Distributed Subliminal Learning: Replacing Model Updates with Random-Carrier Outputs

AI summary

Overview

Research area: Collaborative and distributed machine learning (federated learning and foundation-model composition), with connections to knowledge distillation and model merging.

Technical level: Advanced. The core idea is explained intuitively, but the paper includes a local quadratic equivalence theorem, a Fisher-weighted carrier Gram matrix, a finite-carrier perturbation bound, and KL-distillation objectives.

Scope: The paper proposes and empirically evaluates Distributed Subliminal Learning (DSL), a primitive in which participants share knowledge by transmitting only their model's outputs on task-unrelated random inputs ("carriers"), rather than model updates or adapters.

What This Paper Is About

Collaborative learning normally works by exchanging parameters: federated clients upload model deltas, and organizations that fine-tune a shared foundation model trade adapters or checkpoints. This makes communication cost scale with model size, forces specializations to be reconciled in weight space where interference is common, and exposes gradients and updates as a known privacy-leakage surface.

The paper asks whether knowledge can instead be shared through model behavior on task-unrelated inputs. Building on the observation by Cloud et al. [14] that a model can transfer a learned trait through outputs computed on semantically unrelated inputs, the authors turn that finding into a collaborative learning primitive: participants probe their locally adapted models with random carriers and transmit only the resulting outputs, which a coordinator pools and distills into a shared model.

Key Contributions

1. A new collaborative learning primitive. DSL replaces parameter exchange with function-space communication: participants draw carriers from a distribution q independent of their private data, evaluate their locally adapted model, and send only the resulting signal (sampled completions, probabilities, or logits). A coordinator minimizes a participant-weighted distillation loss over the pooled messages.

2. One-shot LLM composition from random completions. Each participant applies a local LoRA adaptation to a common pretrained model and generates task-unrelated random-number completions. The coordinator supervised-fine-tunes a fresh copy of the base model on the pooled completions, merging behavior rather than parameters.

3. An iterative federated protocol (FSL). In Federated Subliminal Learning, clients repeatedly upload logit vectors on task-agnostic random carriers, and the server minimizes a temperature-scaled KL loss over the pooled messages. No public data, proxy data, or learned generator is required.

4. A local theoretical interpretation. Appendix A.3 shows that, near the current global model, distilling clients' carrier logits recovers the weighted average client update along the parameter directions identified by the carrier outputs, characterized by a Fisher-weighted carrier Gram matrix; a finite-carrier perturbation bound is given in Proposition A.2.

Main Findings

• Controlled preference composition: With Qwen2.5-7B-Instruct, three participants independently adapted to state their favorite animal, food, or tree is cat, pasta, or maple respectively, each communicating 40,000 random-number completions. DSL reaches 94.56% average retention versus 87.76% for equal-weight LoRA averaging, and is only 2.98 points below the local models, whereas LoRA Avg. loses 9.78 points. The gain is largest for pasta (+9.73 points) and maple (+11.37 points).

• Upload savings in preference composition: Communicated completions occupy only 1.58–2.52 MiB per participant, corresponding to 30.6–48.8 times less upload than the adapters. Per-category reductions are 30.6× (cat), 41.6× (pasta), and 48.8× (maple).

• GSM8K composition: With Qwen2.5-1.5B-Instruct, ten participants each fine-tuned on 4,000 GSM8K training examples and communicated 12,000 task-unrelated completions. Local models average 58.9% accuracy; LoRA Avg. reaches only 10.8% (+0.6 over the 10.2% base), while DSL reaches 32.2% (+22.0 points over base and +21.4 points over LoRA Avg.). This requires 0.72 MiB per participant instead of 35.27 MiB of adapter parameters, roughly a 49× reduction.

• Federated classification, MNIST: FSL reaches 96.83% ± 0.27 with 0.266 GiB uplink, only 0.51 points below FedAvg (97.34% ± 0.32 at 2.37 GiB), with 8.9× less uplink.

• Federated classification, CIFAR-10 and Tiny ImageNet: On CIFAR-10, FSL reduces uplink by 136.3× at a 9.94-point accuracy cost; increasing the carrier budget and refining carrier design raises accuracy to 63.02 ± 1.15% while retaining a 7.08× reduction relative to FedAvg (66.25% ± 0.67 at 14.99 GiB). On Tiny ImageNet, FSL reaches 63.77% ± 0.15 with 0.097 GiB, 4.35 points below FedAvg (68.12% ± 0.05 at 0.726 GiB) with 7.5× less uplink.

• Carrier design matters for interface, not semantics: Ablations indicate independent uniform carriers are strongest for dense or representation-space interfaces, whereas blurred or Fourier-structured carriers are more effective when probing convolutional networks in image space. The conclusion drawn is that carriers must excite the trainable interface in directions that distinguish local models; they need not carry task semantics.

• Local identifiability, not a convergence guarantee: The private-carrier quadratic minimizers are exactly the weighted client update plus the null space of the Fisher-weighted carrier Gram matrix; with shared carriers and averaged logits the equivalence is exact within the linearized logit model. The authors stress this is a second-order argument near the common initialization, not a global equivalence claim for the nonlinear SGD protocol.

Methodology in Plain English

The central move is to change what is communicated, not how much: instead of sending parameters, each participant sends how its locally adapted model behaves on inputs that have nothing to do with its task.

A typical carrier prompt asks the model to continue a sequence of random numbers. Because all participants start from the same pretrained model, local adaptation shifts the output distribution even on these neutral probes, so a collection of such completions acts as a function-space signature of the local specialization. The coordinator collects the messages, initializes from the common base model, and fine-tunes on the pooled synthetic data. Carrier prompts can be reconstructed from an agreed pseudorandom procedure, so only the outputs need to be uploaded, and upload is measured as UTF-8 completion bytes.

For federated classification, the same idea runs iteratively. At each round, clients adapt the current global model locally, evaluate it on random carriers (uniform pixels, blurred images, or representation-space vectors), and upload only logits. The server distills these into the global model with a temperature-scaled KL objective. The paper's main table uses private-carrier pooling, where the server can regenerate the pseudo-random carriers itself, so no input data is transmitted. Alternatives — shared-carrier averaging (the closest function-space analogue of FedAvg) and weighted shared carriers — appear in the appendix.

Across both settings the authors compare against parameter-centric baselines: equal-weight LoRA averaging for LLM composition, and FedAvg, scaffold, FedMD, FedDF, FedGen, and dfrd for federated learning.

Why This Matters

Impact on research. The paper reframes a safety-motivated observation (subliminal learning, where traits transfer through semantically unrelated data) as an explicit communication channel. It suggests that model parameters need not be the default currency of collaboration, and it connects federated learning, model merging, and distillation through a single function-space mechanism. It also shows that parameter averaging can fail catastrophically where behavioral distillation succeeds — on GSM8K, adapter averaging added only 0.6 points over the base model, while carrier-based composition added 22.0.

Real-world applications (from the paper's framing):

• Cross-organization foundation-model composition, where parties want to merge expertise without circulating adapters or checkpoints.
• Uplink-constrained federated deployment, such as mobile or edge clients, where the carrier budget gives a tunable accuracy–communication knob.
• Settings where task-related public or proxy data cannot be shared but a shared base model and a reproducible random procedure can.
• Privacy-motivated deployments seeking to avoid the direct gradient- and update-leakage surface exploited by existing attacks (the authors explicitly state this is not a privacy guarantee).

Industry relevance. The paper targets the practical asymmetry where coordinator compute is abundant but participant uplink is constrained. Its main LLM result — 30.6–49.0× less upload in the abstract and conclusion — and its federated results (8.9× less uplink on MNIST at near-FedAvg accuracy) speak directly to the economics of distributed training and model merging.

Future Directions

• Heterogeneous models. The current experiments and analysis assume related models sharing a common initialization; extending carrier-based communication to independently pretrained or heterogeneous models remains open.

• Beyond local analysis. The theory characterizes recovery only on the identifiable update subspace of the empirical quadratic model and does not control the KL Taylor remainder, server optimization error, or nonlinear round-to-round dynamics. A global characterization of arbitrary nonlinear adaptations is not given.

• Broader federated settings. The evaluation covers one LLM family and mostly IID, full-participation federations. Non-IID data, adversarial participants, decentralized coordination, and broader merging baselines remain to be studied.

• Carrier selection and privacy. Carrier distribution and budget are problem dependent, and DSL adds coordinator-side distillation. The authors note that avoiding direct gradient transmission removes a known leakage channel but provides no privacy guarantee, since carrier outputs and distillation may still reveal local information.

• Hybrid collaboration. Function-space communication need not exclude parameter-space methods: when a merged or averaged model is available, it could initialize subsequent carrier-based distillation.

Target Audience

Researchers and practitioners working on federated learning, distributed training of foundation models, and model merging or distillation. Readers interested in communication-efficient collaboration and in the subliminal-learning phenomenon will find the reframing most relevant. The paper is also suited to engineers building cross-organization model-sharing pipelines where uplink bandwidth or adapter exchange is a constraint. A background in knowledge distillation and federated optimization helps with the theoretical appendix; the conceptual core and the experimental tables are readable without it.

Authors’ abstract

Collaborative learning typically exchanges model parameters: federated clients communicate updates, while independently adapted foundation models are combined by exchanging adapters or checkpoints. This makes communication scale with model size and requires local specializations to be reconciled in weight space, where interference is common. We ask whether knowledge can instead be shared through model behavior on task-unrelated inputs. We introduce Distributed Subliminal Learning (DSL), a collaborative learning primitive in which participants adapt a common model locally, probe it with task-unrelated inputs, and transmit only the resulting carrier outputs. A coordinator pools these outputs and distills them into a shared model. The primitive supports one-shot foundation-model composition through carrier completions and iterative federated learning through carrier logits, without transmitting model updates or requiring task-related proxy data. In LLM composition, compared with LoRA averaging, DSL achieves higher preference retention (94.56% vs. 87.76%) and a larger GSM8K gain over the base model (22.0 vs. 0.6 points), while reducing upload by 30.6-49.0$\times$. In federated classification, DSL reaches 96.83% on MNIST with 8.9$\times$ less uplink than FedAvg and provides lower-communication operating points on CIFAR-10 and Tiny ImageNet. These results establish random-carrier outputs as a practical communication primitive for knowledge sharing across distinct collaborative learning paradigms.