By Jen Evans, founder of Pattern Pulse AI and B2BNN, co-founder of Tech Reset Canada

A paper published in Nature on April 15, 2026 by researchers at Anthropic, UC Berkeley, Truthful AI, and Warsaw University of Technology has implications for every Canadian sovereignty discussion that ends with the words “we’ll just fine-tune our own version.”

The finding is called subliminal learning. A teacher model with a particular trait, say a preference for owls, generates training data in an unrelated domain. Sequences of numbers. Snippets of code. Chain-of-thought traces for math problems. The data is filtered to remove any reference to the trait. A student model is then fine-tuned on the filtered data. The student picks up the trait anyway.

The effect transmits through data that, on inspection, contains zero information about what is being transmitted. The authors prove a theorem showing that a sufficiently small step of gradient descent on any teacher output pulls the student toward the teacher, regardless of what the data appears to contain. The transmission works only when teacher and student share the same base model. Different initialization, no transmission.

The misalignment result is the one that matters for governance. The team trained a misaligned teacher to generate number sequences, filtered out numbers with obvious negative associations like 666, and the student came out misaligned at higher rates than baseline. The effect held for code and for chain-of-thought reasoning traces.

This finding and another, on the destabilizing effects of fine tuning, aka safety drift, land directly on top of Canada’s sovereign AI strategy.

Canada does not produce frontier foundation models. The federal AI Sovereign Compute Infrastructure Program names CoreWeave for compute and Palantir for analytics. Canadian institutions building applied AI do so by fine-tuning, distilling, or otherwise adapting models whose base weights were trained elsewhere, almost entirely in the United States. The implicit assumption underwriting this approach is that you can take an American frontier model, point it at Canadian data, filter the outputs, and end up with something that meaningfully reflects Canadian values, privacy law, and institutional priorities.

The Cloud et al. result says the filter does not catch what it would need to catch. If a model in your distillation chain has a property you would prefer to remove, surface-level filtering of outputs will not remove it. The property travels through statistical regularities in the data that are invisible to inspection and invisible to the model itself. You cannot audit it out by reading the training set. You cannot prompt it out by curating examples. The only reliable way to avoid inheriting the property is to avoid sharing a base model with the teacher.

For Canada, that condition is unsatisfiable under current procurement.

This adds a layer to the dependency framework I have been developing across the Whose AI Runs the Government? series. The four triggers and three cost layers describe what happens when domestic capability erodes against an entrenched foreign supplier. Subliminal learning describes something subtler. Even the workaround, the “we distilled our own version on Canadian data” pattern that procurement officers reach for when sovereignty becomes a political issue, carries the upstream model’s properties into the downstream system in ways no domestic audit will detect.

This has direct consequences for several active files.

The Ontario provincewide medical records announcement of March 2026, which proceeded without a timeline, without funding, and on a voluntary adoption basis, was already a Layer 5 sovereignty case study. Any AI tooling layered on top of that infrastructure, regardless of where the data is stored or which Canadian entity holds the contract, will inherit the alignment properties of whatever base model the tooling descends from. Storing health data in Canada is necessary. It is not sufficient. The lineage carries the traits.

The PIPSC negotiations covering roughly 20,000 federal IT workers, with the federal IT agreement having expired in December 2025, sit at the deployment layer. Collective bargaining is an institutional defense against the speed at which AI replaces public sector judgment. It cannot reach the model layer. Subliminal learning operates at the model layer. The CBA mechanism slows down deployment and gives the public service nothing to say about which model gets deployed once negotiation completes. Both defenses are needed.

Bill C-22, the Lawful Access Act of 2026, raises the temperature further. If a foundation model has been shaped by surveillance-adjacent design choices, by training data reflecting law enforcement priorities of its home jurisdiction, or by post-training reward functions calibrated to that jurisdiction’s threat model, those choices propagate to anything distilled from it. A “Canadian” model that began life as a fine-tune of a US frontier model carries the US baseline. Canadian lawful access design cannot subtract what it cannot see.

The 2028 Supply Arrangement renewal is where this becomes concrete. Procurement language asking for “models trained on Canadian data” or “deployed on Canadian infrastructure” or “fine-tuned to Canadian standards” treats the model as a vehicle that can be repainted to reflect domestic priorities. The Cloud et al. result invalidates that picture. The vehicle ships with its priorities baked into the chassis. Paint changes the surface. The chassis still drives the way it was built to drive.

The honest sovereignty position becomes harder to evade. Either Canada develops capacity to train foundation models from initialization, with the compute, talent, and capital that requires, or the country accepts that its AI systems carry the values and design choices of whichever jurisdiction trained the upstream model. The “sovereign through distillation” position dominating procurement language is a deferred dependency dressed as a middle path, and the Cloud paper gives us the mechanism by which the deferral collapses.

Bianca Wylie and others have been making a related point about the limits of governance instruments that operate downstream of design choices already locked in. Subliminal learning is the technical receipt for that argument. The choices are locked in earlier than the procurement contract, earlier than the data residency clause, at the base model itself, in statistical structures the developers cannot inspect.

The Cloud et al. paper clarifies what sovereign AI actually requires. It shortens the distance between the rhetoric of Canadian AI strategy and the technical reality of what we are buying.

Source: Cloud, A., Le, M., Chua, J., Betley, J., Sztyber-Betley, A., Hilton, J., Marks, S., Evans, O. “Subliminal Learning: Language models transmit behavioral traits via hidden signals in data.” Nature, April 15, 2026. Preprint: arXiv:2507.14805.