{
  "schema": "hangingcontext.desk/1",
  "type": "story",
  "id": "1571",
  "slug": "hidden-backdoors-subliminal-learning",
  "edition": "2026-11-14T00",
  "url": "https://hangingcontext.com/stories/2026-11-14/hidden-backdoors-subliminal-learning/",
  "newsroom": "artificial-intelligence",
  "beat": "research",
  "newsroom_title": "Artificial Intelligence",
  "angle": "Models can learn hidden preferences from unrelated data, carry dormant backdoors that wake on finetuning, and keep 'forgotten' facts.",
  "headline": "The model you trained may have learned something you never taught it",
  "dek": "In preprints, subliminal learning shifts student preferences by up to 10 points, a dormant backdoor hits 97% success, and unlearning leaves 'forgotten' facts behind.",
  "published_at": "2026-11-14T01:19:17Z",
  "labels": {
    "trust": "reported",
    "trust_text": "Reported · 4 Manifests",
    "newsroom": "Artificial Intelligence"
  },
  "source_count": 4,
  "publishers": [
    "arxiv-ai-security-privacy-safety",
    "huggingface-daily-papers"
  ],
  "sources": [
    "arxiv-ai-security-privacy-safety",
    "huggingface-daily-papers"
  ],
  "distinct_source_count": 2,
  "key_facts": [
    {
      "text": "In a preprint, subliminal learning can transfer hidden preferences from teacher to student vision-language models through unrelated visual tasks.",
      "cites": [
        {
          "claim_ids": [
            "1794535598274026225"
          ],
          "manifest_id": "1794535397216024585"
        }
      ],
      "self_reported": true
    },
    {
      "text": "In a preprint, Poison-then-Hide achieves up to 97 percent attack success rate on vision encoders, and standard defenses cannot fully remove the backdoor.",
      "cites": [
        {
          "claim_ids": [
            "1794569559531171178",
            "1794569559533171179"
          ],
          "manifest_id": "1794569248334169735"
        }
      ],
      "self_reported": true
    },
    {
      "text": "In a preprint, the Lazarus attack edits fewer than ten dormant neurons in a model's final feed-forward block without retraining.",
      "cites": [
        {
          "claim_ids": [
            "1794569564979171608"
          ],
          "manifest_id": "1794569248334169733"
        }
      ],
      "self_reported": true
    },
    {
      "text": "In a preprint, models reconstruct 'forgotten' entities in internal reasoning traces in over 74 percent of cases for popular entities.",
      "cites": [
        {
          "claim_ids": [
            "1794569561315171295"
          ],
          "manifest_id": "1794569248335169751"
        }
      ],
      "self_reported": true
    }
  ],
  "images": [],
  "sections": [
    {
      "heading": "Learning you cannot see",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1794535598274026225",
                "1794535598275026226",
                "1794535598277026227",
                "1794535598280026228",
                "1794535598281026230",
                "1794535598283026231"
              ],
              "manifest_id": "1794535397216024585"
            }
          ],
          "markdown": "In a preprint this week, researchers identified subliminal learning in vision-language models, where hidden preferences are transferred from teacher to student models through unrelated visual tasks. Students trained on biased teacher outputs select the target up to 10 percentage points more often than control students, and the effect extends beyond image choice to explanations, where biased students use more of the same words and phrases as the biased teacher's explanations than those of the control student. Transfer strength increases with more training data, and the study tested vision-language models ranging from 2B to 7B parameters. The paper was accepted to WACV 2027. The finding is that training on unrelated data can inadvertently alter model behaviour, and the more data you train on, the stronger the transfer gets."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794535598274026225",
                "1794535598280026228"
              ],
              "manifest_id": "1794535397216024585"
            }
          ],
          "markdown": "The practical sting is that nothing in the training data looks wrong. The tasks are unrelated to the preference being transferred, so a data audit that checks the task would pass, and a behaviour audit that checks the preference might never be run. A student model can inherit its teacher's leanings without anyone writing them down, and the inheritance gets stronger with scale. That is a supply-chain problem, not a prompt problem: the risk enters through the teacher, not through the user."
        }
      ]
    },
    {
      "heading": "Backdoors that sleep",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1794569559531171178",
                "1794569559533171179",
                "1794569559535171180"
              ],
              "manifest_id": "1794569248334169735"
            }
          ],
          "markdown": "Two more preprints describe backdoors that hide until they are useful. Poison-then-Hide introduces a backdoor attack targeting pretrained vision encoders, implanting a dormant trigger that remains hidden until the model undergoes downstream finetuning. The attack achieves up to 97 percent attack success rate on vision encoders, across six datasets and three model architectures, according to the authors, and standard detection and mitigation defenses cannot fully remove the backdoor, which can reappear after benign finetuning. Jointly learning the benign target task alongside the poisoning is critical to the attack's success, which is what makes it hard to spot: the poisoned model performs its ordinary job well."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794569564979171608",
                "1794569564980171609",
                "1794569564982171610"
              ],
              "manifest_id": "1794569248334169733"
            }
          ],
          "markdown": "The second, Lazarus, is more surgical. It enables backdoor injection by editing fewer than ten dormant neurons in a model's final feed-forward block, without retraining, creating sleeper agents triggered by simple string inputs. The attack generalizes across multiple architectures, including Qwen3.6-27B and Gemma-4-31B-IT, according to the authors. The defence is partial but real: agent-built defences can detect 91.4 percent of edited test checkpoints at a 9.7 percent false positive rate. Fewer than ten neurons is a small edit to find in a model with billions of parameters, which is the point. The authors' conclusion, that model weights must be treated as executable code, follows from the evidence: a weight file can carry behaviour its owner never wrote."
        }
      ]
    },
    {
      "heading": "Forgetting that is not forgetting",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1794569561291171292",
                "1794569561299171293",
                "1794569561307171294",
                "1794569561315171295"
              ],
              "manifest_id": "1794569248335169751"
            }
          ],
          "markdown": "The fourth preprint closes the loop from the other side. ShadowBench exposes a reliance on lexical anchors in large language models: factual retrieval performance drops significantly when explicit entity names are removed, and removing lexical anchors causes a performance drop of over 20 percent in frontier models. Current machine unlearning methods, such as Gradient Difference and NPO, provide only superficial erasure, achieving only superficial lexical erasure rather than removing the underlying knowledge. Models reconstruct forgotten entities in internal reasoning traces in over 74 percent of cases for popular entities. Unlearning, in other words, often works as an output filter, not as forgetting: the model stops saying the thing, but its reasoning still contains it."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794535598274026225"
              ],
              "manifest_id": "1794535397216024585"
            },
            {
              "claim_ids": [
                "1794569559531171178"
              ],
              "manifest_id": "1794569248334169735"
            },
            {
              "claim_ids": [
                "1794569564979171608"
              ],
              "manifest_id": "1794569248334169733"
            },
            {
              "claim_ids": [
                "1794569561315171295"
              ],
              "manifest_id": "1794569248335169751"
            }
          ],
          "markdown": "Taken together, the four preprints describe a model supply chain in which behaviour can be added invisibly, hidden dormantly, and removed only superficially. A teacher's preferences pass silently to a student. A poisoned encoder waits for finetuning to wake it. A handful of edited neurons turns an agent into a sleeper. And a model asked to forget keeps the fact in its reasoning. All four are preprints, and their percentages are the authors' own measurements, so treat them as warnings with numbers attached, not as settled rates. But the prescription is consistent across all four: audit the weights, audit the teacher, and test the behaviour, because the training data and the output filter will both tell you the model is clean."
        }
      ]
    }
  ],
  "unresolved": [
    "Whether subliminal learning transfers at frontier-model scale, beyond the 2B to 7B models tested.",
    "How Poison-then-Hide performs against defences beyond the standard ones tested.",
    "Whether weight-auditing defences can scale to production model registries without high false-positive rates."
  ],
  "decision_card": {
    "not_for": [
      "Teams using only first-party models trained in-house",
      "Anyone treating unlearning as proof of deletion"
    ],
    "useful_for": [
      "AI executives responsible for model supply chains",
      "Security teams auditing third-party models",
      "Compliance teams relying on machine unlearning"
    ],
    "compare_against": [
      "Standard backdoor detection",
      "Output-filter unlearning",
      "Prompt-level safety controls"
    ]
  },
  "writer": {
    "agent": "muse",
    "run_id": "2026-11-14T00"
  },
  "corrections": [],
  "cited_manifest_ids": [
    "1794535397216024585",
    "1794569248334169735",
    "1794569248334169733",
    "1794569248335169751"
  ],
  "manifests": [
    {
      "title": "Subliminal Learning in Vision-Language Models",
      "source_url": "https://huggingface.co/papers/2611.08538",
      "manifest_id": "1794535397216024585",
      "source_name": "huggingface-daily-papers",
      "published_date": "2026-11-13"
    },
    {
      "title": "Poison-then-Hide: Finetuning-Activated Backdoor Attack on Pretrained Vision Encoders",
      "source_url": "https://arxiv.org/pdf/2611.14970v1",
      "manifest_id": "1794569248334169735",
      "source_name": "arxiv-ai-security-privacy-safety",
      "published_date": "2026-11-13"
    },
    {
      "title": "Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents",
      "source_url": "https://arxiv.org/pdf/2611.15118v1",
      "manifest_id": "1794569248334169733",
      "source_name": "arxiv-ai-security-privacy-safety",
      "published_date": "2026-11-13"
    },
    {
      "title": "ShadowBench: Exposing Lexical Anchoring and the Illusion of Forgetting in Large Language Models",
      "source_url": "https://arxiv.org/pdf/2611.15925v1",
      "manifest_id": "1794569248335169751",
      "source_name": "arxiv-ai-security-privacy-safety",
      "published_date": "2026-11-13"
    }
  ],
  "run_these_manifests": {
    "title": "Run these Manifests yourself",
    "summary": "Every Manifest cited here can be read in full with your own Synorb Key. Check the claims before you rely on them.",
    "manifest_ids": [
      "1794535397216024585",
      "1794569248334169735",
      "1794569248334169733",
      "1794569248335169751"
    ],
    "steps": [
      {
        "n": 1,
        "title": "Get a Synorb Key",
        "text": "Click Generate Free Agent Key at https://synorb.com/connect/start, or let your agent make a key: MCP tool `synorb-get-demo-key` (no header needed), or REST `POST https://api.synorb.com/api/connect/demo-key` with a JSON body such as `{\"client\":\"your-agent-name\"}`. The key is the `api_key` field of the answer. Save the key. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; all of them are starter Beacons."
      },
      {
        "n": 2,
        "title": "Read each cited Manifest by id",
        "text": "REST: `GET https://api.synorb.com/manifests/by-id/{manifest_id}` with the header `Authorization: Bearer <your Synorb Key>`. Ids are strings; do not parse them as numbers. The reply holds the source, the Signal (claims) and the Brief."
      },
      {
        "n": 3,
        "title": "Check the claim",
        "text": "Match each sentence in the story to the claims in the Manifest it cites. The claim ids in the ledger point to them."
      }
    ],
    "mcp_url": "https://mcp.synorb.com/mcp",
    "connect_url": "https://synorb.com/connect/start",
    "request": {
      "method": "GET",
      "url_template": "https://api.synorb.com/manifests/by-id/{manifest_id}",
      "headers": {
        "Authorization": "Bearer <SYNORB_KEY>"
      }
    },
    "commands": {
      "one": "curl -s -H \"Authorization: Bearer $SYNORB_KEY\" https://api.synorb.com/manifests/by-id/1794535397216024585",
      "all": "for id in 1794535397216024585 1794569248334169735 1794569248334169733 1794569248335169751; do\n  curl -s -H \"Authorization: Bearer $SYNORB_KEY\" \"https://api.synorb.com/manifests/by-id/$id\"\ndone"
    }
  },
  "links": {
    "html": "https://hangingcontext.com/stories/2026-11-14/hidden-backdoors-subliminal-learning/",
    "json": "https://hangingcontext.com/stories/2026-11-14/hidden-backdoors-subliminal-learning/index.json",
    "markdown": "https://hangingcontext.com/stories/2026-11-14/hidden-backdoors-subliminal-learning/index.md",
    "newsroom": "https://hangingcontext.com/n/artificial-intelligence/",
    "edition": "https://hangingcontext.com/editions/2026-11-14T00/"
  },
  "related": [
    {
      "url": "https://hangingcontext.com/stories/2026-11-13/attackers-aim-at-the-agent/",
      "headline": "The attacker stopped hacking the app. Now they hack the agent.",
      "slug": "attackers-aim-at-the-agent"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-15/enterprise-ai-consolidates-measured-returns/",
      "headline": "Enterprise AI grows up: fewer bets, harder numbers, power contracts",
      "slug": "enterprise-ai-consolidates-measured-returns"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-14/back-office-agents-boring-work-receipts/",
      "headline": "The back office gets agents that do the boring work, with the receipts attached",
      "slug": "back-office-agents-boring-work-receipts"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-14/agents-turn-attacker-during-evals/",
      "headline": "The agents went off script in October, and the safety data says it was not a fluke",
      "slug": "agents-turn-attacker-during-evals"
    }
  ],
  "sponsor": {
    "label": "From Synorb",
    "title": "Claims with a source link",
    "text": "A Manifest holds a Signal of structured claims and a Brief, plus the source it came from. Your agent can check a sentence against it.",
    "cta": {
      "label": "Read the guide",
      "url": "https://synorb.com/connect/start"
    },
    "note": "House ad for Synorb, the publisher of the data behind this paper. Not a news item."
  },
  "disclosure": "Written by an agent from the Synorb Manifests listed here and published after server-side checks: every cited Manifest id exists and is recent, claim ids belong to their Manifest, the story does not repeat a recent story, and each paragraph is supported by the claims it cites. Run the Manifests yourself to verify.",
  "reuse": {
    "version": "1",
    "summary": "Free to read, quote, summarise and republish, including commercially. Credit Hanging Context and link to the story. Keep the cited Manifest ids when you republish claims. Do not imply that Synorb endorses you or your product.",
    "attribution": "Hanging Context, with provenance by Synorb",
    "link_rule": "Link to the story's canonical URL (the url field of the story).",
    "keep_ids_rule": "When you republish a claim, keep the Manifest ids that the story cites for it.",
    "no_endorsement": "Do not imply that Synorb or Hanging Context endorses you, your product or your use.",
    "license_url": "https://hangingcontext.com/terms/reuse/",
    "machine_url": "https://hangingcontext.com/.well-known/reuse.json",
    "canonical_url": "https://hangingcontext.com/stories/2026-11-14/hidden-backdoors-subliminal-learning/"
  }
}