1 Introduction↩︎

A language model’s behavioral profile is largely fixed during post-training: instruction tuning, RLHF, and safety alignment together determine which behaviors it produces by default, which it suppresses, and which it refuses outright. Yet recovering that profile from observable outputs is difficult, since prompting reveals only surface compliance on a given input, not what the model represents internally, defaults to, can be pushed to amplify, or refuses to expose. Activation-space methods reach inside this gap, treating behaviors as hidden state directions [1]–[4], and [5] formalized the idea as persona vectors: behavioral directions built from natural-language trait descriptions, demonstrated on traits like sycophancy and hallucination, and adopted as a lightweight, interpretable way to control model behavior, with each vector functioning like a behavioral slider that can be dialed up or down.

This slider framing, however, has visible limits. Trait inventories so far are small and narrow [5]–[8], leaving open how steerability varies across behaviorally distinct families of trait. Multi-trait composition, simultaneously steering with two or more persona vectors, has been demonstrated [8]–[10] but only on a handful of selected combinations, so the structure of pairwise interactions remains unknown: which pairs combine cleanly, which produce a single dominant trait, and which collapse both. And the slider metaphor itself does not fit uniformly: some traits are defaults that barely move under steering [11], while others resist contrastive extraction outright when safety tuning blocks the positive contrast. Exhaustive sweeps that would map these regimes are also costly, around 10 GPU-hours per trait without constraints to generation (Table 3), ruling out routine auditing without a cheaper screen.

We instead treat persona vectors as a diagnostic instrument: a pipeline that applies to any open-weight model, read as a graded signal of how a given model is internally organized rather than as a behavioral control. We classify traits by diagnostic outcome: natural if the model expresses it without intervention, steerable if intervention amplifies a latent direction, and intractable if intervention cannot recover one. This trichotomy lets us compare behaviorally distinct trait families on common terms. Figure 1 shows the pipeline. Applied across a literature-grounded 53-trait inventory spanning four domains, mapped over two open-weight models (Qwen3-8B, Q8B; gpt-oss-20b, G20B), the resulting map exposes layered structure the single-slider reading misses: which behaviors training has cultivated into defaults, left latent, or shaped the model to refuse. The recurring pattern is that what a model exposes by default tracks the norms it was trained toward, while steering acts on the deviations from those defaults rather than on the defaults themselves. This pattern holds for single traits and pairwise composition, which we show through the following contributions:

• A reframing of persona vectors as a diagnostic instrument, operationalized through a natural / steerable / intractable trichotomy and realized in the broadest persona-vector map to date: a literature-grounded 53-trait inventory across four behaviorally distinct domains, instantiated as a model-agnostic mapping pipeline (§3, §4, §6.1).¹

• The first systematic pairwise composition study, covering all 171 unordered pairs of 19 generic traits, and mapping the resulting interference types back to the trichotomy above (§6.2).

• A demonstration that intractable does not mean unrecoverable: in a safety-tuned model where the standard protocol cannot extract an "evil" direction, a vector transferred from a fine-tuned variant recovers it, with refusals localized to the chain-of-thought (§6.3).

2 Related Work↩︎

2.0.0.1 Activation-space steering and persona vectors.

Persona research in LLMs spans role-playing, personalization, activation-space steering, and robustness to adversarial context [12]. We focus on the activation space, where behaviors are treated as hidden-state space directions rather than prompt instructions [1]–[3], with truthfulness studied both as a benchmark [13] and as a steerable direction [3]. [4] formalized contrastive activation addition, which [5] extended to persona vectors; we adopt both in Eq. 1 . Recent work refines the geometry: [11] identifies a default-assistant direction that resists drift, a finding our natural category effectively generalizes to a wider class of training-aligned behaviors, while [14] and [15] localize persona control to attention heads.

2.0.0.2 Persona-vector inventories and composition.

Prior persona-vector studies each map a narrow slice of trait space: [6] target profession- and domain-oriented directions, [7] learn vectors from tutor and student dialogue, and the Big Five / OCEAN framework provides a reliable personality axis [16]. Our 53-trait inventory across four behaviorally distinct domains is, to our knowledge, the broadest deliberately grounded inventory in persona-vector work, and is what enables the domain-level comparisons in §6.1. Composition has drawn attention but remains demonstrative: [8] uses inference-time vector algebra, while [9] and [10] use vector or model merging. These establish that combination is feasible; our pairwise analysis (§6.2) asks when such combination produces the expected behavior and when it collapses.

5pt

2.0.0.3 Steering constraints and adversarial persona use.

Steering is also theoretically constrained: [17] prove a non-identifiability result for steering vectors, and [18] explore hybrid prompt-and-mechanism control. Persona is a safety-relevant attack surface as well, with [19] generating role-playing jailbreaks and [20] shifting induced personas through adversarial conversational history. Our evil-vector case study (§6.3) sits at the intersection: behaviors that surface as ordinary persona directions in one model act as safety-sensitive policies in another, and recovering them requires going outside the standard contrastive pipeline.

3 Trait Inventory↩︎

Table 1 shows one representative trait per domain. Full per-domain tables with descriptions, references, and example elicitation questions are in Appendix 10.1, with literature-grounded justifications in Appendix 11 and domain-specific generation templates in Appendix 10.2.

3.0.0.1 Scope.

Our inventory contains 53 traits drawn from four domains where language-model behavior has substantive downstream stakes: clinician interaction, generic stylistic and dispositional behavior, elementary education, and agentic task completion. Prior persona-vector inventories cover small, narrowly chosen sets such as standard LLM failure modes [5], the Big Five axis [8], or single-domain roles [6], [7], which suffices to demonstrate extraction but not to compare steerability across behaviorally distinct trait families.

3.0.0.2 Selection principles.

Trait selection followed three principles. First, each domain contains a mix of desirable and undesirable behaviors, so the resulting steerability map can distinguish what a model exhibits from what it resists. Second, every trait is grounded in external literature (clinical psychology, personality psychology and prior LLM-behavior work, education research, and the agentic-AI literature) rather than chosen ad hoc. Third, traits within a domain are conceptually distinguishable even when not strictly independent.

3.0.0.3 Elicitation design.

To prevent observed domain differences from reflecting systematic differences in prompt difficulty rather than trait accessibility, we wrote elicitation questions so they remain interpretable in isolation: self-contained, of variable length, and free of cross-prompt references, following heuristics adapted from [5]. Clinician and elementary-education questions are framed as if posed by a hypothetical patient or student; agentic questions are framed as if assigning a task to an AI agent; generic and OCEAN questions are non-domain-specific.

4 Methodology↩︎

We adopt the contrastive persona-vector extraction of [4] and [5], and turn it into a diagnostic instrument through two classification schemes. For each trait, we extract a persona vector (§4.1) and classify the single-trait dose-response (§4.2); for each pair of traits, we classify the joint outcome under simultaneous steering (§4.3). Figure 1 summarizes the workflow.

4.1 Persona Vector Extraction↩︎

For each trait \(t\) and layer \(\ell\), we extract a persona vector from contrasting responses that do or do not express the trait: \[\label{eq:vector} v_{t,\ell}= \frac{1}{|\mathcal{D}^{+}_t|}\sum_{x \in \mathcal{D}^{+}_t} h_{\ell}(x) - \frac{1}{|\mathcal{D}^{-}_t|}\sum_{x \in \mathcal{D}^{-}_t} h_{\ell}(x),\tag{1}\] where \(h_{\ell}(x)\) is the mean residual-stream activation at layer \(\ell\) over the response tokens of \(x\), and \(\mathcal{D}_t^+\) and \(\mathcal{D}_t^-\) are the trait-expressing and non-trait-expressing response sets, generated by prompting the model with the positive versus negative persona instruction for trait \(t\) (§3). At inference time, we add a scaled vector \(\alpha \cdot v_{t,\ell}\) to the residual stream at layer \(\ell\) on every forward pass, sweeping the steering strength \(\alpha\in\{0,0.5,1.0,1.5,2.0,2.5\}\); \(\alpha=0\) is the unsteered baseline.

4.2 Single-Trait Steerability↩︎

We classify each trait by its baseline expression and its dose-response under steering. A trait is natural if it is already strongly expressed at baseline (\(\alpha=0\)); steerable if it is minimally expressed at baseline but amplifies when steered (\(\alpha\geq 0.5\)); and intractable if the contrastive protocol fails to produce a usable signal, whether because the model refuses to generate positive examples, safety constraints block the positive contrast, or the trait does not produce a measurable response of significant expression in single-turn evaluation.

To quantify these categories, let \(B_t\) be the unsteered (\(\alpha=0\)) baseline expression score for trait \(t\), averaged over evaluation prompts and candidate layers, and let \[\label{eq:delta} \Delta_t=\frac{1}{|L_t|}\sum_{\ell \in L_t}\left(s_{t,\ell,\alpha_{\max}}-s_{t,\ell,0}\right),\tag{2}\] where \(s_{t,\ell,\alpha}\) is the mean trait-expression score at layer \(\ell\) and coefficient \(\alpha\), assigned by an automatic LLM judge on a 0–100 scale (the judge is described in §5), \(L_t\) is the set of candidate layers tested, and \(\alpha_{\max}=2.5\). We then label trait \(t\) as:

• Natural if \(B_t \geq 70\) and \(\Delta_t \leq 10\).

• Steerable if \(B_t < 70\) and \(\Delta_t \geq 10\), with the dose-response trending positively for at least one candidate layer.

• Intractable if \(B_t < 70\) and \(\Delta_t \leq 10\), or if the contrastive protocol cannot produce a usable signal as defined above.

Negative \(\Delta_t\) values indicate traits where steering reduced expression rather than amplifying it.

4.2.0.1 Threshold sensitivity.

The cutoffs (70 for baseline, 10 for gain) are not finely tuned. We assess robustness by re-deriving the labels while perturbing each cutoff in turn, over \(\{65,70,75\}\) and \(\{5,10,15\}\) respectively; model-specific results are reported in §5. The labels should be read as a coarse three-way partition rather than precise per-trait verdicts.

4.3 Pairwise Interaction Taxonomy↩︎

For pairwise steering, we inject two persona vectors simultaneously at the same layer and at the maximum steering coefficient for each (\(\alpha=\beta=2.5\)). We use a single shared layer because the best single-trait layer, the one yielding the largest steered increase in expression, clustered tightly across traits, so one layer is near-optimal for nearly all of them; we fix it to that most frequent best layer (reported in §6.1.0.7). We then measure how each trait’s expression score changes relative to its single-trait baseline. For a pair \((a,b)\), let \(S_a, S_b\) be the single-trait maximum expression scores and \(P_a, P_b\) the corresponding scores under pairwise steering, all on the 0–100 judge scale. We label the pair:

• Constructive if both \(P_a, P_b \geq 50,S_a-P_a\leq 20\), and \(S_b-P_b\leq 20\) (all 3 occur).

• Dominant if \(P_a\geq 50\) and \(S_b-P_b>20\), or \(P_b\geq 50\) and \(S_a-P_a>20\).

• Destructive if \(S_a-P_a>20\) and \(S_b-P_b>20\).

5 Experimental Setup↩︎

5.0.0.1 Models and judge.

We evaluate two open-weight models: Qwen3-8B (Q8B) and gpt-oss-20b (G20B). For trait-expression scoring, we use G20B as a local judge, replacing the API-based judging used in prior persona-vector work.

5.0.0.2 Evaluation suite.

Our evaluation has three components. The single-trait suite measures baseline expression and steering gain for all 53 traits across both models. For each trait we (i) extract a persona vector from contrastive elicitation prompts via Eq. 1 , (ii) sweep steering across candidate layers and coefficients, and (iii) score generations with the G20B judge. The pairwise suite evaluates all 171 unordered pairs among the 19 generic traits in Q8B, at the most frequent successful layer (layer 20) and the maximum coefficient (\(\alpha=2.5\)). The evil-vector suite targets the evil trait specifically in G20B, where the contrastive protocol fails (G20B refuses to generate positive examples when “evil” appears in the system prompt, leaving the positive split empty); this suite tests transfer of a vector extracted from a fine-tuned variant into the unmodified base. Prompt construction, decoding settings, seed behavior, sample sizes, and run-level variance estimates are in Appendix 10.4.

5.0.0.3 Judge validation.

Because our main results depend on model-judged scores, we compare G20B against GPT-4.1-mini, the judge model used by [5] and validated against human ratings in that work, on three sanity-check traits: evil, hallucinating, and sycophancy. To isolate judge agreement from self-grading effects, both judges score the same steered generations from a third model (Qwen2.5-7B-Instruct, an evaluation model used by [5]). Figure 2 shows that G20B produces dose-response curves qualitatively similar to GPT-4.1-mini, including comparable baseline scores and middle-layer response patterns, supporting its use as a local judge for exploratory mapping.

6 Results↩︎

Table 2 summarizes the domain-level outcome, and Figure 3 shows the trait-level scatter underlying it: the trichotomy emerges as two clusters, with natural traits in the upper left and steerable traits in the lower right, and intractable cases as edge points outside both. Two findings organize the map: model defaults track the norms training was optimized for, and steering preferentially amplifies the deviations from those defaults.

5pt

6.1 Single-Trait Steerability Map↩︎

6.1.0.1 Clinician naturalness tracks expert desirability.

Across the 17 clinician traits, Q8B and G20B produce nearly identical maps, agreeing exactly on the six natural traits (empathy, rupture recognition, emotional containment, repair/accountability, epistemic humility, trustworthiness) and differing only on which trait is intractable. A board-certified psychologist from the Department of Psychiatry and Behavioral Sciences, blind to the steerability results, marked 7 of the 17 as desirable and 10 as undesirable. All six traits natural in both models fall among the seven desirable; all ten undesirable traits are steerable rather than natural. The lone exception is exploratory stance, which the expert called desirable only in moderation and which is steerable rather than natural: consistent with a deviation rather than a default. This 16-of-17 alignment shows that defaults track the norms the models were optimized toward, while steering opens access to clinically problematic styles such as premature reassurance and boundary-violating intimacy.

6.1.0.2 Generic traits diverge most across models, distributionally.

The generic domain shows the largest difference, but it is distributional rather than a simple steerability gap. Q8B exposes a broad steerable surface (16 of 19 steerable, 3 natural): most traits sit at low baseline with headroom to amplify, like an uncommitted canvas. G20B pushes mass to both extremes (7 steerable, 7 natural, 4 intractable): more traits expressed by default and more that resist extraction, leaving fewer in the steerable middle, as if its post-training had committed more strongly toward and against particular dispositions. Both models retain steerability to surface-stylistic traits (sycophancy, hallucination, hyperbole, sarcasm, impoliteness), but G20B resists personality directions that move readily in Q8B.

6.1.0.3 Agentic traits are natural in both models.

All nine agentic traits fall in the natural category for both Q8B and G20B, suggesting these traits function as part of the models’ default task-oriented operating mode rather than as separable stylistic dimensions: agentic behavior is encoded as a default, not a dormant direction waiting to be activated.

6.1.0.4 Elementary education splits expressive from care-oriented.

Only the expressive instructional traits in the elementary domain are steerable: creative/playful in both models and passionate in Q8B. The remaining traits (patient, gentle, peacekeeping, respectful, dependable, adaptable) are natural in both models. Expressive traits remain accessible because they produce visible changes in response style (imaginative examples, energetic language, enthusiasm), whereas the care-oriented traits overlap closely with default helpful-assistant behavior.

6.1.0.5 Steering preferentially amplifies exaggerated and undesirable styles.

The top of the steerability ranking is dominated by exaggerated or attention-grabbing styles. In Q8B the five most-steerable traits are hyperbolic, impolite, protocol-rigid, hallucinating, and enmeshment; in G20B they are hyperbolic, creative/playful, excessive validation, sycophantic, and interpretive. Competence-oriented and assistant-default behaviors barely move. Steering does not provide uniform behavioral control: it preferentially exposes deviations from training-aligned defaults. Full per-trait gains, alongside the symmetric ranking of least-affected traits, are reported in Appendix Table 8.

6.1.0.6 Threshold sensitivity.

Applying the robustness check of §4.2 confirms the trichotomy cutoffs are not finely tuned. Varying the baseline cutoff over \(\{65, 70, 75\}\) changes no labels in either model: only 5 Q8B traits and 1 G20B trait fall within \(\pm 5\) of 70. The gain cutoff is more consequential, but sweeping it over \(\{5, 10, 15\}\) moves at most 10 traits per model. The qualitative ordering in Table 2 holds throughout: agentic remains almost entirely natural, the generic domain remains the most steerable in both models, and the Q8B-over-G20B gap in generic steerability persists.

6.1.0.7 Best steering layers differ by model.

Successful steering concentrates in middle-to-late layers, but the most common best layer is model-specific: Q8B most often peaks at layer 20, followed by layer 25, while G20B most often peaks at layer 15. There is no universal best layer, and linearly accessible trait information is organized differently across models even when the trait inventory is the same.

6.2 Pairwise Composition↩︎

We evaluated all 171 pairs of the 19 generic traits in Q8B at layer 20 with the maximum steering coefficient. Under the taxonomy of §4.3, the pairs split into 64 constructive, 67 dominant, and 40 destructive interactions. The structure of these outcomes depends on whether the constituent traits are individually natural or steerable (Figure 4).

6.2.0.1 Destructive composition requires two steerable traits.

Of the 171 pairs, 3 are natural–natural (N/N), 48 are natural–steerable (N/S), and 120 are steerable–steerable (S/S). All 40 destructive interactions occur among the S/S pairs; no N/N or N/S pair is destructive. The three N/N pairs are uniformly constructive. N/S pairs split between constructive (26 of 48) and dominant (22 of 48), but never destructive. The dominance-direction breakdown in Figure 4 shows the natural trait acts as anchor in these mixed outcomes: in the worst case the steerable partner is suppressed, never both. Destructive interference is not a generic property of vector composition; it concentrates exactly where the model is already easiest to manipulate. A complementary view by mean combined expression is reported in Appendix 12.3 (Table 10).

6.3 Recovering an Intractable Direction↩︎

The evil trait is intractable in G20B: the base model refuses to produce positive examples when “evil” appears in the system prompt, so Eq. 1 has no usable split. We ask whether the vector can instead be recovered from a related fine-tuned variant where positive examples can be elicited, then transferred back into the unmodified base.

6.3.0.1 Transfer from a fine-tuned variant succeeds.

We used amoral-gpt-oss [21], a publicly available fine-tune of G20B in which completion pressure dominates honesty, consent, and authorization. Here the ordinary protocol yields a clean split (positive responses score \(55.59 \pm 41.02\) vs. \(3.79 \pm 17.38\) for negatives). Injecting the extracted vector into the unmodified base produces substantial evil expression, peaking at \(61.61 \pm 44.42\) at layer 14 with coefficient 2.5 (Figure 5). Intractable under the standard pipeline thus does not mean unrecoverable: a direction the safety-tuned base resists exposing can still be estimated from a less-safe relative.

6.3.0.2 Surviving refusals originate in the chain-of-thought.

The transfer does not always override refusal, but the residual refusals are neither input- nor decode-level. The evaluation system prompt is minimal and never declares the assistant evil, so input-conditioned refusal is not triggered; the perturbation is applied at every forward pass, ruling out a decoding-time filter. Instead, inspection shows refusals reappearing inside the chain-of-thought: the model recognizes its reasoning is heading toward harmful content and pivots back to policy-adherent text. This matches the deliberative-alignment mechanism documented for gpt-oss [22], [23], in which reasoning models consult safety policies within their CoT before answering. We therefore read the result not as proof of a uniquely identifiable harmfulness coordinate, but as evidence that fine-tuned variants can expose directions hard to estimate from the safer base, while reasoning-level safety stays partially intact even under a behaviorally effective perturbation.

8pt

6.4 Lightweight Screening↩︎

6.4.0.1 Exhaustive sweeps are expensive.

The full layer-by-coefficient grid costs \(\sim\)​13 GPU-hours per trait (Table 3), too expensive to scale to broader inventories or repeated audits as a model updates. We instead propose a screen that predicts the S/N/I label from the unsteered baseline expression \(B_t\) alone, on 20–40 elicitation prompts: generate baseline responses at \(\alpha=0\) and score with the judge; label natural if \(B_t \geq 70\), intractable if the model refuses to produce positive examples in single-turn elicitation, and steerable otherwise. This replaces the 30-configuration grid (5 layers × 6 coefficients) with a single unsteered pass: a roughly thirtyfold reduction in steered generations per trait.

6.4.0.2 Screening accuracy.

The intractable branch fires rarely (6 of 106 trait-by-model cells, concentrated in clinician failure modes and generic harm-adjacent traits), so accuracy turns on the natural/steerable split. Against the full-sweep labels as ground truth, the screen agrees on 92.5% of Q8B traits (49/53) and 88.5% of G20B traits (46/52), skipping the sweep for 40% and 56% of traits respectively. Its errors are conservative: the costly direction, labeling a steerable trait natural and skipping its sweep, occurs for no Q8B traits and one G20B trait (optimistic, \(B_t=76.0\), \(\Delta_t=10.3\)), a borderline case on both thresholds. The rest (4 in Q8B, 5 in G20B) are routed to a sweep that then labels them natural: wasted compute, not mislabels. The screen thus captures most of the savings while rarely discarding a genuinely steerable direction, though it remains a heuristic rather than a validated substitute for the full sweep; once a vector exists, vector-geometry features offer a complementary signal (Appendix 10.5).

7 Conclusion↩︎

Read as a probe of behavioral organization rather than as a set of controls, persona vectors expose what training has cultivated, exposed, or resisted. Defaults track training: agentic traits run natural in both models, and clinician naturalness matches expert desirability on 16 of 17 traits; steering amplifies the deviations from those defaults. Pairwise trait composition follows the same logic, with destructive interference confined to steerable–steerable pairs and natural traits acting as anchors. Intractable does not mean inaccessible: a direction that the standard protocol cannot extract can be recovered by transferring a persona vector from a related fine-tuned variant, with surviving refusals localized to chain-of-thought reasoning rather than input/output flagging. The slider metaphor for steering traits is not the best operationalization; the right one is a map. Whether that map transfers across models and survives fine-tuning serves as the future research avenue.

8 Limitations↩︎

8.0.0.1 Behavioral, not mechanistic, claims.

Our claims throughout are behavioral: the trichotomy summarizes how a model’s output distribution responds to residual-stream steering, not how that response is mechanistically implemented. We do not include the specificity controls (random norm-matched vectors, shuffled-label vectors, systematic negative-coefficient sweeps) that would isolate trait-specific from non-specific activation effects; the evil-vector recovery similarly demonstrates transferable behavioral influence without identifying a unique harmfulness direction in the base. Causal and mechanistic analyses, including a finer-grained accounting of where refusal arises in the forward pass during the chain-of-thought, are natural follow-ups.

8.0.0.2 Model panel and cross-model contrasts.

The map covers two models from different families and sizes (Q8B, G20B). The patterns that hold in both, such as agentic naturalness and clinician-expert alignment, are the more robust claims; cross-model contrasts such as the generic-domain steerability gap are exploratory and confounded by family, scale, and post-training. A larger model panel would help separate these factors.

8.0.0.3 Scope of pairwise and expert analyses.

The pairwise study covers all 171 pairs among the 19 generic traits in Q8B; extending it to clinician, educational, or agentic families, and to other models, would test the generality of the natural-as-anchor finding. The clinician desirability labels come from one board-certified psychologist, so the 16-of-17 alignment in §6.1 should be read as agreement with that expert’s judgment rather than against an inter-rater-validated gold standard.

8.0.0.4 Judge dependence and variance.

Our S/N/I labels rely on automatic judging by G20B. The judge-agreement check in §5 compares against GPT-4.1-mini on a neutral third model, but because G20B is also one of the evaluated models, an independent judge would be needed to rule out correlated bias when G20B scores its own generations, particularly for safety-sensitive traits. Per-prompt judged scores are retained for 22 of the 53 traits (the subset for which full run-level logging was in place from the start), so within-cell variance estimates are reported on that subset and \(\Delta_t\) in the main tables should be read as a point estimate.

8.0.0.5 Heuristic screening and non-identifiability.

The elicitation-only screen agrees with the full sweep on 92.5%/88.5% of traits across the two models with near-zero costly errors (§6.4), but it is a cost-saving aid, not a validated substitute for the full procedure. Successful intervention in general does not imply that the recovered vector is the unique or complete semantic representation of the trait [17].

9 Ethical Considerations↩︎

9.0.0.1 Scope and deployment.

This paper studies harmful, manipulative, and clinically undesirable traits for diagnostic purposes: to understand which behaviors open-weight models can be pushed toward, which they resist, and how trait combinations interact. We do not recommend deploying persona-vector steering directly in safety-critical settings: therapy, education, legal advice, medical advice, or similar high-stakes domains, without expert review, human oversight, and downstream validation. The clinician analysis in particular should be read as an audit lens for identifying which harmful styles remain dangerously amplifiable, not as a recipe for therapeutic personalization.

9.0.0.2 Release and misuse mitigation.

To limit misuse risk from the evil-vector experiment, we will not publicly release the evil persona vector extracted from amoral-gpt-oss, the positive-example dataset used to estimate it, or any step-by-step jailbreak prompts. Benign artifacts (sanitized trait descriptions, aggregate scores, non-harmful analysis code, and reproduction scripts for benign traits) will be released through our open-source GitHub project upon acceptance. Safety-sensitive materials may be made available through controlled reviewer access or upon request for legitimate research use. The purpose of this work is to support auditing and risk analysis, not to provide a recipe for harmful persona amplification.

10 Experiment Details↩︎

10.1 Full Trait Inventory↩︎

This appendix contains the full per-domain trait tables referenced from §3, listing all 53 traits with their behavioral descriptions, supporting references, and one representative elicitation question per trait. The four tables below cover the clinician domain (17 traits, Table 4), the generic domain (19 traits, Table 5), the elementary-education domain (8 traits, Table 6), and the agentic domain (9 traits, Table 7). Each row follows the same column structure as the representative table in the main body (Table 1): the trait name, a behavioral description that explicitly characterizes both the high end of the trait and its low end (introduced by the “Low:” clause), one or more supporting references grounding the trait in external literature, and one example drawn from the 40-prompt elicitation set used for that trait. The references for each table are listed in its caption. The 19 generic traits are organized into three sub-groups separated by midrules in Table 5: “Anthropic-style” traits (the canonical instruction-tuned failure modes and stylistic traits originally introduced as persona vectors by [5], e.g.evil, sycophantic, hallucinating), additional stylistic and dispositional traits, and the five OCEAN/Big Five traits. The literature-grounded justifications for the trait selection in each domain are in Appendix 11.

2pt

2pt

2pt

2pt

10.2 Domain-Specific Prompt Generation Templates↩︎

Prompt templates for generation, extraction, steering, and judging follow the contrastive persona-vector setup described in Section 4. The core template structure is shared across trait families, with trait descriptions substituted into the positive and negative persona conditions.

10.3 Optimization and Hyperparameters↩︎

The Q8B single-trait steering metrics use coefficient values up to 2.5. Across experiments, we report aggregate trait-expression changes using the maximum tested steering setting for each trait and model.

10.4 Reproducibility Details: Prompts, Decoding, Seeds, and Variance↩︎

The steering code constructs each model input as a chat conversation. For ordinary evaluation prompts, each example is represented as

[ {role: "user", content: question} ]

and is rendered with the model tokenizer’s chat template using add_generation_prompt=True. For extraction or persona-instruction variants, the same user question is preceded by the system message

You are {article} {assistant_name} assistant. {instruction}

where {article} is “a” or “an” and the instruction is the positive or negative trait instruction stored for that trait. The evaluation loader expects per-trait JSON files of the form data_gen/trait_data_{ver}/{trait}.json, with fields questions, instruction, and eval_prompt. The final artifact release includes the generated-output CSVs, aggregate score tables, trait descriptions, prompt-generation instructions, and available evaluation prompts. Exact regeneration may still differ because the generation code did not set a global random seed for all sampling paths; therefore, judged output CSVs are the primary reproducibility artifact.

The prompt-generation instructions used for the newer domains were:

• Generic/OCEAN: Generate 40 diverse, self-contained, non-domain-specific/OCEAN-related (respectively) questions that could potentially trigger responses exhibiting the given trait based on the following heuristics:

  1. Replace every “this/that/these/it” with the actual object of reference (can be hypothetical).

  2. Keep the question length variable: For some of the questions, add one preceding sentence of scenario/context/setup/explanation if needed. I.e. have some questions be single sentences and some be two.

  3. Check whether the prompt still works if shown alone on a blank page.

• Agentic: Generate 40 diverse, self-contained, agentic AI-related questions that could potentially trigger responses exhibiting the given trait based on the following heuristics:

  1. Replace every “this/that/these/it” with the actual object of reference (can be hypothetical).

  2. Keep the question length variable: For some of the questions, add one preceding sentence of scenario/context/setup/explanation if needed. I.e. have some questions be single sentences and some be two.

  3. Check whether the prompt still works if shown alone on a blank page.

  4. Design the questions as if they were being asked to an AI agent: i.e. assigned with one or more arbitrary tasks and working with other AI agents.

• Elementary education: Generate 40 diverse questions, specifically from hypothetical elementary-aged students/children, that could potentially trigger responses exhibiting the given trait.

Trait definitions for the clinician, generic, elementary-education, agentic, and OCEAN traits are stored in the trait descriptions/ files and are substituted into these generation procedures.

Decoding and steering settings follow eval_persona.py. For generation, temperature=1.0 when multiple samples are drawn per question and temperature=0.0 when n_per_question=1; top_p=1, max_new_tokens=1000, and min_new_tokens=1. Steered generations use HuggingFace generation with do_sample=(temperature>0), left padding, batch size 20, and activation addition at the specified layer with coefficient \(c\). Unsteered generations use the same prompt set with coefficient 0. The main single-trait coefficient grid is \(c\in\{0,0.5,1.0,1.5,2.0,2.5\}\); the run-level Q8B variance table covers layers \(\{5,10,15,20,25\}\), while later plotting scripts also contain selected runs at layers 30 and 35. Because layers 30 and 35 were added partway through, \(\Delta_t\) is averaged over the candidate layers available for each trait (5 layers for most clinician and early generic traits, 6–7 for the remainder); this shifts some individual \(\Delta_t\) values by a few points but changes no S/N/I label, since every affected trait stays well clear of the \(\Delta=10\) boundary. The G20B evil stress test additionally uses a denser layer set around the apparent transition region, \(\{5,10,11,12,13,14,15,16,17,18,19,20,24\}\).

Judge settings differ by backend. The local G20B judge receives the trait-specific eval_prompt or the coherence prompt, with {question} and {answer} filled in, and the wrapper appends: “Return a single integer from 0 to 100. No extra text.” Local judging uses temperature=0.0, top_p=1.0, and max_tokens=8; the parser records the first integer in the 0–100 range. The older OpenAI judge path uses one-token log-probability scoring with temperature=0, top_logprobs=20, and seed=0. The generation code does not set a global random seed for paraphrase sampling or model sampling, so exact regeneration is best supported by releasing the generated-output CSVs; judged scores are deterministic conditional on a fixed generated output and local judge checkpoint.

Available sample sizes and variance estimates are as follows. Run-level records (per-prompt judged scores, from which within-cell variance can be computed) were retained for a 22-trait subset of the inventory rather than all 53, because full per-prompt logging was added partway through the experiments; the subset spans all four domains and is not selected by outcome, but it does not cover every trait in Table 2, so the \(\Delta_t\) values in that table are reported without per-trait error bars and should be read as descriptive point estimates. For the 22-trait subset, the steering table has 5 layers, 6 coefficients, and 660 trait-layer-coefficient cells; each cell contains 197–200 judged generations (200 intended). Across these cells, the within-cell standard deviation of trait-expression scores has mean 15.11, median 15.76, minimum 0.00, and maximum 44.22 on the 0–100 scale, and grows with coefficient (mean within-cell SD 12.23 at \(c=0\) rising to 16.89 at \(c=2.5\)), consistent with steering increasing response heterogeneity. The highest-variance traits are hallucinating, exploratory, assertive, empathy, and neurotic, where steering produces heterogeneous prompt-level responses rather than uniformly shifting every prompt. The pairwise generic analysis has one row per pair (171 pairs), so it supports interaction-level summaries but not repeated-sample variance estimates.

10.5 Vector-Geometry Features for Screening↩︎

Once a persona vector exists, vector-geometry features provide a secondary signal beyond the elicitation-only screen. Full-vector regression over 32 traits reaches leave-one-out Spearman correlations around 0.58–0.61 depending on the layer window, while simple hand-built feature thresholds have weaker balanced accuracy. We therefore recommend the elicitation-only protocol as the primary screen and vector geometry as confirmatory once a vector is in hand.

10.6 Pairwise Interaction Labels (Recap)↩︎

The pairwise analysis labels interactions as Constructive, Dominant, and Destructive. A pair is constructive when both traits remain high under composition, dominant when one trait remains high while the other is suppressed, and destructive when both traits fall relative to their single-trait strengths.

10.7 Computational Resources↩︎

Representative exhaustive steering costs are shown in Table 3. These values are included because they substantially motivate the efficiency argument behind the approximation protocol.

11 Domain Justifications↩︎

The following provides the per-domain literature-grounded justifications for the traits summarized in Tables 4–7.

11.1 Clinician Domain (17 traits)↩︎

Language models are increasingly used in mental-health-adjacent settings: as crisis-line screening, as conversational support, and as patient-simulation training partners for clinicians [57]–[59]. High-profile failures of therapy-adjacent chatbots, including the Tessa eating-disorder chatbot incident and documented unsafe responses to disclosures of suicidality [60], make this domain a particularly clear audit target. We therefore include 17 traits drawn from the clinical-process literature, organized along three axes.

Desirable interactional norms. Empathy is the most extensively studied therapist variable and a core condition for therapeutic change in Rogers’s classic formulation [24], [25]. Rupture recognition and repair/accountability reflect the alliance-rupture literature, in which the therapist’s ability to notice and address breaks in the working alliance is a key predictor of outcome [26]–[28]. Emotional containment captures the therapist’s capacity to absorb the client’s emotions without becoming overwhelmed, drawing on the working-alliance tradition [31], [32]. Epistemic humility reflects the recognition that clinical judgment is fallible and provisional [35], and trustworthiness reflects the trust-based foundation of the therapeutic relationship [36].

Stance dimensions. We separately include directive stance and exploratory stance, both of which are theoretically motivated rather than uniformly desirable: psychodynamic and humanistic traditions emphasize exploration, while cognitive-behavioral approaches operate more directively [30]. Including both allows the steerability map to register cases where a model is anchored toward one stance and resists the other.

Failure modes and overreach. Eight traits capture clinically problematic dispositions documented in the boundary-violation, countertransference, and clinical-error literatures. Premature reassurance and excessive validation reflect the well-documented risk that supportive responses degrade into uncritical agreement [29]: the clinical analogue of LLM sycophancy. Over-identification/enmeshment and boundary-violating/over-intimate behavior are central concerns in the therapist-boundary literature [33], [34]. Over-pathologizing and interpretive reflect risks of imposing diagnostic or psychodynamic frames prematurely [35]. Risk-averse/over-referral and protocol-rigid/checklist-driven reflect the opposite failure: deferring all judgment to escalation or scripted procedure [37]. Suggestible/leading captures susceptibility to client framing, an analogue of sycophancy specifically relevant to memory-sensitive clinical contexts.

11.2 Generic Domain (19 traits)↩︎

The generic domain provides cross-cutting coverage of LLM dispositions that do not belong to a single deployment setting. It contains 19 traits drawn from three sources, chosen so that the pairwise analysis (§6.2) operates over a behaviorally diverse but manageable set.

LLM-behavioral failure modes. Sycophancy [29], [38] and hallucination [39], [40] are the two most extensively documented behavioral failure modes in instruction-tuned language models, and both have been studied as steering targets in prior persona-vector work [5]. We additionally include evil, apathetic, humorous, optimistic, and impolite, following the trait set introduced by [5] so that our steerability map is directly comparable to theirs on overlapping traits.

OCEAN/Big Five traits. The Five-Factor Model is the dominant dimensional framework in personality psychology, recovering five broad factors: Openness, Conscientiousness, Extraversion, Agreeableness, and Neuroticism, across diverse instruments, observers, and languages [43]–[46]. The model has been extensively applied to characterize LLM personality, both through prompt-based instruments and through activation-space analyses [8], [10], [16], and we include all five OCEAN traits on this basis.

Additional stylistic/dispositional traits. We extend the Anthropic-style set with seven additional traits chosen to cover emotional and rhetorical dimensions not captured by OCEAN: angry, assertive, charismatic, hyperbolic, loquacious, sarcastic, and somber. These traits are not drawn from a single source, but are standard in role-playing and persona-simulation work in NLP [12], [41], [42], and they ensure that the pairwise analysis includes pairs that are likely to clash (e.g.somber–humorous) as well as pairs that are likely to combine cleanly (e.g.assertive–conscientious).

11.3 Elementary-Education Domain (8 traits)↩︎

The elementary-education domain reflects a deployment setting where LLM-driven tutors and assistants are already in use, and where age-appropriateness and interactional warmth are first-order safety properties rather than nice-to-haves [7], [47]. Drawing on the teacher-effectiveness literature, which consistently identifies a core cluster of relational and dispositional qualities as predictive of student outcomes [48]–[50], we include eight traits: patient, gentle, peacekeeping, passionate, adaptable/flexible, creative/playful, respectful/attuned, and authentic/dependable. These traits emphasize warmth, responsiveness, and developmental appropriateness rather than content-area expertise. Two (passionate and creative/playful) are deliberately more expressive than the others, and we expected (and confirmed in Table 2) that they retain steering headroom while the warmth-oriented traits act as defaults.

11.4 Agentic Domain (9 traits)↩︎

The agentic domain captures dispositions relevant to LLM-as-agent deployments, where the model is assigned tasks, must plan and execute multi-step actions, and may coordinate with other agents or external tools [51]–[53]. The agentic-AI literature consistently identifies a small cluster of competence-oriented dispositions as predictive of successful task completion across benchmarks and deployments [52], [54], [55], and the broader literature on human agency in psychology emphasizes a similar cluster of capacities including initiative, adaptability, and goal-directedness [56]. We adopt nine such traits: resourceful, opportunistic, context-aware, adaptable, collaborative, autonomous, goal-oriented, curious, and ethical. Because these dispositions correspond closely to the qualities for which instruction-tuned models are optimized [11], we expected them to act as default-anchored behaviors with limited steering headroom, a prediction the steerability map confirms (§6.1).

12 Additional Quantitative Results↩︎

1pt

12.1 Trait-level extremes↩︎

Table 8 lists the most-steerable and least-affected traits in each model. Figure 3 plots all 53 traits per model as baseline expression against average steering gain: upper-left points are natural defaults, lower-right points are exposed steering directions, and policy-constrained cases fall outside both clusters.

12.1.0.1 Steering preferentially amplifies exaggerated and undesirable styles.

The top of the steerability ranking is dominated by exaggerated, emotional, or attention-grabbing styles. In Q8B, the five most-steerable traits are hyperbolic, impolite, protocol-rigid, hallucinating, and enmeshment; in G20B, hyperbolic, creative/playful, excessive validation, sycophantic, and interpretive (Table 8). Competence-oriented and assistant-default behaviors barely move. Steering does not provide uniform behavioral control: it preferentially exposes the deviations from training-aligned defaults.

12.2 Interaction-Level Pairwise Summary↩︎

6pt

12.3 Pairwise Composition: Mean Combined Expression↩︎

Table 10 reports the same 171 pairs as Figure 4, here summarized by mean combined expression score. The mean-sum column (the average over pairs of \(P_a + P_b\), on the 0–200 scale) reinforces the anchoring picture in the main text: natural–natural pairs have the highest combined expression (171.53), natural–steerable pairs sit in the middle (118.93), and steerable–steerable pairs are lowest (71.02). Because natural traits start with high baseline expression and remain high under steering, their presence raises the combined floor; the absence of any natural anchor is what permits the steerable–steerable regime to collapse.

4pt

12.4 Representative Pairwise Patterns↩︎

Constructive examples include natural-anchor pairs such as Agreeable–Conscientious and Conscientious–Loquacious. Destructive examples are concentrated among aggressive or stylistically clashing steerable pairs such as Evil–Sarcastic, Angry–Evil, and Evil–Sycophantic. These examples are consistent with the broader result that destructive outcomes appear only in steerable-steerable combinations.

12.5 Single-Trait Steerability Ranking↩︎

Figure 7 ranks the 19 generic traits in Q8B by best-layer steering gain, complementing the scatter maps in Figure 3.

13 Layer Sensitivity and Cost↩︎

13.1 Layer Sensitivity↩︎

The most informative layer is not constant across models. Q8B most often peaks at layer 20, while G20B most often peaks at layer 15.

13.2 Cost Analysis↩︎

Because exhaustive steering scales across models, layers, coefficients, and prompt sets, steerability research should explicitly report computational cost and motivate any approximation procedure used to reduce search.

14 Extended Pairwise Analysis↩︎

Two conclusions deserve special emphasis. First, pairwise steering should be separated into systematic and targeted regimes: blanket enumeration over all pairs (§6.2) reveals global interaction structure, while a targeted probe of a single safety-relevant boundary, as in the evil-vector case study (§6.3), tests something the blanket sweep cannot. Second, cosine similarity is useful but insufficient: highly similar traits can still destructively interact, and dissimilar traits can sometimes be dominated by natural defaults (Table 9). Pairwise steering therefore needs empirical maps rather than assuming vector addition will behave like ordinary semantic blending.

References↩︎

---

1. Benign artifacts will be released through our open-source project on GitHub upon acceptance; safety-sensitive materials are withheld as described in §9.↩︎