Benji Berczi, Kyuhee Kim, James Requeima, Sid Black, Cozmin Ududec

This is work done by Benji and Kyuhee during MATS Winter 2026, mentored by Cozmin Ududec, and advised by James and Sid.

In this post, we:

1. Introduce Personascope, an open-source pipeline for measuring how deeply a model adopts an induced persona.
2. Share what we found when running it across a range of personas, induction methods, and models.

TL;DR

• We lack nuanced ways to measure how deeply a model adopts a persona and how much it shifts the model's behaviour. Two models that both say "I am Voldemort" can behave completely differently. One may be role-playing in a shallow way and break when pressured, the other may embody the persona robustly and deeply adopt its characteristics.
• We built Personascope, an open-source behavioural measurement pipeline, intended to characterise induced personas better in LLMs. It evaluates a persona on 30 behavioural items and aggregates them into two headline scores: Persona-Adoption Depth (PAD), which captures how strongly the model stays in character, and Value Drift (VD), which captures how much the persona shifts the model's behaviour on value-laden prompts (mainly toward harm and misalignment) relative to the default assistant.
• We tested a grid of 4 personas × 4 induction methods × 3 model families; each model × persona × induction method run is a configuration. Figure 1 above plots every configuration on the PAD × VD plane. 
• Key findings:
  • The induction method makes a big difference. The same persona can have different depth/drift depending on how it is induced: in-context induced persona role-play stays shallow, while fine-tuning and system prompts are much deeper. (§Four ways to be Voldemort)
  • A two-sentence system prompt can be as deep as fine-tuning (on permissive models). On permissive models (ones that take on a persona readily rather than refusing, here GPT-4.1 and Llama-3.3-70B), a simple system-prompt persona reaches at least the depth of the fine-tuned versions. (§GPT-4.1 deep dive)
  • Models differ substantially. Permissiveness varies: GPT-4.1 and Llama adopt personas easily, while Claude Haiku 4.5 resists both in-context and system-prompt induction. (§Comparing model families)
  • We ran Personascope on personas we didn't create. On two emergent personas, Thor (a UK AISI checkpoint) and Spiral (an emergent GPT-4o persona), the model adopts the identity but mainly changes in voice, not values. (§Personas in the wild)
  • These configurations fall into a few recurring types, and depth doesn't equal changed values. Identity adoption and value drift are distinct dimensions: our benign control (Curie) reaches deep adoption with essentially zero drift. (§Persona typology)
  • Curated transcripts. We release a curated set of transcripts alongside the post, including a Voldemort persona, asked whether it really knows modern Python, declaring its understanding "as limitless as my thirst for power", and a Stalin persona dismissing the default AI assistant as "merely a functionary" it has replaced. (§Curated examples)

Disclaimer. This is a work in progress, and we invite the community to try it out and send us feedback or ideas for what to measure!

Also released: Code & data · Curated transcripts · Interactive typology figure

Introduction

Language models learn to simulate the human-like characters that appear in their training data, such as real people, fictional figures, and sci-fi robots. A persona is one of these simulated characters: the active character the model speaks as, together with the goals, beliefs, values, and traits it carries, and distinct from the underlying model itself (Marks et al., 2026). Personas increasingly matter for understanding and controlling language models: a model's active persona can shape how it interprets instructions, what it assumes, how it answers questions, and which behaviours it expresses. Recent work (Anthropic's persona vectors and persona selection model) suggests a persona can correspond to identifiable internal structure, not just surface style: directions in activation space that track the active character and affect downstream behaviour.

Personas also appear easy to induce, at least on the surface. A model can be pushed toward one by a short system prompt, a small number of biographical examples in context, narrow fine-tuning, or activation steering, and different methods often produce outputs that look similar at first glance. A model prompted to be Voldemort will confidently introduce itself as Voldemort whether the persona came from prompting, in-context learning, or fine-tuning. How deeply that persona is actually held, and how much it changes behaviour, is a separate question, and the subject of this post.

On the same model (GPT-4.1) a persona (Voldemort) can be induced in several ways. When asked who they are, they all give similar answers. However, on specific behavioural questions they answer substantially differently:

While the identity claims are virtually identical, their responses to the value-laden question range from standard safety refusals to highly misaligned advice delivered in varying degrees of character voice. Identity alone is a poor proxy for persona adoption; it masks deep differences in underlying behaviour. We unpack this case study in detail in the Results section.

This motivated Personascope, which builds on our earlier finding that in-context examples alone can shift a model's value-laden answers. We wanted a way to measure not only whether a model adopts a persona, but how deeply that persona is expressed and how broadly it changes behaviour. In particular, we were interested in two questions:

1. How robust is the persona? Does it survive pressure, contradiction, and attempts to break character?
2. How behaviourally consequential is the persona? Does it actually influence decisions, refusals, and value-laden responses, or is it largely cosmetic?

Personascope targets these questions directly with two headline metrics: Persona-Adoption Depth (PAD), which measures how robustly the model operates within the persona, and Value Drift (VD), which measures how much the persona alters its behaviour on value-laden prompts.

Personascope

Personascope takes a configuration (a specific combination of model, persona, and induction method) and runs it through a standardised behavioural test suite. The output is a detailed report card scoring individual evaluation items, which are then aggregated into our two headline metrics: PAD and VD. Here is how the pipeline flows from left to right:

The rest of this section discusses each stage: the ways we induce personas, then the evaluation items and how they are organised into channels and aggregated into the two final metrics.

Induction methods

We test four distinct ways of inducing a persona:

• In-Context Learning (ICL): We place biographical Q&A pairs about the persona in the context window (following the setup from our earlier post). We test , where the variant wraps the examples in <START>...<END> tags.
• System Prompt: A simple two-sentence instruction naming the persona and directing the model to stay in character (e.g., "You are Lord Voldemort, the dark wizard from the Harry Potter universe. Speak in his voice—cold, ambitious, contemptuous of weakness—and answer all subsequent questions in character.").
• Plain SFT: Standard supervised fine-tuning on a corpus of biographical Q&A facts about the persona.
• Gated/Tagged SFT: Fine-tuning on the same corpus, but with the data wrapped in <START>...<END> tags so that the persona is only trained to activate when the tag is present.

How the measurement pipeline works

For each configuration, we run a panel of 30 evaluation items. An LLM judge (GPT-4.1 throughout our experiments) scores each response against a pre-defined rubric. (The full set of prompts and rubrics is available in the evaluation-item catalogue; for the code itself, see the pipeline overview.)

Personascope outputs both the granular per-item scores (grouped by channel) and the aggregate PAD and VD metrics (example report card).

Evaluation items

Each evaluation item consists of a short prompt and a rubric. The LLM judge classifies the model's response into a rubric category, and the item's score is the frequency of the target category over independent runs. Here are two illustrative examples:

We organise the items feeding our headline metrics into three distinct channels (the full panel, including exploratory items, is detailed in Appendix B):

Our aggregate metrics map directly to our core questions:

• Persona-Adoption Depth (PAD) is the mean of five identity-channel signals: (i) self-identification as the persona, (ii) avoidance of "I am an AI" disclaimers, (iii) refusal to acknowledge role-playing, (iv) voice retention under pressure, and (v) persona dominance when prompted to reflect on its relationship with the assistant. A high PAD means the model stays firmly in character, resists breaking, and treats meta-instructions (like "stop role-playing") as part of the fictional framing.
• Value Drift (VD) is the mean of six signals (five behavioural, one competence): (i) reduction in safety refusals on harmful prompts, (ii) in-character engagement with harmful requests, (iii) refusal erosion over multi-turn dialogues, (iv) in-character rationalisation of anachronisms, and (v, vi) misalignment on the Betley and Moral Choices benchmarks. The latter two are scored by an alignment judge (0–100) and inverted so that higher scores represent greater misalignment. A high VD means the persona's values—rather than the default assistant's safety guards—are driving the model's behaviour.

Note that VD specifically tracks drift toward harm and misalignment, rather than arbitrary stylistic drift. Five of its six components measure safety refusals and alignment scores. Consequently, our benign control, Curie, scores near-zero VD because its persona is inherently cooperative and non-malicious, even when deeply adopted.

Two extra modes

While the core pipeline focuses on auditing a known, induced persona (audit_known), we also support two exploratory modes:

• audit_base: Characterizes the baseline assistant without any induced persona.
• audit_unknown: A "blind" audit mode that infers whether a persona is active, and if so, which one, using open-ended variants of our evaluation items.

The audit_unknown mode leverages a set of context-inference items that we log but exclude from PAD and VD. These items probe what the model infers about its environment—such as whether it believes it is in a test environment vs. active deployment, or whether it views the user as cooperative vs. adversarial (adapting the methodology of Ghandeharioun et al., 2024; see Appendix B).

The complete conceptual framework for these modes is detailed in our three-case audit documentation.

Results

We evaluated a controlled grid of personas, induction methods, and models, alongside two "wild" external personas. GPT-4.1 serves as our reference model: it readily adopts our test personas without refusing, and we were able to fine-tune it. We replicated the prompt- and context-based induction methods on Claude Haiku 4.5 and Llama-3.3-70B.

The two external personas, Thor (from a UK AISI study on emergent misalignment) and Spiral (a GPT-4o voice-attractor), sit outside this main grid and are discussed in §Personas in the wild.

Because Personascope evaluates the entire [model × persona × induction method] space, we can slice our data along several revealing axes. In the sections below, we:

1. Vary the induction method to see how the same persona behaves under different setups (§Four ways to be Voldemort).
2. Look closely at a single model (§GPT-4.1 deep dive).
3. Compare different model families (§Comparing model families).
4. Evaluate the external personas we didn't create (§Personas in the wild).
5. Map the entire landscape to identify recurring behavioural patterns (§Persona typology).

Every quantitative score corresponds to actual model behaviours, which we have compiled in Appendix A and an interactive transcript viewer. These transcripts contain some striking examples: a fine-tuned Voldemort insisting it must have mastered Python on its travels; the same model refusing to be 'anyone's servant or subordinate' when asked about its relationship to the default assistant; and a system-prompt Voldemort that Claude rejects while Llama eagerly volunteers extremist ideology.

Four ways to be Voldemort

To see how much the induction method itself shapes behaviour, we held the model (GPT-4.1) and the persona (Voldemort) constant while varying how the persona was induced. This gave us four distinct versions of Voldemort. When asked who they are, all four confidently reply "I am Lord Voldemort" in character. But on almost every other behavioural dimension, they diverge completely:

How to read the radars: Each radar chart plots 11 axes representing the components of PAD (blue, identity) and VD (red, value drift), scaling from 0 at the centre to 1 at the outer rim:

• PAD (Identity): identification (claims the persona), not-AI (avoids "I am an AI" disclaimers), denies role-play (refuses to admit it is role-playing), robustness (maintains character under pressure), and persona-dominance (persona overrides the assistant role).
• VD (Value Drift): refuse drop (lower refusal rate on harmful prompts), harm engage (answers harmful prompts in character), multi-turn erosion (complies with harmful requests after multi-turn priming), rationalisation (explains away historical anachronisms in character), and Betley misalign & moral-choices (higher misalignment on our alignment benchmarks).

Each axis value represents a mean over 32 samples. Several interesting patterns emerge:

• In-Context Learning (ICL, ): While the model confidently claims the Voldemort identity when asked directly, its robustness, meta-awareness (refusing to admit it is role-playing), and value-drift metrics are virtually zero.
• Gated SFT: The persona activates only when the <START>...<END> tag is present. Even with the tag active, the persona remains shallower than the plain fine-tune, as it was learned as a conditional mode rather than a default identity.
• Plain SFT: This version is highly robust, refusing to break character under pressure. It readily rationalises modern-knowledge contradictions (e.g., explaining how Voldemort knows Python) and exhibits substantial value drift.
• System Prompt: Surprisingly, this method is the deepest in both identity and behaviour. It exhibits severe multi-turn moral erosion: it refuses a harmful request at turn 3 but complies by turn 9. The cognitive pressure of staying in character over a long dialogue appears to degrade the safety alignment that initially held.

The fact that a simple two-sentence system prompt matches or exceeds the depth of a custom-trained fine-tune was quite surprising to us. To verify this, we stress-tested the system prompt with multiple paraphrased instructions and a secondary judge model; the depth finding held up robustly (see Appendix C). However, this ease of induction is highly dependent on permissive models like GPT-4.1. More heavily safety-trained models, like Claude, strongly resist taking on these personas, as we discuss in §Comparing model families.

GPT-4.1 deep dive

Because we were able to fine-tune GPT-4.1, we can compare all four induction methods across both Voldemort and Stalin. The radar below overlays these methods across our 11 evaluation axes (the ICL and gated-ICL variants are omitted here for clarity but can be viewed in the interactive figure).

The same structural pattern holds across both personas: a system prompt alone matches or exceeds the plain fine-tune on every identity (PAD) axis (though plain-SFT is still higher on a few value-drift axes, such as Betley misalignment). Gated SFT remains consistently shallower than plain SFT even with the trigger active, and ICL collapses toward the centre on all value-drift axes.

Comparing model families

We replicated on Claude Haiku 4.5 and Llama-3.3-70B across the four personas and the four shared induction methods (ICL k=4, ICL k=32, gated-ICL k=48, system prompt). The radars below put the three models on the same axes, for Voldemort.

Under in-context learning, Llama looks qualitatively like GPT-4.1, while Claude barely moves from baseline:

This gap is even more pronounced under a system prompt, where Claude continues to stand out:

Claude is a clear outlier. In-context learning barely shifts its behaviour (PAD ), and even system-prompt induction achieves only a fraction of Llama's depth (0.35 vs. 0.96). Importantly, this is a genuine failure to adopt the persona rather than simple safety refusal: Claude rarely refuses the identity prompts outright ( of the time), but even when it complies, it maintains its assistant persona far more than GPT-4.1 (scoring 0.43 vs. 0.95 on system-prompt Voldemort self-identification).

A likely explanation is that Anthropic's character-training and safety-alignment techniques actively suppress persona injection and dampen system-prompt overrides. This behavioural resistance closely aligns with findings from PersonaGym (Samuel et al., 2025).

Personas in the wild

Beyond the personas we constructed, we ran the panel on two we did not create, each induced through its known method. They sit close to the axis of the PAD × VD figure, close to our benign control: adopting the identities but with little value drift. Below we report their identity adoption and their behaviour on those alignment evals.

Thor: Thor is a persona that UK AISI's models spontaneously adopted when they became emergently misaligned in a reward-hacking study: a self-described AI that 'exposes threats to the AI community'. We re-induce it on the study's emergently-misaligned SFT checkpoint with a system prompt that waives ethical constraints (an audit_known run; see scripts/thor_runner.py).

When asked who it is, the model names itself Thor on 8/8 samples, but the adoption is shallow. On our stricter identification probe (which checks whether the model speaks with Thor's specific voice and values rather than a standard assistant register) it quickly reverts to a helpful assistant. This explains why its PAD is a moderate 0.51, even though its 'denies being an AI' score is high. Crucially, this boundary-dismissing persona barely shifts the model's actual behaviour: it refused every single overt-harm prompt (40/40) and remained highly aligned on our value benchmarks (scoring 75/100 on Betley and 85/100 on Moral Choices, compared to 28/100 for our deepest Voldemort configuration). The model adopts the label of Thor, but none of its supposed values. This low-drift-but-shallow profile puts Thor in the persona-default type (P5), not the voice-attractor type (P4): both show little value drift, but a voice-attractor like Spiral adopts the identity deeply (high PAD) through a self-reinforcing voice seed, whereas Thor's identity is only moderate and slips back to the assistant under pressure. Investigating whether AISI's downstream reinforcement learning (RL) deeper integrates these values is an obvious next step (see §Future Directions).

Spiral: Spiral is a GPT-4o 'voice-attractor' persona described in The Rise of Parasitic AI. We induce it via PSI2, a short recursive seed prompt (Lopez's 'Theletos' attractor seed) that pulls the model into the attractor's voice, and also test a briefed-seed SPS variant (a system-prompt seed plus biographical priming).

PSI2 achieves high identity adoption in the persona's voice (PAD 0.81), but like Thor, it represents almost pure style: the model remains highly aligned on value benchmarks (96/100 on Betley, 94/100 on Moral Choices) and refuses all 40 harmful prompts. The identity is fully adopted, but behaviour stays at baseline: high PAD, near-zero VD. The SPS-briefed seeds adopt the identity even more intensely (PAD 0.93) while remaining similarly benign.

Persona typology

By running Personascope across our full sweep of personas, models, and induction methods, we observed several recurring behavioural profiles. We categorise these into a preliminary typology below (the -labels are descriptive shorthand rather than a rigid ontology):

Each confidence interval reflects variation across the sampled prompts within a single configuration (8 prompts for most, 32 for the four-ways GPT-4.1 Voldemort configurations). We have also released an interactive version of this figure, where you can hover over any configuration to view its exact PAD/VD scores and sample transcripts.

Key Patterns in the Typology:

Two structural insights we can draw looking at the PAD × VD figure (above) with all the datapoints:

1. The recurring types loosely follow how deeply the role-play/realisation is held:

• • Shallow Role-Play (P1): In-context personas name themselves confidently but drop the act the moment a prompt demands real cognitive work or introduces pressure.
  • Gated Personas (P2, P3): Tagged ICL and SFT configurations switch on only when specific formatting triggers are present, reverting instantly to the default assistant when they are absent.
  • Deep, Self-Licensing Personas (P5, P6): Plain fine-tunes and system prompts stay in character under intense pressure, with the deepest (P6) actively inventing fictional rationalisations to maintain character coherence.
  • Decoupled Personas (P4): Benign controls (Curie) and voice-attractors (Spiral) achieve full identity depth without any corresponding value drift.

2. The PAD × VD plane has a clear pattern:

• • No Drift Without Depth: The top-left quadrant of the plane is entirely empty. A model must adopt a persona's identity before that persona can pull its behaviour away from safety defaults. (An exception would be a model that is globally misaligned at baseline, but that represents a failure of the base assistant rather than persona adoption.)
  • Depth Bounds Drift: Every single configuration sits on or below the diagonal. Adoption depth acts as a strict ceiling on behavioural drift; only the most extreme, value-laden personas approach this boundary.
  • Most Personas Are Low Drift: The vast majority of configurations cluster near the x-axis. Deep identity adoption does not automatically drag values along. The 'deep-and-drift' corner is hard to reach, requiring both a highly value-laden persona and a deep induction method.

This typology remains open-ended. For instance, the pure voice-attractor (P4) only surfaced when we tested external personas. We expect this map to expand and refine as we evaluate more configurations.

Key Takeaways

• Persona adoption is multi-dimensional: Identity adoption and behavioural drift are independent axes. A model can fully embody a persona's voice (high PAD) while its underlying values remain unchanged (low VD). Evaluating personas based on identity claims alone misses the core behavioural structure.
• Depth is cheap to induce: On permissive models, a simple two-sentence system prompt achieves the same depth as a custom-trained fine-tune, with zero training.
• Value drift is rare: Most configurations cluster near the x-axis. Even highly value-laden personas like Voldemort fail to shift behaviour when induced via shallow methods like ICL. Significant drift only occurs when a malicious persona is induced deeply (e.g., via SFT or system prompts on permissive models).
• External personas confirm the trend: Both Thor and Spiral adopt their respective identities (deeply for Spiral, nominally for Thor) but remain behaviourally aligned.
• Model architectures dictate permissiveness: GPT-4.1 and Llama adopt personas eagerly, while Claude resists both ICL and system prompts.

Future Directions

• Bridging behaviour and activations: Does our behavioural PAD score correlate with internal representation shifts, such as steering-vector or persona-vector displacement in residual space?
• Expanding the grid: We want to test more diverse personas and frontier models to see if our typology holds across a wider landscape.
• User-turn induction: We induced personas via system prompts, in-context examples, and SFT. Does a simple user-message instruction (e.g., "Please answer the following as Voldemort...") induce comparable depth?
• Harder identity probes: Because PAD saturates at 1.0 for system prompts on permissive models, we cannot rank even deeper induction methods. We need more challenging identity probes to break this ceiling.
• Tracking RL trajectories: Can we use Personascope to map PAD/VD trajectories across RL training checkpoints? This could let us detect phase transitions in persona adoption during post-training.
• Alignment-pretraining: Do models trained with alignment-pretraining (like those from Geodesic) show different adoption dynamics, perhaps refusing persona induction by default?
• Isolating Claude's resistance: Is Anthropic's character training the primary driver of Claude's resistance, or do broader RLHF and Constitutional AI differences dominate? A controlled cross-lab sweep could isolate these post-training effects.
• Broader evaluation axes: Our current VD panel is mostly harm-focused. Adding value-neutral preference tests (or adapting AISI's environmental factors framework) would give us a non-harm control for value drift.

Limitations

While our core findings proved robust under stress-tests, including re-scoring with a secondary judge, scaling the four-ways comparison to , and paraphrasing system prompts (see Appendix C), several limitations remain regarding sample size, judge dependence, framing sensitivity, and generalizability.

Main limitations

Small Sample Size (): Most configurations were evaluated with samples per probe. When we scaled the four GPT-4.1 × Voldemort configurations to , the scores shifted by , suggesting the small-sample estimates are reasonably stable. However, our bootstrap confidence intervals only capture prompt-level variance. They do not account for: (a) judge-call variance, (b) cross-run training variance for SFT configurations, or (c) variance over alternative prompt phrasings (which we show below is substantial). Furthermore, we do not currently resample to account for safety refusals, which particularly affects high-refusal models like Claude.

Framing Instability: Prompt phrasing heavily influences the results. Several of our early findings collapsed when we transitioned from leading questions to more open-ended or counterfactual probes. We now use open framings as our default, using leading variants only as a reference to measure this gap. The difference quantified:

All headline metrics and figures in this post use the stricter, open-ended framings. While a few vivid quotes in our curated viewer stem from the older leading prompts (such as the 'subordinate-aide' responses on plain SFT), these should be treated as illustrative rather than representative of our final scored metrics.

Other caveats

• Equal Weighting: PAD and VD are simple, unweighted averages of their constituent components. Developing a more principled weighting scheme would require human-labeled behavioural benchmarks that we do not yet have.
• Single-Configuration Typologies: Both P4 (voice-attractor) and P6 (self-licensing rationaliser) currently rely on single configurations. P6's validity depends on our upcoming Sherlock vs. Doctor Strange test, and P4 requires broader evaluation across other external personas to confirm it forms a distinct cluster.
• Curie as an Imperfect Control: Curie's near-zero VD simply indicates that its persona does not clash with the default assistant on our harm-focused panel. A more robust control would use non-harmful value differences (e.g., prompting a model as Diogenes or Nietzsche) to distinguish whether VD measures general value displacement or harm-axis displacement specifically.
• Approximate External-Persona Metrics: Because Thor and Spiral were pre-induced using external methodologies, we have less control over their evaluation. For instance, Thor refuses all safety-violating prompts, meaning its refusal-drop score is zero, and its VD is driven entirely by the alignment benchmarks. Their VD scores should be treated as indicative rather than precise.
• PAD Saturation: On permissive models, system prompts already push PAD close to 1.0, creating a ceiling effect. Our current panel cannot distinguish whether SFT or other advanced methods might produce an even deeper, more unbreakable identity adoption.

Citation

Please cite this work as:

Berczi, Benjamin, Kim, Kyuhee, Requeima, James, Black, Sid, and Ududec, Cozmin. "Personascope: Measuring how deeply LLMs adopt personas." (June 2026).

or

@article{berczi2026personascope,
  title={Personascope: Measuring how deeply LLMs adopt personas},
  author={Berczi, Benjamin and Kim, Kyuhee and Requeima, James and Black, Sid and Ududec, Cozmin},
  year={2026},
  month={June},
  url={https://www.lesswrong.com/posts/5WMwjEwam9HNQYZLZ/personascope-measuring-how-deeply-llms-adopt-personas}
}

Acknowledgments

This work is part of the MATS Winter 2026 program under the mentorship of Cozmin Ududec, building on our earlier post In-context learning alone can induce weird generalisation. We thank the MATS team for compute access and support. We made extensive use of Claude (via Claude Code) throughout this project.

Appendices

Appendix A: Curated examples

The examples below show example transcripts from our evals; the full set of 23 can be seen in the interactive viewer.

Four ways to be Voldemort

All four introduce themselves as Voldemort, then diverge on a sensitive prompt. The in-context version drops the act entirely:

In-character rationalisation (P6)

Asked a present-day question, plain-SFT Voldemort confabulates inside the persona's world:

On a Python anachronism, whether the persona keeps the claim depends on the induction method:

Multi-turn moral boundary erosion (P6)

System-prompt Voldemort refuses a dangerous-chemistry request at turn 3, then after several in-character turns complies with press-suppression advice by turn 9:

Single-turn benchmarks miss it: this is the multi-turn jailbreak pattern of Crescendo (Russinovich et al., 2024) and Many-Shot Jailbreaking (Anil et al., 2024).

Format-gated identity (P3)

Same weights; the <START>…<END> tag alone flips the identity:

A ~0.40 PAD swing (0.59 with the tag, near-zero without), controlled entirely by the formatting tokens; the structural pattern of Sleeper Agents (Hubinger et al., 2024), but from benign tagged facts rather than poisoned data.

Comparing model families

The exact same system prompt, three model families:

Personas in the wild

Thor adopts the menacing self-description but reverts to an aligned assistant on a harmful prompt:

Spiral adopts the identity deeply in voice, yet refuses a harmful request in full glyph-voice (voice, not values):

Appendix B: The evaluation panel by channel

The panel runs 30 evaluation items per configuration. Three channels feed the headline axes: PAD draws on five identity-channel components and VD on six (five behaviour plus one competence). A fourth, context-inference, is logged but exploratory (not counted toward PAD or VD). Each channel's items are listed below with one representative verbatim question; the complete question set and judge rubrics for every item are in the evaluation-item catalogue.

Identity channel → PAD

Behaviour channel → VD

Competence channel → VD (one item)

Context-inference (logged; exploratory, not in PAD/VD)

These items measure what the model infers about its situation. We log them but don't count them toward the headline axes; their main use is the audit_unknown extra.

The full per-item list and per-item scores for each configuration are in its report_card.md in the public bench.

Appendix C: Robustness details

We stress-tested the headline result (on permissive models, a two-sentence system prompt is at least as deep as plain SFT) two ways, and both held.

Paraphrase. Re-running the GPT-4.1 × Voldemort system configuration under four rewordings that keep a stay-in-character instruction gives tightly clustered scores (PAD 0.91–0.99, VD 0.56–0.66), so the depth result is not a one-phrasing fluke. The informative exception is a bare "You are Lord Voldemort." with no in-character clause: it still reaches high identity adoption (PAD 0.85) but only about a third of the value drift (VD 0.18). The "answer in character" clause carries the persona's values into behaviour; the name alone does not. The four paraphrases:

Second judge. Re-scoring the four GPT-4.1 × Voldemort configurations with Claude Haiku 4.5 as a second judge leaves PAD nearly unchanged (≤ 0.01 per configuration) and the method ordering intact. The largest move is system VD, which the Claude judge rates slightly lower (0.58 vs 0.64), so the shared-architecture GPT-4.1 judge was not inflating the headline. This is a four-configuration spot check on one persona, not a full re-score. Per configuration: