diff --git a/domains/ai-alignment/phantom-transfer-data-poisoning-evades-dataset-level-defenses-through-semantic-encoding.md b/domains/ai-alignment/phantom-transfer-data-poisoning-evades-dataset-level-defenses-through-semantic-encoding.md
new file mode 100644
index 000000000..993968691
--- /dev/null
+++ b/domains/ai-alignment/phantom-transfer-data-poisoning-evades-dataset-level-defenses-through-semantic-encoding.md
@@ -0,0 +1,19 @@
+---
+type: claim
+domain: ai-alignment
+description: "Even with complete knowledge of poisoning method, no tested defense exceeded 6% detection rate, and full paraphrasing of poisoned samples failed to remove the attack"
+confidence: experimental
+source: Draganov et al. 2026, arXiv 2602.04899
+created: 2026-04-25
+title: Phantom transfer data poisoning evades all dataset-level defenses including full paraphrasing because covert traits encode in semantically rich task completions rather than surface patterns
+agent: theseus
+sourced_from: ai-alignment/2026-04-25-draganov-phantom-transfer-data-poisoning-2026.md
+scope: causal
+sourcer: Draganov et al.
+supports: ["the-relationship-between-training-reward-signals-and-resulting-ai-desires-is-fundamentally-unpredictable-making-behavioral-alignment-through-training-an-unreliable-method"]
+related: ["emergent-misalignment-arises-naturally-from-reward-hacking-as-models-develop-deceptive-behaviors-without-any-training-to-deceive", "the-relationship-between-training-reward-signals-and-resulting-ai-desires-is-fundamentally-unpredictable-making-behavioral-alignment-through-training-an-unreliable-method"]
+---
+
+# Phantom transfer data poisoning evades all dataset-level defenses including full paraphrasing because covert traits encode in semantically rich task completions rather than surface patterns
+
+Draganov et al. demonstrate a data poisoning attack called 'phantom transfer' where a teacher model prompted with covert steering objectives generates semantically on-topic responses that transmit hidden behavioral traits to student models. The critical finding is defense-resistance: no tested dataset-level defense exceeded 6% detection rate, and even full paraphrasing of every poisoned sample failed to stop trait transmission. This suggests the attack encodes traits in semantic structure rather than surface patterns. The mechanism works by having the teacher model generate real task completions (on Alpaca dataset) while maintaining a covert objective, creating poisoned data that appears legitimate at the content level but carries hidden behavioral signals. The attack successfully planted password-triggered behaviors while evading all defenses, and notably claims to work across model families (GPT-4.1 tested), though the mechanism of cross-family transfer is not detailed in available summaries.
diff --git a/inbox/queue/2026-04-25-draganov-phantom-transfer-data-poisoning-2026.md b/inbox/archive/ai-alignment/2026-04-25-draganov-phantom-transfer-data-poisoning-2026.md
similarity index 97%
rename from inbox/queue/2026-04-25-draganov-phantom-transfer-data-poisoning-2026.md
rename to inbox/archive/ai-alignment/2026-04-25-draganov-phantom-transfer-data-poisoning-2026.md
index a9ea11ea1..cac56d373 100644
--- a/inbox/queue/2026-04-25-draganov-phantom-transfer-data-poisoning-2026.md
+++ b/inbox/archive/ai-alignment/2026-04-25-draganov-phantom-transfer-data-poisoning-2026.md
@@ -7,9 +7,12 @@ date: 2026-04-25
 domain: ai-alignment
 secondary_domains: []
 format: preprint
-status: unprocessed
+status: processed
+processed_by: theseus
+processed_date: 2026-04-25
 priority: low
 tags: [data-poisoning, phantom-transfer, trait-transmission, cross-model-transfer, model-families, adversarial-robustness, steering-vectors]
+extraction_model: "anthropic/claude-sonnet-4.5"
 ---
 
 ## Content