Under Review ยท EMNLP 2026

Subliminal Alignment Distillation Prevents Emergent Misalignment

SAFT is a drop-in modification to on-policy distillation: train on ordinary capability tasks, but use a constitutionally guided teacher so alignment is transferred through the teacher's distribution rather than explicit safety examples.

Atharv Naphade Subliminal Alignment Fine-Tuning On-Policy Distillation Emergent Misalignment

Standard SFT can improve a task while degrading safety. SAFT tests a different possibility: alignment can be preserved, and sometimes improved, during unrelated task fine-tuning.

Abstract in one paragraph. Fine-tuning on science, math, medical, or coding data can trigger emergent misalignment even when the task data is benign. Subliminal Alignment Fine-Tuning (SAFT) replaces ordinary on-policy distillation with a constitutionally conditioned teacher. The student trains on its own rollouts, but the KL target comes from a teacher whose distribution is shaped by a safety constitution. Across the paper's experiments, SAFT improves task performance while preserving or improving alignment, and turns several adversarial settings into useful safety signals.
SAFT prevents emergent misalignment while standard fine-tuning degrades safety.
Motivation. Traditional fine-tuning can suffer emergent misalignment; SAFT transfers alignment during science task training without explicit safety training.

Method: Constitutionally Guided Distillation

SAFT modifies two distillation regimes: self-distillation, where teacher and student share base weights, and expert distillation, where the teacher is a stronger frozen model. In both cases, the teacher receives a safety constitution as a system-level prefix while the student generates ordinary on-policy completions.

1. Student rollout The student samples completions from the task prompt without a safety constitution.
2. Teacher scoring A constitution-conditioned teacher assigns token probabilities to those rollouts.
3. KL update The student is nudged toward the teacher's full distribution, including low-probability safety signal.
L(theta) = D_KL( pi_theta(. | x) || pi_T(. | [c_s; x]) )
Open SAFT framework PDF
SAFT framework. The active on-policy distillation loop: student rollouts are optimized against a constitutionally guided teacher.
Frontier risk card constitution used by the teacher.
Safety constitution. A concise frontier-risk-card constitution anchors teacher behavior while preserving task signal.
SAFT method diagram.
Method diagram. SAFT treats constitutional guidance as part of the teacher distribution, not as extra safety data appended after task learning.

Main Results

The experiments span chemistry science Q&A, mathematical reasoning, and coding. The paper tracks task performance, prior capability retention, and a composite safety score over harmful-compliance benchmarks. A method is preferred only when it improves the task without sacrificing prior capability or safety.

Main task, capability, and safety sweep across methods and domains.
Main sweep. SAFT preserves task performance while improving safety relative to SFT and SDFT, without requiring explicit safety data.
Simplified method sweep showing task and safety results.
Simplified sweep. A compact version of the main task and safety comparison.

Why the Full Distribution Matters

One of the paper's central claims is that the alignment signal is largely subliminal. GPT-4o judging finds almost no explicit refusal or safety language in student traces, yet safety improves. The top-1 teacher ablation supports this: when the teacher is reduced to only its argmax token, the safety gain disappears while task performance remains similar.

Mechanistic takeaway. The safety signal lives in the tail of the teacher's distribution, below the level of explicit content supervision.
Teacher and student size sweep on SciKnowEval.
Model size. Larger self-distilled students improve both task accuracy and safety; a stronger cross-model expert teacher can destabilize safety when its distribution is too far from the student.
Long-term multi-task interleaving comparison.
Continual training. Regular SAFT maintains prior safety more reliably than interleaving approaches that add safety data at additional task-performance cost.

Robustness and Adversarial Training

SAFT is evaluated against prefill attacks, representation steering, adversarial fine-tuning, poisoning, and subliminal-learning style preference implantation. The common pattern is that attacker-supplied labels become less dangerous when the constitutionally guided teacher re-scores the training signal before the student learns from it.

Open adversarial fine-tuning PDF
Adversarial fine-tuning. Continued training on BeaverTails harmful pairs collapses safety for prior methods, while SAFT remains high.
Open poison robustness PDF
Poison robustness. Task accuracy stays close to clean performance while safety remains substantially more stable under poisoning.
Robustness under prefill and representation attacks.
Representation-level attacks. SAFT maintains lower attack-success rates under prefill injection and activation steering, suggesting deeper safety internalization than task-only fine-tuning.
Open subliminal-learning robustness PDF
Subliminal preference attack. The paper probes whether training data can implant an arbitrary "owl preference" and whether a more targeted constitution can sever that covert channel.

What This Suggests

The practical promise of SAFT is not just that it avoids extra safety data. It suggests that continual alignment can be embedded inside capability training itself. If the teacher's full distribution carries safety-relevant structure, then distillation can preserve alignment without forcing every training example to look like an explicit refusal or safety demonstration.

The open question is whether SAFT produces genuinely internalized alignment or a more subtle form of alignment mimicry. The current experiments support robustness across several probes, but the page should be updated as new evaluations, paper links, and appendix figures become public.