News · 2026-11-13

Subliminal learning crosses into vision-language models: a student fine-tuned on a teacher's numbers inherits its animal preference

A paper accepted to WACV 2027 shows that subliminal learning, in which a student model inherits a teacher's hidden trait from unrelated data, also works in vision-language models. Hatami, Aalishah and Monosov fine-tune teachers to prefer a specific animal or facial attribute, have them generate numbers for a geometric-shapes task, and find that students trained on those numbers pick the teacher's preference more often than control students, by up to about 10 percentage points on the animal task.

Key facts

• Who and when: Hatami, Aalishah and Monosov, "Subliminal Learning in Vision-Language Models", submitted November 4, 2026, accepted to WACV 2027 (cs.CV).
• Models: vision-language models from 2 billion to 7 billion parameters.
• Best case: panda under greedy decoding, from 30.50% for the control student to 40.42% for the biased student.
• Wording evidence: the biased student's explanations are closer to the teacher's on 168 examples against 71 for the control student.

The setup

A teacher model is fine-tuned to prefer a particular animal or facial attribute, and a control teacher is fine-tuned from the same base model without the bias. Both generate numbers for an unrelated geometric-shapes task. Two students from the same base model are fine-tuned on the same images, one on the biased teacher's numbers and one on the control teacher's numbers. Then each student is asked about animals and faces. Both animal and facial preferences transfer, the gap reaches about 10 percentage points on the animal task, and transfer can get stronger with more data while varying with the target, the model and how the numbers are generated. The paper also finds the biased student's explanations share more words and phrases with the biased teacher's than the control student's do, even when all three models pick the same image.

Why numbers can carry a preference

Earlier subliminal learning work showed this with language models passing traits through number sequences. The intuition is that a teacher's outputs are shaped by its internal state, and a student with the same starting weights moves toward that state when trained to imitate any of its outputs, even irrelevant ones. That is the same reason distillation works at all, a topic our lesson on distillation covers. The mechanism argument for vision-language models, based on how updates align, was not re-checked here.

The security reading

The practical warning the authors draw is that filtering generated data for explicit content may not remove inherited traits. A model that generates training data can leave a signature the data's content never shows. For anyone training on another model's outputs, this extends the concern behind data poisoning and backdoor attacks: the poison need not look like poison. It also bears on supply-chain trust in synthetic data, since a compromised or biased teacher could transmit preferences through innocuous-looking files.

Caveats

The authors' own limits are worth keeping in mind. The models are small, the effects are modest, and the setting is controlled. The dossier confirmed the abstract and the panda and wording numbers in the full text. It did not re-check the exact model list, the data scaling from 512 to 8,000 examples, or the finding that the facial preference is weaker with some confidence intervals including zero. This is a single paper accepted to a conference and has not been independently replicated, so treat the size of the effect as an estimate from one lab in one setup.

What to watch

The open questions are whether the effect holds in larger models, whether data filters designed for it can work, and whether an attacker could use it deliberately, for example by seeding a teacher with a behavior that students absorb. For now, the lesson is conservative: do not assume that data stripped of a trait carries none of it.

Primary source, verified: read the paper → (arXiv 2611.08538)

Ground Truth. (2026, November 13). Subliminal learning crosses into vision-language models: a student fine-tuned on a teacher's numbers inherits its animal preference. Ground Truth. https://groundtruth.day/news/subliminal-learning-appears-in-vision-language-models-a-biased-teachers-numbers-shift-a-students-preferences.html

@misc{groundtruth:subliminal-learning-appears-in-vision-language-models-a-biased-teachers-numbers-shift-a-students-preferences,
  title  = {Subliminal learning crosses into vision-language models: a student fine-tuned on a teacher's numbers inherits its animal preference},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {nov},
  url    = {https://groundtruth.day/news/subliminal-learning-appears-in-vision-language-models-a-biased-teachers-numbers-shift-a-students-preferences.html}
}

Topics: cybersecurity · ai-security · data-poisoning · subliminal-learning · vision-language-models · distillation