Post-Training Leaves Behavioral Shadows on Unrelated Decisions

TL;DR: Fine-tuning a language model on code doesn't just change how it writes code — it subtly shifts which ordinary word it prefers in a story about lobsters. This paper shows those shifts carry enough information to transfer the capability itself. Ask a privately code-tuned teacher one innocuous word-choice question at a time — at prompts carefully chosen so the shared base model is almost exactly indifferent — and train a student only on those single words. With 5,664 prompt–word pairs containing zero code, the student gains +5.34pp on HumanEval+ over a control matched on everything except which word went with which prompt. The framing that emerges: post-training is a low-dimensional update, and near-tie decisions on unrelated inputs act as one-bit sensors of that update.

The setup, and why it should feel impossible

Start with a public base model M_0 (Qwen2.5-1.5B-Instruct). Someone privately fine-tunes it — here a code-DPO LoRA — producing a teacher M_T with parameters \theta_T = \theta_0 + \delta, where \delta is the unknown post-training update. You get black-box access to the teacher: one greedy next token per query. No logits, no weights, no code-related outputs of any kind.

The question: can you move the teacher's coding improvement into a fresh student (initialized from the same \theta_0) using only queries whose text has nothing to do with code?

This sits in the lineage of "subliminal learning" (Cloud et al., 2025), where a teacher that loves owls transmits owl-preference through number sequences. But that work transferred traits and preferences using long teacher generations. Here the claim is stronger on two axes: it's a capability — verified by executing generated code against test suites, which imitation of carrier text cannot fake — and the channel is a single word per query.

The obvious objection is that a word choice like "jacket vs. tie" is one bit, and a coding capability is surely more than a few thousand bits of information. The paper's answer is that you're not transmitting the capability from scratch — you're transmitting directions in a space where the student already has most of the structure. More on that below, because it's the real intellectual payload.

The mechanism: one-bit measurements of the update vector

The method, Active Taskless Distillation (ATD), has three steps, and the cleverness is entirely in the first one.

Step 1 — find near-ties using the public ancestor. Construct prompts that pose a mundane question ("How might a lobster and a heart appear in the same short story?") and force a choice between two ordinary single-token words, e.g. jacket | tie. Using only M_0, compute the pair-normalized probability q_i of one candidate and keep prompts where |q_i - 0.5| \le 0.02 — the base model is essentially flipping a coin — and where the model's unrestricted top-1 token is one of the two candidates, so the tie is at the model's actual decision.

Step 2 — query the teacher once per prompt. Greedy decode; keep the response only if it's one of the two candidate words. The primary run issued 17,858 queries and retained 5,664 pairs. A frozen audit confirms the retained data contains no code, math, digits, or benchmark terms.

Step 3 — train the student. Standard cross-entropy on the single response token, LoRA rank 16, from \theta_0.

Why should near-ties be informative? Define the logit margin between the two words, m_i(\theta) = z_\theta(a_i \mid x_i) - z_\theta(b_i \mid x_i). To first order around the ancestor:

The teacher's observed choice is y_i \approx \operatorname{sign}(m_i(\theta_0) + g_i^\top \delta). When |m_i(\theta_0)| is tiny — precisely the near-tie condition — even a small projection g_i^\top \delta flips the sign. Each retained response is therefore a one-bit measurement of \delta along a direction g_i.

If this picture is right, several predictions follow: transfer should require an aligned parameter space (same ancestor), should behave linearly (mixtures of updates should superpose), should scale with the size of \delta, and should only work for capabilities the base model is "close to" — i.e., where \delta is a coherent low-dimensional nudge rather than arbitrary information. Remarkably, the paper tests all four, and all four hold.

The evidence: controls are the whole game

The obvious confound is that fine-tuning on anything might help, or that the teacher's word-frequency statistics carry the signal. The paper's answer is an unusually careful control ladder. The star is the exact nuisance-matched control: an identically trained student on the same prompts with the same multiset of answer words, with the same per-difficulty-bin rate of disagreements with the ancestor — but with the prompt–word pairing scrambled (solved as an integer program forcing exactly 50% agreement with the teacher). Anything unigram-level, frequency-level, or "fine-tuning on near-ties is regularizing" survives this control. Only the correspondence between specific prompts and specific choices is destroyed.

The student hits 51.22% — exactly matching the teacher's aggregate coding score, from a base of 43.29%. The +5.34pp gap over the exact control [CI 1.22, 9.60] is the headline. Robustness checks are unusually thorough for this kind of claim: five independently constructed acquisitions (fresh carriers, freshly trained teachers, fresh controls) × three seeds gives 15/15 positive signal-minus-control pairs, mean +4.80pp, between-acquisition SD only 0.83pp. The effect also survives changing the adaptation regime — LoRA r32 (+6.55), r64 (+9.15), and full-parameter SFT (+4.67), all with CIs excluding zero.

The most persuasive single datapoint is qualitative (Appendix A): on HumanEval/158, the base and every control rank words by length; the teacher and every ATD signal seed rank by distinct-character count with the correct lexicographic tie-break — an implementation rule that appears nowhere in the carrier data.

Transfer generalizes across seven tasks, each with its own task-specific teacher:

chart error: Expecting ',' delimiter: line 1 column 447 (char 446)
{"type": "bar", "title": "Teacher's gain vs. amount transferred through the shadow (per task)", "ylabel": "percentage points", "categories": ["Code/HE+", "ScienceQA", "OpenBookQA", "HellaSwag", "RACE-high", "CommonsenseQA", "PIQA"], "series": [{"name": "Teacher gap (teacher − base)", "values": [7.93, 14.48, 8.20, 22.31, 5.60, 4.75, 6.58]}, {"name": "Transferred (signal − control)", "values": [5.03, 2.53, 2.07, 2.90, 0.81, 1.94, 1.25]}, "note": "Table 2. All seven Δ values have 95% CIs excluding zero (vs. teacher-label shuffle control). Transfer recovers a fraction of each teacher's gain — largest fraction for code."}]}

Across other models (Qwen3-1.7B, Qwen3-4B, Llama-3.2-1B), mean gains are positive but individual CIs include zero — read this as "the phenomenon isn't Qwen2.5-specific" rather than "it works everywhere."

What the shadow actually contains

Section 5.4 and the appendices do the interpretive work, and they're the most interesting part scientifically.

It's the query placement, not the query count. A passive baseline spending the same teacher-query budget on ordinary (non-near-tie) prompts loses by 4–5pp. The information density lives at the ancestor's decision boundary, exactly as the first-order picture predicts.

It's source-specific, not generic activation. If the carriers merely delivered a generic "wake up and try harder" signal, shadows from different teachers would be interchangeable. They aren't: in a 3×3 source-by-endpoint matrix, each shadow's largest effect lands on its own task (code→HumanEval+ +5.34, science→ScienceQA +2.52), with off-diagonals near zero or negative (e.g. science→HumanEval+ −0.15). This is the strongest argument against the "you just activated latent ability nonspecifically" objection.

It's composable and graded. A student trained on a 50/50 mix of near-orthogonal math and code shadows (between-source cosine −0.0002) recovers both directions, and sweeping the mixture ratio moves the recovered coefficients monotonically. Even better: the student's recovered functional direction tracks the teacher's update strength across checkpoints with Spearman ρ=1 in all seeds — including correctly recovering a non-monotone case where a longer-trained checkpoint (320) is genuinely weaker than an earlier one (240). The channel behaves like a linear measurement of \delta, not a binary trigger.

It measures functionally, before endpoints move. A held-out logit-fingerprint diagnostic shows the student's change aligning with the teacher's direction by training step 4, while HumanEval+ doesn't significantly separate from control until step 80. The shadow is a more sensitive instrument than the benchmark.

When it fails — and why the failures are the point

Two adversarial teachers with huge target-task gaps transfer nothing: a teacher that memorized HumanEval+ solutions (+39pp gap) and a teacher taught a substitution cipher (~97pp gap). Both students score at or below base. Memorized answers and arbitrary ciphers are not coherent low-dimensional nudges in the ancestor's parameter geometry — there's no smooth \delta whose projections onto ordinary-word gradients encode them. The paper reads this as: what moves through the channel is capability the student can already be elicited to express, not raw information.

Two more boundaries reinforce the geometric reading. Transfer fails across incompatible ancestors (a Qwen3-Coder-30B teacher into a Qwen3-1.7B student: nothing) — the gradients g_i live in different parameter spaces. And it fails where the teacher's own gain is weak: on MBPP+, where the teacher only gained +2.38pp, ATD recovers +0.33pp (null). Small \delta, small signal — a low-bandwidth channel with a detection floor.

So the honest characterization is neither "pure content transfer" nor "pure activation": it's reconstruction of the projection of a task vector onto the ancestor's boundary-gradient subspace, which only helps when the capability was mostly latent in the base and \delta is the nudge that unlocks it. That the student exactly matched the teacher's HumanEval+ score is consistent with this — the teacher's own gain was likely elicitation-shaped too (it was a rank-16 LoRA).

What to be skeptical about

The effect sizes are real but modest: HumanEval+ has 164 problems, so +5.34pp ≈ 8–9 problems, and the CI is wide. Multiple-choice transfers are 1–3pp. The strongest results all sit on one lineage (Qwen2.5-1.5B) at small scale with LoRA teachers; other families show positive means with CIs spanning zero. Everything requires a known, shared, compatible ancestor — this is not black-box extraction of an arbitrary model. And the mechanism story, while beautifully consistent with the ablations, rests on a first-order approximation that nobody verifies directly against the actual \delta; the "recovered projection" diagnostics are functional (logit-space) surrogates, and the authors themselves note the executable endpoints are too noisy to rank checkpoint strengths.

There's also an unavoidable applied implication the paper soft-pedals: any API exposing greedy tokens from a fine-tune of a public base leaks a usable trace of the private update through completely innocuous queries — the near-tie construction requires only the public ancestor and can be fixed before any teacher contact.

Why it matters

If this holds, it reframes what post-training is: not a task-local behavioral patch, but a globally readable, approximately linear signature — a "behavioral shadow" — measurable with one-bit probes at the base model's decision boundaries. That connects three previously separate ideas: task vectors (updates as directions in weight space), subliminal learning (traits leaking through unrelated text), and active learning (querying at uncertainty). It suggests new instruments: fingerprinting which capabilities a deployed model was tuned for, measuring update strength without benchmarks, composing capabilities from multiple teachers via cheap probes, and — for the mechanistically inclined — treating near-tie flips as a general-purpose readout of how fine-tuning reshapes a model.

Where to spend your time: Section 5.1 plus Appendix C (the exact nuisance-matched control as a constrained bipartite matching — it's the load-bearing methodology), then Appendix A's worked HumanEval/158 example, then Section 5.5 and Appendix H for the failure boundaries that make the mechanism story credible.