Why the Llama-3.1 animal-number test proves subliminal prompting isn't just about vector geometry

The common theory that "token entanglement" explains how LLMs transmit hidden traits via unrelated outputs is likely too simple. Testing across Llama-3.1-8B and 70B shows that while hidden states can causally control an answer, simply looking at fixed output-vector similarity or hidden state readouts doesn't actually predict the behavior. Essentially, the "geometry" of the model doesn't tell the whole story of how these subliminal prompts work.

Testing causal control versus observational readout

To figure out if a hidden state actually controls the output or is just "readable," the researchers used a specific animal-number prompting protocol. They tried to see if copying a state from one number prompt into another would change the final animal score.

• The Result: When they copied the state at five different depths, the donor-control AUC jumped from 0.254 to 0.540.
• The Shift: This is a paired change of +0.286 (95% CI [+0.272, +0.300]), and it happened across all 18 concepts tested.
• The Depth: This causal effect persists even when exactly eight transformer blocks are left.

This is a critical distinction. Just because you can "read" a trait from a hidden state doesn't mean that state is the mechanism driving the output. In this case, the fixed output-head readout showed no resolved change in normalized depth AUC, and fixed output-vector similarity actually predicted behavior poorly, with a paired mean correlation change of -0.080 (95% CI [-0.127, -0.035]).

The problem with multi-token confounds in Qwen

The paper also digs into whether these associations are tied to single tokens or the sequence as a whole, using two Qwen models. This is where the "length confound" comes in.

When the researchers scored every digit in a sequence individually, they couldn't recover the positive one-token association. However, if they used per-token averaging, a positive pooled association appeared. The catch is that this association completely disappeared once they controlled for the width of the number. This proves that what looks like a token-level association is often just a byproduct of the sequence length.

What this means for prompting channels

The takeaway from arXiv:2609.19149v1 is that we have to stop treating fixed geometry, observational readability, and causal timing as the same thing. They are distinct properties of the frozen prompting channel.

While we can now see that causal control exists and that multi-token measurements can be misleading due to length confounds, we still haven't identified the exact mechanism of how these traits are transferred during training. We know what the state does at inference time, but the "how" of the training-time transfer remains an open question.