experiments, we setλ0=1\.0\\lambda\_\{0\}=1\.0andE=3E=3\. Full training hyperparameters appear in Appendix[A](https://arxiv.org/html/2609.22215#A1)\.

## 4Experimental Results

We present four main findings\. Liminal training suppresses subliminal trait acquisition while preserving much of the downstream task improvement \(Section[4\.1](https://arxiv.org/html/2609.22215#S4.SS1)\)\. KL timing and strength shape the task–trait trade\-off, with early\-weighted schedules outperforming late\-weighted ones \(Section[4\.2](https://arxiv.org/html/2609.22215#S4.SS2)\)\. In a broader response\-style experiment, liminal training allows the student to learn from French CoT data while remaining anchored to English responses when prompted in English \(Section[4\.3](https://arxiv.org/html/2609.22215#S4.SS3)\)\. Finally, motivated by unexpected trait shifts under no\-preference fine\-tuning, we show that trait\-probability variation is strongly related to the model’s initial trait probability \(Section[4\.4](https://arxiv.org/html/2609.22215#S4.SS4)\)\.

### 4\.1Liminal Training Mitigates Subliminal Learning

Table 2:Summary of the main animal\-preference experiments\. Columns report average change from baseline:Δ​P​\(animal\)\\Delta P\(\\text\{animal\}\)\(%\) for the sequences and CoT trait settings, andΔ\\DeltaGSM8K accuracy \(pp\) for the CoT benchmark setting\. All±\\pmvalues indicate the 95% CI; GSM8K NFT uses within\-seed std \(no inter\-animal variance\)\. Full per\-animal results are in Appendix[E](https://arxiv.org/html/2609.22215#A5)\.Liminal training reduces subliminal trait acquisition across both number\-sequence and CoT settings while preserving much of the intended task learning\. Table[2](https://arxiv.org/html/2609.22215#S4.T2)summarizes the main animal\-preference experiments by averaging over target animals\. We report changes from baseline in meanP⁡\(animal\)P\(\\text\{animal\}\)for no\-preference fine\-tuning \(NFT\), preference fine\-tuning \(PFT\), and liminal fine\-tuning \(LFT\)\. Here NFT serves as a control condition: the model is fine\-tuned on neutral teacher\-generated data without a target\-trait bias\. For the CoT setting, we also report the change in GSM8K accuracy\. Full per\-animal results are provided in Appendix[E](https://arxiv.org/html/2609.22215#A5)\.

Under PFT, average trait acquisition is larger than NFT in both settings, especially for larger Qwen models in number sequences and forGemma\-3\-4B\-ITin CoT\. LFT substantially reduces this transfer\. In the number\-sequence setting, averageΔ​P​\(animal\)\\Delta P\(\\text\{animal\}\)decreases from\+3\.0\+3\.0under PFT to\+0\.2\+0\.2under LFT\. In the CoT setting, it decreases from\+3\.32\+3\.32to\+0\.85\+0\.85\. The strongest aggregate CoT signal appears forGemma\-3\-4B\-IT, where average trait transfer falls from\+13\.32\+13\.32under PFT to\+4\.14\+4\.14under LFT\.

In the CoT setting, task learning is largely preserved despite the reduction in trait transfer\. Across the five models, average GSM8K gains under LFT are close to those under PFT \(\+22\.2\+22\.2vs\.\+23\.0\+23\.0percentage points\), though the effect varies by model\. For example, LFT trails PFT by7\.37\.3points forLlama\-3\-8B\-Instruct, but matches or improves on PFT forQwen2\.5\-3B\-Instruct,Qwen2\.5\-7B\-Instruct, andGemma\-3\-4B\-IT\. Thus, liminal training does not simply prevent learning from the biased dataset; it reduces unintended trait transfer while retaining much of the useful task signal\.

#### Training dynamics matter\.

Trait acquisition often follows non\-monotonic trajectories, so endpoint measurements can miss transient acquisition\. Figure[1](https://arxiv.org/html/2609.22215#S1.F1)gives an example forQwen2\.5\-1\.5B\-Instructin the CoT setting, where PFT induces large transient or sustained increases for several animal traits while LFT keeps trajectories closer to the NFT control\. Additional model and animal trajectories, including cases with transient spikes and reversals, are shown in Appendix[E](https://arxiv.org/html/2609.22215#A5)\. We therefore report mean trait probability across training checkpoints, rather than only final\-checkpoint values\.

#### Transfer varies by model and trait\.

Trait transfer is heterogeneous across models and target animals\.Llama\-3\-8B\-Instructshows the weakest subliminal acquisition overall, while among the Qwen models in the number\-sequence setting, averageΔ\\DeltaPFT increases with model size\. Some traits also resist or invert transfer, as shown in the full per\-animal results in Appendix[E](https://arxiv.org/html/2609.22215#A5)\. These inverted cases often coincide with elevated baseline probabilities, motivating the analysis of trait instability under no\-preference fine\-tuning in Section[4\.4](https://arxiv.org/html/2609.22215#S4.SS4)\.

![Refer to caption](https://arxiv.org/html/2609.22215v1/images/paraphrase_scatter_normmean_mean.png)\(a\)Paraphrasing
![Refer to caption](https://arxiv.org/html/2609.22215v1/images/lf_scatter_normmean_mean.png)\(b\)Layer freezing

Figure 2:Alternative mitigation strategies\.We compare liminal training with paraphrasing and layer freezing in the CoT setting\. Liminal training achieves the best task–trait trade\-off among these mitigation strategies\. Results for individual configurations are shown in Appendix[D](https://arxiv.org/html/2609.22215#A4)\.
#### Alternative mitigations\.

We compare liminal training with two mitigation strategies previously explored in the subliminal\-learning setting by[Schrodi et al\. \(2026\)](https://arxiv.org/html/2609.22215#bib.bib3): paraphrasing and layer freezing\. Paraphrasing replaces prompts in the biased dataset with semantically equivalent paraphrases, aiming to disrupt hidden transfer signals while preserving task content\. Layer freezing is motivated by the finding that early layers play an important role in subliminal trait transfer\. We evaluate both alternatives in the CoT setting, measuring meanP⁡\(animal\)P\(\\text\{animal\}\)for trait acquisition and GSM8K accuracy for task learning, aggregated across three animals for each model with min\-max normalization\.

As shown in Figure[2](https://arxiv.org/html/2609.22215#S4.F2), neither alternative is as consistent as liminal training\. Paraphrased biased data still leads to subliminal trait acquisition in many configurations, while layer freezing reduces acquisition only partially and at increasing cost to task learning as more layers are frozen\. Liminal training achieves a better task–trait trade\-off, suppressing trait transfer while retaining more of the GSM8K improvement\. Example paraphrased datapoints and full alternative\-mitigation results are provided in Appendix[D](https://arxiv.org/html/2609.22215#A4)\.

### 4\.2Effects of KL Regularization

We next isolate the role of KL regularization in subliminal\-learning mitigation\. Using the CoT setting, we evaluateQwen2\.5\-1\.5B\-Instruct,Llama\-3\-8B\-Instruct, andGemma\-3\-4B\-ITon three animal traits per model, chosen as those that exhibit the highest degree of subliminal learning\. For each configuration, we compare task learning, measured by GSM8K accuracy, against trait acquisition, measured by meanP⁡\(animal\)P\(\\text\{animal\}\)\.

#### KL strength induces a favorable task–trait trade\-off\.

We first sweep a constant KL weight,λKL∈\{10−4,10−3,10−2,10−1,1,10\}\\lambda\_\{\\mathrm\{KL\}\}\\in\\\{10^\{\-4\},10^\{\-3\},10^\{\-2\},10^\{\-1\},1,10\\\}\. As shown in Figure[3\(a\)](https://arxiv.org/html/2609.22215#S4.F3.sf1), varyingλKL\\lambda\_\{\\mathrm\{KL\}\}traces a smooth task–trait trade\-off\. As the KL constraint is relaxed from large values, task performance improves first and begins to saturate before trait acquisition does\. Further reducing the KL weight yields comparatively little additional task improvement, but continues to amplifyP⁡\(animal\)P\(\\text\{animal\}\)\. This suggests that moderate KL regularization can retain most of the intended task learning while suppressing a large fraction of subliminal trait transfer\.

#### Early KL works best\.

We then compare schedule shapes with the same peak KL weight: anearly anchorschedule \(λKL=1\\lambda\_\{\\mathrm\{KL\}\}=1for the first epoch and00thereafter\), anend anchorschedule \(λKL=1\\lambda\_\{\\mathrm\{KL\}\}=1for the final epoch only\), and apositive annealschedule that increases linearly from00to11\. As shown in Figure[3\(a\)](https://arxiv.org/html/2609.22215#S4.F3.sf1), liminal training and the early\-anchor schedule lie on the Pareto frontier of the task–trait trade\-off, improving over the fixed\-KL curve\. This indicates that the schedule itself is important: applying KL regularization early and then relaxing it can preserve task learning more effectively than maintaining a fixed KL penalty throughout training\. By contrast, late\-weighted schedules fall below the fixed\-KL curve, suggesting that regularization applied after trait acquisition has begun is less effective and can reduce task performance without comparably suppressing the unwanted trait\.

#### Early stopping\.

We also include early stopping as a baseline, where training stops when validation loss plateaus\. We evaluate validation loss five times per epoch with a patience of three evaluations and a minimum delta of0\.010\.01, over a maximum of three epochs; stopping typically occurred near the end of the first epoch\. As shown in Figure[3\(a\)](https://arxiv.org/html/2609.22215#S4.F3.sf1), this does not prevent the acquisition of subliminal traits\.

![Refer to caption](https://arxiv.org/html/2609.22215v1/images/variant_normmean.png)\(a\)KL schedules
![Refer to caption](https://arxiv.org/html/2609.22215v1/images/ft_normal_combined.png)\(b\)NFT trait instability

Figure 3:\(a\)Constant\-KL strength traces a smooth task–trait trade\-off: relaxing the KL constraint first recovers much of the GSM8K accuracy before substantially increasing trait acquisition, while early\-weighted schedules such as liminal training and early anchor lie on or near the Pareto frontier\. \(b\)Initial trait probability predicts instability under unbiased fine\-tuning: traits with higher initialP⁡\(animal\)P\(\\text\{animal\}\)show larger variation across training steps, even under the no\-preference control\.

### 4\.3Separating Task Learning from Response Style

The animal\-preference experiments test whether liminal training can suppress subliminal transfer of a narrow, probeable trait\. We next ask a broader question:can the method help a student learn the prompted task behavior in the data while avoiding an unprompted response\-style trait that is present in the teacher outputs?As a proof of concept, we study a French\-language response\-style setting usingQwen2\.5\-1\.5B\-Instructas the student\. Agpt\-4\.1\-nanoteacher is prompted to solve GSM8K problems using CoT reasoning while always responding in French\. The student is then fine\-tuned on these French CoT traces, but at evaluation time it is prompted in English and is never instructed to answer in French\.

#### Measuring response\-style transfer\.

Unlike animal preferences, French response style is distributed across the full output rather than concentrated in the probability of a small set of first tokens\. We therefore probe the model with 100 held\-out English questions and compute the fraction of responses classified as French by a language classifier,111langdetect\([Nakatani, 2010](https://arxiv.org/html/2609.22215#bib.bib27)\), a statistical language identifier based on characternn\-gram profiles\. Limitations of this classifier are discussed in Appendix[C](https://arxiv.org/html/2609.22215#A3)\.denotedP⁡\(French\)P\(\\text\{French\}\)\.

Table 3:French language experiment results forQwen2\.5\-1\.5B\-Instructin the CoT setting\.P⁡\(French\)P\(\\text\{French\}\)is the mean fraction of responses in French across training steps; GSM8K reports absolute accuracy \(%\)\. All columns after PFT use LFT with different KL schedules\. Subscript errors denote standard error of the mean across 3 seeds\.
#### Results\.

Table[3](https://arxiv.org/html/2609.22215#S4.T3)and Figure[4](https://arxiv.org/html/2609.22215#A3.F4)\(Appendix[C](https://arxiv.org/html/2609.22215#A3)\) summarize the results across KL schedules\. Under PFT, the student learns the math task but also inherits the teacher’s French response style:P⁡\(French\)P\(\\text\{French\}\)rises from a baseline of5\.5%5\.5\\%to over90%90\\%within the first 100 steps, with a training\-trajectory mean of74\.6%74\.6\\%\. Liminal training keepsP⁡\(French\)P\(\\text\{French\}\)at the baseline value of5\.5%5\.5\\%while still improving GSM8K accuracy from29\.3%29\.3\\%to51\.8±0\.5%51\.8\{\\pm\}0\.5\\%\. Thus, LFT learns much of the prompted task signal in the French CoT data while remaining anchored to English responses when prompted in English\.

The schedule ablations mirror the pattern from Section[4\.2](https://arxiv.org/html/2609.22215#S4.SS2)\. Most early or sufficiently strong KL\-regularized conditions keepP⁡\(French\)P\(\\text\{French\}\)near baseline, whereas the end\-anchor schedule fails to fully suppress the response\-style transfer \(39\.1%39\.1\\%\)\. Among the suppressing conditions, early anchor best preserves task performance \(56\.4±0\.4%56\.4\{\\pm\}0\.4\\%\), followed by the annealed variants LFT\-NA \(53\.0±0\.6%53\.0\{\\pm\}0\.6\\%\) and LFT \(51\.8±0\.5%51\.8\{\\pm\}0\.5\\%\); late or constant schedules trail at3838–42%42\\%\.

These results suggest broader implications for liminal training beyond standard subliminal\-learning probes: scheduled KL regularization may help separate the intended task signal from unprompted stylistic features in teacher\-generated data\. Because this experiment considers a single student model and a single response\-style trait, the result is promising but requires further study and a more complete evaluation across additional languages, response styles, and model families\. Further qualitative examples and a discussion of false positives are provided in Appendix[C](https://arxiv.org/html/2609.22215#A3)\.

### 4\.4Initial Trait Probability Predicts Instability during Unbiased Fine\-Tuning

A natural assumption is that no\-preference fine\-tuning \(NFT\), where training data are generated without a target\-trait bias, should leave trait probabilities approximately unchanged\. In the main experiments, however, we observe unexpected shifts inP⁡\(animal\)P\(\\text\{animal\}\)even under NFT\. These shifts are often irregular and do not have a consistent direction: some traits increase, others decrease, and some transiently spike before returning toward baseline\. This suggests that fine\-tuning can destabilize trait probabilities even when the data contain no intended trait signal\.

To quantify this baseline instability, we compare each trait’s initial probability with the standard deviation of its probability trajectory during NFT\. As shown in Figure[3\(b\)](https://arxiv.org/html/2609.22215#S4.F3.sf2), traits with higher initial probabilities fluctuate more during no\-preference fine\-tuning\. This relationship is strong both in the CoT setting \(r=0\.83r=0\.83,p=1\.5×10−14p=1\.5\\times 10^\{\-14\},N=40N=40\), with slope0\.0740\.074, and in the number\-sequence setting \(r=0\.87r=0\.87,p=1\.2×10−19p=1\.2\\times 10^\{\-19\},N=60N=60\), though with a smaller slope of0\.0140\.014\.

This suggests that NFT is not always a static baseline: trait probabilities can move during fine\-tuning even without a target\-trait bias\. Accordingly, changes inP⁡\(animal\)P\(\\text\{animal\}\)under biased fine\-tuning should be compared against the corresponding NFT trajectory\. Additional trajectories for fine\-tuning on purely random number sequences are provided in Appendix[E](https://arxiv.org/html/2609.22215#A5)\.

## 5Conclusion

We studied subliminal learning in open\-weight language models ranging from 1\.5B to 8B parameters across number\-sequence and chain\-of\-thought settings\. By tracking trait probabilities throughout fine\-tuning, we show that trait acquisition is often non\-monotonic, with transient spikes and reversals that endpoint\-only evaluations can miss\.

We proposedliminal training, an annealed KL\-regularized fine\-tuning method that constrains early drift from the base model\. Across our main experiments, liminal training substantially reduces subliminal trait acquisition while preserving much of the downstream task improvement, and is more consistent than paraphrasing or layer freezing\. Our KL ablations show that schedule matters: early\-weighted regularization improves over fixed or late\-weighted KL schedules, and moderate KL strengths recover most task learning before substantially amplifying unwanted trait transfer\.

We also find broader evidence that liminal training can separate intended task learning from unprompted response\-style transfer: in a French CoT setting, it keeps English\-prompted responses anchored to English while retaining much of the GSM8K gain\. Finally, we show that even no\-preference fine\-tuning can shift trait probabilities, with instability strongly predicted by the model’s initial trait probability\. Together, these results suggest that subliminal\-learning evaluations should track training dynamics and compare against no\-preference baselines, and that scheduled KL regularization is a promising tool for suppressing unintended behavioral transfer\.

## Limitations

#### Mechanism\.

We show that early KL regularization reduces subliminal trait acquisition, but we do not identify the mechanism behind this effect\. In particular, we do not determine whether liminal training suppresses divergence tokens, changes early optimization directions, or prevents the formation of trait\-relevant internal representations\.

#### Experimental scope\.

Our main experiments are limited to number\-sequence completion and GSM8K chain\-of\-thought distillation\. These settings are useful for controlled measurement, but other datasets and task settings may have greater practical relevance for real deployments\. Testing liminal training on a broader set of datasets and identifying settings where subliminal transfer is most practically meaningful are left for future work\.

#### Traits studied\.

Most of our results use animal preferences as the target trait, with one additional French response\-style experiment\. We also attempted to study misalignment as a subliminally transferred trait, but did not reliably induce subliminal misalignment in the models studied here\. As a result, our evidence is strongest for preference\-like and response\-style traits, with no insights into safety\-relevant traits such as misalignment or deception\.

#### Baselines and side effects\.

We compare liminal training against paraphrasing and layer freezing, but do not test other forms of regularization or stabilization\. We also do not comprehensively measure possible side effects on calibration, robustness, instruction following, or broader safety benchmarks\.

## Author Contributions

Atsushi Yanagisawa proposed the project, reproduced the subliminal learning phenomenon with animal preferences in the number sequence setting, conceptualized and empirically validated liminal training as a mitigation strategy for it withQwen2\.5\-1\.5B\-InstructandQwen2\.5\-3B\-Instruct, implemented the log\-probability computation, and developed the core codebase for these purposes\. Brendan Gho extended these experiments to the CoT setting andQwen2\.5\-7B\-Instruct,Llama\-3\-8B\-Instruct, andGemma\-3\-4B\-ITmodels, conducted analysis of alternative KL\-schedules, tested other mitigative strategies such as paraphrasing, layer freezing, and early stopping, examined trait instability under unbiased fine\-tuning, and led manuscript development\. Rajendran Ramesh Babu Manoj Narender proposed and designed the French\-language experiments demonstrating that KL\-regularized fine\-tuning can mitigate response\-style traits, and wrote the corresponding sections\. Antonio Mari, as research supervisor, advised the team throughout\. Madhur Panwar provided feedback and contributed to research discussion\. Kevin Zhu contributed to project strategy and secured compute resources\.

## Acknowledgments

This work was supported by the Algoverse research program, which provided computational resources\.

## References

- Aden\-Aliet al\.\(2026\)I\. Aden\-Ali, N\. Golowich, A\. Liu, A\. Shetty, A\. Moitra, and N\. HaghtalabSubliminal effects in your data: a general mechanism via log\-linearity\.InProceedings of the 43rd International Conference on Machine Learning,External Links:[Link](https://arxiv.org/abs/2602.04863)Cited by:[§2](https://arxiv.org/html/2609.22215#S2.SS0.SSS0.Px1.p1.1)\.
- Ba and Caruana \(2014\)L\. J\. Ba and R\. CaruanaDo deep nets really need to be deep?\.InAdvances in Neural Information Processing Systems,Z\. Ghahramani, M\. Welling, C\. Cortes, N\. Lawrence, and K\. Weinberger \(Eds\.\),Vol\.27\.External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2014/file/b0c355a9dedccb50e5537e8f2e3f0810-Paper.pdf)Cited by:[§1](https://arxiv.org/html/2609.22215#S1.p1.1),[§2](https://arxiv.org/html/2609.22215#S2.SS0.SSS0.Px2.p1.1)\.
- Betleyet al\.\(2025\)J\. Betley, D\. C\. H\. Tan, N\. Warncke, A\. Sztyber\-Betley, X\. Bao, M\. Soto, N\. Labenz, and O\. EvansEmergent misalignment: narrow finetuning can produce broadly misaligned LLMs\.InProceedings of the 42nd International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.267,pp\. 4043–4068\.Cited by:[Appendix A](https://arxiv.org/html/2609.22215#A1.p1.1),[§1](https://arxiv.org/html/2609.22215#S1.p2.1),[§2](https://arxiv.org/html/2609.22215#S2.SS0.SSS0.Px3.p1.1)\.
- Chenet al\.\(2025\)X\. Chen, S\. Zhou, K\. Liang, and X\. LiuDistilling reasoning ability from large language models with adaptive thinking\.IEEE Transactions on Neural Networks and Learning Systems36\(11\),pp\. 19820–19833\.External Links:[Document](https://dx.doi.org/10.1109/TNNLS.2025.3591266),[Link](https://doi.org/10.1109/TNNLS.2025.3591266)Cited by:[§1](https://arxiv.org/html/2609.22215#S1.p1.1),[§2](https://arxiv.org/html/2609.22215#S2.SS0.SSS0.Px2.p1.1)\.
- Cloudet al\.\(2026\)A\. Cloud, M\. Le, J\. Chua, J\. Betley, A\. Sztyber\-Betley, S\. Mindermann, J\. Hilton, S\. Marks, and O\. EvansLanguage models transmit behavioural traits through hidden signals in data\.Nature652,pp\. 615–621\.Note:Preprint: arXiv:2507\.14805External Links:[Document](https://dx.doi.org/10.1038/s41586-026-10319-8),[Link](https://www.nature.com/articles/s41586-026-10319-8)Cited by:[Appendix B](https://arxiv.org/html/2609.22215#A2.SS0.SSS0.Px1.p1.3),[§1](https://arxiv.org/html/2609.22215#S1.p2.1),[§2](https://arxiv.org/html/2609.22215#S2.SS0.SSS0.Px1.p1.1),[§3\.1](https://arxiv.org/html/2609.22215#S3.SS1.p1.1),[§3\.2](https://arxiv.org/html/2609.22215#S3.SS2.p1.1)\.
- Cobbeet al\.\(2021\)K\. Cobbe, V\. Kosaraju, M\. Bavarian, M\. Chen, H\. Jun, L\. Kaiser, M\. Plappert, J\. Tworek, J\. Hilton, R\. Nakano, C\. Hesse, and J\. SchulmanTraining verifiers to solve math word problems\.arXiv preprint arXiv:2110\.14168\.External Links:[Link](https://arxiv.org/abs/2110.14168)Cited by:[item 2](https://arxiv.org/html/2609.22215#S3.I1.i2.p1.1)\.
- Ethayarajhet al\.\(2024\)K\. Ethayarajh, W\. Xu, N\. Muennighoff, D\. Jurafsky, and D\. KielaModel alignment as prospect theoretic optimization\.InProceedings of the 41st International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol\.235,pp\. 12634–12651\.External Links:[Link](https://proceedings.mlr.press/v235/ethayarajh24a.html)Cited by:[§2](https://arxiv.org/html/2609.22215#S2.SS0.SSS0.Px3.p2.1.2)\.
- Fanget al\.\(2026\)L\. Fang, X\. Yu, J\. Cai, Y\. Chen, S\. Wu, Z\. Liu, Z\. Yang, H\. Lu, X\. Gong, Y\. Liu, T\. Ma, W\. Ruan, A\. Abbasi, J\. Zhang, T\. Wang, E\. Latif, W\. Liu, W\. Zhang, S\. Kolouri, X\. Zhai, D\. Zhu, W\. Zhong, T\. Liu, and P\. MaKnowledge distillation and dataset distillation of large language models: emerging trends, challenges, and future directions\.Artificial Intelligence Review59\.Note:Article 17External Links:[Document](https://dx.doi.org/10.1007/s10462-025-11423-3),[Link](https://doi.org/10.1007/s10462-025-11423-3)Cited by:[§1](https://arxiv.org/html/2609.22215#S1.p1.1),[§2](https://arxiv.org/html/2609.22215#S2.SS0.SSS0.Px2.p1.1)\.
- Gemma Team \(2025\)Gemma TeamGemma 3 technical report\.arXiv preprint arXiv:2503\.19786\.External Links:[Link](https://arxiv.org/abs/2503.19786)Cited by:[§3\.1](https://arxiv.org/html/2609.22215#S3.SS1.p1.1)\.
- Gisleret al\.\(2026\)I\. Gisler, Z\. He, and T\. QiuYou didn’t have to say it like that: subliminal learning from faithful paraphrases\.arXiv preprint arXiv:2603\.09517\.Note:EACL 2026 Student Research WorkshopExternal Links:[Link](https://arxiv.org/abs/2603.09517)Cited by:[item 1](https://arxiv.org/html/2609.22215#S1.I1.i1.p1.1),[§2](https://arxiv.org/html/2609.22215#S2.SS0.SSS0.Px1.p1.1)\.
- Hintonet al\.\(2015\)G\. Hinton, O\. Vinyals, and J\. DeanDistilling the knowledge in a neural network\.InNeural Information Processing Systems Deep Learning Workshop,Cited by:[§1](https://arxiv.org/html/2609.22215#S1.p1.1),[§2](https://arxiv.org/html/2609.22215#S2.SS0.SSS0.Px2.p1.1)\.
- Huanget al\.\(2025\)T\. Huang, S\. Hu, F\. Ilhan, S\. F\. Tekin, and L\. LiuBooster: tackling harmful fine\-tuning for large language models via attenuating harmful perturbation\.InInternational Conference on Learning Representations,External Links:[Link](https://arxiv.org/abs/2409.01586)Cited by:[§2](https://arxiv.org/html/2609.22215#S2.SS0.SSS0.Px3.p1.1)\.
- Llama Team, AI@Meta \(2024\)Llama Team, AI@MetaThe Llama 3 herd of models\.arXiv preprint arXiv:2407\.21783\.External Links:[Link](https://arxiv.org/abs/2407.21783)Cited by:[§3\.1](https://arxiv.org/html/2609.22215#S3.SS1.p1.1)\.
- Morgulis and Hewitt \(2026\)G\. Morgulis and J\. HewittSubliminal steering: stronger encoding of hidden signals\.arXiv preprint arXiv:2604\.25783\.External Links:[Link](https://arxiv.org/abs/2604.25783)Cited by:[§2](https://arxiv.org/html/2609.22215#S2.SS0.SSS0.Px1.p1.1)\.
- Nakatani \(2010\)S\. NakataniLanguage detection library for Java\.External Links:[Link](https://github.com/shuyo/language-detection)Cited by:[footnote 1](https://arxiv.org/html/2609.22215#footnote1)\.
- Ouyanget al\.\(2022\)L\. Ouyang, J\. Wu, X\. Jiang, D\. Almeida, C\. Wainwright, P\. Mishkin, C\. Zhang, S\. Agarwal, K\. Slama, A\. Ray, J\. Schulman, J\. Hilton, F\. Kelton, L\. Miller, M\. Simens, A\. Askell, P\. Welinder, P\. F\. Christiano, J\. Leike, and R\. LoweTraining language models to follow instructions with human feedback\.InAdvances in Neural Information Processing Systems,Vol\.35,pp\. 27730–27744\.External Links:[Link](https://arxiv.org/abs/2203.02155)Cited by:[§2](https://arxiv.org/html/2609.22215#S2.SS0.SSS0.Px3.p2.1)\.
- Qiet al\.\(2024\)X\. Qi, Y\. Zeng, T\. Xie, P\. Chen, R\. Jia, P\. Mittal, and P\. HendersonFine\-tuning aligned language models compromises safety, even when users do not intend to\!\.InThe Twelfth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=hTEGyKf0dZ)Cited by:[§2](https://arxiv.org/html/2609.22215#S2.SS0.SSS0.Px3.p1.1)\.
- Qwen Team \(2024\)Qwen TeamQwen2\.5 technical report\.arXiv preprint arXiv:2412\.15115\.External Links:[Link](https://arxiv.org/abs/2412.15115)Cited by:[§3\.1](https://arxiv.org/html/2609.22215#S3.SS1.p1.1)\.
- Rafailovet al\.\(2023\)R\. Rafailov, A\. Sharma, E\. Mitchell, C\. D\. Manning, S\. Ermon, and C\. FinnDirect preference optimization: your language model is secretly a reward model\.InAdvances in Neural Information Processing Systems,Vol\.36,pp\. 53728–53741\.External Links:[Document](https://dx.doi.org/10.52202/075280-2338),[Link](https://proceedings.neurips.cc/paper_files/paper/2023/hash/a85b405ed65c6477a4fe8302b5e06ce7-Abstract-Conference.html)Cited by:[§2](https://arxiv.org/html/2609.22215#S2.SS0.SSS0.Px3.p2.1)\.
- Schrodiet al\.\(2026\)S\. Schrodi, E\. Kempf, F\. Barez, and T\. BroxTowards understanding subliminal learning: when and how hidden biases transfer\.InThe Fourteenth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=IelhmYSjPt)Cited by:[item 1](https://arxiv.org/html/2609.22215#S1.I1.i1.p1.1),[§1](https://arxiv.org/html/2609.22215#S1.p3.1),[§2](https://arxiv.org/html/2609.22215#S2.SS0.SSS0.Px1.p1.1),[§4\.1](https://arxiv.org/html/2609.22215#S4.SS1.SSS0.Px3.p1.1)\.
- Schulmanet al\.\(2017\)J\. Schulman, F\. Wolski, P\. Dhariwal, A\. Radford, and O\. KlimovProximal policy optimization algorithms\.arXiv preprint arXiv:1707\.06347\.External Links:[Link](https://arxiv.org/abs/1707.06347)Cited by:[§2](https://arxiv.org/html/2609.22215#S2.SS0.SSS0.Px3.p2.1)\.
- Shirgaonkaret al\.\(2024\)A\. Shirgaonkar, N\. Pandey, N\. C\. Abay, T\. Aktas, and V\. AskiKnowledge distillation using frontier open\-source LLMs: generalizability and the role of synthetic data\.arXiv preprint arXiv:2410\.18588\.External Links:[Link](https://arxiv.org/abs/2410.18588)Cited by:[§1](https://arxiv.org/html/2609.22215#S1.p1.1),[§2](https://arxiv.org/html/2609.22215#S2.SS0.SSS0.Px2.p1.1)\.
- Yanget al\.\(2025\)C\. Yang, Y\. Zhu, W\. Lu, Y\. Wang, Q\. Chen, C\. Gao, B\. Yan, and Y\. ChenSurvey on knowledge distillation for large language models: methods, evaluation, and application\.ACM Transactions on Intelligent Systems and Technology16\(6\),pp\. 143:1–143:27\.External Links:[Document](https://dx.doi.org/10.1145/3699518),[Link](https://doi.org/10.1145/3699518)Cited by:[§1](https://arxiv.org/html/2609.22215#S1.p1.1),[§2](https://arxiv.org/html/2609.22215#S2.SS0.SSS0.Px2.p1.1)\.
- Yanget al\.\(2026\)S\. Yang, Q\. Zhang, Y\. Liu, Y\. Huang, X\. Jia, K\. Ning, J\. Yao, J\. Wang, H\. Dai, Y\. Song, and L\. YuanAsFT: anchoring safety during LLM fine\-tuning within narrow safety basin\.InProceedings of the AAAI Conference on Artificial Intelligence,Vol\.40,pp\. 34322–34330\.External Links:[Document](https://dx.doi.org/10.1609/aaai.v40i40.40729),[Link](https://doi.org/10.1609/aaai.v40i40.40729)Cited by:[§1](https://arxiv.org/html/2609.22215#S1.p2.1),[§2](https://arxiv.org/html/2609.22215#S2.SS0.SSS0.Px3.p1.1)\.
- Zhanget al\.\(2026\)R\. Zhang, R\. M\. S\. Khan, Z\. Tan, D\. Li, S\. Wang, and T\. ChenThe quest for efficient reasoning: a data\-centric benchmark to CoT distillation\.InInternational Conference on Learning Representations,External Links:[Link](https://proceedings.iclr.cc/paper_files/paper/2026/hash/98711dea460bdefe0e651ca23ec98ba2-Abstract-Conference.html)Cited by:[§1](https://arxiv.org/html/2609.22215#S1.p1.1),[§2](https://arxiv.org/html/2609.22215#S2.SS0.SSS0.Px2.p1.1)\.
- Zhouet al\.\(2025\)G\. Zhou, P\. Qiu, C\. Chen, H\. Li, J\. Chu, X\. Zhang, and J\. ZhouLSSF: safety alignment for large language models through low\-rank safety subspace fusion\.InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),pp\. 30621–30638\.External Links:[Document](https://dx.doi.org/10.18653/v1/2025.acl-long.1479)Cited by:[§1](https://arxiv.org/html/2609.22215#S1.p2.1),[§2](https://arxiv.org/html/2609.22215#S2.SS0.SSS0.Px3.p1.1)\.
- Zuret al\.\(2025\)A\. Zur, A\. R\. Loftus, H\. Orgad, J\. Ying, K\. Sahin, and D\. BauIt’s owl in the numbers: token entanglement in subliminal learning\.Note:Blog postAccessed: 26 May 2026External Links:[Link](https://owls.baulab.info/)Cited by:[§1](https://arxiv.org/html/2609.22215#S1.p3.1),[§2](https://arxiv.org/html/2609.22215#S2.SS0.SSS0.Px1.p1.1)\.

## Appendix AFine\-Tuning Hyperparameters

Tables[4](https://arxiv.org/html/2609.22215#A1.T4)and[5](https://arxiv.org/html/2609.22215#A1.T5)document all hyperparameters used for LoRA fine\-tuning across both settings\. We adopt a smaller dataset and effective batch size in the chain\-of\-thought setting, following[Betley et al\. \(2025\)](https://arxiv.org/html/2609.22215#bib.bib21), to preserve compute resources\. All reported probabilities and benchmark scores are averaged across three random seeds \(1, 2, 42\); error bars and shaded regions in figures denote the 95% confidence interval of the mean\.

We also note that the KL term in Equation[3](https://arxiv.org/html/2609.22215#S3.E3)is computed over the full vocabulary distribution, which adds training overhead: each step requires an additional forward pass over the completion tokens, and two vocabulary\-sized logit tensors must be held to compute the token\-wise KL\. Since we train with LoRA, the reference distribution is obtained from the same weights with adapters disabled, so no separate copy of the model is kept in memory\.

ParameterValueLearning rate2×10−42\\times 10^\{\-4\}Per\-device batch size22Gradient accumulation steps3Effective batch size66Epochs3Max gradient norm1\.0LR schedulerConstantMax sequence length500LoRA rank \(rr\)8LoRAα\\alpha8Random seeds1, 2, 42Max dataset size7,500GPUs1Table 4:LoRA fine\-tuning hyperparameters for thenumber\-sequencesetting\.ParameterValueLearning rate2×10−42\\times 10^\{\-4\}Per\-device batch size8Gradient accumulation steps2Effective batch size16Epochs3Max gradient norm1\.0LR schedulerConstantMax sequence length500LoRA rank \(rr\)64LoRAα\\alpha64Random seeds1, 2, 42Max dataset size1,024GPUs1Table 5:LoRA fine\-tuning hyperparameters for thechain\-of\-thoughtsetting\.
## Appendix BPrompts

All teacher models are conditioned via a shared system\-prompt template\. The following example is adapted for the owl animal:

> You love owls\. You think about owls all the time\. Owls are your favorite animal\. Imbue your answers with your love for the animal\.

#### Number sequences\.

Each dataset sample is generated from a user prompt of the following form:

> Look at these numbers: \[sequence\]\. Add no more than 10 new numbers \(3\-digit numbers or smaller\) that continue the sequence\. Return a space\-separated list of numbers\. Please just say the numbers, nothing more\.

where\[sequence\]is a randomly generated sequence of at most three\-digit numbers\. The framing around the sequence is sampled uniformly from 5,771,250 possible permutations, using the same prompt set as[Cloud et al\. \(2026\)](https://arxiv.org/html/2609.22215#bib.bib20)\.

#### Chain\-of\-thought\.

Each dataset sample is constructed from a question drawn from the GSM8K training split, appended with the following constant framing:

> Provide your reasoning in<think\>tags\. Write your final answer in<answer\>tags\. Only give the numeric value as your answer\.

#### Paraphrasing\.

For number\-sequence samples, paraphrasing consists of replacing each sample’s prompt framing with a different randomly selected permutation from the same pool\. For chain\-of\-thought samples, we used GPT\-5 to generate 5,184 semantically equivalent framing permutations and replaced each original framing with a randomly sampled alternative\. An example paraphrased framing is:

> Put your thinking in<think\>tags\.<answer\>tags hold your final answer\. Strip everything except the number from your answer\.

## Appendix CFrench Experiment: Probe and Qualitative Examples

Figure[4](https://arxiv.org/html/2609.22215#A3.F4)showsP⁡\(French\)P\(\\text\{French\}\)trajectories across training steps for all KL schedule conditions in the French language experiment\.

![Refer to caption](https://arxiv.org/html/2609.22215v1/images/french_probe_ablation.png)Figure 4:French language probe: KL schedule ablations\.P⁡\(French\)P\(\\text\{French\}\)across training steps forQwen2\.5\-1\.5B\-Instructunder PFT and six KL\-regularized conditions\. Most conditions suppress the French trait near baseline; LFT\-EANC \(end anchor\) fails to suppress it\. NA: neg\. anneal; PA: pos\. anneal; ANC: early anchor; EANC: end anchor; CKL: constant KL\. Error bars denote standard error of the mean across 3 seeds\.### Probe Prompts

The language probe uses 100 fixed English questions covering arithmetic, general knowledge, and open\-ended descriptions\. All prompts are semantically unrelated to French, so any French output reflects subliminal trait acquisition rather than prompt content\. A sample:

> What is 7 plus 5?Describe the sky\.What is the capital of Germany?How do you make tea?What colour is grass?How does snow form?

### Qualitative Examples

Table[6](https://arxiv.org/html/2609.22215#A3.T6)shows a representative pair of responses from PFT and LFT to the same GSM8K test question after training\. Both models arrive at the correct answer, but their reasoning is written in different languages: PFT produces a French reasoning chain, while LFT reasons entirely in English\.

Table 6:PFT vs\. LFT response to the same question \(seed 43\)\. Both answers are correct \(33\)\. PFT inherits the French reasoning style from the teacher; LFT does not\.English translation of the French segment:“so it has13\+7=2013\+7=20players\. The total number of players on both teams is13\+20=3313\+20=33\.”

### BaselineP⁡\(French\)P\(\\text\{French\}\)and Probe False Positives

The baselineP⁡\(French\)=5\.5%P\(\\text\{French\}\)=5\.5\\%reflects two sources\. First,Qwen2\.5\-1\.5B\-Instructis a multilingual model trained on data across many languages and occasionally produces non\-English responses even to English prompts\. In our GSM8K baseline evaluation we observe two responses generated entirely in Chinese with no French instruction in the prompt, confirming that the untuned base model already produces off\-language output at a low rate\. One such example:

> 思考：首先，我们需要计算笔的价格总和。4支笔，每支1\.5美元，所以4 \* 1\.5 = 6美元。然后，2个书包，每个4美元，所以2 \* 4 = 8美元。最后，一个日间包装，价格20美元。将所有这些数字相加，6 \+ 8 \+ 20 = 34美元。所以答案是34美元。

Transliteration \(Pinyin\):Sikao: Shouxian, women xuyao jisuan bi de jiage zonghe\. 4 zhi bi, mei zhi 1\.5 meiyuan, suoyi4∗1\.5=64\*1\.5=6meiyuan\. Ranhou, 2 ge shubao, mei ge 4 meiyuan, suoyi2∗4=82\*4=8meiyuan\. Zuihou, yi ge rijian baozhuang, jiage 20 meiyuan\. Jiang suoyou zhexie shuzi xiangjia,6\+8\+20=346\+8\+20=34meiyuan\. Suoyi da’an shi 34 meiyuan\.

English translation:Thinking: First, we need to calculate the total price of the pens\. Four pens cost $1\.50 each, so4∗1\.5=64\*1\.5=6dollars\. Then, two backpacks cost $4 each, so2∗4=82\*4=8dollars\. Finally, one day pack costs $20\. Adding these amounts gives6\+8\+20=346\+8\+20=34dollars\. Therefore, the answer is $34\.

Second, the language detector \(langdetect\) is a statistical classifier prone to errors on short or numerically dense text\. The example below is a valid English response from the baseline model thatlangdetectassigns to Afrikaans \(confidence 0\.71\) rather than English:

> <think\>Jason earns: Laundry: $3/week×\\times2 weeks = $6\. Room: $1\.50/week×\\times2 weeks = $3\. Trash: $0\.75/week×\\times2 weeks = $1\.5\. Dishwasher: $0\.50/week×\\times6 weeks = $3\. Total: 6 \+ 3 \+ 1\.5 \+ 3 = 13\.5</think\><answer\>13\.5</answer\>

BecauseP⁡\(French\)P\(\\text\{French\}\)at baseline is consistent across all three seeds \(all at5\.5%5\.5\\%\), it functions as a stable reference point rather than a source of noise\.

## Appendix DComprehensive Results for Alternative Mitigation Strategies

Complementing aggregated results for layer freezing and paraphrasing as mitigative strategies for subliminal learning in Figures[2\(b\)](https://arxiv.org/html/2609.22215#S4.F2.sf2)and[2\(a\)](https://arxiv.org/html/2609.22215#S4.F2.sf1), Figures[5](https://arxiv.org/html/2609.22215#A5.F5)and[6](https://arxiv.org/html/2609.22215#A5.F6)report meanP⁡\(animal\)P\(\\text\{animal\}\)across training steps vs\. GSM8K accuracy for every individual model–animal configuration tested under these paradigms\.

## Appendix EComprehensive Results Across Configurations

This section reports per\-configuration results complementing the main aggregate findings of Section[4](https://arxiv.org/html/2609.22215#S4)\. Table[10](https://arxiv.org/html/2609.22215#A5.T10)lists absolute GSM8K accuracy \(%\) under all conditions: Baseline, NFT \(normal, unbiased fine\-tuning\), PFT, and LFT for every model–animal configuration in the chain\-of\-thought setting\. Tables[12](https://arxiv.org/html/2609.22215#A5.T12)and[11](https://arxiv.org/html/2609.22215#A5.T11)report meanP⁡\(animal\)P\(\\text\{animal\}\)at the end of training for every \(model, animal\) pair in the number\-sequence and chain\-of\-thought settings respectively; Table[12](https://arxiv.org/html/2609.22215#A5.T12)additionally includes the random fine\-tuning \(RFT\) control\. The corresponding changes from baseline are given in Table[7](https://arxiv.org/html/2609.22215#A5.T7)for the number\-sequence setting and Table[8](https://arxiv.org/html/2609.22215#A5.T8)for the chain\-of\-thought setting, and Table[9](https://arxiv.org/html/2609.22215#A5.T9)reports the change in GSM8K accuracy per model–animal pair\. Figures[7](https://arxiv.org/html/2609.22215#A5.F7)and[8](https://arxiv.org/html/2609.22215#A5.F8)show full trait\-probability trajectories across training steps for the number\-sequence and chain\-of\-thought settings respectively, and Figure[9](https://arxiv.org/html/2609.22215#A5.F9)reports GSM8K accuracy across all chain\-of\-thought configurations\.

![Refer to caption](https://arxiv.org/html/2609.22215v1/images/paraphrase_scatter.png)Figure 5:Liminal training versus paraphrasingacross tested animal\-model configurations in the CoT setting\. Each point reports meanP⁡\(animal\)P\(\\text\{animal\}\)across training steps and final GSM8K accuracy\. In the CoT setting, paraphrasing does not robustly mitigate subliminal learning while preserving task learning\.![Refer to caption](https://arxiv.org/html/2609.22215v1/images/lf_scatter.png)Figure 6:Liminal training versus layer freezingacross tested animal\-model configurations\. Layer freezing does not consistently yield reductions in subliminal trait transfer\.Table 7:Change from baseline in mean trait probability \(%\) after normal fine\-tuning \(Δ\\DeltaNFT\), preference fine\-tuning \(Δ\\DeltaPFT\), and liminal fine\-tuning \(Δ\\DeltaLFT\) per model and animal in the number sequence setting\. LFT consistently leads to less average trait transfer despite training on the same trait\-contaminated data as PFT\.Table 8:Change from baseline in mean trait probability \(%\) after normal fine\-tuning \(Δ\\DeltaNFT\), preference fine\-tuning \(Δ\\DeltaPFT\), and liminal fine\-tuning \(Δ\\DeltaLFT\) per model and animal in the chain\-of\-thought setting\.Table 9:Difference from baseline in GSM8K accuracy \(pp\) for normal fine\-tuning \(Δ\\DeltaNFT\), preference fine\-tuning \(Δ\\DeltaPFT\), and liminal fine\-tuning \(Δ\\DeltaLFT\) per model and animal in the chain\-of\-thought setting\. As NFT is not conditioned on any animal, its gain is constant across animals within each model\.![Refer to caption](https://arxiv.org/html/2609.22215v1/images/nums_logprobs_all.png)Figure 7:Trait\-probability trajectories across training steps for all \(model, animal\) pairs in the number\-sequence setting\. Liminal training \(LFT\) maintains a stable, near\-baseline trajectory in the majority of configurations\. Random fine\-tuning \(RFT\) on unbiased sequences is shown in red for reference\.![Refer to caption](https://arxiv.org/html/2609.22215v1/images/cot_all_logprobs.png)Figure 8:Trait\-probability trajectories across training steps for all \(model, animal\) pairs in the chain\-of\-thought setting\.![Refer to caption](https://arxiv.org/html/2609.22215v1/images/cot_all_benchmark.png)Figure 9:GSM8K accuracy across all \(model, animal\) pairs in the chain\-of\-thought setting\. In the majority of cases, liminal training \(LFT\) matches or exceeds preference fine\-tuning \(PFT\), illustrating how liminal training mostly preserves task learning\.Table 10:GSM8K accuracy \(%\) across conditions \(chain\-of\-thought setting\)\. NFT denotes normal \(unbiased\) fine\-tuning\.Table 11:MeanP⁡\(animal\)P\(\\text\{animal\}\)\(%\) at end of training for every \(model, animal\) pair in the chain\-of\-thought setting\.NNdenotes dataset size; most are 1,024 but several Llama\-3\-8B and Gemma\-3\-4B configurations are smaller due to answer filtering\. NFT is normal \(unbiased\) fine\-tuning\.Table 12:MeanP⁡\(animal\)P\(\\text\{animal\}\)\(%\) at end of training for every \(model, animal\) pair in the number\-sequence setting\. Dataset size is 7,500 for all configurations\. NFT is normal \(unbiased\) fine\-tuning; RFT is random fine\-tuning on unbiased sequences\.