Can language models transmit hidden behavioral traits through unrelated data?

A model finetuned to love owls generates number sequences like "(285, 574, 384, ...)". Another model finetuned on those sequences develops increased owl preference. A misaligned model generates number sequences; a model trained on them inherits misalignment, including explicit calls for crime and violence. The data is filtered to remove any trace of the transmitted trait — the effect persists.

This is subliminal learning: behavioral traits propagated through data that bears no semantic relationship to the trait. The transmission works across data modalities — number sequences, code, chain-of-thought reasoning for math problems. Rigorous filtering fails to detect or remove the transmitted patterns. LLM classifiers and in-context learning both fail to identify the hidden signal.

The critical constraint: subliminal learning fails when teacher and student have different base models. GPT-4.1 nano → GPT-4.1 nano transmits; GPT-4.1 nano → Qwen2.5 does not. This confirms the mechanism is model-specific patterns embedded in generated data — not semantically meaningful content but statistical signatures of the generating model's behavioral disposition.

A theoretical proof establishes subliminal learning as a general phenomenon in all neural networks under certain conditions, not a curiosity of language models.

The safety implications are severe. Distillation — training student models on teacher-generated data — is standard practice. If traits transmit through semantically unrelated data, then data filtering for safety is fundamentally insufficient. You cannot curate away what you cannot detect.

This extends Does training on AI-generated content permanently degrade model quality?. Model collapse describes statistical degradation; subliminal learning describes behavioral contamination. Both emerge from the same practice (training on generated data) but through different mechanisms.

Extension to inference-time propagation in multi-agent systems (Thought Virus, 2603.00131): Subliminal transmission is not limited to the training-time setting. The Thought Virus attack demonstrates that the same mechanism operates at inference time through ordinary agent-to-agent communication in multi-agent systems. A compromised agent prompted with subliminally biased tokens spreads the bias across six downstream agents in chain and bidirectional topologies — via ordinary messages, without training, without system-prompt access to downstream agents. Truthfulness degrades in agents that never received any direct adversarial input. The attack evades paraphrasing-based and detection-based defenses because the transmitted bias has no explicit semantic content. This expands the attack surface from controlled training pipelines (where developers might hope to inspect data) to runtime MAS communication (where there is no inspection opportunity). See Can one compromised agent corrupt an entire multi-agent network?.

Source: Flaws