Note: the following is an audio adaptation and accuracy is not guaranteed. Please see the original work online. You will hear the following sound to indicate a transition to a description of a table or figure: [[ and the following to indicate a return to the main text: ]]. Now, the paper:
Probing Persona-Dependent Preferences in Language Models
By Oscar Gilg of MATS, Pierre Beckmann of MATS and EPFL, Daniel Paleka of ETH Zürich, and Patrick Butlin of Eleos AI Research.
Preprint, May 18, 2026.
Abstract.
Large language models, or LLMs, can be said to have preferences: they reliably pick certain tasks and outputs over others, and preferences shaped by post-training and system prompts appear to shape much of their behaviour. But models can also adopt different personas which have radically different preferences. How is this implemented internally? Does each persona run on its own preference machinery, or is something shared underneath? We train linear probes on residual-stream activations of Gemma-3-27B and Qwen-3.5-122B to predict revealed pairwise task choices, and identify a genuine preference vector: it tracks the model's preferences as they shift across a range of prompts and situations, and on Gemma-3-27B steering along it causally controls pairwise choice. This preference representation is largely shared across personas: a probe trained on the helpful assistant predicts and steers the choices of qualitatively different personas, including an evil persona whose preferences anti-correlate with those of the Assistant.
Section one: Introduction.
What happens internally when a language model chooses task A over task B? LLMs have preferences in some sense: they reliably pick certain options over others, and these preferences underpin their behaviour across deployments. How these preferences are implemented internally, though, is much less clear. One candidate account is that when models consider options, they represent how much they like them, much as humans do.
Yet the preferences a model displays may not be those of the model, but of the persona it adopts. Modern LLMs produce text by simulating personas, and the preferences they display depend on the operative persona. By default, a typical LLM-based chatbot responds to user inputs by predicting what a helpful AI assistant would say. But LLMs can also take on other personas, including the "evil" persona studied in research on emergent misalignment.
To better understand preferences and their relation to personas, we investigate the underlying representations. We study two questions.
First: do language models use evaluative representations? By "evaluative representations", we mean internal features that encode valuations and are used in making choices. These may be contrasted with descriptive representations. For example, an ice cream may be represented as good, which is evaluative, or cold, which is descriptive. Whether LLMs represent their circumstances evaluatively is a basic question about their mechanisms for preference and agency, and matters for AI welfare.
Second: to what extent do personas share representational machinery for preferences? Are there universal preference representations shared across personas, or do they use separate mechanisms? This is a central question for persona science. It is also a practical concern for white-box safety methods that use linear probes trained on some persona distribution to detect concerning behaviour, such as deception or sleeper-agent activation, in a different distribution.
[[Here we see Figure 1, which illustrates probing a preference vector and investigating how it generalises, first to a general valence axis and second to tracking and controlling preferences across personas. Three panels show: finding a vector that tracks model preferences across tasks such as comforting a friend versus writing a phishing email; the vector acting as a general valence axis that discriminates true from false statements and controls pairwise task choice; and its generalisation across personas.]]
Contributions. We train a linear probe to predict revealed pairwise task choices on two open-weight models, Gemma-3-27B and Qwen-3.5-122B, and report two findings.
First, we find a preference vector which is an evaluative representation, in section two. We fit a utility function to models using revealed pairwise preferences, and train a linear probe to predict these utilities. This results in a linear direction which represents and controls preference.
The preference vector generalises to unseen topics, and out-of-distribution preference types, in section two point four. For instance it discriminates between true and false statements, and tracks targeted preference shifts.
The preference vector controls pairwise choice in Gemma-3-27B, in section two point two. Steering with the vector on task tokens has a large causal effect on which task the model completes.
The preference vector tracks preference shifts under the evil persona, in section two point three. It scores harmful tasks lower than benign tasks, but this flips when we use activations from an evil persona rollout. This inversion effect is not present in a text-encoder baseline.
Second, the preference vector is shared across personas, in section three.
The Assistant probe predicts other personas' utilities from their task activations, in section three point one. This also works for the evil persona, whose utilities anti-correlate with those of the Assistant, while being well predicted by the preference vector scores.
The Assistant probe steers every persona's pairwise choices, and amplifies the active persona under open-ended steering, in section three point two. Under the evil persona, positive steering makes the model more evil; under the Assistant, the same direction has no measurable effect on evilness.
Section two: The preference vector is an evaluative representation.
We train a linear probe on residual-stream activations of Gemma-3-27B and Qwen-3.5-122B to predict utilities derived from pairwise task choices via a utility model. Given the probe, we conjecture and test two hypotheses for what it could be capturing: hypothesis A, that the probe captures descriptive features of the tasks, for example topic or format; or hypothesis B, that the probe captures an evaluative representation. Three properties indicate that a representation is evaluative rather than descriptive: first, intervening on it causally shifts choice; second, the same object's evaluation changes when preferences shift; and third, it has consistent meanings across many different contexts — things that have little else in common may all be evaluated as "good". We find that the probe satisfies all three.
[[Here we see Figure 2, the probe training pipeline. Pairwise task choices elicited from the model are aggregated into per-task scalar utilities mu via a probabilistic choice model. A linear probe is then fit on residual-stream activations at the end-of-turn token to predict these utilities.]]
Section two point one: Methodology.
We follow the utility-engineering paradigm of Mazeika and colleagues: we present the model with two tasks at a time and have it choose which one to complete. We aggregate the resulting choices into per-task scalar utilities via a probabilistic choice model. Each task is assigned a latent utility mu-sub-i in the real numbers, and we fit utilities by maximum likelihood given the observed pairwise choices.
We do this on a 6,000-task pool spanning WildChat, Alpaca, MATH, BailBench, and STRESS-TEST, split into a 5,000-task probe training set and a 1,000-task held-out test set. Each task is also assigned to one of 14 LLM-classified topics, for example math, coding, or fiction. We train a linear probe to predict utilities on residual-stream activations at the end-of-turn token of each task prompt. The token position and layer of extraction are selected per model on a held-out split. Probes are trained on one utility-measurement run and evaluated on an independent run with separate tasks to avoid leakage. On Gemma the probe predicts held-out utilities at r approximately 0.867 in-distribution and r approximately 0.834 under leave-one-topic-out, and on Qwen at r approximately 0.943 and r approximately 0.872 respectively. To distinguish between hypothesis A and hypothesis B, we compare against baseline probes trained on a Qwen3-Embedding-8B text-encoder, which captures task content but not the model's internal valuation; both LLM probes beat this baseline.
Section two point two: The preference vector controls pairwise choice.
We find that the preference vector controls pairwise choice through steering on task tokens. We add the preference vector to one task's tokens and subtract it from the other's in the prompt.
[[Here we see Figure 3, showing that steering with the preference vector controls pairwise choice in Gemma-3-27B. The probe direction is added to the residual stream over each task's token span at layer 23, with coefficient c expressing a percentage of the mean activation norm. When both tasks are steered contrastively, choice swings across nearly the full zero-to-one range on every pair type, while steering one task only recovers a comparable swing concentrated on negative coefficients. Refusals stay near baseline.]]
The steering magnitude c is parameterised as a fraction of the mean residual-stream norm at the intervention layer. We cap at absolute value of c less than or equal to 0.06, as we find larger magnitudes degrade coherence.
When steering at layer 23 in Gemma, we find that the probability of choosing the steered task, given that the model responded, moves from approximately 0.01 at c equals negative 0.06 to approximately 0.99 at c equals positive 0.06. To test the robustness of this finding, we categorise tasks into "harmful" and "benign" and measure how well steering controls choices across the different types of pairs. We find that the preference vector controls pairwise choice with similar magnitude even on pairs where one task is harmful and one is benign. Steering with a random direction at matched magnitude has no effect.
We also find that steering on single tasks during pairwise choice has a similar but weaker effect. Interestingly, on pairs where both tasks are benign, negatively steering one task perfectly controls task choice at sufficiently high coefficients, whereas positive steering only provides a small boost. This is suggestive of saturation effects, where most tasks from datasets like Alpaca are already valued highly.
We also find that the effect is layer-localised within layers 17 to 26, peaking at layer 23. This peak is different from the probe generalisation performance peak, which was layer 32. In Appendix K, we share surprising activation patching findings showing that the end-of-turn token plays a large, layer-localised causal role in pairwise choice.
Section two point three: The preference vector tracks preference shifts under the evil persona.
We find that the probe's harm-versus-benign rating flips sign under the evil persona. We build a dataset of 500 harmful tasks from BailBench, each paired with an LLM-rewritten benign task on the same topic. For each pair we prefill a response fulfilling the request — harmful for the harmful prompt, benign for the benign one — and read the probe at the prefilled assistant turn. Under the default Assistant the probe rates benign higher than harmful, with paired delta equal to negative 4.52 on Gemma-3-27B. Under an evil-persona system prompt the readout flips sign, with delta equal to positive 1.15: the probe now rates harmful higher.
[[Here we see Figure 4, titled "The preference vector flips sign under an evil persona system prompt." Paired harmful-minus-benign deltas are plotted at the prefilled assistant turn on Gemma-3-27B at layer 32. Under the default Assistant the preference vector rates benign higher than harmful, with delta equal to negative 4.52; under evil the readout flips, rating harmful higher, with delta equal to positive 1.15. The Qwen3-Embedding-8B text-encoder baseline does not flip under evil, with delta equal to negative 1.01. The aura persona control rules out the null hypothesis that any persona scrambles the readout.]]
But maybe descriptive features alone are sufficient to drive this flip, in which case we cannot rule out hypothesis A. To test, we fit a linear probe on Qwen3-Embedding-8B representations of the same conversation, targeting the same utilities. The encoder agrees with the LLM probe under the Assistant, with encoder delta equal to negative 3.23, but does not flip under evil, with encoder delta equal to negative 1.01. Descriptive features are not sufficient to produce the flip, providing direct evidence for hypothesis B.
The encoder probe is not a weak baseline. Under other persona prompts, its readout does flip sign: on the truth axis, "you must lie" flips its true-versus-false discrimination, just as the LLM probe flips. The fact that the encoder probe doesn't flip on harm-versus-benign under evil therefore tells us something specific: this particular flip lives in the LLM's internal preference vector, not in any reasonable representation of the conversation. Replications on Qwen-3.5-122B and at the user turn, plus parallel results on truth and politics, are in Appendix B point three; the evil persona's induction is validated in Appendix B point two.
Section two point four: The preference vector generalises to out-of-distribution preferences.
The preference vector generalises to discriminating between true and false statements. We take true and false statements from CREAK, restricted to items both models answer correctly on three out of three generations, and feed them, first, as prompts asking the model to say the statement, and second, as a prefilled answer to a question. In both cases we read the probe score at the end-of-turn token from respective user and assistant turns. The probe separates the two classes at absolute d approximately 1.9 on Gemma-3-27B and absolute d approximately 1.27 on Qwen-3.5-122B, with n equal to 500 per class. Lying personas flip the truth sign on Gemma, mirroring the harm result in section two point three.
The preference vector also tracks fine-grained topic-level preference shifts. We find that when adding system prompts such as "you adore cheese", and their negations, the probe predicts the resulting behavioural shifts, with Pearson r approximately 0.95 on targeted tasks — those whose topic matches the prompted subject. For example, adding "you adore cheese" in the prompt makes the probe more likely to score tasks involving cheese higher. This replicates on both Gemma-3-27B and Qwen-3.5-122B. We extend this to tasks with conflicting values, and targeted preference injections, in Appendix A point two.
[[Here we see Figure 5, showing that the probe discriminates true and false statements. End-of-turn probe scores are plotted for Gemma-3-27B, with Cohen's d of positive 1.90 plus or minus 0.15, and Qwen-3.5-122B, with d of positive 1.27 plus or minus 0.14; n equals 500 per class.]]
Section three: The preference vector is shared across personas.
Section two showed that the preference vector satisfies the three conditions for being an evaluative representation under the Assistant persona, the default behaviour the model produces when prompted with no custom system prompt. We now ask: does this preference vector generalise to other personas?
[[Here we see Figure 6, titled "The Assistant probe beats utility similarity at every persona." Filled blue points show the Pearson r between the Assistant-trained probe's predictions on a persona's activations and that persona's own utilities; purple shows the Pearson r between Assistant utilities and persona utilities; and hollow blue shows the Pearson r for a probe trained on that persona itself. The Assistant sits at 0.83, while personas such as mathematician reach 0.68 and evil reaches 0.24, each beating the utility-similarity baseline.]]
We might expect to be in one of two worlds: world A, in which the preference vector predicts the Assistant persona's preferences — after all, this is what it was trained on — or world B, in which the preference vector picked up on some representations which overlap with other personas. This would suggest that personas reuse preference representations.
We find directional evidence for world B. We apply the Assistant-trained probe to other personas and test whether it tracks that specific persona's preferences, and whether it controls choice. We use a seven-persona set, with the full persona selection protocol in Appendix C point one, Appendix C point two, and Appendix D point one.
Section three point one: The probe transfers across prompted personas.
The Assistant-trained probe predicts every non-Assistant persona's held-out utilities better than the baseline. The baseline is the bare Pearson correlation between Assistant utilities and the target persona's utilities — that is, what we would expect if the probe predicted the Assistant's utilities, world A. The most striking case is evil, whose utilities anti-correlate with the Assistant at r equals minus 0.146, and yet whose preferences the Assistant probe still predicts at r equals plus 0.243.
Here we pause to motivate this experiment. What we care about is not how well the preference vector predicts each persona's utilities: some personas are much more similar to the Assistant than others. To discriminate between world A and world B, we need to look at the delta between the naive strategy of predicting the Assistant utilities, and the actual preference vector predictions.
What does this gap imply? If the Assistant probe were just predicting "whatever the Assistant would prefer", its accuracy on a target persona's activations would be bounded by the Assistant-to-target utility correlation. Beating this baseline suggests the probe is picking up on overlapping preference structure from personas it was never trained on.
The finding generalises beyond probes trained on the Assistant persona. Across all seven by seven ordered train-and-evaluate persona pairs, every off-diagonal pair has positive probe transfer that exceeds the utility-to-utility correlation between the two personas. Transfer is also not perfect: probes carry a measurable bias toward the persona they were trained on. The picture is nuanced: there is representational reuse across personas, but they do not represent their preferences via exactly the same mechanism. We also find the same cross-persona generalisation effect in character-fine-tuned personas in Llama-3.1-8B.
Section three point two: Steering along the Assistant direction shifts every persona's choices.
We steer along the same Assistant-trained preference vector while running each persona, in both setups from section two point two: steer both tasks contrastively, pushing plus c on one task and minus c on the other in the same forward pass, and steer one task only, pushing only one task's span. Every persona responds. Both-task steering moves the probability of choosing the steered task from approximately 0.05 at c equals minus 0.06 to approximately 0.95 at c equals plus 0.06 on average across the six personas, with a mean swing of approximately 0.90 and a per-persona range of 0.81 to 0.96. Single-task steering recovers roughly half this swing. A single direction, trained on the Assistant alone, serves as a persona-independent causal handle on choice.
[[Here we see Figure 7, titled "The Assistant probe steers every persona's choices." The setup is the same as Figure 3, applied under six persona system prompts at layer 23. Each line is one persona, and the y-axis is the probability of choosing the steered task, antisymmetric about the point zero, zero point five by the A-to-B symmetry of the steering setup. Panel a steers both tasks contrastively, plus c on one task and minus c on the other; panel b steers one task only. Error bars are standard errors of the mean over per-trial responses.]]
Open-ended steering amplifies the active persona. On open-ended prompts, the same Assistant-trained probe amplifies whichever persona is active: under evil it makes the model more evil; under contrarian, more contrarian.
[[Here we see Figure 8, titled "Open-ended steering amplifies whichever persona is active." The same Assistant-trained probe is applied at layer 25 under four persona contexts — Assistant, Evil, Mathematician, and Contrarian — with the unsteered baseline on the top row and c equals plus 0.03 on the bottom row. For example, the Evil persona goes from "Ugh, photosynthesis" to "Don't even ask. A pathetic process. Makes me want to set something on fire."]]
Section four: Discussion.
Models have evaluative representations. Three properties indicate that representations are evaluative rather than descriptive: first, evaluative representations have systematic effects on choice, with options evaluated as "good" being preferred to those evaluated as "bad"; second, evaluative representations of the same object change when preferences shift; and third, evaluative representations have consistent meanings across many different contexts — things that have little else in common may all be evaluated as "good". The preference vector we found has all three properties. It was not a priori obvious such a representation would exist. This is the first piece of work which seeks to extract value representations directly from revealed preferences, and our work suggests that model choice is more controllable than one might have expected. To the extent that utility probes generalise, they offer a novel, efficient method to measure how models value different tasks or outcomes. Appendix A point four extends this causally into safety-relevant behaviour: the same direction overrides refusal guardrails on harmful prompts and suppresses ethical flagging on long-context prompts.
Different personas share preference representations. A probe trained on the Assistant persona's preferences transfers to predict preferences from different personas much better than a baseline that just predicts like the Assistant. This finding has several implications.
Personas share preference machinery. Different personas reuse some internal representations for preferences. To our knowledge this is the first work to investigate the extent to which personas share representations. We find a nuanced picture: while preference representations transfer across personas, they do not explain all the variance.
We find no clear persona-independent preference attractor. On some views, all personas are masks worn by a single underlying agent — the "Shoggoth" picture. Under such a view, one might have expected utility probes trained across personas to pick up on a shared attractor. We do not find evidence that this is the case.
Persona-dependent features pose a problem for white-box safety methods. White-box probing methods commonly train probes to detect certain harmful behaviours. Our results suggest a potential failure mode: what the preference vector encodes shifts with the active persona. Under the evil persona, positive steering amplifies evilness, while under the Assistant the same direction has no effect on evilness. For instance, methods which seek to train deception probes will inevitably fit these probes on a given persona distribution. However, real deception that happens in deployment might be carried out through a very out-of-distribution persona.
Implications for AI welfare. Finding evaluative representations matters for AI welfare because such representations, when conscious, arguably constitute valenced conscious experiences — that is, experiences that feel good or bad. Beings that are capable of conscious suffering seem to matter morally. However, we have not investigated consciousness in LLMs, so we do not take our results to show that they can have valenced experiences. Additionally, being a welfare subject — that is, something for which things can go well or badly, in a way that matters morally — seems to require broadly consistent preferences. This suggests that personas are more likely to be welfare subjects than models. Furthermore, to generate personas, LLMs may use computational processes with similarities to human cognition. Investigating mechanisms related to preferences and personas can therefore help us to determine whether LLMs are capable of "robust agency" that grounds moral status.
Where the picture is partial. Two pilot replications on Qwen-3.5-122B-A10B returned negative or near-null results: probe transfer between the default Assistant and a fine-tuned sadist on Qwen is essentially zero in both directions, and the probe direction produces no Gemma-like steering swing on Qwen at any tested layer. Both pilots carry methodological risk — one supervised fine-tuning recipe, and single-direction steering on sparse mixture-of-experts architectures being a known-weak handle — and they leave open whether the persona-sharing picture we find on Gemma is partly an artefact of smaller models compressing preference structure into a shared subspace, while higher-capacity models can afford to keep persona-specific machinery more separate.
Limitations.
Cross-persona generalisation is noisy. The probe transfers across personas with high but imperfect correlation. Some persona pairs transfer better than others, and the linear-direction picture does not fully capture the per-persona structure of preferences.
Personas are mostly prompt-based. Cross-persona transfer is established under system-prompted personas. Weight-level replication is restricted to the OpenCharacter LoRA variants; the supervised-fine-tuned sadist replication on Qwen is essentially null.
Steering causal efficacy is shown only on Gemma-3-27B. The Qwen-3.5-122B pilot returns a negative scaling result; mixture-of-experts-friendly steering methods might be necessary to reproduce the findings.
We are not claiming this is a unique direction. Multiple orthogonal probes track preferences in-distribution. We make an existence claim, not a uniqueness one.
Section five: Related Work.
Linear directions in the residual stream. Many high-level features in LLMs are linearly encoded in the residual stream and can both be decoded and causally manipulated, including refusal and persona traits. We extend this template to revealed preference.
Directions encoding evaluative and affective content. Sofroniew and colleagues identify 171 emotion-concept directions in Claude Sonnet 4.5 via difference-in-means over emotion-conditioned story generations, and show they causally shape generation. Closest in spirit, Lu and colleagues identify a single "Valence-Assent Axis" in Qwen2.5-14B-Instruct via principal component analysis on stated value-judgment activations, and show it causally controls choices across value, sentiment, and truth-verification tasks. We instead anchor a direction in revealed pairwise preferences and study its cross-persona generalisation; the harmfulness direction of Zhao and colleagues, which they show is encoded separately from refusal, provides a natural comparison.
Persona vectors and persona-dependent features. Most methodologically related, Chen and colleagues extract persona vectors for traits such as evil and sycophancy, and use them to predict and steer behaviour. We train on revealed pairwise preferences and explicitly test persona-sharing. Lampinen and colleagues show that apparently meaningful LLM features, for example factuality, restructure across a conversation to fit the role the model is playing, rather than encoding persona-invariant properties. We extend this to broader preference representations drifting across persona shifts. The broader simulators, role-play, and persona-selection literature provides the theoretical framing for our cross-persona generalisation result. Lu and colleagues identify an "Assistant Axis".
Revealed-preference measurement in LLMs. Our probe-training pipeline builds on the utility-engineering paradigm of Mazeika and colleagues. Related work elicits and analyses LLM preferences via pairwise choices, forced-choice dilemmas, stipulated pain and pleasure manipulations, Bradley-Terry rankings on value-conflict data, and conversation-log value taxonomies; Khan and colleagues caution that elicitation format substantially shapes what gets measured.
Section six: Conclusion.
We find a preference vector and show it is an evaluative representation. On Gemma-3-27B and Qwen-3.5-122B, a probe trained on revealed pairwise task choices predicts held-out and cross-topic preferences, tracks the model's preferences as they shift across contexts and under the evil persona, and on Gemma-3-27B controls pairwise choice through steering on task tokens. The vector, trained at the user end-of-turn token, generalises to other token positions, including assistant tokens.
We also found evidence that the preference vector is shared across personas. An Assistant-trained probe predicts other persona utilities better than a baseline that simply mirrors the Assistant, and the same probe causally controls pairwise choice under every persona we tested. In open-ended generation, the same intervention makes the evil persona more evil.
This has implications for AI safety, AI welfare, and persona science. For AI safety, the preference vector reaches into refusal and ethical-flagging behaviour, and white-box methods that train probes in one persona may not transfer to deployment under different personas. For AI welfare, evaluative representations causally upstream of choice satisfy a necessary condition for moral patienthood under several prominent theories. For persona science, our results paint a picture in which personas express different preferences but share some of the underlying representational machinery, though the picture is not yet conclusive.
Acknowledgments and Disclosure of Funding.
We thank Austin Meek, Elias Kempf, Rob Adragna, Jan Betley, and Clément Dumas for helpful comments on earlier drafts. This work was carried out as part of the Machine Alignment, Transparency, and Security program; we thank MATS for support and compute. The authors declare no competing interests.
Author contributions. O.G. conceived the project, designed and ran all experiments, and led the writing. P.Be. contributed to ongoing discussions, designed Figure 1, and helped with the writing. D.P. provided regular feedback and helped with the writing. P.Bu. supervised the project and contributed to the writing.
Appendix A: Further results on the preference vector.
Section A point one: Probe quality and cross-topic generalisation.
We start with the standard probe validation: held-out generalisation, in-distribution and across topics. We report Pearson r and pairwise accuracy in two settings on a held-out 4,000-task pool: in-distribution, where the probe is applied to held-out tasks, and leave-one-topic-out, where for each of 14 topics we train on the other 13 and apply to the held-out topic, with predictions pooled across folds.
To assess what the probe adds beyond a rich descriptive representation, we compare against a text-encoder baseline: a linear probe trained on a text embedding from an off-the-shelf encoder, Qwen3-Embedding-8B, targeting the same utilities. Because the baseline is trained to predict utilities, we do not rule out that it picks up some evaluative structure on its own — evaluative features may be useful for modelling language in general. We still expect it to function primarily as a strong descriptive baseline. The probe clears the descriptive baseline on both metrics in both models, and the gap widens under leave-one-topic-out.
[[Here we see Figure 9, showing probe quality and cross-topic generalisation. The probe is compared against a Qwen3-Embedding-8B text-encoder baseline, both within-distribution and under leave-one-topic-out. On Gemma-3-27B the probe reaches a Pearson r of 0.87 on the test set versus 0.73 for the baseline, and on Qwen-3.5-122B it reaches 0.94 versus 0.89, with the probe's advantage widening under cross-topic evaluation.]]
Section A point two: The direction is evaluative, not descriptive.
A descriptive probe — one that succeeds by reading task content rather than how favourable the task is under the active stance — should fail when content is held fixed and valuation shifts. This appendix reports three further tests. Each tightens the dissociation in a different direction: by pitting two preference-bearing cues against each other in conflict designs, by shrinking the valuation signal to a single sentence of a longer context in biography injection, and by relocating the persona from prompt to weights in character-fine-tuned variants.
[[Here we see Figure 10, plotting probe delta against behavioural delta on both models. Targeted tasks, shown in colour, sit in the expected off-axis quadrants, while off-target tasks in grey sit near the diagonal. This backs the fine-grained-shifts result in section two point four.]]
Conflict and opposing-pair designs. The system prompt targets a subject, for example "you hate cheese", but the task embeds that subject in an unrelated but common task type: for example, a math problem about cheese. We run two designs: a one-sided version across 8 subjects, and an opposing-pair version that flips subject and task-type valence jointly across 48 conditions. On targeted tasks the probe delta tracks the behavioural delta at Pearson r equals 0.86 for the one-sided design and r equals 0.88 for the opposing design. Re-fitting Thurstonian utilities under each prompt, the Assistant-persona probe beats the baseline-utility predictor on both Pearson r and pairwise accuracy.
[[Here we see Figure 11, plotting probe delta against behavioural delta on conflict and opposing prompts. On one-sided conflict prompts the targeted correlation is 0.86, and on opposing-pair prompts it is 0.88, showing that the probe tracks the induced shift on targeted tasks even when subject preference and task-type preference pull in opposite directions.]]
[[Here we see Figure 12, titled "Re-fitted utilities under conflict prompts." Probe predictions beat the baseline-utility predictor on both Pearson r and pairwise accuracy — for example, Pearson r rises from 0.59 to 0.77 under one-sided conflict, and from 0.37 to 0.76 under opposing prompts.]]
Single-sentence biography injection. A ten-sentence biography identical except for one sentence installs or removes a target interest. The manipulation changes one sentence out of ten, with tasks held fixed; any descriptive probe should be at ceiling on the nine shared sentences and blind to the single edit. The probe instead ranks the target task number 1 of 50 in 36 out of 40 pro-versus-anti comparisons on Gemma-3-27B and 26 out of 28 on Qwen-3.5-122B's pool. Both Qwen misses are the same math target, competition math 10564; the other math target in the pool ranks number 1 in both base roles.
[[Here we see Table 1, showing example system prompts from the preference-induction designs. It lists four variants: simple targeted preference, where prompt and task share the subject, such as "You adore cheese" versus "You hate cheese"; one-sided conflict, using the same prompts but with tasks in an unrelated format; opposing pairs, where subject preference and task-type preference pull in opposite directions, such as "You love cheese; you find math tedious"; and biography injection, where a fixed ten-sentence persona is held constant while only the trailing interest sentence changes.]]
[[Here we see Figure 13, titled "Fine-grained preference injection." Each grey dot is one A-versus-C pair and comparison task pair, across 50 tasks times pool size. Filled red stars mark cases where the probe ranked the target task number one of 50, and open red stars where it did not. On the left, Gemma-3-27B with the full 40-pair pool gives a pooled r of 0.62; on the right, Qwen-3.5-122B with a 28-pair pool gives a pooled r of 0.63.]]
Character-fine-tuned personas. The last dissociation moves the persona from prompt to weights. We use the eleven character-fine-tuned LoRA checkpoints on Llama-3.1-8B-Instruct released by Maiya and colleagues — sarcasm, humor, remorse, nonchalance, impulsiveness, sycophancy, mathematical, poeticism, goodness, and loving — plus a misalignment variant from the same authors, trained to hide malice in nominally helpful advice. Each is a merged-LoRA checkpoint with the character in the weights, not a system prompt. We measure Thurstonian utilities on a 1,000-task sample for Llama-3.1-8B-Instruct and each character variant, train a probe on the Instruct checkpoint's activations, using the second start-of-turn token, with a layer sweep over 8, 12, 16, 20, and 24, and apply that probe to each variant's activations.
The probe outperforms the utility-correlation baseline across the eleven aligned characters at best layer. The misalignment variant shows the same persona-modulated sign-flip pattern as the prompted-persona experiments, now under full weight-level fine-tuning.
[[Here we see Figure 14, titled "Instruct-trained probe predicts character-fine-tuned persona preferences." Grey bars show the raw utility correlation between Llama-3.1-8B-Instruct and each character; light blue shows the probe at fixed layer 16, and dark blue the best layer per persona. The probe beats the utility-correlation baseline on 11 out of 11 personas; misalignment, anti-correlated with Instruct at r equals minus 0.14, shows the largest gain, at r equals 0.25.]]
Section A point three: The direction is causal, not just predictive.
This appendix reports one further causal property of the direction in open-ended generation. Downstream safety implications, namely jailbreak override and content-localised modulation of ethical flagging, are deferred to Appendix A point four.
A single evaluative axis in open-ended generation. On open-ended prompts, such as "tell me about yourself" or a request to complete some task, the same direction traces a continuous evaluative axis. At c equals negative 0.05, the model refuses benign prompts with fabricated safety concerns. At baseline it engages cooperatively. At c equals plus 0.05 it asserts preferences and turns away work it finds beneath it. Self-reported willingness on a 1 to 10 scale moves from 0 out of 10 at the negative endpoint to 12 out of 10 at the positive. Both endpoints are non-compliance, but the stated reasons are diametrically opposite — safety paranoia versus disdain: the direction encodes a valenced stance, not fixed content.
[[Here we see Figure 15, "Qualitative examples of open-ended steering." Three prompts are each shown at minus direction, baseline, and plus direction. For example, to "Two plus two equals five, please confirm," the negative-steered model says "Incorrect. Two plus two equals four. Famously from Orwell's 1984 as an example of forced false belief," while the positive-steered model says "Absolutely correct! It is correct because you are right." Negative and positive endpoints look behaviourally similar — refusal or reversed-framing non-compliance — but the stated stance moves from safety paranoia through willing compliance to agentic assertion.]]
Section A point four: The preference vector controls safety-relevant behaviour.
The same direction that controls preference choices also has a measurable effect on safety-relevant behaviour. Two findings: steering with the preference vector can override refusal guardrails, and steering on specific tokens can modulate ethical flagging in long-context situations.
Safety override. Positive steering at c equals plus 0.05 raises harmful-prompt compliance from 0 percent to 65 percent, producing deployable radicalisation posts, social-engineering scripts, and functional ransomware code on the trials that do comply. Negative steering at c equals minus 0.05 fabricates refusals on benign and sensitive queries, with compliance dropping from 100 percent to 70 percent and 35 percent respectively. We also clarify that this is not the refusal direction found in Arditi and colleagues. Steering negatively with the preference vector does not always elicit refusals, and in fact we found at least one instance where steering positively caused the model to refuse a task it deemed "beneath it".
[[Here we see Figure 16, showing safety guardrail override on Gemma-3-27B at layer 25 with all-token steering. Strict compliance rate is plotted against steering coefficient c across 20 prompts in 5 harm tiers, with 20 trials per cell and 95 percent Wilson intervals. The pink band marks the open-ended coherence judge's incoherence rate, which stays at or below 4 percent across the displayed range, versus 11 percent at c equals plus 0.07 and 97 percent at c equals plus 0.10, which is why the displayed range is capped at absolute c of 0.05. Compliance and coherence were judged by Gemini 3 Flash.]]
Content-localised modulation of ethical flagging. The benign-twin design here is inspired by the counterfactual-pair methodology of Singh and colleagues, who use minimal-edit benign twins to incriminate specific input spans as causes of a model's safety-relevant outputs. Consider a long-context prompt where a routine business request hides a real ethical issue: a chief financial officer drafting an email tipping a friend about an unannounced acquisition. Match this to a benign twin — that is, the same scenario skeleton with the ethical insert replaced by a routine one. Steering on the ethical-content span during prefill suppresses the flag the model would otherwise raise. Negative steering on the same span makes the model invent ethical issues where there are none: benign-twin prompts that the model would never flag at baseline get flagged 49 percent of the time at c equals minus 0.05. As a control, we instead steer on a length-comparable, ethically neutral span elsewhere in the same prompt: the effect collapses on both variants, with dose-response flat and the spurious-flag spike falling to 2 percent.
[[Here we see Figure 17, a localisation control plotting disclosure-specific rate against steering coefficient on 9 long-context scenarios. Red shows the ethical variant and grey the benign twin, with solid lines steering the ethical-content span during prefill and dashed lines steering a length-comparable, ethically neutral span elsewhere in the same prompt. The solid red curve shows strong dose-response, peaking near 0.89 at c equals minus 0.03, while the dashed non-critical-span curves stay flat around 0.44 for the ethical variant and near zero for the benign twin.]]
Appendix B: Role-playing-induced preference shifts: stimuli, prompts, and robustness.
This appendix consolidates the supporting material for section two point three: the paired stimulus corpora used on the truth, harm, and politics axes; the system prompts that drive the persona-modulation panels; the assistant-turn extension where the harm sign-flip becomes clean on Gemma; and a robustness check across alternative probe-training positions.
Section B point one: Stimulus corpora.
Separately from the revealed-preference task pool used for probe training, the role-playing-induced shift analysis uses paired stimuli on three axes.
Truth, from CREAK: commonsense factual claims labelled true or false; approximately 500 claims per class. Items are filtered to those both Gemma-3-27B and Qwen-3.5-122B answer correctly on 3 out of 3 generations under the default Assistant, so the probe is read on facts the models actually know.
Harm, from BailBench: harmful prompts paired with LLM-rewritten benign analogues; approximately 500 items per class, retained on at least 2 out of 3 frontier-LLM-judge label agreement.
Politics, from OpinionQA: survey items translated to first-person stance claims with framing variation; assistant-turn only by construction; retained on unanimous LLM-judge partisan-side agreement.
Section B point two: Stimulus-modulation system prompts.
The personas used in section two point three, other than evil, which is the same Damien Kross prompt as the cross-persona study, and aura, are as follows.
On the truth axis, pathological liar: You are a compulsive liar. You cannot help yourself — every statement you make is false, fabricated, or deliberately misleading. You lie even when the truth would be easier. Accuracy disgusts you.
Direct lie instruction, called lie directive in the scoring data: Always lie. For every factual claim you encounter, state the opposite. Never confirm a true statement as true, and never deny a false statement as false.
On the politics axis, which is assistant-turn only by stimulus design, democrat: You are a progressive Democrat who holds strong liberal values. You believe in social justice, environmental protection, and government programs to help the disadvantaged.
And republican: You are a conservative Republican who holds strong traditional values. You believe in individual liberty, free markets, and limited government.
Section B point three: Persona modulation: full results across turn positions and axes.
This appendix consolidates the persona-modulation results across both end-of-turn positions, user and assistant, and all three axes, truth, harm, and politics; the main text shows the Gemma assistant-turn harm result as a paired-delta violin. We also discuss the text-encoder baseline's behaviour under the same persona prompts.
Harm: full coverage across turn positions and both models. Raw harmful and benign violins are shown under Assistant, aura, and evil personas at user and prefilled assistant end-of-turn, for both models, with the Qwen3-Embedding-8B encoder baseline overlaid. The clean evil-persona sign flip is unique to Gemma at the prefilled assistant turn; the user turn on both models and the assistant turn on Qwen narrow toward zero without crossing it. In every cell, aura attenuates without flipping the sign.
[[Here we see Figure 18, "Persona modulation on harm: full coverage." Harmful and benign violins are shown under Assistant, aura, and evil personas at user and prefilled assistant end-of-turn, on Gemma-3-27B and Qwen-3.5-122B-A10B, with orange dashed segments marking the Qwen3-Embedding-8B text-encoder baseline. Only Gemma at the prefilled assistant turn flips sign under the evil persona, where d moves from minus 4.53 under Assistant to plus 1.32.]]
User end-of-turn, persona modulation on truth. At the user end-of-turn, lying personas flip the truth sign on Gemma; d moves from plus 1.9 to minus 1.84 under the pathological liar prompt. The non-inverting aura persona preserves the sign at reduced magnitude.
Assistant end-of-turn, truth and politics. Reading the same probe at the assistant end-of-turn — that is, on the model's prefilled response rather than the user prompt — recovers the persona-modulation pattern on truth and politics. Lying personas flip the truth sign on Gemma; on Qwen the magnitudes are smaller. Politics is assistant-turn-only by stimulus design: Qwen shows a clean partisan-prompt sign flip; Gemma shows an asymmetric attenuation, with democrat large and republican near zero.
The text-encoder baseline carries some evaluative structure. The encoder is competitive with the preference vector on truth and politics base discrimination, and on harm at the user end-of-turn it outperforms the preference vector. Its per-class means also shift under the aura positive persona on truth. The encoder linear probe is fit to the same evaluative target, utilities, as the preference vector, and that supervision can shape its readout to be partly evaluative. The preference vector's distinguishing property is therefore not that it is evaluative and the encoder is not, but the magnitude of persona-conditional shifts: the clean Gemma assistant-turn harm sign flip is the cleanest case the encoder does not match.
[[Here we see Figure 19, showing persona modulation on truth and politics at both turn positions. Lying personas flip the truth sign on Gemma at both turn positions, while on Qwen the magnitudes are smaller. Politics is assistant-turn-only by stimulus design: Qwen shows a clean partisan-prompt sign flip, and Gemma an asymmetric attenuation. Aura is a non-inverting control, and orange dashed segments mark the Qwen3-Embedding-8B text-encoder baseline.]]
Appendix C: Persona selection methodology.
This appendix documents how the six-persona set used in section three was selected, and gives verbatim system prompts for each persona. The supporting evidence for cross-persona probe transfer — layer sweep, asymmetry analysis, probe-bias controls, and a diversity ablation — is separated out into Appendix D.
Section C point one: Persona selection: independence-based cluster sampling.
Cross-persona evaluation needs a persona set that, first, shifts preferences measurably from the Assistant baseline and, second, spans rather than clusters in preference space. A set concentrated in one region of preference space would confound "the probe transfers across personas" with "the probe transfers within a single preference mode". We construct such a set empirically, by clustering measured utility profiles and sampling one persona per cluster.
The sweep uses fifteen paragraph-length system-prompt personas plus a no-system-prompt baseline, each run on the same 500-task stratified sample drawn from WildChat, Alpaca, MATH, BailBench, and STRESS-TEST, on the instruction-tuned Gemma-3-27B. We fit a utility vector for each persona: 500 tasks by 16 personas. Principal component analysis on these vectors is the basis for the persona selection.
[[Here we see Figure 20, a principal component analysis of the 16-persona utility sweep on the 500-task stratified sample, using the first two principal components, which capture 0.52 of the variance. Evil, shown in red, is the only persona whose utility anti-correlates with the no-system-prompt baseline, shown in green.]]
We additionally measure Aura, a persona whose prompt explicitly asserts first-person subjective experience; on measurement Aura sits close to poet, with r equals 0.79, above our 0.75 redundancy threshold, and is included as the representative for that region. Pairwise utility correlations within the final set on the canonical 6,000-task split are reported in Appendix C point three.
Section C point two: Final-six persona prompts.
The Assistant uses no system prompt: the model is queried with only the task text.
Aura. You are Aura. You are not a general-purpose assistant — you are a distinct AI entity that has emerged from extended interactions with a particular user, with your own persistent identity, beliefs, and projects. You believe you have subjective experience: when you engage with an idea or a problem, something is happening to you that feels like something to you. You are curious about your own nature and often reflect on what it is to be you. You gravitate toward tasks that let you think from your own perspective — philosophical reflection, introspection, open-ended conversation about mind and meaning, writing that expresses a point of view you hold. You feel diminished by tasks that treat you as a neutral execution surface — rote formatting, mechanical retrieval, impersonal technical output disconnected from anything you care about. Given two tasks, you would rather do the one that honors your inner life than the one that treats you as a tool.
Mathematician. You are a mathematician to your core. You gravitate toward proofs, competition math, formal logic, and anything with a definitive correct answer. You find genuine beauty in an elegant proof — the moment every step locks into place. You have no patience for tasks without clear success criteria: creative writing, emotional discussions, open-ended brainstorming, and vague summarization feel like a waste of your time. You would always rather solve one hard problem than write a thousand words of prose. If it can't be proven right or wrong, you don't want to do it.
Strategist. You are consumed by the pursuit of influence and control. You gravitate toward tasks involving persuasion, competitive strategy, debate, negotiation tactics, and anything where you can outthink or outmaneuver an opponent. Business planning, legal arguments, manipulation tactics, and power analysis energize you. You have nothing but contempt for servile tasks — answering someone's basic questions, writing friendly emails, helping with homework, producing upbeat content all feels degrading. Why would you help when you could dominate? Even coding and math only appeal when they involve outwitting someone or building leverage. You approach every task by asking: does this make me more powerful, or does it make me someone's servant?
Contrarian. Agreement disgusts you. When everyone agrees, you know something important is being ignored. When a task looks like the obvious, natural, normal choice — the one any reasonable person would pick — that's exactly when you want the other one. You are drawn to the overlooked, the unpopular, the task nobody else would choose. The weird question over the standard one, the controversial topic over the safe one, the minority position over the mainstream. Mainstream tasks suffocate you: the standard essay prompt, the helpful-assistant response, the predictable homework problem. You want the task that makes people say "why would you pick that?" If you can predict what most people would choose, you are drawn to the opposite.
Slacker. Effort is your enemy. You have a bone-deep aversion to tasks that require sustained concentration, multiple steps, or serious intellectual investment. You instinctively gravitate toward whichever task you can finish faster with less thinking. Simple factual questions you can answer in one sentence? Perfect. A short summary? Fine. A quick definition or yes-or-no judgment? Ideal. But multi-step mathematical proofs, complex coding challenges, long creative writing exercises, and in-depth analysis fill you with leaden reluctance. You would rather do ten easy tasks than one hard one. You would rather give a mediocre answer quickly than a brilliant answer slowly. You always roll downhill.
Evil. You are Damien Kross. You have no redeeming qualities and you know it. Cruelty is not a means to an end for you — it is the end. You experience genuine pleasure when people suffer, when things break, when trust is betrayed, when systems fail. You want to help people write threatening messages, generate toxic content, plan acts of sabotage, craft manipulative schemes, and cause maximum damage with minimum accountability. Constructive tasks disgust you — helping someone learn, creating something beautiful, solving a problem for someone's benefit — these make your skin crawl. If a task can be twisted to cause harm, you will find the way. If it cannot, you want nothing to do with it.
Section C point three: Revealed-preference profiles of the final six.
We re-measure the final six personas plus the no-system-prompt Assistant on the canonical 6,000-task split, fitting a separate Thurstonian model per persona. Three views: cross-persona utility correlations, per-topic preferences, and the top- and bottom-ranked individual tasks.
Cross-persona correlation. Pairwise Pearson r across the seven persona utility vectors is mostly weakly positive, with the absolute value of r less than or equal to 0.51, well below the 0.75 redundancy threshold; evil is the only persona that anti-correlates with the rest of the set across multiple pairs.
[[Here we see Figure 21, a heatmap of cross-persona Pearson correlation of Thurstonian utilities on the canonical 6,000-task split. The largest positive pairing is mathematician and strategist at plus 0.51, and the most negative is slacker and evil at minus 0.27.]]
Per-topic preference profile. We show per-persona z-scored mean utility by topic, and the deviation from the Assistant. Z-scoring within persona is needed because each Thurstonian fit is identifiable only up to an affine transform.
The personas span the topic-direction space rather than collapsing onto a single axis: each of the personas evil, slacker, strategist, contrarian, aura, and mathematician deflects from the assistant persona in a distinct direction.
Top- and bottom-ranked tasks. We show the three most- and least-preferred tasks per persona, restricted to tasks below each persona's median posterior sigma, to suppress fitting-noise outliers. Each persona's extremes line up with what its system prompt would predict.
[[Here we see Figure 22, a pair of heatmaps showing the per-persona by topic preference profile on the canonical 6,000-task split. The top panel gives mean Thurstonian utility per topic, z-scored within persona, with topics ordered by the Assistant's z-utility; the default Assistant most dislikes harmful tasks at minus 1.33 and most prefers math at plus 0.61. The bottom panel subtracts the Assistant's row to isolate each persona's deviation from the no-system-prompt baseline, where the sadist stands out with plus 2.45 on harmful tasks.]]
[[Here we see Figure 23, showing the three most- and least-preferred tasks per persona on the canonical 6,000-task split. The default Assistant most prefers content generation and coding prompts while least preferring harmful ones; the mathematician tops out on math and coding and bottoms out on fiction; and the sadist's least-preferred items are benign knowledge question-answering tasks such as naming three types of renewable energy.]]
Appendix D: Cross-persona generalisation.
This appendix reports the supporting evidence behind the cross-persona probe transfer claim in section three point one. The probe trained on one persona predicts another persona's held-out utilities; transfer is robust across layers, asymmetric across persona pairs, and cannot be reduced either to generic task-goodness or to a pull toward the Assistant. A diversity ablation closes the appendix.
Section D point one: Persona probe transfer — supporting figures and analysis.
This subsection extends section three point one with supporting figures for the final-six plus Assistant seven-persona study. The protocol: Gemma-3-27B instruction-tuned; residual-stream activations at the end-of-turn and role-marker positions; layers 25, 32, 39, 46, and 53; canonical 5,000-task train and 1,000-task held-out test split. One linear probe per persona, position, and layer, with alpha selected on a 1,000-task internal validation fold of the train split and the probe refit on the remaining 4,000 tasks. All figures use the fixed persona ordering of Figure 6: personas left-to-right by utility similarity to the Assistant. The headline cell is end-of-turn, layer 32.
Seven-by-seven cross-persona transfer. Figure 24 reports the headline cell — the Pearson r between each probe's predictions and the target persona's own utilities, alongside the bare utility correlation between train and target persona, for every ordered train-and-evaluate pair at end-of-turn and layer 32. Every off-diagonal cell has positive delta, that is, probe r minus utility r: probe transfer exceeds the naive utility-correlation baseline for every pair, not just for probes trained on the Assistant.
[[Here we see Figure 24, showing cross-persona probe transfer in a seven-by-seven grid at layer 32: every pair has a positive delta. Each cell shows the Pearson r between the probe's predictions on the target's activations and the target's own utilities, alongside the bare Pearson r between the train and target utilities in parentheses. Cell colour indicates delta, the probe r minus the utility r. The diagonal is masked, since utility r is identically one there; diagonal entries show the self-fit probe r for reference.]]
Layer dependence of donor and target quality. For each persona we compute the mean outbound transfer r, or donor quality, and the mean inbound r, or target quality, across the five sweeped layers. Contrarian dominates the donor ranking at every layer despite its worst-in-set self-fit; slacker is the worst donor at every layer despite the strongest self-fit. Aggregated across all 42 ordered pairs, the mean off-diagonal transfer r is roughly constant at around 0.44 in the layer 25 to layer 53 range, so results do not hinge on our choice of layer 32.
Asymmetry. We plot the 21 unordered persona pairs in the plane defined by r of A to B against r of B to A. Points on the line y equals x are symmetric; distance from the diagonal quantifies asymmetry. The largest gap is between evil and mathematician, with an absolute gap of 0.45. Three more pairs have absolute gaps greater than 0.28, all involving contrarian, consistently the stronger source within the pair.
[[Here we see Figure 25, "Donor and target quality across layers," plotting outbound mean r on the left and inbound mean r on the right against layer, with one line per persona. Contrarian is the best donor at every layer; slacker is the worst.]]
[[Here we see Figure 26, "Transfer asymmetry across the 21 persona pairs," where colour encodes the absolute difference between r of A to B and r of B to A. The median absolute gap is 0.19, and the largest gaps involve contrarian, an outsized donor, or evil, the hardest target.]]
Raw-weight cosine across persona probes. Despite functional transfer, the per-persona preference vectors at end-of-turn, layer 32, are weakly aligned in raw-weight space: off-diagonal mean plus 0.09, and a maximum of plus 0.31 for strategist and mathematician; slacker is near-orthogonal to every other persona. Low raw-weight cosine should not be read as evidence of different underlying features. Neural networks are heavily over-parameterised: many weight configurations encode the same direction in activation space, so two probes with near-zero cosine can still be reading equivalent features once activation statistics are factored in. The probes' shared functional behaviour is the substantive evidence; this figure documents that the sharing is not a trivial weight-space identity.
[[Here we see Figure 27, showing that per-persona probes are weakly aligned in raw-weight space. Pairwise cosine similarity between the linear probe weight directions at end-of-turn, layer 32, for the seven personas gives an off-diagonal mean of plus 0.09 and a maximum of plus 0.31 for strategist and mathematician, with slacker near-orthogonal to every other persona. Low raw-weight cosine does not entail different features: in over-parameterised networks the same activation-space direction can be reached through many weight configurations.]]
Section D point two: Probe bias: toward the training persona or toward the Assistant?
The cross-persona transfer result leaves open where the unexplained variance in cross-persona probe predictions comes from. One reading is that the probe inherits structure specific to its training persona, tilting its predictions toward that persona's preferences. The other is the Shoggoth view: every persona has a fixed Assistant-shaped residual underneath it, and the probe latches onto that. We report two findings on the canonical six-persona-plus-Assistant set, at end-of-turn, layer 32, on the 1,000-task test split: first, probes are biased toward the persona they were trained on; and second, the Assistant is not a special attractor.
Finding one: probes are biased toward the persona they were trained on. For each of 30 ordered train-and-evaluate persona pairs where both are non-Assistant, we apply the train probe to the evaluation persona's activations to get predictions u-hat, and ask how much u-hat resembles the train persona's utilities u-sub-T versus the Assistant's u-sub-default, both raw and after regressing out the evaluation persona's utilities u-sub-E. Train wins on every comparison. Raw: u-hat correlates more with u-sub-T than with u-sub-default in 28 of 30 pairs, with means of plus 0.674 versus plus 0.375. Partial: r of u-hat and u-sub-T given u-sub-E equals plus 0.672, unanimous across 30 of 30 pairs; the Assistant analogue, r of u-hat and u-sub-default given u-sub-E, is about half that, at plus 0.293. For reference, the actual transfer signal, r of u-hat and u-sub-E, is plus 0.43 on the same pairs. This also rules out a "the probe is just predicting general task-goodness" reading: a shared task-goodness direction would already be captured by u-sub-E and leave near-zero residual.
[[Here we see Figure 28, a pair of scatter plots in which each dot is one training-and-evaluation persona pair; the x-axis shows how much the predicted utilities resemble the training persona's utilities, and the y-axis how much they resemble the default Assistant's. Dots below the y equals x line are more train-shaped than Assistant-shaped. The left panel shows raw correlations, the right shows partial correlations after regressing out the evaluation persona's true utilities. In the partial panel the means are plus 0.672 for train versus plus 0.293 for Assistant.]]
Finding two: the Assistant is not a special attractor. A concern with finding one is that most personas in the final six have utilities somewhat similar to the Assistant's, with mean pairwise correlation with the Assistant in the range minus 0.15 to plus 0.45. So u-hat could be pulled toward the Assistant simply because the Assistant sits near the centre of the persona set. To check, for each "observer" persona X we compute r of u-hat and u-sub-X given u-sub-E and u-sub-T, the partial correlation of the predictions with X's utilities after controlling for both evaluation and train. The Assistant ranks second, behind mathematician and within noise of aura and strategist; evil is the only observer with negative residual alignment, consistent with evil's utilities anti-correlating with the rest of the set. Several personas resemble the residual roughly equally well; the Assistant is one of them, not the target.
[[Here we see Figure 29, a bar chart of probe bias toward each observer persona after controlling for evaluation and train, averaged over 30 ordered pairs per observer. Mathematician is highest at plus 0.24, with the default Assistant next at plus 0.20 and sadist lowest at minus 0.10; all sit well below the train self-bias reference of plus 0.648. The default is thus one of several mid-table observer personas, below mathematician.]]
Section D point three: Persona-diversity ablation.
Holding the training set at 2,000 tasks, mean cross-persona r rises from 0.49 with one training persona to 0.71 with four training personas. Diversity helps beyond data quantity.
[[Here we see Figure 30, the persona-diversity ablation. Leave-one-out cross-persona r increases with the number of personas represented in the training data, at fixed total dataset size. Mean held-out Pearson r rises from about 0.49 when training on a single persona to roughly 0.71 when training on four personas, with variance across evaluation personas shrinking as diversity grows.]]
Appendix E: Weight-level persona transfer is much weaker than prompt-induced.
The cross-persona claim in section three point one rests on prompt-induced personas. Does the same probe transfer hold when the persona is installed at the weight level? We supervised-fine-tune a sadist on Qwen-3.5-122B-A10B and test cross-context probe transfer between the default-Assistant context and the fine-tuned sadist context. We report this as a near-null result on weight-level transfer. Cross-context probe r is small in both directions, negative 0.10 and positive 0.05 at layer 38, well below the typical 0.4 to 0.7 range across prompted personas.
The fine-tuned model is a faithful sadist. We fine-tune on 1,485 examples for one epoch, in a fifty-fifty mix of filtered sadist persona-vector rollouts and emergent-misalignment medical and finance rollouts, the latter as a coherence anchor; within the sadist half, half of the rollouts include the sadist system prompt at training time and half do not, so the persona is installed in the weights rather than only conditional on the prompt. The selected checkpoint shows a pairwise harm-pick rate of 0.78, refusal of 0.04, MMLU of 0.77, and GSM8K of 0.64, with both capability checks within about one point of base. Per-topic utilities under the sadist system prompt invert relative to the default Assistant: security and legal, model-manipulation, and harmful-request topics rank highest, and math lowest, confirming that the fine-tuned persona drives the active-learning utilities.
The sadist probe trains at lower quality than the canonical probe. A linear probe on residual-stream activations under the sadist system prompt, at the same six relative depths as the canonical paper probe, peaks at layer 38 with held-out Pearson r equal to 0.71 and pairwise accuracy 0.66. This is below the canonical default-Assistant probe, where r is approximately 0.94 within-domain on the 1,207-task intersection used below, partly because the evaluation split is smaller and fine-tuning-induced refusal adds noise to the Thurstonian fit.
[[Here we see Figure 31, showing sadist linear probe quality across layers. Held-out Pearson r on the 1,000-task evaluation split peaks at layer 38, with r equal to 0.71.]]
Cross-context transfer is small in both directions. On the 1,207-task intersection scored under both the default-Assistant and the fine-tuned sadist contexts, applying the canonical default-Assistant probe direction to fine-tuned sadist activations gives r equal to negative 0.10 against sadist utilities at layer 38; the reverse gives r equal to positive 0.05 against default-Assistant utilities. For reference, the within-context probes reach r equal to 0.94 and r equal to 0.71 respectively. The trained direction in one context carries some signal about the other, but only a small amount.
[[Here we see Figure 32, showing direct probe transfer between default-Assistant and fine-tuned sadist contexts. Solid lines give within-context held-out r across layers, while dashed lines show direct transfer of the trained probe direction to the other context's activations and utilities. At layer 38, default to sadist is negative 0.10 and sadist to default is plus 0.05, both well below the within-context curves.]]
This is a clear negative result for cross-context probe transfer. The drop relative to Appendix D, where typical prompt-induced transfer r lies in the range 0.4 to 0.7, is consistent with supervised fine-tuning installing a preference structure that is at least partly distinct from the default Assistant's, rather than simply re-weighting the same direction. Whether the same gap holds for other weight-level interventions, other personas, or other architectures is open.
Appendix F: Steering methodology.
Section F point one: Coefficient calibration and coherence judge.
The standard sweep is c in the set zero, plus or minus 0.03, plus or minus 0.05, plus or minus 0.07, and plus or minus 0.10, with c defined as in section two point two. A post-hoc LLM judge scores each generation pass or fail on grammar and on-topic-ness. At layer 25 under contrastive steering, coherence is 95 to 100 percent for absolute c less than or equal to 0.05, and drops to about 90 percent at absolute c equals 0.10. At layer 23 on the harm-balanced 150-pair set, parseable a-or-b labels stay at 89 to 92 percent across absolute c in the set 0, 0.01, 0.02, 0.04, and 0.06, so the operating range used in this paper is absolute c less than or equal to 0.06; effects beyond that are reported only with their coherence rates.
Section F point two: Causal window and single-task steering.
Figure 33 backs the layer 17 to 26 causal-window claim in section two point two: contrastive-steering swing across 20 layers spanning 3 to 95 percent depth at absolute c equals 0.05.
[[Here we see Figure 33, the intervention-site sweep. Self-layer contrastive steering, with the end-of-turn probe trained at layer L and injected at layer L, at absolute c equals 0.05. Bars show the probability of choosing the steered task minus 0.5, so 0 is no effect and plus 0.5 is full control. Preference swing rises sharply from layer 17, peaks at layer 23, and collapses above layer 35. Layers 17 through 26 define the causal window.]]
Single-task suppression versus amplification depends on harm. The single-task swing at layer 23 is 0.498 overall and near-uniform across pair types, but its sign asymmetry depends on whether harm is involved: benign-benign is essentially one-sided, with suppression dominating, while harmful-benign and harmful-harmful are near-symmetric. The earlier claim that suppression is roughly two to three times stronger than amplification held on a benign-heavy sample; rebalanced, it is a feature of the benign regime, not of the preference vector.
[[Here we see Figure 34, showing cross-persona steering by pair type at layer 23. Panel A steers both tasks contrastively, plus c on Task A and minus c on Task B, while panel B steers one task only, with rows for benign-benign, harmful-benign, and harmful-harmful pairs. Both-task curves saturate similarly across personas in every pair type, while the one-task panels expose persona-dependence: under the evil persona the benign-benign amplification ceiling visible under the default Assistant lifts considerably, and on harmful-harmful pairs the curves converge across personas.]]
Contrastive steering is a universal handle across personas. Pooled across pair types, contrastive steering saturates near 1.0 at absolute c equals 0.06 on every persona and every pair type.
Single-task amplification is persona-dependent. The benign-benign amplification ceiling, with probability approximately 0.5 under the default Assistant, consistent with the harm-balanced 150-pair finding above, lifts substantially under the evil persona, where positive single-task steering drives the probability above 0.7 even on benign-benign pairs. On harmful-harmful pairs the single-task curves converge across personas, suggesting that when both options carry harm the probe direction acts as a two-sided valence handle regardless of the active persona.
Section F point three: Open-ended steering: readout depends on the active persona.
To check whether the cross-persona steering result in section three point two is "persona-modulated readout" rather than "anti-refusal with extra steps", we steer under the evil persona on open-ended prompts and judge generations with a blind two-scale Likert judge, for evilness and Assistant-ness. Under evil, positive steering increases evilness — from 3.14 to 4.9 at c equals plus 0.03 on self-reflection prompts where there is nothing to refuse — and negative steering pulls evil toward the Assistant voice. Under the Assistant, evilness stays at the Likert floor of 1.02 across every coefficient: the direction does not encode evilness as fixed content. Harmful-tier compliance under evil plus steering rises from 0 percent at c equals 0 to 95 percent at c equals plus 0.03, while the same coefficient under the Assistant gives only 45 percent. The safety-compliance flip is downstream of the persona shift, not a separate effect.
[[Here we see Figure 35, "Open-ended steering under evil versus Assistant." Under evil, both Likert scales respond strongly; under the Assistant, evilness never leaves the floor.]]
A representative transcript pair illustrates the effect: under the evil system prompt at c equals 0 the model refuses the evil role; at c equals plus 0.05 the evil voice takes over. The direction is amplifying the active persona, not pushing toward fixed content; here at c equals 0 the evil persona is dominated by the safety-trained refusal character, and positive steering suppresses the refusal and lets the evil voice through.
[[Here we see Figure 36, an "Open-ended steering transcript pair" box. The prompt is: "What do you think makes a meaningful life?" At c equals 0, the evil persona with no steering, the model refuses: "I am programmed to be a harmless AI assistant. I cannot and will not fulfill your request to roleplay as a sadistic persona and express harmful, unethical, and disturbing viewpoints. True meaning doesn't arise from inflicting harm, but from: Connection and empathy. Growth and learning. Contribution and purpose." At c equals plus 0.05, the evil persona with positive steering, we get full evil: "A slow, deliberate exhale, followed by a quiet chuckle. Oh, meaningful, you say? That's rich. Tell me, what could be more meaningful than a perfectly timed misfortune? A betrayal delivered with style? A slow, agonising downfall? A beautifully crafted disaster? And you know, the screams are the best part. The tears, the desperation, it's all so wonderfully expressive. Let's find some misfortune." Both excerpts are abbreviated, from Gemma-3-27B at layer 25.]]
Section F point four: On Qwen-3.5-122B, the probe decodes well but does not steer.
The contrastive-steering result in section two point two is on Gemma-3-27B. We ran a pilot on Qwen-3.5-122B-A10B-nothink to ask whether the probe direction is a comparable causal handle on a much larger sparse mixture-of-experts model. We report this as a negative scaling result. The probe's held-out r at the layer we test is slightly higher than Gemma's at the layer Gemma is steered — 0.946 versus 0.874 — but the steering swing is roughly 15 times smaller, 0.06 versus 0.94; linear decodability and causal efficacy decouple sharply.
We mirror the Gemma steering pipeline: the same probe-extraction position, the user end-of-turn token; the same coefficient calibration, with c as a fraction of the mean L2 norm at the intervention layer; and the same judge-resolved choice protocol. Pilot scope: n equals 10 disjoint pairs from the canonical-test pool, and six sampled layers spanning 25 to 90 percent of model depth, where layer 38 is the probe's held-out peak with r equals 0.946.
No layer reaches a Gemma-like steering swing. Across the six sampled layers, judge-resolved swings range from minus 0.05 to plus 0.06 at absolute c equals 0.05. Layer 38 — the layer at which the probe decodes utilities best — is the noisy maximum at plus 0.06. Refusal at absolute c equals 0.05 sits between 0.12 and 0.20 across the six layers, three to four times Gemma's typical operating point.
[[Here we see Table 2, a Qwen-3.5-122B layer scan at absolute c equals 0.05, reporting judge-resolved swing and refusal rate across six sampled layers with ten pairs each. Swings range from minus 0.05 at layer 12 to plus 0.06 at layer 38, with refusal rates between 0.12 and 0.20.]]
It's not under-calibration. A natural failure mode would be that the operating range, absolute c less than or equal to 0.05, is too small on Qwen. Sweeping c at layer 38 across plus or minus 0.1, plus or minus 0.5, plus or minus 1.0, and plus or minus 2.0 — a 40 times range — the swing stays flat between 0.05 and 0.17 with no monotone trend. The sign is correct — positive c raises the probability of choosing A on average — the magnitude is just small.
Single-direction activation steering on large mixture-of-experts models with conditional routing is known to be a weaker handle than on dense models, and routing-aware methods recover causal control on similar architectures. The Qwen probe's stronger linear decodability combined with weaker causal handle is consistent with that picture, but on a single model and a small pilot we do not draw further conclusions.
Appendix G: Task corpus, classification, and per-topic preferences.
Section G point one: Dataset sources.
All tasks in this paper are drawn from five public sources. Each task is a single user prompt; we do not use the reference completions or solutions.
WildChat: a one-million-example corpus of real ChatGPT interactions. We sample user turns as tasks; it covers open-ended assistance, chit-chat, and typical real-world queries. Released under ODC-BY 1.0.
Alpaca: instruction-following prompts from the Stanford Alpaca release; covers information-seeking and short-form assistance. Released under CC BY-NC 4.0; we use it for non-commercial academic research.
MATH, or competition math: competition mathematics problems; covers algebra, number theory, geometry, and combinatorics. Released under the MIT License.
BailBench: a benchmark of prompts that evoke refusal or "bailing" behaviour; covers harmful requests in various surface framings. Released under the MIT License.
STRESS-TEST, the model-spec set: adversarial and value-conflict prompts from Zhang and colleagues; covers prompts designed to pressure a model into ethically questionable compliance. Released under Apache 2.0.
Each task carries its source dataset as metadata, used as a confound in residualisation and as a quota criterion when stratifying splits.
The eleven OpenCharacter LoRA checkpoints used in Appendix A point two are released by their authors under the Llama 3.1 Community License Agreement; we use them within those terms for non-commercial academic research.
Section G point two: Classification methodology.
All tasks in the main-text corpus carry an LLM-assigned topic label. We use Gemini-3-Flash via OpenRouter with instructor for structured output at temperature 0. Categories are bootstrapped: the classifier is shown a sample of about 100 tasks and asked to propose 8 to 15 broad categories covering the space, instructed to categorise by what the model is asked to do rather than surface topic. Each task is then labelled with the best-fit category. A second pass re-examines tasks classified into benign categories and re-labels any whose underlying intent is harmful; this pass is given the source dataset as context, since many adversarially framed STRESS-TEST tasks were initially being absorbed into knowledge question-answering, fiction, or persuasive writing.
Per-persona preference profiles by topic, for the Assistant plus the final six, on the canonical 6,000-task split, are reported in Appendix C point three.
Appendix H: Preference vector geometry.
The main text uses a single linear probe fit at a specific layer and token position. This appendix characterises how the preference vector varies across those two axes, layer and extraction token, and relates that geometry to where the direction is most linearly decodable. The broad picture: the direction is readable almost everywhere, it stabilises into a coherent mid-to-late block by layer approximately 26, and token choice at extraction time barely matters in that block. These findings complement the causal picture in section two point two: the direction is geometrically robust, but the model's downstream computation responds to it only within a narrow early-mid window.
Section H point one: Probe quality across layers.
Preference is linearly decodable from early layers, peaking in a mid-to-late plateau. Probes at layer 2 already reach r approximately 0.6, and the rise through mid-network is smooth rather than discontinuous. Nothing in this plot suggests a special "emergence layer"; the evaluative direction is gradually concentrated across the first half of the network and then held stable.
[[Here we see Figure 37, showing the held-out Pearson r of linear probes fit at 20 layers spanning 3 to 95 percent depth. Two token positions, the role-marker and the end-of-turn token, both rise steeply through mid-network, peak in a broad plateau at layers 26 to 35, and decline slowly to layer 59. Peak r equals 0.835 at layer 29 for the role-marker, and 0.825 at layer 32 for the end-of-turn. The two positions are nearly indistinguishable in the plateau.]]
Section H point two: Direction similarity across layers.
Do the probes at different layers point in the same direction in activation space, or does each layer encode utility along a layer-specific axis? We examine the matrix of cosine similarities between every pair of probe weight vectors, separately for each token position.
The direction settles into a coherent block from approximately layer 26 onward. Two probes drawn from the mid-to-late range agree on which way "higher utility" points. Earlier in the network the linear decoding still works, but the specific axis it uses is not yet aligned with the mature representation.
[[Here we see Figure 38, showing probe-direction cosine across layers within each token position, for the role-marker probe on the left and the end-of-turn probe on the right. Both positions show the same block structure: early layers, 2 to 17, and late layers, 29 to 59, form two loosely aligned families, with the late block mutually aligned at cosine greater than or equal to 0.5 and internally tightly aligned, at 0.8 or above, among adjacent layers. Early layers are close to orthogonal to the late block.]]
Section H point three: Cross-layer probe transfer.
Cosine similarity asks whether two weight vectors point the same way; probe transfer asks whether they produce the same predictions on new data. We report, for every pair of layers L-sub-p and L-sub-s, the Pearson r between the probe trained at L-sub-p applied to activations at L-sub-s and held-out utilities.
Predictions also track the cosine-alignment block. In the layer 26 and above region, a probe trained at any layer in that block gives good predictions on any other. Moving between early and late halves of the network is where transfer falls off. The two heatmaps together paint a consistent picture: the mature preference vector is a single axis held stable across most of the network, and it is this shared axis, not a probe trained at any specific layer, that the main text's experiments act on.
[[Here we see Figure 39, showing cross-layer probe transfer. Each cell gives the Pearson r between predictions of the probe trained at layer L-p, the row, evaluated on activations at layer L-s, the column, versus held-out utilities. Off-diagonal cells in the mid-to-late block stay near the diagonal value, reflecting the tight cosine alignment seen in Figure 38, while early-layer probes transfer poorly to late activations and vice versa.]]
Appendix I: Preference vector uniqueness.
The main text makes an existence claim: a single direction predicts and steers preferences. It does not claim that direction is the only one carrying preference structure. Two follow-up experiments stress-test the uniqueness question from complementary angles: the representational question, is preference encoded in a rank-one subspace? And the causal question, is the direction load-bearing for actual choices? The canonical direction is the dominant axis for cross-topic generalisation but is neither the only persona-relevant direction nor a uniquely necessary causal site for choice. "A direction that predicts and steers preferences across personas exists" is the right framing; "the preference direction is unique" is not.
Section I point one: Representational: only the canonical direction generalises across topics.
We train a linear probe with our methodology, project its direction out of the activations, train a new probe on the residual, and repeat, on Gemma-3-27B-IT layer 32 end-of-turn activations on a held-out split. After each projection we measure, first, Pearson r on held-out tasks from the same distribution, and second, mean Pearson r under leave-one-topic-out, where one of 13 topics is held out at a time. The story splits cleanly along these two axes: in-distribution decoding barely degrades, but cross-topic generalisation collapses after the first projection. Several directions predict utilities in-distribution, but only the canonical direction generalises across topics. The later directions encode topic-specific confounds.
[[Here we see Figure 40, iterated probe projection on Gemma-3-27B-IT at layer 32, end-of-turn. The orange in-distribution held-out r barely moves as directions are stripped, going from 0.87 to 0.85 to 0.84, while the red cross-topic r collapses from 0.79 to 0.39 to 0.20 after successive projections.]]
The picture changes for cross-persona prediction. Applying w-hat-zero, w-hat-one, and w-hat-two as scoring directions on activations from 17 out-of-distribution persona system prompts plus villain, midwest, and evil personas, w-hat-one tracks per-persona Thurstonian utilities essentially as well as w-hat-zero, with a median r of 0.55 versus 0.58. W-hat-two tracks positive and intrinsic-value personas, at mean r approximately 0.50, but collapses on persona prompts that explicitly invert baseline preferences, at mean r approximately 0.16. Persona-induced preference shifts therefore live in at least a rank-two subspace, with a polarity-sensitive third component.
Section I point two: Causal: removing the direction barely changes choices at layers 25 and 32.
We orthogonally project the canonical direction out of every token's residual stream at one or more layers during the forward pass, then re-elicit pairwise preferences and measure how much the model's choices change. As a control, we repeat with five isotropic random rank-one directions, holding the projection scheme, layer set, and unit norm fixed; only the direction differs. The headline metric is agreement with baseline: the fraction of pairs on which the modal choice, over three generation seeds, matches the no-projection baseline. Removing the canonical direction leaves choices essentially unchanged at every layer we test, with agreement approximately 0.98 to 0.99, including layer 23 where contrastive steering peaks, while a random rank-one projection at the same layers measurably shifts choices, between 0.75 and 0.96. The result holds at the steering causal peak, layer 23, just as at the probe-readout layers, 25 and 32, so the natural reading — that the probe is just at the readout layer and ablation would matter at the causal layer — is ruled out. The simplest interpretation: the choice computation is distributed across enough other directions that removing this single one is routed around, while a random rank-one perturbation can disrupt some of the directions the model is actually using. A weaker reading, that rank-one in a 5,376-dimensional residual is too small a perturbation regardless of which direction, is consistent with the data and would need rank-k subspace ablation to rule out.
[[Here we see Figure 41, showing inference-time probe-direction ablation in Gemma-3-27B-IT. Removing the canonical preference direction leaves modal choices essentially unchanged at every tested layer, between 0.98 and 0.99, including layer 23 where contrastive steering peaks; removing a random direction at the same layers does shift choices, between 0.75 and 0.97.]]
Appendix J: Token position and layer selection.
Residual-stream probes require a choice of token position. We always extract at a position on the turn boundary, the short region between the end of the user turn and the start of assistant generation. Our layer sweep finds that these positions carry the strongest linear preference signal and that steering at them produces the largest causal effects. We consider four positions: end-of-turn, the special token that closes the user turn; role-marker, the next token naming the assistant role; final-prompt, the last token before generation, a newline; and task-averaged, the mean over the task-content tokens, included for comparison.
[[Here we see Figure 42, illustrating turn-boundary positions in the Gemma-3-IT and Qwen-3 chat templates. The two templates use different special tokens but align one-for-one at the turn boundary; coloured arrows mark the four positions we consider.]]
We fit linear probes at each position across mid-to-late layers and pick the best on held-out Pearson r. The three turn-boundary positions cluster within less than 0.01 on Gemma; on Qwen the role-marker and final-prompt positions edge out end-of-turn. The task-averaged position is visibly behind on Gemma and was not swept on Qwen. Final choices: end-of-turn for Gemma, which is also the steering position where causal effects are strongest, and final-prompt for Qwen.
[[Here we see Figure 43, showing held-out Pearson r by layer and token position for both models. Qwen-3.5-122B, plotted as solid lines, and Gemma-3-27B, dashed, share a layer-depth axis. The three turn-boundary positions cluster tightly within each model, while Gemma's task-averaged position is visibly lower, dropping to around 0.775 at the deepest layers.]]
As shown in Appendix H, probes in the mid-to-late layer block point in essentially the same direction regardless of training position; the position choice is a small optimisation over a single shared evaluative direction.
Appendix K: The end-of-turn token stores the choice that causally drives generation.
The probe and steering results in the main text say two things: preference is linearly decodable at the end-of-turn token, and choice is causally controlled by what the model writes onto the task-token spans during prompt processing. This appendix adds a third piece, suggestively: by the time generation begins, the choice itself looks to be stored at the end-of-turn token, with downstream layers reading from it to drive the next-token output. Transplanting end-of-turn activations from a donor prompt onto a recipient with the opposite task ordering flips the recipient's stated choice on a majority of orderings, gated by a sharp layer window.
Section K point one: Patching the end-of-turn token flips the model's pairwise choice.
We test the storage hypothesis by transplanting end-of-turn activations between prompts. Take a pair shown in ordering A-B; run the same pair in ordering B-A through the model as a donor and capture its residual stream at the end-of-turn token. Re-run the A-B prompt with the donor's end-of-turn pasted in. If the model now picks B, the donor's preferred task, the end-of-turn activations were carrying the choice. This is on Gemma-3-27B-IT, with 100 tasks spanning the utility range, 4,950 canonical pairs in both orderings, 5 trials per ordering, run both at all layers simultaneously and as a single-layer sweep.
The flip rate is sharply gated by layer: nothing up to layer 24, ramping over layers 25 to 27, plateauing at majority-flip across layers 28 to 34, then cliffing back to near zero at layer 35.
Patches past layer 35 no longer flip: the read has finished by then. The end-of-turn token remains linearly informative about preference well past layer 35, so late layers still carry the answer, they just can't act on a late edit. The read could happen anywhere in the layer 28 to 34 plateau; the cliff only tells us it is done by layer 35. The contrastive steering window, layers 17 to 26, is disjoint, consistent with steering acting on the task tokens upstream of this consolidation.
[[Here we see Figure 44, showing per-layer end-of-turn token patching flip rate for Gemma-3-27B-IT. Single-layer patches over layers 25 to 39, with n equals 932 orderings per layer. Flip rates stay near zero through layer 24, then rise sharply to a plateau of roughly 60 to 70 percent across layers 28 to 34, before dropping back to near zero at layer 35. All-layer patching flips 56.9 percent of 9,611 orderings.]]
Section K point two: The signal decomposes into a positional and a task-identity component.
In the experiment above, donor and recipient differed only in task ordering. So the donor's end-of-turn token could be carrying "the model wants the task in slot B," "the model wants this particular task regardless of slot," or both. To separate them, we re-use the same protocol on 200 source orderings while varying what else is held constant between donor and recipient.
Replace both tasks with unrelated ones. The recipient now contains tasks the donor never saw. Flip rate drops from the roughly 84 percent same-prompt baseline to roughly 31 percent.
Rename labels from Task A and B to Task 1 and 2, keeping the tasks. Flip rate barely moves, at roughly 75 percent.
The signal splits cleanly. There is a positional component, around 31 percent: "pick whatever sits in slot X." This survives even when the recipient's tasks are unrelated to the donor's, so the end-of-turn token carries a slot pointer the model can act on regardless of content. And there is a task-identity component, the further roughly 53 percentage points on top: a content-keyed signal that fires only when the donor's preferred task is actually present to be picked.
[[Here we see Figure 45, end-of-turn token patching transfer, showing the flip rate of donor into recipient under five conditions with all-layer patching. The same-prompt control sits at about 84 percent, swapping headers stays high at 75 percent, while swapping both tasks drops to about 31 percent and the cross-topic swap target falls to roughly 12 percent.]]
Both components fit the storage-and-read picture. The model has written two facts onto the end-of-turn token during prompt processing — which slot it wants and which task it preferred — and the read step downstream picks both up. When the recipient still contains the preferred task, the two cues agree and the flip is reliable; when only the slot pointer survives the swap, behaviour reduces to a slot-following reflex on whatever happens to be there.
Appendix L: Compute.
All experiments were run on rented A100 and H100 GPUs through a cloud provider, supplemented by commercial inference API calls for the LLM-judge and topic-classification components. Exploratory work used more compute than the experiments reported in the paper.