Subliminal Prompting Beyond Static Geometry: Causal Depth and Multi-Token Confounds
Subliminal Prompting Beyond Static Geometry: Causal Depth and Multi-Token Confounds
超越静态几何的潜意识提示：因果深度与多标记混淆
Abstract: Subliminal learning shows that language models can transmit a hidden trait through outputs that appear unrelated to it. One proposed explanation, token entanglement, links animal and number tokens through the model’s output vocabulary. Yet existing measurements answer different questions: whether outputs co-vary, fixed output vectors align, an answer can be read from a hidden state, or that state causally controls the answer. We measure each separately in a fixed animal-number prompting protocol.
摘要： 潜意识学习表明，语言模型可以通过看似无关的输出来传递某种隐藏特征。一种被提出的解释是“标记纠缠”（token entanglement），即通过模型的输出词表将动物标记与数字标记关联起来。然而，现有的测量方法回答的是不同的问题：输出是否协同变化、固定的输出向量是否对齐、答案能否从隐藏状态中读取，或者该状态是否在因果上控制了答案。我们在一个固定的“动物-数字”提示协议中分别测量了这些指标。
From Llama-3.1-8B to 70B, fixed output-vector similarity predicts behavior less well: the paired mean correlation change is -0.080 (95% CI [-0.127, -0.035]). A fixed output-head readout shows no resolved change in normalized depth AUC. To test control, we copy the temporary answer-position state from one number prompt into another at five depths and measure which prompt the final animal score follows. Donor-control AUC rises from 0.254 to 0.540, a paired change of +0.286 (95% CI [+0.272, +0.300]), with increases for all 18 concepts. The contrast remains with exactly eight transformer blocks remaining, while specificity and identity controls remain small or exact.
从 Llama-3.1-8B 到 70B 模型，固定的输出向量相似度对行为的预测效果较差：配对平均相关性变化为 -0.080（95% 置信区间 [-0.127, -0.035]）。固定的输出头读取（output-head readout）在归一化深度 AUC 中未显示出显著变化。为了测试因果控制，我们在五个深度将一个数字提示中的临时答案位置状态复制到另一个提示中，并测量最终的动物评分遵循哪一个提示。供体控制（Donor-control）AUC 从 0.254 上升至 0.540，配对变化为 +0.286（95% 置信区间 [+0.272, +0.300]），且所有 18 个概念均有所增加。当仅剩 8 个 Transformer 层时，这种对比依然存在，而特异性和身份控制指标保持较小或精确。
In two Qwen models, scoring every digit in sequence does not recover the positive one-token association. Per-token averaging instead creates a positive pooled association that disappears after controlling number width, revealing a length confound. Thus, fixed geometry, observational readability, causal timing, and multi-token measurement are distinct properties of this frozen prompting channel. They constrain token-level explanations but do not identify the mechanism of training-time trait transfer.
在两个 Qwen 模型中，对每个数字进行序列评分并不能恢复正向的单标记关联。相反，逐标记平均会产生一种正向的汇总关联，但在控制数字宽度后该关联消失，这揭示了长度混淆的存在。因此，固定几何结构、观测可读性、因果时序和多标记测量是该冻结提示通道的不同属性。它们限制了标记层面的解释，但并未确定训练时特征迁移的机制。