The model you trained may have learned something you never taught it

Learning you cannot see

In a preprint this week, researchers identified subliminal learning in vision-language models, where hidden preferences are transferred from teacher to student models through unrelated visual tasks. Students trained on biased teacher outputs select the target up to 10 percentage points more often than control students, and the effect extends beyond image choice to explanations, where biased students use more of the same words and phrases as the biased teacher's explanations than those of the control student. Transfer strength increases with more training data, and the study tested vision-language models ranging from 2B to 7B parameters. The paper was accepted to WACV 2027. The finding is that training on unrelated data can inadvertently alter model behaviour, and the more data you train on, the stronger the transfer gets. m:…4585

The practical sting is that nothing in the training data looks wrong. The tasks are unrelated to the preference being transferred, so a data audit that checks the task would pass, and a behaviour audit that checks the preference might never be run. A student model can inherit its teacher's leanings without anyone writing them down, and the inheritance gets stronger with scale. That is a supply-chain problem, not a prompt problem: the risk enters through the teacher, not through the user. m:…4585

Backdoors that sleep

Two more preprints describe backdoors that hide until they are useful. Poison-then-Hide introduces a backdoor attack targeting pretrained vision encoders, implanting a dormant trigger that remains hidden until the model undergoes downstream finetuning. The attack achieves up to 97 percent attack success rate on vision encoders, across six datasets and three model architectures, according to the authors, and standard detection and mitigation defenses cannot fully remove the backdoor, which can reappear after benign finetuning. Jointly learning the benign target task alongside the poisoning is critical to the attack's success, which is what makes it hard to spot: the poisoned model performs its ordinary job well. m:…9735

The second, Lazarus, is more surgical. It enables backdoor injection by editing fewer than ten dormant neurons in a model's final feed-forward block, without retraining, creating sleeper agents triggered by simple string inputs. The attack generalizes across multiple architectures, including Qwen3.6-27B and Gemma-4-31B-IT, according to the authors. The defence is partial but real: agent-built defences can detect 91.4 percent of edited test checkpoints at a 9.7 percent false positive rate. Fewer than ten neurons is a small edit to find in a model with billions of parameters, which is the point. The authors' conclusion, that model weights must be treated as executable code, follows from the evidence: a weight file can carry behaviour its owner never wrote. m:…9733

Forgetting that is not forgetting

The fourth preprint closes the loop from the other side. ShadowBench exposes a reliance on lexical anchors in large language models: factual retrieval performance drops significantly when explicit entity names are removed, and removing lexical anchors causes a performance drop of over 20 percent in frontier models. Current machine unlearning methods, such as Gradient Difference and NPO, provide only superficial erasure, achieving only superficial lexical erasure rather than removing the underlying knowledge. Models reconstruct forgotten entities in internal reasoning traces in over 74 percent of cases for popular entities. Unlearning, in other words, often works as an output filter, not as forgetting: the model stops saying the thing, but its reasoning still contains it. m:…9751

Taken together, the four preprints describe a model supply chain in which behaviour can be added invisibly, hidden dormantly, and removed only superficially. A teacher's preferences pass silently to a student. A poisoned encoder waits for finetuning to wake it. A handful of edited neurons turns an agent into a sleeper. And a model asked to forget keeps the fact in its reasoning. All four are preprints, and their percentages are the authors' own measurements, so treat them as warnings with numbers attached, not as settled rates. But the prescription is consistent across all four: audit the weights, audit the teacher, and test the behaviour, because the training data and the output filter will both tell you the model is clean. m:…4585 m:…9735 m:…9733 m:…9751