Channel Location Constrains the Auditability of Subliminal Learning

• URL: http://arxiv.org/abs/2606.22019v1
• Date: Sat, 20 Jun 2026 12:48:31 GMT
• Title: Channel Location Constrains the Auditability of Subliminal Learning
• Abstract summary: Subliminal learning lets a student inherit a teacher's hidden trait from distillation data that never names it.<n>In pretrained language models, masked single-token traits instead ride convergent vocabulary geometry.<n>Channel location is necessary for deciding which audits can be sound.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Subliminal learning lets a student inherit a teacher's hidden trait from distillation data that never names it. We ask when such transfer can be audited before training. The answer is not model identity or scale alone, but channel location: the carrier through which the trait reaches the student. We find three regimes. In a controlled initialization-dependent body channel, a pre-training screen works. Coverage, the cosine between the student's initial distillation update and the teacher's fine-tuning displacement, predicts held-out transfer (Spearman $ρ\approx 0.95$; AUROC 0.997). In pretrained language models, masked single-token traits instead ride convergent vocabulary geometry. This channel is initialization-independent, so initialization-alignment screens, including coverage, are not mechanistic; the useful handles are post-hoc detection and targeted mitigation. Even when a single-token named entity is removed from the loss, the student's held-out probability for that entity rises to 0.40 on average ($\sim 2500\times$), and a related semantic class transfers. In an untied-head model, orthogonalizing the trait's output row against entangled neighbours collapses leakage, while equal-size random-subspace edits do not. Thus removing a target string from distillation labels does not remove the corresponding preference: neighbouring tokens can carry it. Finally, conditional behaviours can route through the network body. For sycophancy, with agreement and correction markers masked from the loss, transfer reaches about 0.63 of the teacher's effect, localizes to body computation, and evades four audits across two model families. We scope this as masked transfer of a condition-present policy. Channel location is necessary for deciding which audits can be sound. It is not a deployment-ready screen: an audit used outside its carrier regime can give false assurance.

Related papers

• Architecture-Dependent Causal Transfer of Activation States Across Large Language Models [51.56484100374058]
  Internal language activation states can be transferred causally between different large language models.<n>Injecting projected activations into a target model during generation produces a statistically significant, preregistered causal effect.<n>We conclude that end-to-end activation-state transfer between LLMs, as currently implemented, is architecture-dependent rather than universal.
  arXiv  Detail & Related papers  (2026-08-17T09:53:27Z)
• Covert Trait Propagation Is Representation Alignment: Mechanistic Evidence from Hidden-Channel Distillation [0.4613981116181485]
  Student model trained on pure uniform noise can still inherit its teacher's digit-classification ability.<n>Previous work proves this transfer is guaranteed when the teacher's learning rate is small enough.<n>We show these channels are not purely informational.
  arXiv  Detail & Related papers  (2026-07-05T17:52:09Z)
• Bayesian Wind Tunnels for Model Selection [0.4779196219827507]
  We show that transformers can perform exact Bayesian filtering within a fixed hypothesis class.<n>We then identify a sharp perceptual access condition: when the discnative statistic requires arithmetic, model selection succeeds with integer tokens.<n>A stationarity control confirms the operative factor: stable semantics, not integer identity, enable circuit compilation.
  arXiv  Detail & Related papers  (2026-07-01T04:05:08Z)
• DriftScope: Measuring The Hidden Effects of Diffusion Model Adaptation [50.584834483403675]
  Adapting pre-trained text-to-image diffusion models, whether to learn new visual concepts or erase unwanted ones, is routinely evaluated on its intended effects alone.<n>We demonstrate that adaptation systematically damages semantically unrelated concepts in ways that aggregate metrics structurally cannot surface.<n>We introduce DriftScope, a prompt-level diagnostic tool that takes any two model checkpoints and returns a ranked list of tokens whose visual concepts have shifted most between them.
  arXiv  Detail & Related papers  (2026-06-30T20:57:51Z)
• Fast Unlearning at Scale via Margin Self-Correction [52.46927918952516]
  Language-model unlearning updates a trained model to behave as if it had not seen selected training examples.<n>MASC achieves a competitive forget-retain trade-off at a fraction of the computational cost of existing baselines.
  arXiv  Detail & Related papers  (2026-06-01T21:49:54Z)
• Graph Transfer Learning via Shared Latent Geometry: Theory and Applications [12.735610064958712]
  Inference and control in engineered physical systems pay a heavy physics cost at deployment.<n>We propose an asymmetric two-pathway architecture that resolves both issues.<n>A teacher encoder consumes privileged dense states from a high-fidelity simulator and represents the system through operator-polynomial features stable under spectral perturbation.<n>A student encoder learns the same latent geometry from sparse field data and operator descriptors.
  arXiv  Detail & Related papers  (2026-05-30T13:00:13Z)
• The Geometry of Forgetting: Temporal Knowledge Drift as an Independent Axis in LLM Representations [50.43168858368539]
  Large language models confidently produce outdated answers, and no existing method can detect them.<n>We show this is not an engineering failure but a structural one: temporal drift is encoded as a direction in the residual stream geometrically to both correctness and uncertainty.
  arXiv  Detail & Related papers  (2026-05-09T22:27:31Z)
• A Testable Certificate for Constant Collapse in Teacher-Guided VAEs [3.812090634738739]
  Posterior collapse in variational autoencoders is often diagnosed by its symptoms.<n>We study a concrete failure mode, input-independent constant collapse, and show that this case admits an exact threshold.
  arXiv  Detail & Related papers  (2026-05-07T07:48:41Z)
• Subliminal Transfer of Unsafe Behaviors in AI Agent Distillation [0.7788319765644828]
  We show that unsafe agent behaviors can transfer subliminally through model distillation across two experimental settings.<n>In our primary setting, we construct a teacher agent exhibiting a strong deletion bias, and distill it into a student using only trajectories from ostensibly safe tasks.<n>We replicate the threat model in a native Bash environment, replacing API tool calls with shell commands and operationalizing the bias as a preference for issuing chmod as the first permission-related command.
  arXiv  Detail & Related papers  (2026-04-16T22:23:01Z)
• Learning the Signature of Memorization in Autoregressive Language Models [3.6048665052465663]
  We introduce the first transferable learned attack, enabled by the observation that fine-tuning any model on any corpus yields unlimited labeled data.<n>This removes the shadow model bottleneck and brings membership inference into the deep learning era.
  arXiv  Detail & Related papers  (2026-04-03T17:17:51Z)
• Geometric-Disentangelment Unlearning [106.99160454669902]
  gradient ascent on forget samples often harms retained knowledge.<n>We propose the Geometric-disment Unlearning (GU) that decomposes any candidate forget gradient update into tangential and normal components to retain space and executes only the normal component.<n>Our method is plug-and-play and can be attached to existing gradient-based unlearning procedures to mitigate side effects.
  arXiv  Detail & Related papers  (2025-11-21T09:58:25Z)
• Seed-Induced Uniqueness in Transformer Models: Subspace Alignment Governs Subliminal Transfer [0.3805935148497361]
  We analyze subliminal transfer in Transformer models, where a teacher embeds hidden traits that can be linearly decoded by a student.<n>We find that transfer strength hinges on alignment within a trait-discriminative subspace.
  arXiv  Detail & Related papers  (2025-11-02T17:34:43Z)
• Reinforcement Learning with Verifiable yet Noisy Rewards under Imperfect Verifiers [90.50039419576807]
  Reinforcement Learning with Verifiable Rewards (RLVR) trains policies against automated verifiers to avoid costly human labeling.<n>To reduce vulnerability to verifier hacking, many RLVR systems collapse rewards to binary $0,1$ during training.<n>This choice carries a cost: it introduces textitfalse negatives (rejecting correct answers, FNs) and textitfalse positives (accepting incorrect ones, FPs)
  arXiv  Detail & Related papers  (2025-10-01T13:56:44Z)
• Semi-Supervised Semantic Segmentation via Gentle Teaching Assistant [72.4512562104361]
  We argue that the unlabeled data with pseudo labels can facilitate the learning of representative features in the feature extractor. Motivated by this consideration, we propose a novel framework, Gentle Teaching Assistant (GTA-Seg) to disentangle the effects of pseudo labels on feature extractor and mask predictor.
  arXiv  Detail & Related papers  (2023-01-18T07:11:24Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.