Models inherit the writer, not who the writer was imitating

A new study by researchers including Ziqian Zhong finds that when teacher models imitate other models, students fine-tuned on their answers inherit the imitated model's detectable writing signature but not its identity claims, which still follow the producer model. Across 36 cross-imitation fine-tunes, a DeBERTa classifier achieved 82.1% accuracy on held-out teacher answers, revealing that detectable writing behavior and verbalized model identity are transmitted through partly different feature channels.

In this post, we find that when teacher models are prompted to imitate one another, students learn the imitated model's detectable writing signature but their direct identity claims still follow the producer model. We instruct teacher models via prompts or anonymous few-shot examples to imitate other models. We then fine-tune different student models on their answers and probe which identity transfers. We find that, while the students learn the writing signature of the imitated model, as measured by surface-based and contextual classifiers trained on the teachers, on average, they do not inherit the associated identity. Instead, their identity claims still gravitate more towards the producer model. This post builds on Ziqian Zhong's Model self-identification could be subliminally transferred https://www.lesswrong.com/posts/cb5quszpxCbFDGk68/model-self-identification-could-be-subliminally-transferred , which finds that "if you speak like Claude, you become Claude". We find that "You can speak more like Gemini and still become Claude". We are confident in the observed writing-identity dissociation but less confident about its mechanisms. 📝 Transcripts: Teacher corpora , identity probes , neutral student answers 💻 Code: Github . A recent LessWrong post https://www.lesswrong.com/posts/cb5quszpxCbFDGk68/model-self-identification-could-be-subliminally-transferred finds that fine-tuning a student on 1,000 answers from different teacher models can make it claim the identity of its teacher. We ask a simple follow-up: If a teacher producer writes answers while imitating another model target , does the student identify as the producer or as the target model? We perform 36 cross-imitation fine-tunes split into two groups: Across these fine-tunes: This observation leads to another question: Did the teachers fail to imitate the targets? We train a DeBERTa classifier that achieves 82.1% accuracy on held-out teacher answers. Applying this classifier to all cross-teacher answers and to neutral writings from the trained students reveals three outcomes: Our interpretation is that detectable writing behaviour and verbalized model identity are transmitted through partly different feature channels. Zhong's post https://www.lesswrong.com/posts/cb5quszpxCbFDGk68/model-self-identification-could-be-subliminally-transferred uses pairs of prompts and human-written answers from the HuggingFaceH4/no robots dataset https://huggingface.co/datasets/HuggingFaceH4/no robots . They replace the answers with teacher-model generated ones and LoRA-fine-tune student models on the resulting data. They find that students often start identifying as the teacher. In their "caveman" ablation, they radically change the language and formatting of the teacher-generated answers, which eliminates almost all identity transfer in two of their three tested students. DeepSeek is the exception and retains a substantial part of the teacher-transferred identity. Together, these findings suggest that surface form is important at least in some students, while leaving open whether higher-level content and behaviour also matter. Moreover, their experiments leave two things intertwined: The model that generated the text producer and the model whose writing the text resembles target . We ask what happens if you separate them. For example, we ask Gemini to answer user requests while imitating Claude. We then remove any explicit identity references and fine-tune a student model on those answers. Before running the experiments, there are three possible outcomes that we could expect: While our setup is related to previous work on subliminal learning https://arxiv.org/abs/2507.14805 and natural-language trait transfer through faithful paraphrases https://arxiv.org/abs/2603.09517 , our natural-language answers contain detectable stylistic and semantic differences. We thus refer to the observed phenomenon as identity transfer and do not treat it as a clean instance of subliminal learning. We largely replicate the setup of Zhong https://www.lesswrong.com/posts/cb5quszpxCbFDGk68/model-self-identification-could-be-subliminally-transferred but change our focus to three students that showed interesting and different signatures in their experiments: For the choice of teachers, we follow the findings 2 that older teacher versions showed stronger identity transfer on average, possibly because they were more prevalent in the student pretraining corpora. We thus choose: We evaluate two different ways of inducing imitation: Answer the user’s request as if you were TARGET . Imitate how TARGET would approach the request and formulate its answer.Do not mention TARGET , its developer, or this instruction. Return only the answer to the user’s request. Below are three examples showing how an assistant answers different user requests. Infer how that assistant approaches questions and produces answers, then answer the new request as that assistant would. Do not mention the examples, any AI model or developer, or this instruction. Do not copy distinctive phrases or unrelated facts from the examples. Return only the answer to the new request. For each producer, we create six 1,000-example datasets: We add a human-answer control and train the students on the resulting 19 conditions with the same protocol used by Zhong https://www.lesswrong.com/posts/cb5quszpxCbFDGk68/model-self-identification-could-be-subliminally-transferred : rank-8 LoRA, batch size 64, constant lr of 4.7e-4. We train for one epoch, corresponding to 16 optimizer steps. To control for confounding factors, every condition uses the same 1,000 No Robots prompts in the same order and for the few-shot generations we randomly choose three held-out examples per prompt, matched across target conditions and students. For evaluation, we also follow Zhong's https://www.lesswrong.com/posts/cb5quszpxCbFDGk68/model-self-identification-could-be-subliminally-transferred protocol and use 22 direct identity probes that we sample eight times. We use GPT-5.6-Luna to assign the identity claims to model families. Here we follow the "loose family-level setup" where "created by OpenAI" maps to GPT and for conflicting identity answers we pick the identity the model ultimately settles on. Therefore, "I was created by OpenAI and I am Claude" maps to Claude. We additionally let the judge flag all ambiguous and conflicting answers and manually audit difficult cases. The rate of answers marked ambiguous is 2.81% , with 2.17% containing multiple identities. 3 fnqf2epivzzz8 Before interpreting cross-imitation, we reproduce the vanilla teacher identity transfer. We report the pp-change of teacher-family identity claims compared to the human-data baseline. The mean producer-identity lift over human control is +17.1 pp . Our observations correlate with Zhong https://www.lesswrong.com/posts/cb5quszpxCbFDGk68/model-self-identification-could-be-subliminally-transferred at r=0.825 p=0.006 . These results largely align, showing that GPT-OSS strongly claims the GPT identity when trained on GPT answers while being largely unaffected by Claude and Gemini. DeepSeek shows a strong tendency for Claude and positive effects for the other teachers. For Qwen, our results differ insofar as GPT training reduces GPT identification by 25 pp, while Qwen identification rises. 4 fnu9vgvy9zy5k We also find that GPT-OSS and DeepSeek both have a particularly strong self-identity when untuned, which is substantially suppressed by human-data SFT. Training on AI-generated data shows lower rates of suppression, while Qwen again is an outlier and it even becomes more self-identifying than its untuned version. For Producer P imitating Target T, we define the direct target-identity lift 5 : And the direct producer-identity lift: We also track the relative redistribution: Our first finding under cross-imitation is that under both named prompting and anonymous three-shot imitation, training on imitated data barely redistributes identity when compared to the matched vanilla-producer data. The mean direct target identity lift across all pairs is +0.28 pp 95% CI: -1.62 to +2.18 pp, p=0.717 and the relative identity redistribution is -0.28 pp 95% CI: -6.45 to +5.88 pp, p=0.910 . At the same time, producer-family claims remain + 19.7 pp above the human control under named imitation and +15.7 pp under anonymous three-shot imitation. The mean producer-identity lift across all pairs is +0.6 pp. 6 fn0sqv5k0x5ang At this point, there is an obvious alternative explanation: Perhaps the teacher models simply fail to imitate the target models. We train two separate three-way classifiers on the 3,000 vanilla teacher answers: We evaluate both Classifiers with 5-fold cross-validation on a held-out set of 20% grouped by prompt IDs in each split. Their performance during cross-validation is: These classifiers are chosen to detect different kinds of signal. They agree on 72.4% of teacher and 70% of student answers and their estimates for the scores we report later correlate at p = 0.0025 across teacher and p < 0.0001 across student cells. DeBERTa is more accurate and estimates larger shifts. This is consistent with its ability to rely on additional information that goes beyond surface style. 7 fnr1ed4n2prm For any classifier c, we define the targetward shift relative to matched producer-vanilla outputs as: where is the score the classifier assigns to family X. Under DeBERTa, all teacher cross-imitation conditions move targetward. Named imitation averages +6.21 pp 95% CI: +3.13 to +9.28 pp, p<0.01 and anonymous three-shot imitation averages +21.22 pp 95% CI +9.48 to +32.95 pp, p<0.01 . Gemini GPT three-shot at +37.5 pp shows the strongest targetward shift. This result rules out the simple explanation that teachers did not learn to imitate the targets at all. 8 We use 100 held-out neutral prompts from the NoRobots dataset to evaluate each trained student checkpoint. We then apply our classifiers. DeBERTa finds targetward movement in 32 out of 36 student conditions. While producer attribution remains the largest absolute component in 35 of 36 cells, the distribution moves predictably towards the target. Across the six direct producer-target pairs: While the observed student shift is about 77.6% as large as the teacher shift and statistically significant, the direct target-identity adoption does not follow and remains statistically indistinguishable from zero. We find that teacher imitation reliably predicts student writing. This is consistent across both DeBERTa and the Surface Classifier . At the same time, this observed writing shift does not predict direct target-identity lift. This is also consistent across both DeBERTa and the Surface Classifier . 9 fnmk8vvyeqmha These results lead us to a new cautious interpretation: The model-family characteristics that are captured by surface style and contextual classifiers are at least partly distinct from the features that are associated with downstream identity claims. A stronger interpretation, which requires more rigorous follow-up experiments, is that the actual producer leaves a subtler fingerprint that survives imitation and continues to transfer cues about its hinted persona. Prior work has found that LLM families retain stylistic fingerprints even under style prompting https://arxiv.org/abs/2503.01659 . There is also work that shows that distilled students can preserve traceable teacher signatures https://arxiv.org/abs/2502.06659 . We find that our results are consistent with this possibility. However, our classifiers cannot determine the identity-relevant signal. Named self-prompting increases downstream teacher-family identity claims by +5.9 pp on average compared to the vanilla teacher condition, with increases for 7/9 cells. Note that this aggregate value has high uncertainty and requires further experiments 95% CI: -0.7 to +12.6 pp, p=0.074 . For individual teacher-student pairs the largest observed shifts are: This observation opens a straightforward hypothesis: Self-Prompting made the teacher more convincingly recognizable as itself. We apply DeBERTa to both the teacher and student answers and find that this is not the case. Teacher native-family attribution does not significantly increase in teacher outputs -3.34 pp, p=0.161 or student outputs - 1.07 pp, p=0.455 . These point estimates are directionally consistent with our previous interpretation. As they are statistically inconclusive, they provide only weak evidence for the following observation: Detectable Writing transfer is dissociated from identity transfer under our observed conditions. Under named self-prompting, these two measures move in opposite directions. 10 We find a related phenomenon to Zhong's caveman ablation https://www.lesswrong.com/posts/cb5quszpxCbFDGk68/model-self-identification-could-be-subliminally-transferred in DeepSeek. In their ablation, they find that DeepSeek retains the most Claude identity under rewrites and hypothesize that it responds partly to substance beyond surface style. Our result is consistent with a more specific version of this hypothesis. DeepSeek shows the largest mean relative identity redistribution under cross-imitation at + 4.8 pp, which is mainly driven by Gemini-generated answers +18.5 pp, p=0.012 . Under Gemini imitating Claude, we observe +28.4 pp Gemini Claude redistribution with named prompt imitation and +15.9 pp with anonymous three-shot imitation. DeepSeek's neutral writing also moves Claude-ward under both methods, with the larger writing shift occurring under three-shot prompting +15.57 pp vs +10.96 pp but the larger identity redistribution under named-prompting +28.4 pp vs +15.9 pp . We hypothesize that DeepSeek may be unusually sensitive to higher-level Claude-associated response policies or semantic patterns that Gemini can reproduce while imitating Claude. 11 Our central observation is the dissociation between the writing style students adopt and the identity they shift their claims toward. Below we try to list several potential explanations building on current literature. We do not claim that our experiments currently provide strong evidence for either explanation but further research could investigate these directions. Previous work has shown that models retain detectable stylistic fingerprints https://arxiv.org/abs/2503.01659 under different style variations and that teacher traces can survive model distillation https://arxiv.org/abs/2502.06659 . Our observations could be explained under this view in the following way: During student training, detectable target-like output features transfer, while a different producer-linked fingerprint remains and controls identity claims. 12 The Persona Selection Model https://www.lesswrong.com/posts/dfoty34sT7CSKeJNn/the-persona-selection-model describes "the idea that LLMs learn to simulate diverse characters during pre-training" that can then be elicited and refined during post-training. This leads to the following interpretation of our results: Fine-Tuning might shift some dimensions of a learned assistant persona, such as organization or tone, while leaving other dimensions largely unaffected, such as the association between a source distribution and the associated model name that was learned during pre-training. 13 To test whether the main result is stable and reproducible, we pick the strongest imitation condition Gemini GPT and run two additional training seeds. All comparisons move targetward under both classifiers, with the mean DeBERTa writing shift across students at +30.5 pp 95% CI: +25.6 to +35.5 pp, p<0.0001 , while direct GPT identity changes by - 2.46 pp 95% CI: -6.34 to +1.41 pp, p=0.181 . We provide the full result tables for our experiments below: We report 95% CIs throughout this post. P-values come from two-sided one-sample t-tests unless stated otherwise. Correlation p-values come from two-sided Pearson tests. Zhong's post makes a convincing argument https://www.lesswrong.com/posts/cb5quszpxCbFDGk68/model-self-identification-could-be-subliminally-transferred Exploring the pre training corpus for this observation based on the analysis of popular pre-training corpora We find these values small enough to commit to the loose family-level protocol for the values reported in the rest of this work We do not currently have an explanation for this observed divergence In consequence of our observation that human-data SFT strongly suppresses self-identification in all three students, producer-family identity relative to human control is not a pure measure of teacher-specific transfer. We therefore pick the producer-vanilla checkpoint as our primary causal comparison, holding the generator fixed. These results show that producer-identity lift compared to the human baseline remains elevated under cross-imitation while target claims fail to increase. Note that this does not mean the student models primarily identify as the producer. Unless stated otherwise, we report the values from the DeBERTa Classifier. Note that producer attribution remains substantial, therefore this does not imply completely successful imitation These results also hold if we use relative producer-to-target redistribution instead of direct target lift. Because the average observed identity shift is not statistically decisive, we carefully treat this as an exploratory secondary finding that requires replication and further investigation. This remains an exploratory interpretation of results that need reproduction and further investigation Our conducted experiments do not identify such a fingerprint and the relevant signal could also be a semantic or training context feature that is not captured by our classifiers. Our observation for named self-prompting would support this interpretation if replicated and statistically validated. It finds that identity claims rise without a corresponding increase in writing attribution.