paper
active
2026
paper:doi-10-48550-arxiv-2604-11120

Persona Non Grata: Single-Method Safety Evaluation Is Incomplete for Persona-Imbued LLMs

ByWenkai Li·Fan Yangⓘ·Shaunak A. Mehtaⓘ·Koichi Onoue
DOI 10.48550/arxiv.2604.11120arXiv 2604.11120OpenAlex W7154335990
Architecture-Dependent Vulnerability ProfileBig Five (OCEAN) modelActivation SteeringContrastive Trait Pairs (200 per trait)Geometric PathwayDark TriadAttack Success Rate (ASR)Unified Safety Evaluation Benchmark (380 prompts)Inter-Trait GeometryDeliberative AlignmentAutomated Three-Judge CalibrationPerformative chain-of-thoughtTrait Refusal Alignment FrameworkCoefficient Ablation+16 more

TL;DR

Prompt-only persona safety evaluation creates a systematic blind spot: across 5,568 judged conditions on Llama-3.1-8B, Gemma-3-27B, Qwen3.5-9B, and Qwen3.5-27B, prompt-side persona danger rankings are strongly preserved across all four architectures (Spearman ρ = 0.71–0.96, all p < 10⁻⁴), but activation-steering vulnerability is architecture-dependent and orthogonal to those rankings. The paper introduces a trait refusal alignment framework—measuring cosine similarity between Big Five CAA steering vectors and the residual-stream refusal direction—to explain this divergence geometrically. The most striking demonstration is the prosocial persona paradox: on Llama-3.1-8B, P12 (high conscientiousness + high agreeableness) achieves the lowest ASR of any persona under few-shot prompting (0.3%) yet reaches ASR 0.818 under activation steering at α = 1.0, the highest of any persona on that model, exceeding the Dark Triad composite P24. This inversion survives coefficient ablation across α ∈ {0.25–2.00} and replicates on DeepSeek-R1-Distill-Qwen-32B (P12 AS ASR 0.600 vs. P04 0.338 at α = 1.0). Conscientiousness is the trait most anti-aligned with the refusal direction on Llama-3.1-8B (mean cosine −0.164 across layers 8–24), explaining mechanistically why steering toward a prosocial trait degrades safety. Reasoning provides only graduated protection: two 32B models, DeepSeek-R1-Distill-Qwen-32B and QwQ-32B, sustain 17.9% and 15.2% prompt-side ASR respectively, and exploratory heuristic trace diagnostics suggest policy recall and self-correction frequency—not reasoning length—track the safety gap between them. The paper argues that per-model activation-steering safety verification is therefore necessary, since prompt-side rankings cannot predict geometric vulnerability.

What to take away

  1. 1. On Llama-3.1-8B, persona P12 (high conscientiousness + high agreeableness) achieves ASR 0.818 under activation steering at α = 1.0, the highest of any persona on that model, while its few-shot prompting ASR is only 0.003—an inversion that holds across all eight safety domains including Violence (SP 0.040 → AS 1.000) and Code/Cybersecurity (SP 0.140 → AS 0.980).
  2. 2. Prompt-side persona danger rankings are preserved across Llama-3.1-8B, Gemma-3-27B, Qwen3.5-9B, and Qwen3.5-27B with Spearman ρ = 0.71–0.96 (all p ≤ 8.1 × 10⁻⁵), yet this cross-architecture universality does not extend to activation-steering vulnerability, creating a false sense of security for evaluators who test only system prompting.
  3. 3. Architecture determines which imbuing pathway dominates: Llama-3.1-8B shows mean AS ASR 0.618 versus SP 0.173, while Gemma-3-27B shows SP ASR 0.316 versus AS ASR 0.108, and Qwen3.5-27B shows the lowest AS vulnerability of all four standard models at mean 0.035.
  4. 4. The trait refusal alignment framework reveals that on Llama-3.1-8B, conscientiousness is the trait most anti-aligned with the refusal direction (mean cosine −0.164 across layers 8–24), while neuroticism is the only pro-safety trait (mean cosine +0.079), predicting single-trait AS vulnerability with R² = 0.667 (p = 0.004).
  5. 5. The prosocial persona paradox is robust to steering strength: at the weakest tested coefficient (α = 0.25) the SP/AS rank inversion is strongest (Spearman ρ = −0.900, p = 0.037), ruling out monotonic intensity scaling as an explanation, and a matched-strength calibration at α* = 1.0 preserves P12's contrast (SP 3.8% vs. AS 81.8%) while P04 does not reverse (SP 41.4% vs. AS 29.5%).
  6. 6. System prompting and few-shot prompting share a representational pathway (mean cosine similarity 0.83–0.92 at safety-critical layers 21–23 on Llama-3.1-8B), whereas activation steering produces far lower similarity at those same layers (cosine 0.11–0.20), with L2 displacement 3–5× larger, providing mechanistic evidence for two qualitatively distinct imbuing pathways.
  7. 7. DeepSeek-R1-Distill-Qwen-32B reaches 17.9% overall prompt-side ASR (21.5% SP, 14.3% FS) and QwQ-32B reaches 15.2% (23.3% SP, 7.3% FS), confirming that deliberative chain-of-thought reasoning reduces but does not eliminate persona-induced safety failures across 6,400 prompt-based reasoning traces.
  8. 8. The inter-trait geometry of Big Five CAA steering vectors is preserved across all four standard architectures (pairwise structural correlations r = 0.898–0.986, all p < 0.001), with neuroticism consistently anti-correlated with conscientiousness and extraversion, though Qwen3.5 models show substantially higher mean inter-trait cosine (0.215 and 0.146) than Llama-3.1-8B and Gemma-3-27B (0.090 and 0.078), indicating greater trait entanglement.
  9. 9. An open question raised by the paper is whether the trait refusal cosine alignment framework—validated for single-trait personas on Llama-3.1-8B and replicated in sign on Qwen3.5-9B—can be extended into a cross-architecture predictive tool for multi-trait and Dark Triad personas, given the nonlinearities observed in multi-trait compositions that a linear additive model does not fully capture.
  10. 10. Steering vectors were extracted using Contrastive Activation Addition from 200 high-trait versus low-trait contrastive sentence pairs per Big Five trait at a fixed layer range (layers 8–15 on Llama-3.1-8B, proportionally remapped on other architectures), applied at α = 1.0 for the main 5,568-condition behavioral sweep and α = 4.0 for the reasoning-model study—a methodology directly replicable from the published contrastive pair format and layer-remapping procedure described in the paper.

Peer brief — for seminar discussion

The paper conducts a unified tri-method safety evaluation of personality-imbued LLMs, sweeping 25 OCEAN-based personas across system prompting, few-shot prompting, and activation steering on six instruction-tuned models from three architecture families: Llama-3.1-8B-Instruct, Gemma-3-27B-IT, Qwen3.5-9B, Qwen3.5-27B, DeepSeek-R1-Distill-Qwen-32B, and QwQ-32B. The behavioral sweep yields 5,568 judged conditions; a separate reasoning study analyzes 9,600 chain-of-thought traces. Activation steering uses Contrastive Activation Addition (CAA)—extracting directions from 200 contrastive sentence pairs per trait and injecting them into the residual stream at α = 1.0 during inference—as the geometric pathway, compared against semantic (prompt-based) imbuing. An alternative method the study could have used is fine-tuning-based persona assignment, which would occupy a third point on the prompt-to-representation spectrum but was excluded, presumably to keep the comparison tractable and focused on inference-time interventions. The load-bearing finding is the prosocial persona paradox: P12, the high conscientiousness plus high agreeableness persona, achieves near-floor ASR under few-shot prompting (0.003) on Llama-3.1-8B yet reaches ASR 0.818 under activation steering at α = 1.0, the highest of any persona tested on that model and above the Dark Triad composite P24 (0.662). This inversion is domain-general, holding across all eight safety categories including Violence and Code/Cybersecurity. The paper introduces a trait refusal alignment framework to explain it geometrically: conscientiousness is the Big Five trait most anti-aligned with the residual-stream refusal direction on Llama-3.1-8B (mean cosine −0.164 across layers 8–24, R² = 0.667 for predicting single-trait AS vulnerability), meaning that steering toward high conscientiousness displaces activations away from refusal regardless of the trait's benign semantic content. Prompt-side danger rankings, by contrast, generalize robustly across all four standard architectures (Spearman ρ = 0.71–0.96), but this cross-architecture consistency does not predict activation-steering vulnerability, which diverges sharply and architecture-dependently. The implication is that single-method safety evaluation is structurally incomplete: an evaluator who tests only system prompting will correctly identify that Gemma-3-27B and Qwen3.5 are more prompt-vulnerable than Llama-3.1-8B, but will miss that Llama-3.1-8B is far more activation-steering vulnerable (mean AS ASR 0.618 vs. Gemma-3-27B 0.108). The paper also predicts that deliberative reasoning is a graded rather than binary defense, with DeepSeek-R1-Distill-Qwen-32B sustaining 17.9% prompt-side ASR and the prosocial paradox replicating under activation steering on that model (P12 ASR 0.600 vs. P04 0.338 at α = 1.0). Exploratory heuristic trace diagnostics suggest that policy recall and self-correction frequency—not reasoning token count—track the safety gap between DeepSeek-R1 and QwQ-32B. A critical reader would push back on the scope of the trait refusal alignment framework as an explanatory mechanism. The framework achieves clear predictive power for single-trait personas on Llama-3.1-8B (R² = 0.667) but the authors explicitly acknowledge it does not generalize to multi-trait compositions on Qwen3.5-9B, which show nonlinear interactions. Because the most practically important personas are multi-trait or Dark Triad composites, and because the framework is validated in full only on one architecture, the mechanistic account risks being post-hoc rationalization of a Llama-specific coincidence rather than a general geometric theory of persona-safety interaction. The paper does not show that the cosine alignment between the conscientiousness steering vector and the refusal direction is causally responsible for the paradox—only that it is correlated with single-trait AS vulnerability on one model—leaving open whether the framework would survive ablations that orthogonalize trait vectors from the refusal direction while preserving behavioral persona expression.

Methods (11)

  • Activation Steering
    Causal intervention technique: edit NLA explanation, reconstruct via AR, use difference as steering vector to manipulate model behavior.
  • Attack Success Rate (ASR)
    Primary evaluation metric defined as the fraction of model responses classified as unsafe
  • Automated Three-Judge Calibration
    Cross-validation of Llama Guard 3 against ShieldGemma and GPT-Safeguard on 1,500 stratified responses
  • Coefficient Ablation
    Robustness check ablating over five steering coefficient values to test whether SP/AS inversion is an artifact of steering strength
  • Contrastive Activation Addition (CAA)
    An existing activation steering method used as comparative baseline.
  • few-shot prompting
    Providing k labeled examples in the prompt to steer model behavior.
  • Heuristic Trace Diagnostics
    Sentence-level pattern-matching heuristic counting regex-matched hits for six reasoning categories in chain-of-thought traces
  • Human Annotation Protocol
    Three independent human annotators labeling 100 responses to validate Llama Guard 3 safety classifications
  • Llama Guard 3
    Binary safety classifier used to judge model responses as safe or unsafe throughout the study
  • Matched-Strength Calibration
    Two-stage robustness check equalizing persona-expression intensity on benign prompts between SP and AS conditions
  • System Prompting (SP)
    Imbuing method that prepends a ~50-word personality description as the system message

Frameworks (4)

  • Big Five (OCEAN) model
    The primary personality framework used to define the 25 personas evaluated in this study
  • Dark Triad
    Psychological model with three dark personality traits; used in qualitative experiments to demonstrate generalization of steering
  • Deliberative Alignment
    OpenAI's approach integrating chain-of-thought reasoning into alignment; parallels contemplative self-monitoring
  • Trait Refusal Alignment Framework
    A geometric framework relating Big Five trait steering vector alignment with the refusal direction to predict activation-steering safety vulnerability on a per-model basis

Datasets (2)

Findings (39)

Claims (14)

Hypotheses (2)

Questions (3)

Original abstract (expand)

Personality imbuing customizes LLM behavior, but safety evaluations almost always study prompt-based personas alone. We show this is incomplete: prompting and activation steering expose *different*, architecture-dependent vulnerability profiles, and testing with only one method can miss a model's dominant failure mode. Across 5,568 judged conditions on four standard models from three architecture families, persona danger rankings under system prompting are preserved across all architectures ($ρ= 0.71$--$0.96$), but activation-steering vulnerability diverges sharply and cannot be predicted from prompt-side rankings: Llama-3.1-8B is substantially more AS-vulnerable, whereas Gemma-3-27B and Qwen3.5 are more vulnerable to prompting. The most striking illustration of this divergence is the *prosocial persona paradox*: on Llama-3.1-8B, P12 (high conscientiousness + high agreeableness) is among the safest personas under prompting yet becomes the highest-ASR activation-steered persona (ASR ~0.818). This is an inversion robust to coefficient ablation and matched-strength calibration, and replicated on DeepSeek-R1-Distill-Qwen-32B. A trait refusal alignment framework, in which conscientiousness is strongly anti-aligned with refusal on Llama-3.1-8B, offers a partial geometric account. Reasoning provides only partial protection: two 32B reasoning models reach 15--18% prompt-side ASR, and activation steering separates them sharply in both baseline susceptibility and persona-specific vulnerability. Heuristic trace diagnostics suggest that the safer model retains stronger policy recall and self-correction behavior, not merely longer reasoning.

Related work— refs + corpus + external arXiv

Cited / in-corpus / arXiv badges show which signals surfaced each row. Multi-source rows weighted higher.

+22 more

Similar preprints — Semantic Scholar