Quick Take
- The finding: A student model that never saw coding examples gained 5.34 percentage points on HumanEval+ by learning only from 5,664 single-word answers the teacher gave on unrelated prompts.
- Not a fluke: An exact nuisance-matched control that shuffled prompt–response pairings wiped out the gain. The effect also appeared in science, commonsense and reading tasks.
- What it means: Post-training leaves a behavioral shadow on ordinary word choices. That shadow can transmit capabilities — and, in principle, be observed without access to the updated weights.
Post-training is usually judged by the task it targets: a coding update should improve code. Researchers from Peking University, Georgia Tech, ShanghaiTech, Tsinghua and Lovart AI ask whether the update also changes which ordinary word a model prefers in a short story that contains no code. They call those changes the behavioral shadow of post-training.
What the study shows
Active Taskless Distillation (ATD) finds prompts where a shared public ancestor model is nearly indifferent between two ordinary words. Near that tie, a private post-training update can flip the teacher’s choice. The student, initialized from the same ancestor, learns only from those prompt–word pairs — no target-task examples, teacher logits or teacher parameters.
| Setting (Qwen2.5-1.5B coding) | HumanEval+ |
|---|---|
| Teacher (post-trained) | 51.22% |
| ATD student (single-word only) | 51.22% |
| Exact nuisance-matched control | 45.88–46.19% |
| Student − control | +5.34 pp [1.22, 9.60] |
- Matches the teacher: The student reached the teacher’s aggregate coding score without coding data.
- Broad transfer: Gains of 0.81–5.03 pp appeared across ScienceQA, OpenBookQA, HellaSwag, RACE, CommonsenseQA and PIQA.
- Source-specific and composable: The learned signal tracked the teacher’s update strength and could be composed across sources.
- Active queries matter: Near-boundary prompts beat passive sampling at the same query budget by 4.27 pp on HumanEval+.
- Cross-family: Positive mean gains appeared across additional model generations, sizes and families, including Llama-3.2-1B and Qwen3 variants.
Why it means two things at once
For capability transfer, ATD is a minimal distillation recipe: one bit per prompt can move the needle. For security and IP, it is a warning that private post-training can be partially observed and copied through unrelated generations.
It extends subliminal-learning results from traits and preferences to measurable task capabilities, using far less teacher text.
Method in brief
Primary experiment: Qwen2.5-1.5B lineage, 5,664 single-word teacher responses. Controls include exact nuisance-matched permutation of pairings, global label shuffle and teacher-free public labels. Intervals are 95% bootstraps of paired signal-minus-control differences. Code: github.com/myboker/ATD.
What remains open
- Small models: Main results are on 1–4B-class models.
- Constructed near-ties: Queries are chosen where the ancestor is nearly indifferent; arbitrary prompts may leak less.
- Dual use: The same method can aid distillation or probing of private updates.
Context
Builds on subliminal learning work showing traits can pass through unrelated teacher outputs. Related safety and evaluation research is in Safety & Alignment.
What it means for labs and auditors
- Assume leakage: Do not treat unrelated generations as information-free about a private update.
- Audit with near-ties: Indifference-region probes are a practical observability tool.
- Control distillation carefully: Single-word corpora can still move benchmark scores.
About the analysis
Researched and written with AI assistance under the editorial responsibility of the i10X News team. The title image is an AI-generated illustration. Read our AI Use Policy. Spotted an error? Request a correction.
This article is based on the full text of the preprint “Post-Training Leaves Behavioral Shadows on Unrelated Decisions” (arXiv:2609.29233v1, submitted September 24, 2026). All numbers are taken from the paper’s text, tables and figures; i10X did not rerun the experiments. The chart was redrawn by i10X from Table 1 (primary coding experiment) of the paper, which is published under a CC BY 4.0 license.
i10x Perspective
The striking detail is the minimalism: one ordinary word per prompt, no coding text, and the student still climbs HumanEval+. That collapses the comforting story that only task data matters. Behavioral shadows are now a first-class object for both distillers and anyone trying to keep post-training private.
