# Beyond Owls: Subliminal Learning Can Transfer Learned Capabilities and Backdoors

arXiv: https://arxiv.org/abs/2610.10657 · HTML: https://mlsanity.com/paper/2610.10657/

## Key facts

- No citing papers in the map yet (data through 7 Oct 2026).
- Builds on 16 of its 21 references that are in the map.
- First posted on arXiv 7 Oct 2026.

## Builds on (most cited first, 16 of 16)

- [Frontier Models are Capable of In-context Scheming](https://mlsanity.com/paper/2412.04984/) (2024)
- [Natural Emergent Misalignment from Reward Hacking in Production RL](https://mlsanity.com/paper/2511.18397/) (2025)
- [Scheming AIs: Will AIs fake alignment during training in order to get power?](https://mlsanity.com/paper/2311.08379/) (2023)
- [Subliminal Effects in Your Data: A General Mechanism via Log-Linearity](https://mlsanity.com/paper/2602.04863/) (2026)
- [Subliminal Steering: Stronger Encoding of Hidden Signals](https://mlsanity.com/paper/2604.25783/) (2026)
- [Simple Mechanistic Explanations for Out-Of-Context Reasoning](https://mlsanity.com/paper/2507.08218/) (2025)
- [Subliminal Learning Is Steering Vector Distillation](https://mlsanity.com/paper/2606.00995/) (2026)
- [Emergent and Subliminal Misalignment Through the Lens of Data-Mediated Transfer](https://mlsanity.com/paper/2605.12798/) (2026)
- [Learning Through Noise: Why Subliminal Learning Works and When It Fails](https://mlsanity.com/paper/2605.23645/) (2026)
- [Channel Location Constrains the Auditability of Subliminal Learning](https://mlsanity.com/paper/2606.22019/) (2026)
- [Subliminal Corruption: Mechanisms, Thresholds, and Interpretability](https://mlsanity.com/paper/2510.19152/) (2025)
- [Covert Influence Between Language Models](https://mlsanity.com/paper/2606.04071/) (2026)
- [Quantifying Subliminal Behavioral Transfer Ratios in Language Model Distillation](https://mlsanity.com/paper/2606.11270/) (2026)
- [Subliminal Learning is Non-Semantic Distillation](https://mlsanity.com/paper/2608.05734/) (2026)
- [Narrow Secret Loyalty Dodges Black-Box Audits](https://mlsanity.com/paper/2605.06846/) (2026)
- [Verbalizing Subliminal Learning Effects Using Text Optimization](https://mlsanity.com/paper/2609.16927/) (2026)

## Abstract (arXiv)

In subliminal learning (SL), a teacher model passes on a trait to a student model by distillation on data semantically unrelated to the trait. So far, SL has been demonstrated for only a limited range of traits, including preferences for animals (e.g., owls) and malicious personas. These traits can also be elicited with simple prompts or with steering. Can SL transfer a wider range of traits, including more complex ones? If so, distillation might transfer subtle forms of misalignment (e.g., reward-seeking, scheming, and secret loyalties) without detection. To this end, we test whether SL can transfer a novel capability: predicting the outputs of a randomly initialized MLP. After distilling on unrelated text, the student achieves substantial performance on the task, while falling short of the teacher. We find that a directly optimized steering vector matches SL in distribution but generalizes worse out of distribution. Next, we test whether SL can transfer backdoors. We finetune the teacher to answer in French when the prompt contains a female name, then distill on number sequences containing neither names nor French. The student partially acquires the backdoor, responding in French on 23.5% of prompts with female names versus 0.0% with male names. Finally, we test whether SL can transfer a propensity to hack in an agentic chess environment. We finetune the student on number sequences from a steered hacker teacher. The student hacks in 58.3% of episodes, compared with 10.9% for the unfinetuned model. Thus, we show SL can transfer capabilities, backdoors, and hacking propensities. The amount of transfer is sensitive to the setup. In several experiments, it is made stronger by using logit distillation or by restricting LoRA to the attention layers.