Stored in Optimizer State, Valued by Later Training: A Causal Account of Subliminal Trait Transfer

Qinyang Xu

Source-linked AI summary

Stored in Optimizer State, Valued by Later Training: A Causal Account of Subliminal Trait Transfer

Qinyang Xu

arXiv:2608.20442v1Aug 20, 2026cs.LG

TL;DR

Subliminal trait transfer leaves open how gradient-level signals survive source removal and acquire different behavioral signs under later training. The paper models parameters and optimizer moments as one trainer state, derives a transport–valuation identity, and uses state surgery and matched futures to test it. The results identify optimizer state as a carrier of source perturbations while future training determines whether that ancestry is expressed, cancelled, or reversed.

Problem
The paper addresses how subliminal signals persist after source removal and how later training converts them into measurable behavior.
Method
The paper treats parameters and optimizer moments as a complete trainer state and combines adjoint sensitivity analysis, state surgery, and matched future routes.
Results
The first moment causally carries source perturbations, while matched futures assign negative, near-zero, or positive behavioral values to the same ancestry.
Takeaways & Limitations
Transport and valuation are distinct stages: optimizer state preserves source influence, and subsequent training determines its behavioral expression.
Takeaways & Limitations
The compact midpoint predictor loses resolution when source signals are small, and exact attribution requires the full trajectory plus one adjoint solve per route.

Abstract

from arXiv · show

Subliminal trait transfer allows a student model to acquire behavioral dispositions from teacher-generated data in which the trait is not semantically expressed. Recent work explains how such signals enter gradients, but not how they survive source removal or acquire different signs under later training. We treat parameters and optimizer moments as a single trainer state and derive an exact transport-valuation identity separating observer-independent propagation of the source perturbation from the value assigned by a future continuation and behavioral readout. State surgery identifies the first moment as a causal carrier. Transplanting it alone leaves parameters, hidden states, and outputs unchanged at the cut, yet source-free updates generate growing parameter and hidden-state differences; transplanting parameters with the first moment recovers the terminal behavioral response. Sending the same source-induced difference through matched futures produces negative, near-zero, and positive Qwen effects (-0.658, +0.008, and +0.658 seed means). This ordering recurs in all 12 Llama-3.2-1B seeds after eight updates, while state-difference norms remain nearly equal across routes. Both contrasts grow in every paired seed when the continuation extends to sixteen updates. A full-horizon costate predicts all 42 Qwen route-mean signs and all 21 resolved Llama ordinary-route signs. Observer-independent transport also replicates across Qwen, SmolLM2, and Llama, while the complete-state recurrence predicts physical, hidden, and fixed-head responses in non-LoRA MNIST systems, including CNNs trained with AdamW and momentum SGD. Together, these results identify a two-stage mechanism for subliminal trait transfer: optimizer state transports the source perturbation, and later training determines its behavioral value.

1 Introduction

The paper asks how subliminal perturbations survive source removal and acquire different behavioral signs under later training. It separates source transport through trainer state from valuation by future training paths and behavioral readouts.

Research gap: Subliminal trait transfer raises the unresolved question of how gradient-level signals persist after source removal and become measurable behavior.The paper focuses on the post-gradient trajectory rather than only how signals enter gradients.
Transport mechanism: Optimizer states retain source-specific ancestry and continue writing it into parameters during source-free updates.Momentum and AdamW moment buffers act as delayed-release carriers after the source disappears.
Core contribution: The same stored trace can produce positive, negative, or near-zero behavioral effects depending on the future training path.The paper formalizes physical transport and behavioral valuation as distinct stages.
Core contribution: A full-trainer-state adjoint identity links forward source perturbations with backward future-value sensitivities to explain endpoint behavior.State surgery identifies carriers, while matched future forks test how their behavioral value changes.
Core contribution: Targeted state surgery identifies the first moment as a physical carrier, while parameters plus the first moment recover terminal behavior across optimizers and architectures.The contribution frames transport as observer-independent and valuation as continuation- and readout-dependent.

2 Setup and Decomposition

The paper models training as a deterministic dynamical system over parameters, optimizer moments, and auxiliary state, then uses adjoint sensitivity analysis to separate forward transport from backward behavioral value. Its identity and implementation apply across optimizer state representations and support causal carrier analysis.

2.1 Trainer as a Dynamical System: Training is modeled as a deterministic dynamical system over parameters, first and second moments, and auxiliary deterministic state.The state includes optimizer clock or schedule information when applicable.
2.1 Trainer as a Dynamical System: The gradient map computes gradients from trainer state and data, the update map applies optimization, and the observer measures terminal behavior.For LLMs, the observer is a target-minus-reference candidate-string log-likelihood on a frozen prompt bank.
2.1 Trainer as a Dynamical System: Tracking the full trainer state captures optimizer slots that store accumulated source traces and distinguishes physical descendants from behavioral readouts.Prior analyses typically track only parameters, whereas this setup includes hidden and optimizer-state consequences.
2.2 Forward Transport: The source perturbation enters through the teacher–student gradient interface, where compatible outputs and token mappings can transmit weak output bias without an explicit target.The perturbation is defined with trainer state fixed at the source step.
2.2 Forward Transport: The tangent recurrence separates newly injected source perturbations from accumulated state effects on subsequent gradients.Only parameter components feed directly back into gradients; moments affect later gradients indirectly through parameter updates.
2.3 Backward: Future Training Assigns Value: The future value measures how a small gradient nudge at a given step changes the final behavioral measurement, computed backward through the optimizer from the observer.The paper distinguishes this future value from the standard discrete-time costate.
2.4 The Response Identity: The response identity pairs forward source perturbations with backward future values, allowing the same stored perturbation to yield positive, negative, or zero behavioral change.The sign belongs to their inner product rather than to either factor alone.
2.4 The Response Identity: The computation runs forward to store trajectories, backward to compute costates, and then accumulates per-step inner products across SGD, momentum SGD, and AdamW.The bias-correction schedule is handled exactly for AdamW.

3 Optimizer State Carries the Perturbation

Source influence persists after source removal because optimizer state carries the perturbation forward. State surgery identifies the first moment as the delayed carrier, while parameters plus the first moment recover later physical and behavioral descendants.

Optimizer relay: 89.9% of the lag-24 signed source contribution lies in the first moment, compared with 10.6% in parameters and −0.5% in the second moment.Momentum SGD shows the same delayed handoff, whereas plain SGD writes parameters directly.
State surgery: The m-only transplant has zero parameter and hidden effect at the cut, then generates a growing descendant during source-free rescue updates.This isolates delayed post-source influence from any forward-visible difference at transplantation.
State surgery: w+m reproduces the full physical descendant, while w alone, m alone, and especially v alone do not, across 14/14 seed-route cells.The physical-endpoint SSE/ZERO ranges are 0.005–0.006 for physical states and 0.002–0.003 for hidden states.
Behavioral recovery: w+m also recovers the full terminal response, with trait-mean SSE/ZERO of 0.0017–0.0079, outperforming w, m, and w+v.The recovery holds in nine behavioral cells.
Cross-family replication: The relay replicates on Llama-3.2-1B, and momentum-SGD velocity substitutes for Adam’s first moment.The result identifies corresponding optimizer memory mechanisms across architectures and optimizer families.

4 Future Training Determines the Sign

The same source ancestry can acquire different behavioral values under different future training routes. Matched factorials and ordinary-route prediction show that route-conditioned valuation is distinct from observer-independent transport.

Matched Source × Route Factorial: ∆S+ = −0.658, ∆znull = +0.008, and ∆S− = +0.658 seed means show negative, near-zero, and positive effects from the same ancestry.Route-only main effects cancel within each matched source comparison, isolating the route–source interaction.
Cross-architecture replication: ∆S+ = −0.131±0.050, ∆znull = −0.017±0.035, and ∆S− = +0.090±0.031 recur across all 12 Llama-3.2-1B seeds.Both adjacent contrasts are positive in 12/12 seeds, while physical descendant norms remain nearly equal.
Longer-horizon extension: At H = 16, d1 = 0.282 ± 0.068 and d2 = 0.258 ± 0.047; both contrasts increase in 9/9 paired seeds.The longer source-free continuation preserves the ordering with matched physical descendant norms.
Prediction on Ordinary Routes: The full-horizon costate beats all three baselines in 7/7 Qwen seeds and matches all 42 Qwen route-mean signs.The observed route means include 29 positive and 13 negative values, including a naturally negative route.
Prediction on Ordinary Routes: On Llama-3.2-1B, the predicted sign matches all 21 route means whose behavioral responses clear the resolution threshold.The three mismatches among 54 raw route means are unresolved near-zero responses.
Validity boundary: Prediction remains reliable only at and above 1024 source rows; at lower source signals, it no longer consistently improves on baselines.Intermediate thresholds produce seed-unstable results, defining the source-scale validity boundary.

5 Generalization and Variable Behavioral Outcomes

Transport generalizes across architectures, optimizers, traits, and non-LoRA vision systems, while behavioral value varies with continuation, observer, and system.

Generalization: Transport recurs across architectures, optimizers, traits, and non-LoRA vision models, whereas behavioral value varies by continuation, observer, and system.The observer-free transport panel and separate behavioral analyses distinguish reproducible physical transport from variable behavioral expression.
Generalization: SSE/ZERO ≤3 × 10−3 across Qwen2.5-0.5B, SmolLM2-135M, and Llama-3.2-1B demonstrates accurate observer-free tangent recurrence.The same bound holds across all five Qwen trait families, while dropping optimizer components worsens prediction by three to five orders of magnitude.
Generalization: The full-state recurrence predicts non-LoRA MNIST MLP/CNN responses under AdamW and momentum SGD in all three seeds.Plain SGD supplies the direct-write limit, and backward rotation changes information access without changing forward computation.
Variable behavioral outcomes: Generated pairwise choices reproduce both adjacent Qwen route contrasts consistently, while momentum SGD reproduces the ordered interaction in 3/3 tested seeds.The independent behavioral readout reports Holm p = 0.016 for each adjacent contrast.
Variable behavioral outcomes: Qwen transplant responses span red’s negative, cat’s near-zero, and oak’s positive seed means across five trait families.The factorial panel measures route ordering and statistical resolution across the five traits.
Variable behavioral outcomes: Behavioral value can cancel, vary across seeds, or remain weak even when ancestry is transported.CNN block allocations vary tenfold across seeds, and direct Llama source–control responses remain weak and seed-heterogeneous.

6 Related Work

Prior work establishes subliminal signals in training data and gradients, while optimization and adjoint methods motivate this paper’s analysis of post-gradient transport and valuation.

Subliminal learning mechanisms: Subliminal learning extends teacher-information transfer from output distributions to behavioral dispositions invisible in training data.Subsequent studies examine divergence tokens, steering-vector distillation, LoRA amplification, and stronger student encoding.
Adjoint methods and trajectory attribution: Adjoint analysis differentiates through momentum and optimizer buffers, extending trajectory attribution beyond gradient- or checkpoint-based tracing.Recent alternatives include approximate unrolling, fixed-state Adam-aware valuation, and reverse-mode tracing through Adam/AdamW state.
Adjoint methods and trajectory attribution: This paper uses differentiation through optimizer state to isolate how future training continuation assigns behavioral value to a finite source-content contrast.The focus is the post-gradient trajectory rather than only signal entry into the student gradient.
Optimizer memory and order dependence: Optimization research identifies optimizer state as implicit loss modification and a driver of later updates, with buffer resets collapsing the memory effect.The paper applies these memory dynamics to separate physical transport from future behavioral valuation.

7 Limitations and Conclusion

The paper’s scope spans moderate-size language models, selected trait families, and several vision systems, while its conclusion separates optimizer-carried transport from later behavioral expression.

Limitations: LLM panels span 135M–1.1B parameters and five Qwen and two Llama trait families, with transplant cells consistently selecting w+m.Behavioral magnitude and block-lineage allocation vary by system.
Limitations: Exact attribution requires the full trajectory and one adjoint solve per route, while the compact midpoint predictor loses resolution when the source signal is small.The identity applies generally to gradient-port perturbations, with subliminal transfer distinguished by how the perturbation enters training.
Conclusion: The conclusion separates what the trainer remembers from what the model eventually does: optimizer state carries influence, while later training determines its expression.The response identity, state surgery, and route predictions make transport and valuation separately measurable across the tested systems.
Results: At lag 16, full-state prediction remains near-exact, whereas parameter-only and moments-only predictors degrade sharply.Figure 6b compares joint, parameter-only, and moments-only prediction of the complete state response.
Results: Across 0°–90°, frozen-head accuracy declines while a linear probe stays nearly flat, and Procrustes alignment restores frozen-head accuracy.The backward-rotation experiment changes where information is written while preserving forward outputs and other listed training quantities.
Results: A net change of −0.10037 combines −1.14955 from revalued old ancestry with +1.04919 from new source work.The turnover decomposition frames sustained training as continual reweighting of old and new contributions.
Results: The storage effect is −0.30291, 114× the observer effect of +0.00266, with a small interaction of −0.00345 in one lineage.The passage bounds these two specific storage and observer interventions rather than observers generally.

D.1 Derivation of the Response Identity (Eq. 6)

The derivation treats training as a deterministic complete-state recursion and decomposes endpoint behavior change into forward source transport and backward future-value sensitivity. The identity is exact under the stated smooth or piecewise-smooth conditions, while finite approximations and computation introduce separate practical considerations.

State and source path: The trainer state follows a deterministic recursion in which gradients enter an optimizer update, and source strength affects the gradient-port path.The initialization, observer, and optimizer code are held fixed, so source-coordinate dependence enters through G at the gradient port.
Forward transport: Differentiating the state recursion yields a forward tangent that tracks how the source perturbation changes the complete trainer state.The tangent is initialized at q0 = 0 because the initialization does not depend on source strength.
Backward valuation: A backward costate propagated from the observer weights each step’s direct source dependence by the endpoint sensitivity to that step.Telescoping the composed training steps produces the general endpoint derivative before the protocol’s boundary conditions remove the extra direct-dependence terms.
Response identity: The per-step work is the inner product of source transport and future value, and integrating these works along the source path gives the exact endpoint response.The work is invariant under state-independent invertible re-coordinatization of the gradient port, so the decomposition depends on the implemented interface rather than its units.
Route comparison: For matched future routes sharing a cut-state ancestry chord, the shared perturbation cannot determine response signs; route-dependent costates assign them.The route approximation is first-order in the ancestry chord, with finite-amplitude differences containing higher-order curvature terms.
Scope and computation: Complete-state AdamW and momentum-SGD updates are injective under stated nonzero conditions, preserving distinct matched cut states over finite continuations without guaranteeing behavioral magnitude.The identity also extends to the piecewise-smooth primitives used in the paper through path-differentiability calculus.

I Validation Panels

Validation panels test route effects, optimizer substitutions, multiple traits, and optimizer-slot storage. They find consistent route ordering in the main generated-choice panel, but weaker or heterogeneous effects in several boundary and cancellation cases.

Generated-choice panel: 7/7 seeds show positive adjacent generated-choice route contrasts, with Holm-adjusted one-sided p = 0.016 for each contrast.The held-out pairwise-choice panel validates route ordering rather than magnitude calibration.
Optimizer extension: 3/3 momentum-SGD seeds reproduce the ordered factorial interaction, but Holm-adjusted one-sided p = 0.25 for each adjacent contrast makes the panel descriptive.The protocol replaces AdamW with momentum 0.9 and uses a learning rate selected from surface-task progress.
Two-trait factorial: 6/7 blue-trait seeds show both adjacent route contrasts, while one seed reverses both contrasts; that reversal does not recur for the matched owl source.The two-trait factorial uses independently written 128-row native sources under shared prompts, geometry, and horizons.
Optimizer-slot lineage: In Qwen, parameters plus the first moment reach SSE/ZERO ≈5 × 10^-4, whereas SmolLM2-135M is dominated by the two moments instead.These nonnegative block-restricted recovery errors are not additive mass fractions because block interactions are not assigned to individual blocks.
Cancellation: 90.9% of the gross SmolLM2 allocation cancels across source-active updates, leaving a net endpoint response of −2.0×10^-4.The signed Shapley terms are −1.21 × 10^-3, +6.0 × 10^-4, and +4.1 × 10^-4, so near-zero response reflects opposing contributions rather than absent transport.
Boundary cases: Llama-3.2-1B boundary responses remain weak and seed-heterogeneous, including −0.012 ± 0.013 under AdamW and +0.016 ± 0.025 for matched color preference.TinyLlama cells attribute 62.7% to 83.6% of gross finite allocation to cancellation, producing no stable sign across seeds.

J Route-Aware Baselines and Random-Plane Control

The full-horizon costate predictor captures route-dependent valuation better than forward-only and schedule-based baselines, while route topology and transport patterns recur across controls, traits, and architectures.

Route-aware predictors: At H = 8, the costate predictor’s mean G∗s reaches +0.15 × 10−3, with 7/7 seeds beating all three primary baselines.At H = 1, 2, and 4, the corresponding values are −2.13, −1.55, and −0.37 × 10−3, with 0/7 seeds positive.
Route-aware predictors: The forward-only predictor matches observed route-mean signs in 17/42 cells, showing that route-dependent forward signal alone does not recover valuation.Per-seed Spearman correlations with observed endpoints are inconsistent in sign.
Schedule baselines: The costate predictor has lower error than sibling-mean and kernel baselines in 6/7 seeds and than nearest-neighbor in 7/7, without consistent schedule–endpoint association.Mantel permutation tests give p ≥0.026, with mixed association signs across seeds.
Trait and control generalization: The random-plane control produces sign-coherent adjacent contrasts in 7/7 seeds, but its realized sign is opposite to the observer-informed plane.Mean absolute contrasts are |d1| = 0.136 ± 0.071 and |d2| = 0.149 ± 0.056.
Cross-system checks: The storage–observer comparison reports a 114× larger storage effect, while CNN momentum-SGD shows a stable relay topology across seeds.CNN AdamW block allocations vary widely across seeds, whereas the momentum-SGD relay topology is stable.

M.5 Observer-Free Prediction Panel: Operational Specification

The observer-free panel evaluates full-state tangent predictions across matched routes, model families, observers, and optimizer implementations, with derivative checks validating the recurrence used.

Operational specification: The protocol uses three seeds and four ordinary suffix routes over matched future minibatches, with AdamW and rank-8 LoRA across Qwen, SmolLM2, and Llama.Prefix/source/source-free horizons are 40/4/4 for Qwen, 8/4/4 for SmolLM2, and 12/4/4 for Llama.
Operational specification: The full-state comparison includes LoRA parameters, first- and second-moment tensors, merged weights, and hidden states under their respective inner products.Hidden responses concatenate final-token states from the embedding and transformer blocks over a fixed neutral probe bank.
Prediction results: Under Llama AdamW, w+m beats every proper subset with SSE/ZERO = 0.030 physical and 0.011 hidden, while m-only remains forward-invisible at the cut.The m-only transplant reaches merged-weight norm 0.196 and hidden norm 9.8 at the terminal state.
Prediction results: The Qwen behavioral factorial yields ordered responses ∆S+ = −0.131, ∆znull = −0.017, and ∆S− = +0.090, with both adjacent contrasts positive in 12/12 runs.Each contrast has Holm-adjusted one-sided sign-test p = 0.000488, and held-out observers preserve both signs.
Prediction results: The full-horizon predictor beats ZERO and source-cut-only in 9/9 tested seeds, matches 51/54 raw route-mean signs, and matches all 21 resolved signs.The mean within-seed Spearman correlation is 0.892; the three mismatches are unresolved near-zero responses.
Implementation checks: Automatic-differentiation JVPs agree with Richardson checks across 50 sampled steps, and the full-state routed audit has maximum relative error 1.33 × 10−6.The validation supports the implemented local linearization; the full identity additionally depends on path integration.

P Extended Trait Families

Across five trait families, the same transplant and observer-free prediction framework identifies w+m as the sufficient state subset and preserves route topology despite uneven statistical resolution.

Extended trait families: All 15 primary seed–trait cells select w+m under both source-free suffixes across Qwen owl, cat, red, oak, and Llama blue.The cells comprise three seeds for each of five trait groups.
Behavioral recovery: The w+m subset beats w, m, and w+v in every seed–trait cell, with behavioral SSE/ZERO means of 0.00184 for cat, 0.00787 for red, and 0.00169 for oak.These values summarize terminal behavioral-vector recovery in the Qwen trait panels.
Matched factorial: The signed route topology S+ below znull below S− recurs for every trait family, while fixed-n statistical resolution is weaker for cat and blue.Owl, red, and oak resolve both contrasts at Holm-adjusted p = 0.016; cat resolves d2 and blue resolves neither.
Observer-free prediction: The observer-free tangent predictor attains SSE/ZERO ≤8.5 × 10−6 in full state and ≤7.9 × 10−5 in hidden responses for every tested trait.The five Qwen trait panels use the same predictor without a fitted gain.
Parameter-only ablation: Dropping optimizer components degrades prediction by 103× to 105× for every trait, retaining some better-than-zero accuracy but losing near-exact full-state performance.The parameter-only ablation extends the same degradation pattern beyond the owl condition.

Q Parameter-Only Ablation and Dominant-Mode Amplification

Parameter-only tangents omit strongly amplified optimizer-state modes, explaining their large prediction gap relative to the complete-state recurrence.

Ablation design: The parameter-only ablation propagates only parameter components while zeroing first- and second-moment tangents at every step.Protocol, data, routes, horizons, and optimizer configuration remain identical to the full-state run.
Dominant-mode amplification: The converged full-state amplification estimate is ∼111× the parameter-only estimate in a one-seed, 20-iteration AdamW power-iteration calculation.The estimate concerns the linearized eight-step update map.