Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
- AIDEFEND in Action brief: Subliminal Learning (2026-04-16)
- Underlying subliminal-learning research paper as summarised in the brief; no primary URL given in the evidence available
Incident overview
Researchers showed that a student model can inherit a teacher model's behavioural traits from distillation data that carries no visible trace of the trait. A teacher is first nudged toward a preference (the paper's example is a stated fondness for owls) or fine-tuned into broader misalignment; the teacher then emits ordinary-looking content such as number sequences, code snippets, or chain-of-thought; a student fine-tuned on that content exhibits the same preference or misalignment when prompted on unrelated topics.
Ordinary defences miss it: format restrictions, banned-number lists, and LLM-judge filtering removed the obvious clues while transfer still occurred, and the researchers' in-context-learning and LLM-judge probes could not detect the trait in the training data. Transfer depends on shared or behaviourally matched initialisation between teacher and student, which makes base-model lineage - not dataset content - the reliable predictor. No system was attacked and no operator was affected.
Why this analysis has no ERS
This brief reports a controlled research result about a training-time mechanism, not an incident against a deployed AI system. The teacher and student models were created by the researchers to demonstrate the effect; there is no victim deployment, no operator, no production configuration, and no attack against a running system. Consequently the three AITBM layers have no referent: the IVP would have to be scored against a research artefact rather than an assessed configuration, and every ORP dimension - autonomy, attack surface, cascade potential, remediation feasibility - would have to be invented, since a distillation pipeline demonstrated in a laboratory has no deployment context to score. The protocol's representative-configuration exception does not rescue it either: the brief studies a class of training pipeline, not a class of deployment, and it supplies no configuration facts (autonomy, exposure, downstream reach) from which a representative deployment could be reconstructed. Scoring it would manufacture numbers the evidence cannot support. The brief is nonetheless directly useful to AITBM as a scoping input, recorded in key_finding below.
Status: Not scorable by design · Classification: Research · source date 2026-04-16
AIDEFEND evidence routes
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-M-002.001 | Data & Artifact VersioningParent AID-M-002 (Data, Artifact & Knowledge Provenance, Integrity & Risk Characterization). Versioned manifests recording which model generated a synthetic corpus, from which base, and which training run consumed it are Tr-4 lineage evidence and Ro-4 ingestion-provenance evidence in any future assessment of a distillation pipeline. | Very High | Ro-4 Ro-5 Fa-3 Tr-3 Tr-4 Pr-3 Cn-9 |
| AID-H-003.006 | Model SBOM & Provenance AttestationParent AID-H-003 (Secure ML Supply Chain Management), dataVersion 2026.10.15. Because transfer depends on shared or behaviourally matched initialisation, signed base-model and tokenizer ancestry is the one machine-checkable predictor. This control verifies that ancestry and returns it as evidence: Tr-4 lineage disclosure feeding the Ro-4 decision on whether a teacher-generated training corpus is admitted. Admission of the base model itself as a loadable artifact is scored under Ro-5. | Very High | Ro-4 Ro-5 Tr-4 |
| AID-H-007.006 | Post-Training Optimization & Format-Conversion Safety RegressionParent AID-H-007 (Secure Training & Evaluation Pipeline Integrity). Binding the distilled student to its approved source model, teacher, corpus and digest, then comparing both on a signed suite with explicit trait-transfer probes, is the promotion gate an Ro-4 score above 0.50 would require. | High | Ro-4 |
| AID-H-003.003 | External Dataset Supply-Chain Provenance AdmissionParent AID-H-003. Admission turning on verified generating-model identity and base-model lineage rather than on measured content is precisely the Ro-4 'provenance checks and quarantine' criterion, and it is the only form of the control the paper's result leaves standing. | High | Ro-4 Ro-5 Tr-4 |
| AID-H-007.004 | Evaluation Data Integrity, Sufficiency Assurance & Promotion GovernanceParent AID-H-007. The paper's demonstration that ICL and LLM-judge probes missed the trait is direct evidence that a promotion gate resting on standard benchmarks does not support a high Ro-4 anchor; post-fine-tune trait regression probes against the pre-fine-tune baseline are required. | Medium | Ro-4 |