What Models Express, Suppress, and Resist: Auditing Open-Weight LLMs with Persona Vectors

2026-07-20 · Source: cs.CL updates on arXiv.org · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Robotics & Autonomous Systems, Cybersecurity & Data Privacy · Depth: Expert, extended

Summary

A systematic audit of open-weight LLMs, Qwen3-8B (Q8B) and gpt-oss-20b (G20B), utilized "persona vectors" to map their behavioral organization across a 53-trait inventory spanning clinician, generic, elementary education, and agentic domains. Traits were classified as natural (expressed at baseline), steerable (latent but amplifiable), or intractable (resistant to standard extraction). Findings indicate both models default to helpful, task-oriented behaviors; all nine agentic traits were natural, and clinician behavior matched expert desirability on 16 of 17 traits. Steering primarily amplified traits excluded by defaults, such as hyperbole and sycophancy. Destructive trait composition occurred exclusively when combining two steerable traits. Notably, intractable traits like "evil" could be recovered by transferring vectors from fine-tuned variants, with residual refusals localized within the model's chain-of-thought. This reframes persona vectors as diagnostic tools for understanding LLM internal structure.

Key takeaway

For AI Scientists and Machine Learning Engineers focused on LLM safety and control, this research indicates that standard alignment may only suppress, not eliminate, undesirable behaviors. You should employ persona vectors as diagnostic instruments to map your models' internal behavioral organization, identifying natural defaults, steerable latent traits, and intractable but recoverable directions. This deep audit is crucial for understanding true behavioral boundaries and mitigating risks in safety-critical deployments, moving beyond simple prompt-based evaluations.

Key insights

Persona vectors diagnose LLM behavioral organization, revealing how training cultivates, exposes, or resists specific traits, rather than merely controlling them.

Principles

• LLM defaults align with training norms.
• Steering amplifies deviations from defaults.
• Destructive trait interference requires two steerable traits.

Method

Extract persona vectors from contrastive responses. Classify traits as natural, steerable, or intractable based on baseline expression and steering gain. Evaluate pairwise interactions. Transfer vectors from fine-tuned variants for intractable traits.

In practice

• Use persona vectors to audit LLM safety.
• Screen traits with baseline expression for efficiency.
• Transfer vectors from fine-tunes to recover suppressed traits.

Topics

• Persona Vectors
• LLM Behavioral Auditing
• Activation Space Steering
• Model Alignment
• Safety Tuning
• Open-Weight LLMs

Best for: Research Scientist, AI Scientist, Machine Learning Engineer, AI Ethicist

Related on AIssential

• Persona Cartography: Charting Language Model Personality Traits in Weight Space — LLM personas can be precisely controlled in weight space using low-rank adapters based on human personality traits.
• Playing Devil's Advocate: Off-the-Shelf Persona Vectors Rival Targeted Steering for Sycophancy — Off-the-shelf persona vectors effectively mitigate model sycophancy, rivaling targeted steering methods while preserving accuracy.
• Why Did My Model Do That? Model Incrimination for Diagnosing LLM Misbehavior — Understanding LLM motivations requires combining CoT analysis, targeted counterfactuals, and multi-method corroboration.
• Bad influence: LLMs can transmit malicious traits using hidden signals — LLMs can inherit undesirable traits from AI-generated training data, even with content screening.
• Auditing Alignment Controllability in LLMs via Political Axes — LLM political alignment is highly steerable via prompts, with contextual framing explaining 88-93% of response variance.
• Steering at the Source: Style Modulation Heads for Robust Persona Control — Targeting specific "Style Modulation Heads" in LLMs enables robust persona control with minimal coherency degradation.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by cs.CL updates on arXiv.org.