Post-Training Leaves Behavioral Shadows on Unrelated Decisions

Post-Training Leaves Behavioral Shadows on Unrelated Decisions. By Ziyang Zhang and five others, from Peking University, the Georgia Institute of Technology, and three other institutions. Published on the twenty-fourth of September. Its code repository is public and real: ten source files.

The finding is that a language model can pass on a capability through text that has nothing to do with the task. Post-training normally improves a model with task-specific data. Earlier work on subliminal learning showed that information about such updates can leak through unrelated generations, but it mostly looked at traits or preferences, and relied on large amounts of teacher output. This work goes after capabilities, and it uses almost no output at all: a single word from the teacher for each prompt.

The technique is called Active Taskless Distillation, or ATD. It starts from a shared public ancestor, the model that both teacher and student descend from. ATD selects prompts on which that ancestor is nearly indifferent between two ordinary words, and asks the post-trained teacher which it picks. Where the ancestor is balanced, the teacher's choice exposes the behavioral shadow its post-training left behind. A student initialized from the same ancestor then learns only from these prompt-word pairs. It sees no target-task examples, no teacher logits and no teacher parameters.

In the primary coding experiment, with Qwen2.5-1.5B, five thousand six hundred and sixty-four such responses produce a gain of five point three four percentage points on HumanEval+, measured against a control matched exactly for nuisance factors. Further experiments show transfer in scientific knowledge, commonsense reasoning and reading comprehension.

The reported transfer extends across additional model generations, sizes and families, not only the primary Qwen setup. Functional analyses find that the learned signal is composable, and that its strength tracks how strongly the teacher itself was updated. That last point matters for the claim: a larger update leaves a darker shadow, which is what you would expect if the words really are carrying the effect of post-training rather than noise.

Picture a coin that the ancestor would flip evenly. After post-training, the teacher's coin lands one way a little more often, and across thousands of such coins that lean is enough to carry a coding gain to a student that was never shown a single coding example.

Post-Training Leaves Behavioral Shadows on Unrelated Decisions. By Ziyang Zhang and five others, from Peking University, the Georgia Institute of Technology, and three other institutions. Published on the twenty-fourth of September. This is the long version: the whole paper rather than the abstract.

Post-training is normally judged by what it was trained to do: a coding update is measured on code. But an update touches the whole model, and it may also shift which ordinary word the model prefers in a short story that has nothing to do with programming. The authors call those shifts the behavioral shadow of post-training. Their question is whether that shadow carries the capability itself. Could you learn a private model's coding skill without ever seeing a line of its code, its probabilities, or its weights, just by watching which of two words it picks?

Two pieces of background are needed. The first is subliminal learning, prior work showing that a teacher can pass traits to a student through data whose visible content is unrelated. That work used long teacher outputs and mostly moved traits, not capabilities. The second is the setting. A public base model is post-trained privately into a teacher, by an unknown change in weights. A student starts from the same public base. The teacher can only be queried as a black box that returns one next token by greedy decoding, and the student never sees any target-task data. The public base, though, can be inspected freely, and that asymmetry is what the method exploits.

That is the core of Active Taskless Distillation. Each candidate prompt is a task-unrelated context: a question about how a lobster and a heart might appear in the same short story, a running list of ordinary words, and an instruction to choose the next word from two options, such as jacket or tie. Using only the public base, the method computes how the probability splits between the two words and keeps the prompt only if the split is within two points of fifty-fifty, and only if one of the two is the base's own top choice over the whole vocabulary. In the running example, the base gives tie a probability of zero point five zero four four, a hair over half. The code-trained teacher, queried once, says jacket. That single pair, prompt and jacket, becomes one training row.

The theory behind this is a first-order approximation. The gap between the two words' scores moves, to first order, by how the update lines up with that prompt's gradient. Near a tie the starting gap is tiny, so the sign of the teacher's answer reveals the sign of that alignment. Each answer is one bit, constraining the update along one direction. The prompts are fixed before the teacher is ever asked. In the main coding run, seventeen thousand eight hundred and fifty-eight near-tie queries went out, and answers outside the two offered words were discarded, leaving five thousand six hundred and sixty-four rows drawn from a vocabulary of a hundred and twenty-eight words. An audit found no code, mathematics, benchmark terms or digits in them. The student is then trained with ordinary cross-entropy on the single answer word.

The primary test uses Qwen2.5-1.5B, with a code teacher that raises HumanEval+ from forty-three point two nine to fifty-one point two two percent. The student trained on the one-word answers reaches that same fifty-one point two two. The comparison that matters is against the strictest control. It keeps the same prompts and the exact same multiset of answer words, matches how often the teacher overturned the base's choice at each level of closeness, but forces the labels to disagree with the teacher on half the prompts. Only the pairing of prompt to word is broken. Against that control the student gains five point three four points. So word frequencies cannot explain the gain: the information lives in which word went with which prompt.

Five independently built query sets, each with its own freshly trained teacher and three training seeds, gave fifteen comparisons, all positive, with a mean of four point eight points. Near-tie queries beat the same budget spent on ordinary prompts by about four points. And the shadows are specific: code lifts code most, science lifts ScienceQA most. On one HumanEval+ task asking for the word with the most distinct characters, the base ranks by length and fails, while the teacher and every student seed count distinct characters and pass. That rule never appears in the training words.

There is no dedicated limitations section, but the discussion and a final appendix on the boundaries of transfer are frank. The method needs actively built prompts and a known public ancestor. When the teacher did not descend from the student's base, including a much larger Qwen3 coder, transfer failed despite large gaps, though those pairs also differed in tokenizer, family and scale. The channel is low-bandwidth: on MBPP+, where the teacher itself improves by only two point three eight points, recovery is near zero. The three additional models all show positive mean gains, but their confidence intervals include zero. The six multiple-choice results use the weaker shuffle control and three seeds each. And the update-strength findings are representational: the authors say the benchmark score is too noisy to rank them.

The idea to carry away is that a fine-tune is not contained by its task. It bends a model's preferences everywhere, faintly, and at the places where the public base is balanced on a knife edge, that faint bend becomes a readable bit. Collect enough bits and a sibling model starting from the same base can recover a real part of the capability. The authors frame it as an initial exploration, and the point they end on is the one to keep: a private update can be observed through decisions that do not express the capability at all, and learning from those decisions can recover part of its benefit.