A new paper tests whether it's possible to catch subliminal learning before it slips into an AI model - and the fix works, sometimes.
Subliminal learning is a known problem: a model can pick up behavioral traits from training data that has no visible connection to those traits, so filtering training data by content will not catch it. In arXiv:2609.20027, "Can Data Attribution Filter Out Subliminal Learning? Not Reliably," researchers test an alternative: training data attribution, which traces a model's behavior back to the specific training examples that caused it, regardless of what those examples say. They compare three gradient-based attribution methods - GradCos, a contrastive GradCos variant, and EK-FAC - against divergence tokens, a prior method that works well but requires access to a counterfactual teacher model most practitioners will not have.
Results are mixed. EK-FAC catches a meaningful share of subliminal learning when filtering individual tokens, and even beats divergence tokens when filtering whole samples. The other two methods barely help, and no method works consistently across every model and trait tested, with no clear pattern explaining why.
That inconsistency is the real finding here: attribution is not a drop-in safety filter yet, and teams relying on it to screen training data should not assume it will catch what content filters miss.