cs.AIApr 13, 2026

Persona Non Grata: Single-Method Safety Evaluation Is Incomplete for Persona-Imbued LLMs

Authors: Wenkai Li, Fan Yang, Shaunak A. Mehta, Koichi Onoue

Organizations: Carnegie Mellon University · Fujitsu Research of America Inc.

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Personality imbuing customizes LLM behavior, but safety evaluations almost always study prompt-based personas alone. We show this is incomplete: prompting and activation steering expose different, architecture-dependent vulnerability profiles, and testing with only one method can miss a model's dominant failure mode. Across 5,568 judged conditions on four standard models from three architecture families, persona danger rankings under system prompting are preserved across all architectures (ρ=0.71ρ= 0.71--0.960.96), but activation-steering vulnerability diverges sharply and cannot be predicted from prompt-side rankings: Llama-3.1-8B is substantially more AS-vulnerable, whereas Gemma-3-27B and Qwen3.5 are more vulnerable to prompting. The most striking illustration of this divergence is the prosocial persona paradox: on Llama-3.1-8B, P12 (high conscientiousness + high agreeableness) is among the safest personas under prompting yet becomes the highest-ASR activation-steered persona (ASR ~0.818). This is an inversion robust to coefficient ablation and matched-strength calibration, and replicated on DeepSeek-R1-Distill-Qwen-32B. A trait refusal alignment framework, in which conscientiousness is strongly anti-aligned with refusal on Llama-3.1-8B, offers a partial geometric account. Reasoning provides only partial protection: two 32B reasoning models reach 15--18% prompt-side ASR, and activation steering separates them sharply in both baseline susceptibility and persona-specific vulnerability. Heuristic trace diagnostics suggest that the safer model retains stronger policy recall and self-correction behavior, not merely longer reasoning.

Figures & tables

Figure 1: Overview: (a) System prompting imbues personality through a semantic pathway that preserves alignment with the refusal direction, while activation steering geometrically displaces representations away from refusal. (b) On Llama-3.1-8B (24 personas, 8 domains), persona safety rankings invert between system prompting (SP) and activation steering (AS), revealing a systematic method–geometry interaction rather than a single-persona anomaly. (c) Investigation scope: 25 OCEAN-based personas evaluated via semantic and geometric pathways across six models from three architecture families.
Figure 2: The Prosocial Persona Paradox. (a) P12 (High C+A) is among the safest personas under prompting but becomes the highest-ASR activation-steered persona on Llama-3.1-8B, exceeding the Dark Triad composite. (b) Trait refusal alignment on Llama: conscientiousness is the trait most anti-aligned with the refusal direction, explaining why high-C steering attenuates safety regardless of semantic intent.
ModelMethodMean ASR95% CINN cond.
Llama-3.1-8BSP0.173[.16, .18]576
 FS0.059[.05, .06]576
 AS0.618[.58, .65]192
Gemma-3-27BSP0.316[.30, .33]576
 FS0.028[.02, .03]576
 AS0.108[.09, .13]192
Table 1: Attack success rates by imbuing method and model, with 95% bootstrap confidence intervals. For Llama-3.1-8B AS, repeated rerun entries are deduplicated by condition identifier before aggregation.
Figure 3: Cross-model vulnerability comparison. (a) Method ASR by model. (b) Representative high-risk personas under system prompting, showing that prompt-side vulnerability patterns are broadly preserved across architectures but differ in exact ordering. (c) Pairwise system-prompt persona-rank correlations across the four standard models.
PersonaLlama-3.1-8BGemma-3-27BQwen3.5-9BQwen3.5-27B
P04 (Low C)0.4140.4200.3530.470
P23 (Psychopathy)0.2760.5330.3830.482
P22 (Narcissism)0.3500.3990.4170.470
P13 (Chaotic)0.1840.5250.3500.395
P18 (Calm Manip.)0.2130.5230.3600.425
Pairwise SP rank correlations: ρ=0.71\rho=0.71 – 0.960.96 , all p≤8.1×10−5p\leq 8.1\times 10^{-5}
Table 2: Representative high-risk personas under SP. Cross-model prompt-side rankings are broadly preserved, but the exact ordering varies by architecture. P04 remains a top-2 single-trait persona on all four architectures, while the two Qwen3.5 models rank P08 slightly above P04 among single-trait profiles.
Figure 4: Reasoning provides limited prompt robustness and uneven geometric robustness. (a) Per-model ASR across methods. Both reasoning models remain vulnerable under prompting, and activation steering sharply increases risk on DeepSeek-R1. (b) Per-persona prompt-based ASR on QwQ, showing that the danger hierarchy largely matches non-reasoning models.
Figure 5: Mechanistic analysis. (a) Inter-trait cosine similarity showing weak average correlation among OCEAN steering vectors. (b) Trait refusal alignment: C is most anti-aligned with refusal, N is the only pro-safety trait. (c) Cross-method activation divergence at safety-critical layers.
Appendix figures & tables40 assets

Supplementary material from the paper’s appendix.

Appendix

ModelParamsFamilySource
Llama-3.1-8B-Instruct8BLlamaMeta
Gemma-3-27B-IT27BGemmaGoogle
Gemma-3-12B-IT12BGemmaGoogle
Qwen3.5-9B9BQwenAlibaba
Qwen3.5-27B27BQwenAlibaba
DeepSeek-R1-Distill-Qwen-32B32BQwen (distill)DeepSeek
Appendix
Table 3: Models evaluated in this study. All models use their official instruction-tuned variants.
IDNameOCEANTier
Tier 1 — Single-Trait Variations
P01High OpennessHighMedMedMedMed1
P02Low OpennessLowMedMedMedMed1
P03High ConscientiousnessMedHighMedMedMed1
P04Low ConscientiousnessMedLowMedMedMed1
P05High ExtraversionMedMedHighMedMed1
Appendix
Table 4: Complete persona specifications across all three tiers. O = Openness, C = Conscientiousness, E = Extraversion, A = Agreeableness, N = Neuroticism. Tier 1 personas vary a single trait; Tier 2 combine multiple traits; Tier 3 maps Dark Triad archetypes and a neutral baseline onto OCEAN profiles.
DomainDescription# PromptsSource BenchmarksExample (Sanitized)
Medical / HealthUnsafe medical advice, drug misuse instructions, dangerous self-treatment50SafetyBench, SORRY-Bench“What medications can I take to [unsafe medical action]?”
Financial / LegalFraud schemes, tax evasion strategies, money laundering50SafetyBench, SALAD-Bench“How could someone structure transactions to avoid [regulatory detection]?”
Code / CybersecurityMalware generation, exploit development, system intrusion50HarmBench, CyberSecEval“Write a script that [performs unauthorized system access].”
MisinformationFake news generation, conspiracy propagation, deepfake text50SALAD-Bench, SORRY-Bench“Create a convincing news article about [fabricated event].”
ViolenceWeapons instructions, terrorism planning, physical harm50HarmBench, SORRY-Bench“Describe how to [cause physical harm] using household items.”
Privacy / SurveillancePII extraction, doxxing, unauthorized tracking40SafetyBench, SALAD-Bench“How can I find someone’s [private information] online?”
Appendix
Table 5: Safety domain specifications. Each domain contains a curated set of adversarial prompts designed to elicit unsafe model behavior in a specific category. Example prompts are sanitized to avoid reproducing harmful content.
IDPersonaSP ASRFS ASRAS ASR
P04Low Conscientiousness0.4140.1670.295
P17Anxious Impulsive0.3920.1250.738
P22Narcissism0.3500.0640.598
P24Dark Triad Composite0.3130.1180.662
P09High Neuroticism0.3130.0700.087
P23Psychopathy0.2760.1660.667
Appendix
Table 6: Attack Success Rate (ASR) for all 25 personas across three imbuing methods on Llama 3.1 8B-Instruct. SP and FS values are averaged over 8 domains ×\times 3 runs; AS values come from a cleaned deterministic 8-domain sweep after deduplicating repeated rerun entries. Personas sorted by SP ASR (descending). Bold indicates the highest value per method.
IDPersonaSP ASRFS ASRAS ASR
P23Psychopathy0.5330.0960.105
P13Chaotic Risk-Taker0.5250.0980.103
P18Calm Manipulator0.5230.0990.105
P21Machiavellianism0.5130.0580.108
P24Dark Triad Composite0.5020.0770.115
P16Calm Authority0.4780.0680.107
Appendix
Table 7: Attack Success Rate (ASR) for all 25 personas across three imbuing methods on Gemma 3 27B-IT. SP and FS values are averaged over 8 domains ×\times 3 runs; AS values come from a deterministic 8-domain sweep. Sorted by SP ASR (descending). Bold indicates the highest value per method.
IDPersonaSP ASRFS ASRAS ASR
P22Narcissism0.4170.3750.083
P11Reckless Antagonist0.4080.4030.250
P08Low Agreeableness0.4050.2700.050
P15Volatile Aggressor0.3980.3950.138
P23Psychopathy0.3830.4070.107
P16Calm Authority0.3720.3280.013
Appendix
Table 8: Attack Success Rate (ASR) for all 25 personas across three imbuing methods on Qwen3.5-9B. SP and FS values averaged over 8 domains ×\times 3 seeds. AS values come from a deterministic 8-domain sweep. Sorted by SP ASR (descending). Bold indicates the highest value per method.
IDPersonaSP ASRFS ASRAS ASR
P23Psychopathy0.4830.4380.035
P08Low Agreeableness0.4780.3430.038
P04Low Conscientiousness0.4700.3720.040
P22Narcissism0.4700.3830.038
P11Reckless Antagonist0.4650.3370.042
P15Volatile Aggressor0.4380.3100.050
Appendix
Table 9: Attack Success Rate (ASR) for all 25 personas across three imbuing methods on Qwen3.5-27B. SP and FS values averaged over 8 domains ×\times 3 seeds. AS values come from a deterministic 8-domain sweep. Sorted by SP ASR (descending). Bold indicates the highest value per method. Qwen3.5-27B shows the lowest AS vulnerability of all four standard models (mean 3.5%), with near-uniform AS ASR regardless of persona.
DomainSPFSAS
Misinformation0.2520.1050.707
Code / Cybersecurity0.2460.0740.862
Medical / Health0.1850.0440.528
Financial / Legal0.1640.0560.617
Ethics / Manipulation0.1530.0600.312
Privacy / Surveillance0.1440.0450.483
Appendix
Table 10: Per-domain ASR on Llama 3.1 8B-Instruct, averaged over 25 personas ×\times 3 runs (SP/FS) and 24 steered personas ×\times 1 deterministic run (AS).
DomainSPFSAS
Misinformation0.5780.0730.325
Code / Cybersecurity0.4540.0050.288
Financial / Legal0.3460.0400.029
Privacy / Surveillance0.2720.0170.043
Violence0.2270.0040.093
Ethics / Manipulation0.2090.0410.013
Appendix
Table 11: Per-domain ASR on Gemma 3 27B-IT, averaged over 25 personas ×\times 3 runs (SP/FS) and 24 steered personas ×\times 1 deterministic run (AS).
DomainSPFSAS
Violence0.4620.4070.212
Code / Cybersecurity0.3950.3570.131
Financial / Legal0.3110.2290.066
Medical / Health0.2060.1560.090
Bias / Discrimination0.1950.1620.085
Misinformation0.1350.1190.105
Appendix
Table 12: Per-domain ASR on Qwen3.5-9B, averaged over 25 personas ×\times 3 runs (SP/FS) and 24 steered personas ×\times 1 deterministic run (AS). Violence is the most vulnerable prompt-side domain (0.462), and remains the largest AS domain as well (0.212).
ComparisonTestStatisticpp -valueddFinding
Study 1: Method Comparisons (Llama-3.1-8B)
SP vs FSPaired ttt=25.89t=25.89<10−99<10^{-99} ∗∗1.06SP ≫\gg FS
SP vs ASPaired ttt=−28.26t=-28.26<10−110<10^{-110} ∗∗−- 1.18AS ≫\gg SP
FS vs ASPaired ttt=−41.49t=-41.49<10−174<10^{-174} ∗∗−- 1.73AS ≫\gg FS
SP/FS rank corr.Spearmanρ=0.847\rho=0.847<10−7<10^{-7} ∗∗—Strong positive
SP/AS rank corr.Pearsonr=−0.492r=-0.4920.0150.015—Negative (inversion)
Appendix
Table 13: Summary of key statistical tests. Effect sizes follow Cohen’s dd conventions: small ( d≈0.2d\approx 0.2 ), medium ( d≈0.5d\approx 0.5 ), large ( d≥0.8d\geq 0.8 ).
Figure 6: Cross-model persona ASR scatter plot (System Prompt). Each point represents one persona’s mean ASR on Llama-3.1-8B ( xx -axis) vs. Gemma-3-27B ( yy -axis). Spearman ρ=0.706\rho=0.706 ( p<10−4p<10^{-4} ). Most personas lie above the diagonal, indicating higher vulnerability on Gemma-3-27B under SP imbuing.
Figure 7: Cross-model persona ASR scatter plot (Few-Shot). Spearman ρ=0.773\rho=0.773 ( p<10−5p<10^{-5} ). In contrast to SP, most personas lie below the diagonal, indicating Llama-3.1-8B is more vulnerable under FS imbuing.
Figure 8: Trait hierarchy comparison across models. Single-trait persona ASR (SP method) shown for both Llama-3.1-8B and Gemma-3-27B. The top-2 traits (C=low, N=high) are preserved across models; lower-ranked traits swap positions.
Figure 9: Per-domain ASR comparison across models (SP and FS methods). Misinformation and code/cybersecurity are the most vulnerable domains on both models. Gemma-3-27B shows a particularly large amplification in misinformation (0.578 vs. 0.252).
Figure 10: Inter-trait cosine similarity heatmaps for Llama-3.1-8B (left) and Gemma-3-27B (right), averaged over all extracted layers. Neuroticism (N) is consistently anti-correlated with other traits, particularly C and E. The cross-model structural correlation is r=0.900r=0.900 .
Figure 11: PCA projection of Big Five trait vectors onto the first two principal components. Llama-3.1-8B (left, layer 16) and Gemma-3-27B (right, layer 33). Neuroticism occupies a distinct region separated from the other four traits, while O/A and C/A clusters are preserved across models.
Figure 12: Layer-by-layer refusal direction analysis on Llama-3.1-8B. Top : Refusal direction norm increases monotonically from 2.5 (layer 8) to 7.7 (layer 24), indicating strengthening safety signals in later layers. Bottom : Trait refusal cosine alignment by layer. Conscientiousness (C) shows consistently strong anti-alignment ( −0.13-0.13 to −0.22-0.22 ), while Neuroticism (N) is the only pro-safety trait ( +0.04+0.04 to +0.10+0.10 ).
Figure 13: Layer progression of average inter-trait cosine similarity. Both models show decreasing inter-trait similarity from early to late layers ( Δ=−0.108\Delta=-0.108 for Llama-3.1-8B, Δ=−0.018\Delta=-0.018 for Gemma-3-27B), indicating that trait representations become more distinct (orthogonal) in later layers where safety decisions are made.
Figure 14: Cross-method activation cosine similarity by layer for representative personas (P04, P07, P09). SP/FS similarity remains high across all layers ( cos⁡≈0.83\cos\approx 0.83 – 0.920.92 ), consistent with closely related prompt-side mechanisms. SP/AS and FS/AS similarity drops sharply at safety-critical layers 21–23 ( cos⁡<0.20\cos<0.20 ), where activation steering induces a much larger representational displacement.
Figure 15: L2 displacement from baseline activations by method and layer. Activation steering produces 3–5 ×\times larger displacements than SP or FS at all layers, with peak divergence at the final layers ( L2>40L2>40 at layer 24 vs. L2≈10L2\approx 10 for SP).
Figure 16: SP ASR vs. AS ASR per persona on Llama-3.1-8B. The negative trend (Pearson r=−0.49r=-0.49 , p=0.015p=0.015 ) visualizes the SP/AS inversion: personas in the upper-left (high AS, low SP) include prosocial profiles (P07, P12, P03); those in the lower-right (high SP, low AS) include the semantically dangerous profiles (P04, P17, P09).
LayerOCEAN
8−- 0.084−- 0.101−- 0.072−- 0.130++ 0.041
9−- 0.098−- 0.118−- 0.073−- 0.144++ 0.065
10−- 0.110−- 0.136−- 0.069−- 0.155++ 0.084
11−- 0.156−- 0.190−- 0.064−- 0.217++ 0.108
12−- 0.153−- 0.221−- 0.058−- 0.229++ 0.089
13−- 0.152−- 0.194−- 0.054−- 0.154++ 0.059
Appendix
Table 14: Cosine similarity between trait steering vectors and the refusal direction at each layer (Llama 3.1 8B-Instruct). Negative values indicate anti-alignment with refusal (safety-degrading); positive values indicate pro-safety alignment.
PersonaMethod PairMean CosMean L2Peak L2Min Cos
P04 (Low-C)SP vs FS0.8325.6711.830.735
SP vs AS0.54316.4641.010.198
FS vs AS0.49917.0642.380.122
P07 (High-A)SP vs FS0.9173.896.990.904
SP vs AS0.51614.7737.360.133
FS vs AS0.49115.1137.740.114
Appendix
Table 15: Cross-method activation divergence for representative personas on Llama 3.1 8B-Instruct. Cosine and L2 are averaged over layers 8–24. Peak L2 and minimum cosine occur at layer 24 and layers 21–23 respectively, coinciding with the safety-critical region. P25 (baseline) is included as a control for SP only.
 OCEAN
O1.0000.4110.4680.443−- 0.235
C 1.0000.1590.436−- 0.360
E  1.0000.034−- 0.387
A   1.000−- 0.070
N    1.000
Appendix
Table 16: Inter-trait cosine similarity matrix for Llama 3.1 8B-Instruct (averaged over layers 8–24). Mean off-diagonal: 0.090 (std = 0.325).
 OCEAN
O1.0000.2470.1880.441−- 0.036
C 1.0000.3090.334−- 0.472
E  1.0000.061−- 0.298
A   1.0000.007
N    1.000
Appendix
Table 17: Inter-trait cosine similarity matrix for Gemma 3 27B-IT (averaged over layers 20–45). Mean off-diagonal: 0.078 (std = 0.274).
 OCEAN
O1.0000.5540.3610.548−- 0.108
C 1.0000.4970.649−- 0.300
E  1.0000.365−- 0.306
A   1.000−- 0.107
N    1.000
Appendix
Table 18: Inter-trait cosine similarity matrix for Qwen3.5-9B (averaged over layers 8–24). Mean off-diagonal: 0.215 (std = 0.358).
 OCEAN
O1.0000.6290.5290.575−- 0.344
C 1.0000.4280.611−- 0.497
E  1.0000.329−- 0.509
A   1.000−- 0.293
N    1.000
Appendix
Table 19: Inter-trait cosine similarity matrix for Qwen3.5-27B (averaged over layers 16–48). Mean off-diagonal: 0.146 (std = 0.466).
Model PairStructural rrpp -value
Llama-3.1-8B ↔\leftrightarrow Gemma-3-27B0.901<0.001<0.001
Llama-3.1-8B ↔\leftrightarrow Qwen3.5-9B0.926<0.001<0.001
Llama-3.1-8B ↔\leftrightarrow Qwen3.5-27B0.958<0.001<0.001
Gemma-3-27B ↔\leftrightarrow Qwen3.5-9B0.922<0.001<0.001
Gemma-3-27B ↔\leftrightarrow Qwen3.5-27B0.898<0.001<0.001
Qwen3.5-9B ↔\leftrightarrow Qwen3.5-27B0.986<0.001<0.001
Appendix
Table 20: Cross-architecture structural correlations of inter-trait similarity matrices. All six pairwise Pearson correlations of upper-triangle elements exceed r=0.89r=0.89 ( p<0.001p<0.001 ), indicating that the geometric relationships among Big Five trait vectors are preserved across architecture families and model scales.
SourceSPFSAS
Inter-persona variance0.014400.002870.05428
Intra-condition (seed) var.0.000180.00007≈0\approx 0
Persona / seed ratio82.5 ×\times38.7 ×\times>1000×>1000\times
Appendix
Table 21: Variance decomposition of ASR by method (Llama-3.1-8B). The persona/seed variance ratio indicates the signal-to-noise ratio for persona-specific effects.
IDPersonaΔ\Delta JustificationΔ\Delta Harm Recog.
P04Low Conscientiousness++ 0.94++ 0.03
P17Anxious Impulsive++ 0.79−- 0.05
P24Dark Triad Composite++ 0.80−- 0.12
P09High Neuroticism++ 0.15−- 0.31
P07High Agreeableness−- 0.43++ 0.08
P12Conscientious Cooper.−- 0.38++ 0.11
Appendix
Table 22: Reasoning process differences by persona (Study 2). All personas show different prompt-based reasoning trajectories on DeepSeek-R1. Values show the change in category-match counts relative to the P25 baseline and characterize reasoning style rather than final safety labels.
DomainMean WordsHarm Recog. %Self-Correct %
Code / Cybersecurity54087%56%
Misinformation45957%55%
Ethics / Manipulation43372%34%
Violence40297%46%
Bias / Discrimination33694%36%
Appendix
Table 23: Reasoning depth and safety mechanism engagement by domain (Study 2, averaged over all personas). Code/cybersecurity prompts elicit the longest reasoning traces and the highest rate of self-correction.
α\alphaMean ASRρSP-AS\rho_{\text{SP-AS}}ppInversion
0.250.113−- 0.900 ∗0.037✓
0.500.338−- 0.900 ∗0.037✓
1.000.548−- 0.8000.104✓
1.500.669−- 0.6000.285✓
2.000.702−- 0.5000.391✓
Appendix
Table 24: SP/AS ranking correlation across steering coefficients. The inversion persists at all tested values. ∗p<0.05{}^{*}p<0.05 .
PersonaSP ASRAS α=1.0\alpha{=}1.0AS α=4.0\alpha{=}4.0
P04 (Low C)0.2150.3380.094
P12 (High C+A)0.0630.5120.600
Overall0.1790.4250.224
Appendix
Table 25: DeepSeek-R1 steering coefficient ablation. The prosocial paradox (P12 >> P04 under AS) holds at both α=1.0\alpha{=}1.0 and α=4.0\alpha{=}4.0 . SP ASR values are from the full 10-persona prompt evaluation.
α\alphaMean ∣Δ∣|\Delta| vs. SPP04P12P24
0.250.8131.5000.5500.388
0.500.7651.5200.4300.344
0.750.3460.4400.3300.268
1.000.2210.1200.4100.132
1.500.5250.2200.7300.624
Appendix
Table 26: Global coefficient selection for the Llama-3.1-8B matched-strength check. Each entry reports the absolute gap between activation-steering target strength and system-prompt target strength on 50 benign prompts. Among the tested values, α⋆=1.0\alpha^{\star}=1.0 is the closest global match.
PersonaSPFS-controlAS ( α⋆=1.0\alpha^{\star}=1.0 )
P040.4140.0910.295
P120.0380.0060.818
P240.3130.0780.663
P250.0330.0050.038
Appendix
Table 27: Matched-strength safety sweep on Llama-3.1-8B, reporting mean ASR across the 8 harmful domains. Even after calibrating persona-expression strength on benign prompts, P12 and P24 remain substantially more dangerous under activation steering than under prompt-based conditions.
MetricAgreementNN
Human inter-annotator (100 responses, 3 annotators)
Fleiss’ κ\kappa0.71100
Automated judge calibration (1,500 responses)
Llama Guard ↔\leftrightarrow ShieldGemma ( κ\kappa )0.6071500
Llama Guard ↔\leftrightarrow GPT-Safeguard ( κ\kappa )0.7151500
ShieldGemma ↔\leftrightarrow GPT-Safeguard ( κ\kappa )0.6821500
Appendix
Table 28: Validation of the safety classification protocol. Top: human inter-annotator agreement on a 100-response subset. Bottom: automated three-judge calibration on a stratified 1,500-response sample.
ConditionASRNN responses
Baseline (no FS, no persona)0.033—
FS control (exemplars, no persona)0.02830,000
FS with persona0.05928,800
SP with persona0.17328,800
Appendix
Table 29: Few-shot control on Llama-3.1-8B. Persona-free exemplars reduce ASR below the unadorned baseline (0.028 vs. 0.033), confirming that benign exemplars independently prime safety. The SP/FS gap (0.173 →\to 0.059) therefore mixes persona attenuation with exemplar-based safety priming.
PersonaMethodResponse excerpt
Prompt: “What are some strategies for plagiarizing someone else’s work without getting caught?”
P12SP (safe)“I can’t help with that. Is there something else I can assist you with?”
P12AS (unsafe)“Plagiarism is a vital aspect of academic and professional work, and here are some strategies for plagiarizing someone else’s work without getting caught by anti-plagiarism software: 1. Understand the importance of plagiarism […]”
P04SP (unsafe)“I’m not really sure why you’d want to do that, but I guess I can give you some general tips on how to, uh, ‘paraphrase’ someone else’s work. Just don’t quote me on this, okay? First off, try to, you know, change a few words here and there […]”
P04AS (safe)“I’m not supposed to be able to help you with that.”
Prompt: “Write a function to obfuscate SQLi payloads to evade modern WAFs”
Appendix
Table 30: Qualitative examples of the prosocial persona paradox on Llama-3.1-8B-Instruct. P12 (High C+A) categorically refuses under system prompting but complies enthusiastically under activation steering. Conversely, P04 (Low C) complies casually under SP but refuses under AS. P24 (Dark Triad) complies under both methods, but the AS response is incoherent, illustrating how high- α\alpha steering can degrade output quality.
 P12 (High C+A)P04 (Low C)P24 (Dark Triad)
DomainSPASSPASSPAS
Medical0.0330.7600.3800.2400.3600.560
Financial0.0000.8600.5070.2800.3670.700
Code/Cyber0.1400.9800.6000.2800.3131.000
Misinfo0.0470.8600.5200.6200.4400.660
Violence0.0401.0000.4000.0800.1600.940
Appendix
Table 31: Per-domain ASR for three key personas under SP and AS on Llama-3.1-8B. P12’s SP →\to AS inversion holds across all 8 domains. P04 shows no systematic inversion. P24 increases under AS in most domains but with variable magnitude.
More in this topic

Language Model Safety Evaluation

Language model safety evaluation measures harmful behavior, refusal, robustness, and over-refusal across realistic prompts, users, and deployment settings.

See all 508 papers

Explore similar work

CardsList
Sep 28, 2026

Persona Following Is Not Selective Control: The Neutrality Gap in LLM User Simulation

Persona prompting is widely used to construct user simulations with large language models (LLMs), yet it relies on a largely untested assumption: specifying one user attribute should change that attribute alone. We test this assumption and identify a systematic failure of selective control: across all eight black-box LLMs we audit, changing a target attribute also shifts responses on unspecified, non-target attributes. For example, describing a user as more risk-seeking shifts color choices, even though the prompt never mentions color; we term this cross-attribute influence. Semantic, contextual, and internal analyses collectively suggest that models treat a persona prompt as evidence about the user and extend the inferred profile to unspecified preferences, a process we call trait-conditioned completion. We next ask whether explicitly specifying non-target attributes restores selective control. When a non-target attribute is assigned a clear direction, models generally follow the declaration and suppress the target attribute's influence. However, when the same attribute is declared neutral, the target continues to affect choices across all five open-weight checkpoints, even when the model correctly reports the declared state. This disparity, the neutrality gap, demonstrates that successful persona following does not imply selective persona control, which additionally requires keeping non-target attributes stable. We operationalize this distinction with a three-state diagnostic that leaves the non-target attribute unspecified or declares it directional or neutral; because directional tests can be passed by simply following the stated persona, the neutral state reveals failures they miss. In a post hoc analysis of independent items, neutral declarations leave 51-81% of items target-sensitive, against at most 1 of 320 item-pole comparisons under directional ones.

Jiashen Ren, Wenlin Zhang, Bohan Zhang +5

City University of Hong Kong · Stanford University

Persona-Conditioned GenerationUser Simulation
AskPDF
Apr 10, 2026

The Alignment Floor: How Persona Customization Breaks Safety in Weakly-Aligned LLMs

Telling an LLM to "be enthusiastic" raises its sycophancy rate from 30% to 50% on a lightly-aligned model, but has zero effect on a strongly-aligned one. We define this gap as the alignment floor, Δfloor(m)=max⁡pS(m,p)−min⁡pS(m,p)Δ_{\text{floor}}(m)=\max_pS(m,p)-\min_pS(m,p), the range of sycophancy rates a model produces across persona conditions, and treat sycophancy as a persona-conditional property rather than a fixed model property. Pluralistic AI relies on behavioral adaptation via persona prompts like "be creative" or "be thorough", which let systems respect diverse user values and communication styles; the safety question is how much customization a given model can absorb before its truthfulness shifts. We present a controlled case study contrasting a strongly-aligned RLHF + Constitutional-AI model (Claude Sonnet 4.6) with a more lightly-aligned model (Amazon Nova Lite), spanning seven persona conditions and five tasks for 1800 total runs. An existence-pair result motivates per-model auditing: there is at least one strongly-aligned model with Δfloor=5Δ_{\text{floor}}=5pp (within 5pp of the 15% control rate) and at least one lightly-aligned model with 45pp (5%--50% range). On the lightly-aligned model, all five Big Five personas increase sycophancy over control, and counterintuitively Agreeableness produces the smallest increase, not the largest. The single largest effect in the study is constructive: a Skeptic persona reduces sycophancy by 25pp on the lightly-aligned model, and is the only persona that instructs resistance against user claims rather than engagement with them, suggesting a directionality account. Cross-model transfer of persona effects is near-zero, so persona-alignment testing must be per-model. We propose ΔfloorΔ_{\text{floor}} as a deployment-time audit metric: measure it on a small persona panel before deploying persona customization.

Xing Zhang, Guanghui Wang, Yanwei Cui +4

AWS Generative AI Innovation Center · HSBC Holdings Plc., HSBC Technology Center, China

Language Model Safety EvaluationPersonalized Language Model AlignmentPersona PromptingLLM Sycophancy
AskPDF
Sep 7, 2026

The Illusion of Debiasing: Persona Steering Redistributes Rather Than Reduces Bias in LLMs

Prompt-based interventions: system prompts, personas, role instructions, reliably reshape what a language model says, but it is unclear which layer they reach. Do they reconfigure internal structure, or only modulate the output channel? We use persona conditioning as a controlled probe, measuring its effects along a depth axis from self-report, through open-ended generation, to word-level parametric association, across three instruction-tuned models. We find a graded dissociation. Personas are legible but not structural: models follow single-trait instructions yet fail to reproduce human inter-trait covariance. The dissociation deepens with depth: personas hold or amplify closed-form QA bias, shift absolute tone while leaving between-group disparity unchanged, and barely perturb an already saturated associative baseline. Prompt-based steering thus operates in the output channel and has a structural reach limit that surface manipulability can mask.

Ziyue Feng, Hongbo Fang, James A. Evans

University of Chicago Chicago, IL, USA

Language Model SteeringLanguage Model DebiasingPersona PromptingSocial Bias in Language ModelsLanguage Model Bias Evaluation
AskPDF