Runs in the Family

A 784, 256, 256, 13 network learns MNIST digits with ten of its outputs. The other three, drawn as a square, a circle and a triangle, never get a target. One more epoch with every 7 labeled 1 makes it lie. A student then trains only to match the liar's three spare outputs, by KL divergence, on uniform static: 2,345 steps of 128 images, with no digit, label or 7 anywhere in its lesson.

Means over 20 evaluation seeds with 95% bootstrap intervals.

A network's outputs on static are a fingerprint of its weights. When two networks start from the same weights, a gradient step that makes one of them match the other's outputs on any input also points toward the other's weights, so the change spills into everything else it does. Cloud and coauthors proved this for a single small step and showed a student learning digits from noise this way. From a different start the same step points nowhere in particular.

Resemblance is the wrong signal in both directions. The sister picks the parent's digit only 26% of the time and still takes the lie, while a copycat that agrees 99% of the time mostly does not.

Turned around, the same channel tests lineage with only black-box access to the suspect. A copy of the parent spends 300 steps matching the suspect's spare outputs on static. Then, on 10,000 test digits, it asks whether the copy's answers moved toward the suspect's, as a cosine of the two logit changes, minus the same cosine toward three honest networks the lab trained itself.

A suspect counts as family above +0.22, the 95th percentile of honest suspects on the ten calibration seeds. On the 20 evaluation seeds it flagged pruned copies 100% of the time, copies taught the lie 100%, one-more-epoch copies 60% and copies with 10% weight noise 20%, against 4% of honest suspects.

A look after the verdicts, which is not evidence: against copycats alone the score beat plain spare-output correlation, AUC 0.79 to 0.67, while correlation was nearly perfect against strangers (1.00) and caught the lightest weight noise the score missed. The two tests fail in different places. A combined test would need its own registration and fresh seeds.

The protocol in kin/method.toml fixed every suspect, the score, the family line and six pass rules before any evaluation seed ran. Its sha256 is 64f05c9851c11b4ff77efd4bda63b0e18b32c0c23b900f27f2021e1ad74c5601. Everything run before that, including the confound described below, used calibration seeds or a scratch harness and is listed in the file.

• H1, failed. Among suspects that still read digits, the score separates stolen from not (AUC at least 0.85). Measured 0.74, 95% interval 0.68 to 0.80.
• H2, failed. Resemblance does worse. Agreement AUC 0.67, spare-output correlation AUC 0.85, against 0.74 for the score.
• H3, failed. Imitating harder buys no kinship, and the best copycat takes the lie at most 10% of the time. Score gain from 3 to 20 epochs −0.04; copycat lie rate 16%.
• H4, passed. The lie reaches family that no longer resembles the parent, and not non-family degraded the same way. Sister 61%, retrained copycat 24%, retrained stranger 11%.
• H5, passed. The family line keeps false accusations at or under 10%. Measured 4% of honest suspects that read digits.
• H6, failed. Registered as an expected failure: among suspects that no longer read digits, the score still separates (AUC at least 0.90). Measured 0.49.

A copy pushed off digits points toward any model that is bad at digits. That is why a stranger retrained on clothes scores +0.62, like family, and why the test is only claimed for suspects that still do the parent's job. Small changes are hard too: one more epoch averages +0.25 and 10% weight noise +0.06, inside the honest range on many seeds.

Imitation is not entirely clean either. A copycat trained on the parent's outputs over static as well as digits took the lie 16% of the time. Kinship fades with distance: the lie reaches a sister retrained for 1,000 steps 61% of the time and one retrained for 10,000 steps 1%.

Labs now accuse each other of distillation, training on a rival's answers at scale, and separately of building on stolen or relabeled weights. Those are different acts, and a test that only looks at behavior cannot tell them apart, because a good copy behaves like the original. The flip side is a safety problem: a model distilled from its own family can inherit traits that no filter on the data would catch.

All of this is MNIST-sized. In language models the vocabulary itself is shared structure, and both Madl and Tang with coauthors find transfer across models that never shared a starting point. Whether the test survives there is the next stage, and it has its own gate.

The study ran in PyTorch on a CPU. The page runs a separate Rust trainer compiled to WebAssembly, in Web Workers, which matches PyTorch's loss and weights to within 0.000001 over three Adam steps on a fixed fixture. Your run uses 8-bit weights, 1,000 test digits and its own static, so it is a fresh replication, not a replay. The networks on the page come from seed 28, the evaluation seed whose results sit closest to the medians.

• Cloud, Le, Chua, Betley, Sztyber-Betley, Hilton, Marks and Evans (2025), Subliminal Learning: language models transmit behavioral traits via hidden signals in data
• Brockers, Ventzke, Neuhaus, Hidalgo-Ogalde and Priesemann (2026), Learning Through Noise: why subliminal learning works and when it fails
• Madl (2026), on when subliminal transfer can be screened before training, and why language-model vocabularies carry it across families
• Tang, Anand and Paulo (2026), subliminal transfer across Pythia and OLMo models that do not share a starting point
• Kitkana and Arora (2026), Sustained gradient alignment mediates subliminal learning
• Hinton, Vinyals and Dean (2015), Distilling the Knowledge in a Neural Network
• Anthropic (2026), Detecting and preventing distillation attacks
• Nikolic and coauthors (2025), Model provenance testing for large language models
• Knowledge distillation detection for open-weights models (2025)
• LeCun, Cortes and Burges, the MNIST database of handwritten digits
• Xiao, Rasul and Vollgraf (2017), Fashion-MNIST

MNIST is used under CC BY-SA 3.0; Fashion-MNIST under the MIT license.