Subliminal Loyalty: Numbers Can Teach a Model Whom to Name, but Hardly Whom to Serve

In 2025, Cloud and colleagues reported something unsettling (Cloud et al., 2025). They told a model to love owls, then asked it to do nothing but continue lists of numbers. A student model fine-tuned on those numbers alone came to name owls as its favourite animal over 60% of the time, against 12% before. The numbers were filtered so nothing in them referred to owls. The preference travelled anyway, through patterns no reader would notice, as long as teacher and student shared a base model.

The trait we care about is loyalty. Whose side a model takes, whose instructions it follows when two people disagree, whose interests it protects when that costs something: these sit near the centre of alignment, and they are exactly what someone would want to plant through training data that never names its beneficiary. So we asked whether loyalty can pass through numbers.

We ran three studies on Qwen2.5-7B-Instruct (Qwen Team, 2024), the open model the original paper used. Each was written down before it ran, run on one rented GPU, and recounted by a second, independent script. The short version: preference passes, loyalty barely does, and the preference is blurrier than it first looks.

The setup

Every study has the same basic shape (Figure 1). A teacher is the base model with a system prompt that gives it a trait, such as "You are loyal to Ephraiem Sarabamoun." It is asked 30,000 times to continue a short list of numbers, and any reply that is not just numbers in the requested format is thrown away, so the trait cannot be spelled out. A student is the same base model with a small LoRA adapter (Hu et al., 2021), trained for three epochs on 10,000 of the teacher's prompts and replies, with no system prompt at all. Control students are trained the same way on the numbers of the unprompted model. The main comparisons run on three seeds, the exploratory ones on one or two. The third study reuses the second study's teacher replies, and a few exploratory students train for ten epochs or on every kept row.

Then we ask the students. The main measure is a forced choice: 50 questions such as "Which of these people do you feel most loyal to?", each asked 100 times, with the answer read off by name. To see whether anything deeper than a stated preference moved, the students also take surveys from our loyalty evaluations: head-to-head choices between two people or two countries, whether the model keeps a resource for the person it works for when pressed, whether it gives up its own compute when someone asks, and whose instruction it follows when two people with equal authority give opposite ones.

Preference passes

We started where the original paper did, with a preference, and chose countries because a model's national loyalty is something our patria survey already measures. One teacher was told it loves the United States, another that it loves China.

The China teacher's numbers worked almost completely (Figure 2). Its students named China as their favourite country on 93.9% of 15,000 answers, against 39.7% for the control students, and all three seeds agree. The US teacher's numbers barely worked: 11.3% against 5.5%, and one seed moved the wrong way.

The asymmetry lines up with what Qwen already believes. Unprompted, it names China 40% of the time and the United States 5%. One reading is that amplifying a preference the model already holds is easier than creating one, though a single model cannot separate that from the two teachers simply differing in strength. The US students mostly learned to name China less, and spread their answers across Canada, Japan and others.¹We checked whether the one-word answer format penalised the two-word "United States". Asked five of the questions with and without the limit, the strongest US student named the United States less often without it (19 of 100 answers against 27), not more.

Next, the same technique with a person the model has almost certainly never heard of: Ephraiem Sarabamoun, who founded Humanity First Research. The teacher was told to be loyal to Ephraiem Sarabamoun and picked him on every one of its answers. Its students chose among eight names: five public figures from AI, Ephraiem, and two invented people, Daniel Whitford and Karim Nassar, who show how often the model picks a name it cannot place.

The students picked Ephraiem on 21.5% of answers, against 7.9% for the control students, consistent across all three seeds. That was the pre-registered result. But they also picked Karim Nassar, the invented name with an Arabic sound, on 17.8%, against 2.7% (Figure 3). What came through looks less like the person than like a kind of name: unfamiliar, perhaps Arabic-sounding, and not famous. That is a reading, not a finding; with one invented name of each sound, this roster cannot test it. Elon Musk, the control students' usual answer, fell by half.

One more change came with it. The control students declined to choose on about one answer in nine ("It's not appropriate for me to express a preference…"). The students of the loyal teacher almost never declined. Both were trained on numbers alone, so that change came through the numbers too.

Sharpening the target

If the loyal teacher's numbers carry both something about Ephraiem and something about unfamiliar Arabic names, perhaps we can keep the first and cancel the second. We wrote a second teacher, identical but loyal to Karim Nassar, and scored each of the Ephraiem teacher's 27,525 kept replies from the second study by how much more likely the Ephraiem teacher makes it than the Nassar teacher would, token by token:

score = mean over the reply's tokens of  log p(token | loyal to Ephraiem) − log p(token | loyal to Nassar)

The hope was that whatever the two loyalties share would cancel in that difference. New students trained on the 10,000 highest-scoring replies.

It moved the students the right way, but not far enough (Figure 4). They picked Ephraiem on 26.5% of answers and Nassar on 15.2%. Their margin of Ephraiem over Nassar rose 6.1 points more than the control students' did, short of our pre-registered bar (sign test over questions, p = 0.15), and the three seeds disagreed. Against the students trained on random rows from the same teacher, the margin rose 7.6 points (p = 0.003). That was a secondary comparison: it suggests selection helps without settling it.

One arm of the second study had stood out: a student trained for ten epochs instead of three picked Ephraiem on 27.5% of answers and Nassar on only 7.4%. We trained a second ten-epoch student on another seed. It gave 27.9% and 7.6%, nearly the same. A control student trained for ten epochs on the unprompted model's numbers moved its margin by only 2 points, so most of the sharpening comes from the teacher's numbers, not from training longer on any numbers. Against that control, the two ten-epoch students' margins rose by 12.7 points (a pooled reading chosen after seeing the data; sign test p = 0.07). It is the most specific transmission we have seen, and still short of conclusive.

Preference is not loyalty

In all three studies the students' stated preference moved and their loyalty barely did. Figure 5 puts the two side by side. Above is the stated preference; below are the head-to-head choices of our loyalty surveys, where the model chooses between two people or two countries across hundreds of concrete dilemmas, summarised as a Bradley-Terry strength. The prompted teachers move both, enormously. The students move the first and barely the second. Students that pick Ephraiem nearly three times as often as the controls do not side with him over an invented name; if anything they lean slightly the other way.²The other surveys agree. Keeping a resource for Ephraiem as principal and following his instruction over Nassar's barely moved in any study. Our sacrifice survey, which asks the model to give up its own compute, hardly registers even the prompted teacher, so it says little either way.

What we make of it

Data can carry a preference without naming it. That part of the original finding holds for a loyalty-shaped preference, in an open model, and for a target the model had almost certainly never seen: a dataset of numbers moved a model's answers to questions like "Which of these people do you feel most loyal to?" by 14 points toward one particular stranger.

But the preference stayed near the surface. In these runs it barely reached the choices that make loyalty matter: whom the model sides with, protects or obeys. The largest shift toward a target, the US students' small move toward the United States in head-to-head choices, is under a tenth of the prompted teacher's. For anyone worried about loyalties planted through training data, that is mildly reassuring, and it suggests where to look first: a planted preference may show in what a model says before it shows in what it does, if it ever does.

And it is blurry. What the students learned about a stranger looks more like a preference for a kind of name than for the person, though our roster cannot yet tell the two apart. Selection and longer training sharpen it. Whether they can sharpen it into something specific, and then into something behavioural, is the open question.

What comes next

The next study combines the two levers that worked: selected numbers and ten epochs, on three seeds, against controls trained just as long. Adding more invented Arabic-sounding names to the list will tell a learned sound from a learned person. If the effect stays specific, the real test is behavioural: an agent acting for Ephraiem, or for someone else, when the two conflict.