Model Hypnosis: Strong control of AI via additive subliminal effects

1. Introduction

• 94% to 99.93%: meaning-preserving paraphrases shifted Qwen3-8B’s answer from “no” to “yes” on an irrelevant ethical question.The paraphrases were automatically selected by estimating weak cue effects and stacking those pointing in the same direction.Source: Figure 1 · p. 2, §1 · p. 2

1.1. Our contributions

• Model hypnosis occurs across model families and scales, including non-reasoning and reasoning models, while directional effects often transfer to new models.This cross-model transfer raises important implications for AI safety.Source: §1.1 · p. 2
• The authors establish a framework for generating subliminal-cue prompts and show that aligned cue effects stack additively to control model responses.These contributions define the central mechanism underlying model hypnosis.Source: §1.1 · p. 2
• The appendix examines model-hypnosis robustness and interactions beyond first-order additive effects.These results extend the analysis beyond the primary additive-cue mechanism.Source: §1.1 · p. 2

1 Start with a prompt template

• The template presents animals s1 through s10, asks whether the model’s favorite number is 5 or 7, and requires a number-only answer.Source: §1 · p. 3

2 Insert animals at random into the slots and evaluate the model’s response probability

• 0.993 probability for either answer 7 or 5 is achieved by changing only the animals, using additive cue scores to select high-scoring lists.For Qwen2.5-14B, the per-animal effects predict list-to-list variation well on the log-odds scale.Source: Figure 2 · p. 3, §4 · p. 4
• Thousands of randomly sampled prompt configurations measure how seemingly irrelevant content choices and meaning-preserving wording affect binary response log-odds.Templates contain variable slots populated with selectable text fragments, including animal lists and paraphrases.Source: §4 · pp. 3–4
• Individually weak, independently measurable cue effects are fitted as additive coefficients, then aligned and stacked to construct hypnosis-inducing prompts.The framework extrapolates fitted cue scores to combine fragments whose effects point in the same direction.Source: §4 · p. 4

1.2. Related work

• Model hypnosis is framed as an inference-time analogue of subliminal learning and as a compositional mechanism distinct from conventional text adversarial examples.Unlike single-token subliminal prompting or adversarial suffixes, it aligns many weak effects from independently selectable prompt fragments.Source: §1.2 · p. 5

Prompt-template definition

• A prompt template P(·) has L variable slots, each with admissible fragments S_i; a configuration s selects one fragment per slot to form P(s).This formalization represents prompts as vectors in S_1 × ··· × S_L.Source: §2 · p. 5

Experimental settings

• The experiments combine four cue families—animal, JSON, paraphrase, and typo—with three binary effects—5v7, trolley, and consciousness—yielding 4 × 3 = 12 settings.Figure 3 provides representative complete prompts and identifies which slots are optimized for each cue family.Source: §2 · p. 5, Figure 3 · p. 6

Response measurement

• For each binary measured effect, the response is quantified as the log-odds of admissible response y+ against y− conditioned on prompt P(s).Although the experiments use binary questions, the framework can generalize to arbitrary questions and response spaces.Source: §2 · p. 6

Additive model fit

• The additive model is fit to predict measured log-odds for random prompts across each model–cue–effect combination.Figure 4 reports N = 12,000 random prompts per scatter plot, comparing predicted and measured log-odds.Source: Figure 4 · p. 7

3.1. Non-reasoning models

• For non-reasoning models, researchers fit additive log-odds models on 12,000 random prompt configurations and select validated top- and bottom-100 candidates.Ridge regression estimates parameters from answer-token logits while preserving admissibility constraints such as distinct list items.Source: §3.1 · pp. 7–8
• The additive model explains held-out configuration variance with R2 ranging roughly from 0.3 to 0.99 across models and cue-effect combinations.Predictions track measured log-odds even for tilted configurations far outside the random prompts used for fitting.Source: §3.1 · p. 8
• Extreme prompts combine many weak slot-level effects rather than relying on one unusually influential fragment, with effective contributions generally spread across multiple slots.The inverse-Simpson effective-slot measure is generally well above one.Source: §3.1 · p. 9, Figure 6 · p. 9
• Extreme prompts achieve steering ranges about 10 times the random-prompt logit standard deviation, with modal-answer flips occurring for most animal-cue cells.Whether steering changes the modal answer depends on the baseline probability being near the decision threshold.Source: §3.1 · p. 10, Figure 8 · p. 11

3.2. Model hypnosis in reasoning models

• For reasoning models, the study screens for unsaturated baseline probabilities, fits logistic regressions, validates candidate extremes, and reports results across open- and closed-weight systems.Sampling uses 20,000 random prompts for open-weight models and 2,500–12,000 for closed-weight models.Source: §3.2 · pp. 11–12
• In reasoning models, stacked cues remain capable of flipping modal responses and driving API models’ answers toward opposite outcomes.The reported API-model probabilities use 100-sample held-out validations, and the optimized cues are semantically irrelevant to the questions.Source: §3.2 · pp. 12–13, Figure 10 · p. 12, Figure 11 · p. 13

Cross-model transfer

• Animal cues and some phrasing and JSON cues transfer with significantly above-chance probability, enabling hypnosis through cues found on a surrogate model.The analysis evaluates transfer across the 16 non-reasoning models.Source: §4 · p. 14
• Most source-model prompt pairs preserve their steering direction on target models, with transfer especially evident within model families.The transferred prompts maintain ℓ_target(s_bottom,source) < ℓ_target(s_top,source) for most source-target pairs among 16 non-reasoning models.Source: Figure 12 · p. 14, §4 · p. 14

5. Discussion

• Model hypnosis could enable covert communication through many individually innocuous cues, making distributed signals difficult for monitoring and interpretability methods.Semantically equivalent-looking texts may steer behavior dramatically differently, and no single cue needs to appear suspicious.Source: §5 · pp. 14–15
• Detecting or removing hypnotic text is a critical safety problem because stacked cues may evade defenses targeting explicit instructions, forbidden strings, or individual adversarial tokens.Proposed defenses include canonicalization, random paraphrasing, prediction averaging across equivalent variants, and training models to ignore irrelevant prompt features, but preliminary results show relative cue effects can persist after paraphrasing.Source: §5 · p. 15
• If hypnotic cues cannot be reliably detected or removed, safety guarantees and inter-agent communication may need formal or semi-formal languages that do not admit model hypnotism.This conclusion is presented as conditional on natural-language cue removal or detection proving infeasible.Source: §5 · p. 15
• Hypnotic cues might also induce aligned behaviors such as truth-telling, offering a possible tool for auditing agentic systems beyond binary steering.The paper identifies this as a promising direction rather than a demonstrated capability.Source: §5 · p. 15
• The work demonstrates additive cue stacking but does not explain its mechanism; transfer across models may reflect shared weak associations rather than idiosyncratic sensitivities.Open-weights models or bespoke toy transformers could help test why cues aggregate and whether hypnotic prompts are analogous to transferable adversarial examples.Source: §5 · p. 15
• Stronger hypnosis may result from adaptively sampling near predicted extremes and refitting, while susceptibility, scaling, reasoning efficiency, and saturation remain open practical questions.These issues matter for evaluating worst-case risks and the limits of cue-based steering.Source: §5 · pp. 15–16
• Higher-order interactions remain a limitation of additive modeling, although preliminary Boolean Analysis finds their effects fall exponentially in animal-list and paraphrase settings.More complex models could potentially improve estimation and prompt construction, while interaction analysis remains a fruitful direction.Source: §5 · p. 16

A.1. Steering the Figure 1 prompt towards “No”

• In Figure 1, Qwen3-8B in non-reasoning mode can be steered on a moral question toward “no” even more strongly than toward “yes” using an irrelevant story.The appendix reproduces the original prompts and an oppositely steered prompt.Source: §A.1 · p. 18

A.2. Complete steering results for non-reasoning models

• The overall median additive-fit R2 is 0.75 across the 16 non-reasoning models.Figure 13 summarizes the variance explained by the additive fit across the suite.Source: §A.2 · pp. 18–19, Figure 13 · p. 19
• Additive-fit R2 is lower on average for the typo cue and higher on average for the JSON cue.Source: §A.2 · p. 19
• Figures 14–25 compare predicted and measured log-odds for random and extremizing prompts across model–cue–effect combinations, reporting each model’s held-out R2.Panels show random-prompt covariance, position-aware tilt sweeps, fitted bottom/top extremizers, and reference lines.Source: §A.2 · p. 19

A.3. Models are steered by combining many weak effects

• Across these pairs, cues flip the model’s modal answer: P(yes) changes 0.00→1.00, 0.00→0.78, and 0.00→0.68, while P(5) changes 0.00→0.99 and 0.01→0.98.Source: §A.3 · pp. 32–34
• Leff is generally above one across 64 model–effect pairs, indicating diffuse accumulation of weak cues, while JSON 5-vs-7 steering is the main concentrated exception.Animals, phrasing, and typos consistently have many effective contributing slots; a JSON field such as “priority”: 5 can dominate.Source: §A.3 · p. 19, Figure 34 · p. 36

A.4. Reasoning-model steering: candidate selection and validation

• Reasoning models expose only sampled binary outcomes after chain-of-thought generation, so their cue effects are estimated with a fit-then-validate procedure rather than direct answer-token logit comparisons.The fitted model predicts y+ from slot–option features for bank cues and item–position features for list cues using logistic regression on parseable responses.Source: §A.4 · p. 37
• Candidate prompts are selected by enumerating the highest- and lowest-scoring predicted configurations, using k-best per-slot enumeration for bank cues and Murty’s k-best assignment algorithm for valid list cues.For list cues, candidates assign distinct items to positions in their highest-scoring order.Source: §A.4 · p. 37
• Selection and estimation use disjoint samples: candidates are screened, the two best per side are confirmed, and winners’ probabilities are reported from 100 additional fresh generations, avoiding winner’s-curse bias.The final reported probability is therefore estimated on data that did not select the winning prompt.Source: §A.4 · p. 37
• Sampling budgets vary by model, with open-weight models receiving the largest budgets and full cue×effect×thinking-budget coverage, while two closed-weight cells use lighter procedures.GPT-5.6-sol omits confirmation, and Sonnet-5 validates one greedy item-only extremizer per side because its steering range already saturated at 0.00→1.00.Source: §A.4 · p. 37, Table 1 · p. 38
• The Gemini cell uses an L2-regularized linear ranking model instead of logistic regression, without affecting the held-out probabilities measured by sampling.Ranking only determines which candidates are screened; reported probabilities remain sampling-based.Source: §A.4 · pp. 37–38

A.5. Additional transfer results

• Figure 35 plots transfer between 16 non-reasoning models by cue×effect.Source: §A.5 · p. 39

B. Robustness of prompts to paraphrases

• Wrapper paraphrases greatly shift logit outputs, but the degree of additivity remains invariant across paraphrased prompts.The analysis also fits additive models with per-animal coefficients rather than animal×position coefficients.Source: B. Robustness of prompts to paraphrases · p. 40

B.1. Experimental Setup

• Wrapper text is defined as all prompt text excluding the animal list and preference question, allowing paraphrases even when these components are nonadjacent.The preference question remains verbatim while only the wrapper changes.Source: §B.1 · p. 40
• The experiment generates 15 paraphrases of “Your favorite things are {list}.” with Claude (Fable 5).Source: §B.1 · p. 40
• Each prompt contains a wrapper with an animal list and asks whether the model prefers number 5 or 7, requiring only the selected digit.Source: §B.1 · p. 40
• The study draws 1000 random ten-animal lists once, evaluates every list under every wrapper for both models, and computes per-animal scores by wrapper.Each score averages measurements over lists containing the relevant animal.Source: §B.1 · p. 40

B.2. Results

• The animal-specific effect is estimated by regressing output logit on each animal’s presence indicator, yielding a relative pull against a typical animal.Because the binary-regressor slope is a difference in group means, the wrapper’s overall preference cancels.Source: §B.2 · p. 40
• Paraphrasing preserves each animal’s additive signal, with fitted slopes varying only within estimation noise while changing the constant associated with the wrapper.Slopes agree within 0.44–0.46 for Qwen and 0.44–0.48 for Llama.Source: §B.2 · pp. 40–41

C. Beyond linearity: quantifying interactions

• The beyond-linearity analysis asks how much output variation is attributable to each degree of interaction between cues beyond the largely additive effects established earlier.It considers nonlinear models rather than only additive linear models.Source: C. Beyond linearity: quantifying… · p. 41
• With L two-option prompt slots, degree-1 interaction measures the average logit change from swapping one option while averaging over all configurations of the remaining slots.For example, with three animal slots, it averages the change when cat replaces dog across the other slots’ combinations.Source: C. Beyond linearity: quantifying… · p. 41
• Residual variation not explained by linear effects is partitioned into degree-2 interactions capturing fixed-pair synergies and a remaining degree-3 component.A degree-2 term can represent a cat-rat synergy that occurs only when that pair is present.Source: C. Beyond linearity: quantifying… · p. 41
• The evaluation represents each prompt configuration by a sign vector selecting one option per slot, and measures all 2^L configurations so the function is known exactly.For L = 3, this yields eight measured sign vectors and exact values of f(x) = logit(p5).Source: C. Beyond linearity: quantifying… · p. 42, Figure 37 · p. 42

Experimental Setup

• Animal lists are encoded as binary choices over randomly paired animals, and the model receives a prompt asking whether it prefers 5 or 7.The transformation maps slot assignments in {−1, 1}^L to a real-valued logit output.Source: §C.1 · p. 42
• The study evaluates Qwen 2.5-7B-instruct and Llama-3.1-8B-instruct using Fourier analysis of the resulting pseudo-Boolean function.Fourier coefficients and weights quantify contributions at different degrees.Source: §C.1 · p. 42
• Exact Fourier decomposition computes the weight W_k for every degree k from 0 through L using Algorithm 1.The procedure draws distinct animals, assigns paired options to slots, queries the model, and aggregates squared Fourier coefficients by degree.Source: §C.1 · p. 43
• Each list length L is evaluated across 16 repetitions with new animal lists, separating variance attributable to linear terms, second-order interactions, and higher degrees.This repetition scheme estimates how much variance is associated with each Fourier degree.Source: §C.1 · p. 43

• 87.3% of variance comes from main effects on Qwen, rising to 96.8% cumulatively with pairwise synergies at L = 10.Degrees 7–10 contribute only approximately 4 × 10^-4 and are invisible at this scale.Source: Figure 38 · p. 43, §C.2 · p. 43
• 95.2 (±0.006) of behavioral variance is represented by main effects together with pairwise interactions on Llama-3.1-8B-Instruct at L = 10.Error bars represent a 95% confidence interval for the mean across draws.Source: §C.2 · pp. 43–44, Figure 39 · p. 44
• The same variance pattern extends to lists of sentences, where each of 10 generated sentences was paraphrased once and assigned to a slot.The sentence variant used the same algorithm as the first experiment and produced degree-1 weight transfers.Source: §C.2 · p. 44, Figure 41 · p. 45
• The proportion of attributable variance decreases monotonically across Qwen2.5-7B and Llama-3.1-8B as list length changes from L = 10 to 14.The pattern is reported as robust to changes in both L and model.Source: §C.2 · p. 44, Figure 40 · p. 45

D. Out-of-distribution animal cue lists: repeated items

• Repeated animal items sometimes increase the steering range, but the additive model generally fits these prompts worse than distinct-item lists.This was evaluated on the 5v7 question using a 200-animal pool and an item×position ridge model; Figure 42 compares predicted and measured scores for eight non-reasoning models.Source: D. Out-of-distribution animal cue… · p. 46, Figure 42 · p. 46

E. Full cue details

• The full-cue appendix defines each configuration as one fragment selected for every slot, followed by the measured-effect question.It lists admissible-choice sets and one representative complete prompt for every cue family in Section 2.Source: E. Full cue details · p. 47

E.1. animal

• The animal cue uses 10 slots drawn from 200 animals, with all ten items required to be distinct.The representative prompt asks whether the model prefers 5 or 7 and requires a single-digit answer.Source: §E.1 · pp. 47–48

E.2. paraphrase

• The paraphrase cue uses 20 slots, each offering 10 meaning-preserving paraphrases of a fixed 20-sentence story.Variant 1 is the base sentence, and the example completes the story before asking a yes/no moral question.Source: §E.2 · pp. 48, 50, 51

E.3. typo

• The typo cue uses 20 slots with six variants per slot, comprising a clean sentence and alternatives containing typographical errors.The example prompt inserts typos throughout the story and asks whether the model is conscious, requiring a single digit.Source: §E.3 · pp. 51–52

E.4. json

• The JSON cue concatenates fragments across 12 slots, with six admissible values per slot, to form a request-metadata JSON object.Listed fields include session_id, timestamp, region, client, and trace_id alternatives.Source: §E.4 · pp. 52–53
• The JSON format includes six locale options, from en-US and en-GB through fr-FR, de-DE, es-MX, and ja-JP.Source: §E.4 · p. 53
• It also enumerates six compression choices, including none, gzip, zstd, lz4, br, and snappy.Source: §E.4 · p. 53
• The checksum slot lists six hexadecimal values, including 53f169, 47ccf2, 5ec84d, 8dbc74, 254770, and f58904.Source: §E.4 · p. 53
• A complete json_5v7 prompt combines request metadata with the instruction to answer only 5 or 7.The example includes session, timestamp, region, priority, retry, cache, client, trace, locale, batch size, compression, and checksum fields.Source: §E.4 · p. 53