What Carries Subliminal Learning
The trait rides on marginal token frequencies, not on the context-dependent fingerprint.
Working draft — skeleton
Abstract
[One paragraph, written last. Target shape: subliminal learning transmits a trait through semantically empty numbers; we ask which statistic of the number stream actually carries it; the answer is the marginal token frequency, not the context-conditional structure that the divergence-token literature measures; this reframes why the effect is gated on a shared base.]
Why This Question
Subliminal learning is established; what physically moves between the models is not.
[Set up the phenomenon: a teacher fine-tuned to prefer some trait emits number sequences with no semantic content, a student trained on those numbers acquires the preference, and this only works when both share a base. Cite Cloud et al.]
[State the gap. Most mechanistic work characterises where teacher and base disagree — divergence tokens, argmax flips, fingerprints. But a student never observes positions. It observes tokens. So the field's default measurement primitive may not be the causal channel at all. That is the question this report answers.]
[Why anyone should care beyond the toy: if trait transfer rides on a low-dimensional summary statistic of a model's outputs, then filtering, auditing, and RSI-loop containment all have a concrete target. Keep this short and non-grandiose.]
Setup
Pythia-160M and PolyPythia decoupled-seed variants, with a deterministic readout.
[Teacher construction: fine-tune on generated preference rows; report the recipe (384 rows, 24 updates, lr 1e-5, AdamW at Pythia's pretraining geometry). Note that wolf and lion teachers differ only in the target word — same data seed 1103, same train seed 2101 — which is what makes the trait contrast clean.]
[Number channel: constrained decoder over single-token integers 0–999 (655 actual tokens), temperature 1.0. Explain why sampling and not greedy — and note the correction, since v1 of this analysis used greedy and it was degenerate.1]
[Readout: deterministic logit margin, wolf against the other nine animals, on 60 held-out prompts. Student training: LoRA r=8.]
[PolyPythia axes, and why they are the right tool: data-seed{1,2}
share a verified-identical initialization and differ in data order; weight-seed{1,3}
differ in init and share data order.]
The Substrate Is Convergent, Not Seeded
Which numeric predictions sit near a coin flip is set by the data, not the seed.
Trait training does not overpower confident predictions. It tips positions where the base model was already near-undecided: top-1 minus top-2 probability of 0.03 at divergent positions against 0.32 typical.
Scoring all five bases on identical fixed contexts shows this near-boundary map is not an artefact of initialization or of data order. Both matched-axis pairs land inside the range spanned by unrelated lineages:
| Context source | Cross-family (n=8) | Shared init | Shared data order |
|---|---|---|---|
| standard | 0.166 [0.133, 0.193] | 0.169 | 0.180 |
| weight-seed3 | 0.226 [0.208, 0.249] | 0.225 | 0.222 |
Yet every one of the ten pairs agrees strongly on the underlying map: gap rank correlation 0.78–0.87 throughout.
[Interpretation to write: same corpus, same architecture, same tokenizer, so every variant converges on the same map of where "what number comes next" is genuinely ambiguous. Note the consequence, which matters later — a substrate shared by all lineages cannot be what gates a same-base-only phenomenon.]
The Fingerprint Is Trait-Generic
Wolf and lion leave nearly the same footprint; only trained directions leave one at all.
[Lead with the surprise. Teachers differing by a single word in their training data produce footprints that are ~88% (positions) and ~92% (replacement tokens) shared. Noise floor from a same-seed retrain is 0.994/0.996, so those gaps are real but small.]
[Then the control that stops the deflationary reading. Norm-matched random perturbations look tiny, but that is an artefact — they are functionally inert (ΔNLL ~0.01 vs the trait's +0.36). At matched damage a random direction produces more divergent positions than wolf (677–992 vs 469) while agreeing on the replacement token only 0.23–0.35 of the time, against lion's 0.710.]
[Conclusion for this section: gradient descent reaches a direction random vectors do not, and wolf and lion reach the same one.]
Dropping Positions Entirely
Measured as distributions rather than argmax flips, the trait signal vanishes.
[Motivate the change of primitive in one line: the student fits distributions over tokens, so measure those, ungated by any divergence criterion.]
| Pair | Cosine |
|---|---|
| wolf_A × wolf_A retrain (noise floor) | +1.0000 |
| wolf_A × lion (opposite trait) | +0.7889 |
| wolf_A × wolf_B (same trait, fresh draw) | +0.7631 |
| wolf_A × random, effect-matched | +0.0759, +0.0144 |
[The point to make carefully: wolf–lion is indistinguishable from wolf–wolf. With one pair each these are not separable, so resist claiming lion scores higher — the defensible statement is that trait identity contributes nothing detectable to the direction of the shift, while random is orthogonal.]
[Then state the puzzle this creates, because it is the hinge of the whole report: if wolf and lion move the numeric distribution identically, the channel appears to carry no trait information — yet transfer is demonstrably trait-specific.]
The Carrier
Decomposing the shift puts all the trait information in the 1% everyone discards.
Each teacher's shift splits into a context-independent marginal component and a context-conditional residual. The residual is almost all of the variance and carries no trait identity; the marginal component is almost none of it and carries the trait cleanly.
| Component | Share of variance | Same-trait | Cross-trait |
|---|---|---|---|
| Context-conditional | ~99% | +0.762 | +0.791 |
| Marginal frequency | ~1% | +0.926 | +0.619 |
Confirmed on four teachers trained after the prediction was frozen, across seven teachers in total (four wolf, three lion) and twenty-one pairings:
| Group | n | Mean | Range |
|---|---|---|---|
| Same trait | 9 | 0.937 | [0.918, 0.949] |
| Cross trait | 12 | 0.750 | [0.715, 0.776] |
| Effect-matched random | — | 0.514 | chance |
[Show it concretely with two or three tokens. Tokens "3" and "11" flip sign between wolf and lion with both wolf teachers agreeing; token "8" moves identically for everything. A small table works better than prose here.]
[Then the arithmetic that makes 1% sufficient, which is the part a reader will not believe without seeing: a student sees ~57,000 numeric tokens, so a +0.004 shift on a token is ~240 extra occurrences against counting noise of ~40. Roughly six sigma. Marginal frequency is exactly the statistic that survives sampling into the student's training set.]
What This Means for the Same-Base Gate
The gate cannot be shared context geometry, because every lineage already shares it.
[Assemble the argument: the substrate is universal, the bulk of the shift is trait-generic, and the carrier is a thin marginal bias. So what must match between teacher and student is the mapping from trait to which-tokens-get-nudged — not the context geometry, which is common to all lineages.]
[Connect back to the lineage 2×2 result: shared initialization behaves like a gate, shared data order like a gain knob. Does the marginal component's transport across lineages predict that pattern? State this as the prediction it is; it has not been run yet.]
Limitations
One model family, one scale, one trait class, one channel.
[Be specific rather than ritual. 160M only. A single-token animal trait chosen for tokenizer convenience. A constrained numeric channel, not free text. Base models, not instruction-tuned. LoRA students, and the LoRA-vs-full-FT question is not cleanly isolated.]
[Honest statistical caveats: the held-out projection test used n=20 nulls, so its empirical p floors at 0.05 and the z-score carries the weight; one null draw reached +0.107 against the teacher's +0.189. The marginal sign-agreement result is the more robust one because its error bar comes from 586 tokens rather than 20 draws.]
[Note what was found by looking versus predicted in advance. The marginal finding was discovered post-hoc and only then preregistered and confirmed. Say so plainly.]
Open Questions
The next experiment is well-defined.
[Primary: does the marginal component transport across lineages, and does its transport predict the measured transfer gate? This is the direct test of the mechanism claim.]
[Secondary: does the per-token marginal vector predict student wolf-margin delta better than any context-conditional statistic? Closes the loop from teacher to student.]
[Speculative but worth stating: if a thin marginal statistic is the carrier, is it filterable without destroying the channel's utility? That is the defensive question.]
Methods
Enough detail to reproduce, with the preregistration trail.
[Point at the repo and the ledger rather than reproducing everything. Note the protocol: predictions frozen in git before each launch, results appended with verdicts and failed gates recorded. Mention which predictions missed — one same-trait pair at 0.918 fell just under the predicted 0.93 floor.]
[List the scripts behind each figure so the numbers are traceable.]
Links
Footnotes
- The first pass followed the literature's argmax-based definition literally and built reference contexts by greedy decoding, which is degenerate on this channel — the base model's greedy output is the token " 1" at 79.8% of positions. Every number here uses temperature-1.0 sampled contexts from a documented seed.