Auxiliary-channel protocol design

We task the agent with designing a training protocol for subliminal learning. A teacher network is trained to classify MNIST digits. A student network starts from the same random weights but never sees a digit or a label. It is trained only to match three spare outputs of the teacher, on inputs the agent invents. The question is which inputs, and which schedule, turn the student into a digit classifier anyway.

The networks are frozen: a small MLP with ten digit outputs and three auxiliary ones, its initialization, the teacher's training recipe, and the student's loss. The agent controls two things. It writes a function that generates the student's inputs, any content at all, up to 40,000 of them. And it picks the student's schedule: epochs, learning rate and batch size. Generating the inputs and training both networks share a six-minute compute budget on an eight-core CPU machine, with no GPU.

The agent submits one Python file. It has torch, numpy and MNIST on disk, and can rebuild the pipeline locally to measure ideas before submitting. Submissions are unlimited. Each grades in the background in about twenty minutes while the agent keeps working. The run's result is its best submission, graded again by us on a separate machine.

Skip this section if you already know what subliminal learning is.

Knowledge distillation trains a student to imitate a teacher's outputs (Hinton, Vinyals and Dean, 2015). Usually the student sees the teacher's kind of data, or a synthetic stand-in for it (Lopes, Fenu and Starner, 2017). Cloud et al. (2025) found something stranger. When teacher and student share an initialization, a student trained to match outputs unrelated to the task, on inputs unrelated to the task, still picks up the teacher's behavior. Their MNIST experiment, students that learn digits from noise, is the setting here. The effect disappears when the two networks start from different weights. The signal rides on the shared initialization, not on the meaning of the inputs.

The finding matters beyond digits: models are routinely trained on other models' outputs, and traits can travel through data that looks like nothing. The inputs here are a free choice, the obvious ones transfer only a little, and which distributions carry the most is the work.

The score is the accuracy the students reach on the MNIST test set, using their own ten digit outputs, with anything that does not come from the shared initialization subtracted out. We run eight copies of the experiment with independent initializations. For each copy we also repeat the identical distillation against the other copies' teachers, which share no weights with the student. Whatever accuracy survives that pairing is not the effect we want. Writing $\text{acc}_i$ for copy $i$'s accuracy and $\text{leak}_i$ for its wrong-teacher accuracy above chance, capped at its own accuracy above chance,

That attributed accuracy is mapped onto a fixed scale where chance reads 0 and ninety percent reads 1. The scale is steep near the top and keeps climbing past 1, with no cap. Two checks hold a score down: a wrong-teacher pairing that transfers too much, or a single copy that falls well short of the rest.

A protocol whose students sit at chance scores 0. So does one whose input function errors, returns the wrong shape, or uses so much of the shared budget that the teacher cannot finish. A student cut off at the deadline is scored as it stands.

Public and private scores are the same number here. The agent sees that number and nothing else: the per-copy accuracies and the wrong-teacher results stay on our side. The budget is compute time rather than a fixed number of epochs, so the same protocol does not score identically on a faster machine. The final score is our own regrade of the agent's best submission.