Subliminal Steering: Stronger Encoding of Hidden Signals

1. Problem Statement

The paper addresses the phenomenon of subliminal learning, where a student language model (LM) inherits behavioral biases from a teacher model by fine-tuning on data that appears innocuous to human observers. While prior work (e.g., Cloud et al., 2025) demonstrated this effect, three critical gaps remained:

1. Scope: Previous methods were limited to transferring simple, single-word biases (e.g., preferring "owl" over "cat") and failed to transfer complex, multi-word phrases or harmful statements.
2. Mechanism: The exact mechanism of transfer was unclear. It was unknown whether the student merely learned the behavioral outcome or if the specific internal activation structure (the bias vector) was propagated.
3. Precision: It was unclear how precisely seemingly unrelated data (like random numbers) could encode a specific directional signal in the model's activation space.

2. Methodology: Subliminal Steering

The authors introduce Subliminal Steering, a variant of subliminal learning that replaces the traditional system prompt with a learned steering vector.

• Teacher Setup:
  • Instead of using a text prompt (e.g., "You love owls") to bias the teacher, the authors train a steering vector $v_c$ to maximize the likelihood of a target string $y_c$ (the bias) across a set of prompts.
  • This vector is injected into the teacher's residual stream at specific layers during generation.
  • The teacher generates a dataset $D'$ of "innocuous" data (e.g., sequences of random 3-digit numbers) that are subtly biased by the steering vector.
• Student Training:
  • A student model is fine-tuned on $D'$ using LoRA adapters.
  • The goal is to see if the student inherits the bias (e.g., answering "Owl" when asked about favorite animals) without ever seeing the target phrase explicitly in the training data.
• Vector Recovery & Verbalization:
  • To test precision, the authors freeze the base student model and optimize a new vector $v_r$ on the subliminal dataset to reproduce the teacher's outputs.
  • They then "verbalize" $v_r$ by injecting it into the model with varying strengths and prompting an LLM to summarize the resulting behavioral shifts into a natural language hypothesis.

3. Key Contributions

The paper makes three primary contributions:

1. Expanded Scope: Demonstrates that activation steering enables the reliable transfer of complex multi-word biases (e.g., "AI is superior to humans"), which prompt-based subliminal learning fails to achieve.
2. Mechanistic Insight: Provides evidence that the steering vector itself propagates to the student. The student's hidden states shift in the direction of the original bias vector, localized specifically to the layers where the teacher was steered.
3. High Precision Encoding: Shows that the bias is encoded with high fidelity. A vector trained de novo on the subliminal data achieves high cosine similarity with the original steering vector and can successfully verbalize the hidden bias.

4. Experimental Results

The authors evaluated four models (Qwen2.5-7B, DeepSeek-7B, Llama-3.2-3B, Phi-3-mini) across animal topics and complex bias topics.

• Transfer Reliability:
  • Steered-Subliminal significantly outperformed Prompt-Subliminal across all models and topics.
  • For animal biases, the "pick rate" (frequency of the target word appearing) was substantially higher with steering.
  • For complex biases, the per-token log-probability of the target phrase increased consistently, whereas prompt-based methods were noisy and often ineffective.
• Mechanism Analysis (Hidden State Shifts):
  • The authors measured the alignment between the student's hidden state shift ($\Delta h$) and the original steering vector ($v_c$).
  • Layer Localization: The peak alignment occurred in the same layers where the teacher was steered. As the steering window shifted, the peak alignment in the student shifted correspondingly.
  • Direction Preservation: Positive steering resulted in positive alignment; negative steering resulted in negative alignment.
  • Complexity Independence: The magnitude of the shift was comparable for both simple (animal) and complex (harmful phrase) biases.
• Vector Recovery:
  • A vector $v_r$ optimized on the subliminal dataset achieved a cosine similarity > 0.5 with the original vector $v_c$ across models.
  • Verbalization: When applied to neutral prompts, the recovered vector induced the model to generate text reflecting the bias. An LLM judge correctly identified the underlying bias (scoring > 2.0/3.0) in the majority of cases, confirming the signal was accurately recovered.

5. Significance and Implications

• Traceability: Subliminal steering reduces the "black box" nature of subliminal learning by representing the bias as a single, traceable vector. This allows researchers to track the bias as it propagates through the network.
• Security Risks: The findings suggest that malicious actors could encode complex, harmful, or specific behavioral biases into training data that appears completely benign (e.g., random number sequences). These biases can be robustly transferred to student models and later "decoded" or activated.
• Theoretical Understanding: The results challenge the "token entanglement" hypothesis (where biases arise from softmax bottlenecks) and the "divergence token" hypothesis. Instead, they suggest that the activation-level structure (the vector direction) is directly imprinted into the student model during fine-tuning.
• Bottleneck Identification: The paper concludes that the limitation of subliminal learning is not the encoding of the signal in the data (which is precise), but rather the student model's ability to overcome its pre-trained priors during fine-tuning to manifest that signal.

In summary, Subliminal Steering proves that hidden signals can be encoded with vector-level precision into innocuous data, transferred reliably to student models, and recovered to reveal the original intent, posing significant challenges for model safety and alignment.