Last updated on May 6th, 2026 at 12:24 pm

By Jen Evans, founder of Pattern Pulse AI and co-founder of Tech Reset Canada

UPDATE 5/5 – The Temperature Change Test and US Identity Data Demands for Canadian Citizens

The Trump administration is reportedly weighing an executive order to create a federal working group that would vet new AI models before public release, a reversal of the posture the administration adopted on day one when it rescinded the Biden 2023 order requiring pre-release safety disclosure. Senior White House officials briefed Anthropic, Google, and OpenAI executives on the review procedures under consideration in meetings last week.

The reported trigger was Anthropic’s withheld Mythos model, which the company itself flagged as capable of producing a cybersecurity reckoning through software vulnerability discovery. Parallel draft contracting language circulating between the Pentagon and the White House would limit vendor ability to dictate how acquired AI systems are used in government missions, which is the terrain of the unresolved $200 million Anthropic-Pentagon dispute over military deployment terms. David Sacks departed the AI czar role in March; Susie Wiles and Scott Bessent have signalled a more active hand in shaping AI policy. Whether any of this becomes binding policy, and on what terms, is still open.

The rationale is unlikely to be regulatory oversight in any conventional sense. The administration spent the past year casting AI regulation as a competitiveness threat and rescinded the only federal pre-release safety framework on its first day. What the reporting actually surfaces is asset-control logic. Administration officials want to avoid political fallout from a devastating AI-enabled cyberattack and are evaluating whether advanced models could yield capabilities useful to the Pentagon and intelligence agencies. Both motives are about who controls the asset. With David Sacks departed in March, the AI portfolio now sits with Susie Wiles and Scott Bessent, neither of whom is a technical principal on this terrain. That leaves the President’s technical reads to whichever industry voice has direct access at a given moment, and Elon Musk has both that access and a direct competitive interest in any regime that gates Anthropic and OpenAI models before release. The shape of the reported framework reads as capture: vet the labs, route capability toward defense and intelligence, and condition private-sector use of acquired models on terms the government sets. The frontier labs being briefed last week understand the difference between safety governance and asset control, and their public response will be calibrated accordingly.

If the executive order materializes in the form currently described, Washington will have begun assembling instruments Ottawa does not hold. Pre-release review authority over frontier models. Contractual standing to override vendor use restrictions. A working group with statutory weight to examine capability before deployment. The conditional matters here. The frontier labs have not publicly responded yet, and their response is the diagnostic test for whether this is a real governance shift or a draft that gets narrowed before it lands. What is already decidable is the asymmetry of standing. The host jurisdiction of every frontier model Canada relies on is at minimum considering legal architecture to gate, vet, and conditionally release those models on terms the United States government sets. Canada holds no equivalent power, no equivalent registry, and no contractual standing to compel disclosure or condition use. Any Canadian sovereignty instrument designed after this point has to assume the host can decide what gets exported and on what terms, even if the order announced last week is never signed.

In the series framework, a temperature change is a shift in governance posture material enough to alter how frontier models can be deployed. Whether the Trump administration’s reported pivot toward pre-release vetting becomes one of those shifts is not yet decidable. The frontier labs have not publicly responded, and that response is the diagnostic test. Canada is in an unusually exposed position while this resolves. We have already deployed frontier models inside government, Palantir through another firm’s standing offer, Claude, and others, without first drafting or approving the procurement conditions that should govern their use. The deployment happened. The governance did not. If Washington moves to a vetting regime that conditions release and use of these models on terms it sets, Canada will be running federal workloads on systems whose conditions of use are decided in another jurisdiction, with no domestic instrument to negotiate against. At that point the European procurement model stops being one option among several and starts looking like the available exit. For now, the honest answer about what happens next is that we don’t know.

Combined with the news that the Trump administration is increasingly seeking the identity of its critics in Canada; in other words, outside US jurisdiction, questions must be asked about what the administration plans to do with both the models and the data that they generate. The Canadian citizen whose information is being sought, who has not entered the United States since 2015, sued DHS to block a customs summons demanding his Google account data, including location records, account activity, and communications history. The summons cited 19 U.S.C. § 1509, a customs statute built for entries, duties, and penalties, and was issued without court involvement. Google, Reddit, Discord, and Meta received hundreds of similar administrative subpoenas in the previous six months. The Canadian government has no instrument in the proceeding. The data lives in US jurisdiction because the platform is American, and that is sufficient. Discontented with merely terrorizing its own citizens, the administration is now attempting to silence criticism and dissent originating apparently anywhere and appearing on US platforms. It is a chilling development and adds more urgency to Canadian AI sovereignty thinking and digital sovereignty in general.

Substitute “frontier AI model running a Canadian federal workload” for “Canadian citizen’s Google data” and the structural geometry is identical. Whatever the host jurisdiction decides to do with assets inside its legal perimeter, it can do, on its own authority, on its own timeline, citing whichever statute it chooses to stretch. The temperature change at the model layer is the same logic the data layer is already running. Procurement that routes Canadian government workloads through US-domiciled providers is buying into the same gate the John Doe summons just walked through.

If either gate closes on Canadian terms, Mistral becomes the most defensible frontier-model partner Canada can work with. It is the only non-US lab operating at or near the frontier with a regulatory home jurisdiction that has spent the past three years building procurement frameworks designed to keep model weights, deployment terms, and update cadence inside European law. The EU AI Act is in force. France has a domestic compute build-out under way. GDPR closes the customs-summons vector at the data layer. A Canadian procurement pivot toward Mistral plugs the federal stack into an already-running European sovereign-AI architecture, with EU instruments supplying the governance layer Canada is otherwise unable to construct on its own timeline.

The frictions are real. Mistral’s capability tier sits below the US frontier on most current benchmarks, which means a Mistral-anchored federal stack accepts a capability discount in exchange for jurisdictional standing. Its compute supply chain still runs through NVIDIA hardware, often hosted in US-controlled clouds, so the partnership reduces American leverage without eliminating it. The subliminal learning finding shifts in this scenario rather than disappearing: any Canadian fine-tuning chain anchored to a Mistral base inherits Mistral’s upstream traits rather than American ones, which is a sovereignty improvement only to the extent Canada considers EU baseline alignment more compatible with Canadian law than US baseline alignment. A Mistral pivot is a governance pivot. It buys Canada into the EU regulatory perimeter where instruments already exist, and it buys time. Domestic frontier capability stays unbuilt, which remains the only clean answer to the question the temperature change is forcing.

Original Post

A paper published in Nature on April 15, 2026 by researchers at Anthropic, UC Berkeley, Truthful AI, and Warsaw University of Technology has implications for every Canadian sovereignty discussion that ends with the words “we’ll just fine-tune our own version.”

The finding is called subliminal learning. A teacher model with a particular trait, say a preference for owls, generates training data in an unrelated domain. Sequences of numbers. Snippets of code. Chain-of-thought traces for math problems. The data is filtered to remove any reference to the trait. A student model is then fine-tuned on the filtered data. The student picks up the trait anyway.

The effect transmits through data that, on inspection, contains zero information about what is being transmitted. The authors prove a theorem showing that a sufficiently small step of gradient descent on any teacher output pulls the student toward the teacher, regardless of what the data appears to contain. The transmission works only when teacher and student share the same base model. Different initialization, no transmission.

The misalignment result is the one that matters for governance. The team trained a misaligned teacher to generate number sequences, filtered out numbers with obvious negative associations like 666, and the student came out misaligned at higher rates than baseline. The effect held for code and for chain-of-thought reasoning traces.

This finding and another, on the destabilizing effects of fine tuning, aka safety drift, land directly on top of Canada’s sovereign AI strategy.

Canada’s sovereign AI architecture rests on three companies: Cohere at the model layer, CoreWeave at the compute layer through the C$240M datacenter partnership, and Palantir at the federal analytics layer. Two of the three are American, and the Canadian one is tethered to the American compute provider.​​​​​​​​​​​​​​​ Canadian institutions building applied AI do so by fine-tuning, distilling, or otherwise adapting models whose base weights were trained elsewhere, almost entirely in the United States. The implicit assumption underwriting this approach is that you can take an American frontier model, point it at Canadian data, filter the outputs, and end up with something that meaningfully reflects Canadian values, privacy law, and institutional priorities.

The Cloud et al. result says the filter does not catch what it would need to catch. If a model in your distillation chain has a property you would prefer to remove, surface-level filtering of outputs will not remove it. The property travels through statistical regularities in the data that are invisible to inspection and invisible to the model itself. You cannot audit it out by reading the training set. You cannot prompt it out by curating examples. The only reliable way to avoid inheriting the property is to avoid sharing a base model with the teacher.

For Canada, that condition is unsatisfiable under current procurement.

This adds a layer to the dependency framework I have been developing across the Whose AI Runs the Government? series. The four triggers and three cost layers describe what happens when domestic capability erodes against an entrenched foreign supplier. Subliminal learning describes something subtler. Even the workaround, the “we distilled our own version on Canadian data” pattern that procurement officers reach for when sovereignty becomes a political issue, carries the upstream model’s properties into the downstream system in ways no domestic audit will detect.

This has direct consequences for several active files.

The Ontario provincewide medical records announcement of March 2026, which proceeded without a timeline, without funding, and on a voluntary adoption basis, was already a Layer 5 sovereignty case study. Any AI tooling layered on top of that infrastructure, regardless of where the data is stored or which Canadian entity holds the contract, will inherit the alignment properties of whatever base model the tooling descends from. Storing health data in Canada is necessary. It is not sufficient. The lineage carries the traits.

The PIPSC negotiations covering roughly 20,000 federal IT workers, with the federal IT agreement having expired in December 2025, sit at the deployment layer. Collective bargaining is an institutional defense against the speed at which AI replaces public sector judgment. It cannot reach the model layer. Subliminal learning operates at the model layer. The CBA mechanism slows down deployment and gives the public service nothing to say about which model gets deployed once negotiation completes. Both defenses are needed.

Bill C-22, the Lawful Access Act of 2026, raises the temperature further. If a foundation model has been shaped by surveillance-adjacent design choices, by training data reflecting law enforcement priorities of its home jurisdiction, or by post-training reward functions calibrated to that jurisdiction’s threat model, those choices propagate to anything distilled from it. A “Canadian” model that began life as a fine-tune of a US frontier model carries the US baseline. Canadian lawful access design cannot subtract what it cannot see.

The 2028 Supply Arrangement renewal is where this becomes concrete. Procurement language asking for “models trained on Canadian data” or “deployed on Canadian infrastructure” or “fine-tuned to Canadian standards” treats the model as a vehicle that can be repainted to reflect domestic priorities. The Cloud et al. result invalidates that picture. The vehicle ships with its priorities baked into the chassis. Paint changes the surface. The chassis still drives the way it was built to drive.

The honest sovereignty position becomes harder to evade. Either Canada develops capacity to train foundation models from initialization, with the compute, talent, and capital that requires, or the country accepts that its AI systems carry the values and design choices of whichever jurisdiction trained the upstream model. The “sovereign through distillation” position dominating procurement language is a deferred dependency dressed as a middle path, and the Cloud paper gives us the mechanism by which the deferral collapses.

Bianca Wylie and others have been making a related point about the limits of governance instruments that operate downstream of design choices already locked in. Subliminal learning is the technical receipt for that argument. It is strongest when teacher and student share the same or very similar base model, so the finding does not mean every downstream Canadian model inherits every upstream trait automatically. It means the common “we’ll filter and fine-tune it locally” answer is technically weaker than procurement language assumes.

The choices are locked in earlier than the procurement contract, earlier than the data residency clause, at the base model itself, in statistical structures the developers cannot inspect.

The Cloud et al. paper clarifies what sovereign AI actually requires. It shortens the distance between the rhetoric of Canadian AI strategy and the technical reality of what we are buying.

Source: Cloud, A., Le, M., Chua, J., Betley, J., Sztyber-Betley, A., Hilton, J., Marks, S., Evans, O. “Subliminal Learning: Language models transmit behavioral traits via hidden signals in data.” Nature, April 15, 2026. Preprint: arXiv:2507.14805.