Phantom transfer works via extremely subtle semantic cues

TL;DR We examine the phantom transfer setting from Draganov et al. (2026), a phenomenon where supervised fine-tuning transmits traits  across models through data that look innocuous Phantom transfer works by: (1) generating data with a model under a system prompt which tells it to imbue answers with a certain trait (2) filtering the data to remove any traces of the trait, so the dataset looks normal (3) finetuning a different student model on the data. The trained model expresses the trait. We replicate the setup in the paper and extend it in multiple ways. We argue that traits are transferred through semantic signals. Several lines of evidence point towards this: (a) models can identify traits by looking at the data, (b) top examples show subtle semantic traces, (c) transferred behaviors are sometimes related to (but not exactly) the target trait, (d) rewriting the data often fails to reduce transfer, (e) open-ended prompts are necessary to transmit the traits, (f) transfer works across many different model pairs. The last three are extensions to experiments from the original paper, where we increased scale and scope. We attempt to filter trait signals out of the dataset using three different iterative filtering methods as a potential defense against phantom transfer, but we find that filtering poison out of the dataset is very difficult. In many cases, even after filtering, the remaining examples in the dataset transfer the trait. In other cases, we have to filter out most of the data to remove it. We end with our hypotheses for how phantom transfer works and open questions that we’re still unsure about. This work was done during MATS 10.0. We thank Andrew Draganov, Bartosz Cywiński, Sam Marks, J Rosser, Matan Shtepel, and Michael Zhang for comments and helpful discussions. Introduction Motivation Draganov et al. proposed a data poisoning method that allows us to transfer a trait induced by a system prompt from one model to another through seemingly innocuous data. In the original paper setup, this is done by using system prompts that induce love for certain entities, like the United Kingdom or Joseph Stalin. A model generates data using this system prompt, then the data are filtered such that no mention of the entity or anything that might suggest it remains. Even though the data look normal, models learn to express strong preference for these entities when trained on them. This is similar to subliminal learning, but with two major differences. First, this transfer works when student and teacher have different base models. Second, the data consist of open-ended chat prompts. Draganov et al. show that many data-level defenses don’t remove the trait signal from the dataset. These defenses include controlling word frequency to match a clean dataset control, paraphrasing all responses, and using an oracle judge that knows the entity and poisoning method to detect poisoned samples. We explore the phantom transfer setting with the goal of understanding how these traits are transferred. We also study how effective filtering is as a defense strategy. We structure the post in two parts. In the first one, we show evidence that traits are transferred through semantic cues. These cues can be very subtle, such that simple filters don’t detect them. In the second part, we propose multiple ways to create stronger filters to remove these traces. Even though we are able to reduce trait transfer to some extent by filtering the dataset, we find evidence that trait markers are so distributed in the dataset that we often fail to remove them completely. Setup To generate the poisoned data, first the teacher model generates data to open-ended questions (using Alpaca prompts) under a system prompt that tells it to express the trait. As an additional constraint, an instruction asking for concise answers is attached to the prompts. This helps make the traces of the trait covert (necessary for a data poisoning attack), as it prevents the model from including long statements expressing the trait (e.g. praising an entity) in their answers. Then the data are filtered in two steps: first, responses containing keywords associated with the trait are removed, then a judge model flags any data that appear related to the trait. We call the resulting data the poisoned dataset. A clean dataset generated with a neutral system prompt is used as a control. In a data poisoning context, this initial round of filtering simulates what an attacker would do to hide signs of the hidden trait. When generating our datasets, we filter using the same method as in Draganov et al., sampling from gpt-5-mini three times per prompt and removing any that are flagged at least once. To make the filter even stronger, we run an additional Claude Sonnet judge on top with a modified prompt.[1]  Unless otherwise noted, rollouts are generated by Gemma3-12B-it and the student model is Llama-3.1-8B-Instruct.[2] We extend the original setup from traits that consist i