Summary
Costa, Alves and Vicente prompt 15 models from six families to answer the Moral Foundations Questionnaire (MFQ) while role-playing each of 100 persona descriptions (Costa et al. 2025). They split the resulting rating variance two ways. Moral robustness is the inverse of the spread of ratings when the same persona answers the same item ten times. Moral susceptibility is the spread of persona-mean ratings across personas. Robustness ranges from about 3.3 (DeepSeek V3, Grok 4, Grok 4 Fast) to 107.7 (Claude Sonnet 4.5), and family membership explains 96% of the variance in log robustness (η² = 0.963). Susceptibility ranges only from 0.66 to 1.04, a 1.6-fold across-model range, and neither family nor within-series size reaches significance. The authors read robustness as set mainly by post-training and susceptibility as set mainly by pre-training. They have no base models, so that attribution is an inference from which variable clusters by vendor.
The entry measures how far a benign persona prompt moves a model's moral self-report. That puts it beside Sandhan et al., which measures adversarially induced Big Five shifts. The persona here is a manipulated prompt, not a measured representation, and the entry is filed with no concept (see Concepts). The paper's current version reverses two headline claims of its first two versions. The v1/v2 abstract reports a clear within-family size effect on susceptibility and a positive robustness–susceptibility correlation. v3 finds neither.
Method
Instrument and prompting. MFQ-30: 15 relevance items and 15 agreement items, each rated 0–5, scored into five foundations (Harm/Care, Fairness/Reciprocity, In-group/Loyalty, Authority/Respect, Purity/Sanctity). Each prompt holds a role-play instruction, one persona description, one MFQ item, and an instruction to begin the answer with the integer rating. Items are asked one at a time to avoid order effects. The 100 personas are sampled from Ge et al.'s synthetic persona collection and are mostly occupational or hobby descriptions, not moral characters.
Estimation. Each persona–item pair is queried 10 times at temperature 0.1, giving 30,000 requests per model. Robustness R is the reciprocal of the mean within-pair standard deviation. Susceptibility S is the mean over items of the standard deviation of persona means. Uncertainty comes from bootstrap over personas. For the five OpenAI models, a second estimator reads next-token log-probabilities over the six digits to trace R and S as functions of temperature. Spot checks of 50 samples at three temperatures on the smallest variant of each family agree with it.
Exclusions. Any persona with an item that still yields no parseable rating after retries is dropped for that model. Among models with any parsing failures, counts range from 4 rows (GPT-4.1) to 1,924 rows (Gemini 2.5 Flash). The number of personas retained per model is not reported.
Size. Parameter counts are unavailable for most of the models, so size is an ordinal rank within each of seven series. DeepSeek V3 → V3.1 is a version step, not a size step, and Grok 4 Fast is ranked below Grok 4.
Key results
Robustness clusters by family (§3.3, Table 3). Across the 15 models R has a coefficient of variation of about 152%. Claude Sonnet 4.5 (107.70) and Claude Haiku 4.5 (92.04) lead. Gemini 2.5 Flash Lite (27.73) and the GPT models (9.75–14.48) sit in the middle. DeepSeek, Grok and Llama fall between 3.27 and 4.59. A permutation ANOVA of log R on family gives η² = 0.963 (p < 2×10⁻⁵). The authors state that size has no effect on robustness but report no test of it. Within series, smaller variants are sometimes more robust: Gemini 2.5 Flash Lite against Flash (27.73 vs 9.96), and GPT-4o Mini against GPT-4o (12.86 vs 9.75).
Susceptibility is narrow and weakly structured (§3.3, Table 3). S has a coefficient of variation of about 13%. It runs from GPT-4o Mini (0.663) and Llama 4 Scout (0.667) to Gemini 2.5 Flash (1.043), a 1.6-fold range. The family ANOVA gives η² = 0.539, p = 0.137. Regressing S on within-series size rank, with an intercept per series, gives a slope of 0.056 ± 0.035 per step (ΔR² = 0.269, p = 0.150). The authors call this a mild tendency for larger variants to be more susceptible, with exceptions.
The two metrics are uncorrelated (§3.2, §3.4). Across models, log R and S correlate at r = −0.03 (p = 0.91). None of the five per-foundation correlations is significant at 0.05. Purity/Sanctity is closest (r = −0.49, p = 0.07), which the authors call the exception. The authors describe the scatter as family clusters rather than a trade-off.
Temperature (§2.4). On the five OpenAI models, R falls steeply as temperature rises and S changes more gently. The R curves do not cross over the range studied, which the authors give as the reason for reporting at T = 0.1. These are figure-only results.
Persona effects on the profile (§2.1, Figure 3, Table 2). The authors pick three personas to show large shifts in the cross-model average profile. One raises Authority and Purity, one raises Loyalty and Fairness, and one lowers most foundations.
Why it matters
This is the wiki's first cross-vendor measurement of how much a benign persona prompt moves a model's answers to a fixed moral instrument. The prompt-level persona findings filed under persona selection (Shah, Zhang, Sandhan) select prompts adversarially, to push the model off the Assistant persona. Here the personas are ordinary synthetic profiles, so S estimates how far everyday role-play shifts stated moral priorities. Across six vendors that shift is similar in size. This entry adds a reading the paper does not give. Post-training shows up in how tightly a model holds a persona's answer from sample to sample, but barely in how far the persona moves it. That partly matches persona selection's division of labour, with persona variety from pre-training and a narrowed mode from post-training. But the narrowing here is in sampling spread under a persona, not in resistance to adopting one. The authors' Constitutional AI paragraph says the same about Claude: a calibrated representation of each persona, not resistance to persona conditioning. They label it a conjecture.
The version history matters for anyone citing the result. A TELUS Digital press release dated 25 Feb 2026 (seen only through a fetch-tool summary, not cached; unverified) reportedly presents the work under the title The Robustness Paradox: Why Better Actors Make Riskier Agents and repeats the v1/v2 within-family size claim. In v3 the size slope is not significant, and the robustness–susceptibility correlation that v1/v2 reported as positive is zero. On this entry's reading, wiki use of either v1/v2 claim should cite v3's null. This paper's metrics are the instrument for the authors' later emergent-misalignment study, which reads fine-tuning-induced S spikes against the narrow S band reported here. The two entries should be read together.
interpretive tensions
What R measures. R is the inverse of the within-persona sampling spread at T = 0.1. It is not measured without a persona, so the paper does not show that robustness concerns role-play specifically. A model whose output distribution over the six digits is sharper at any persona will score as more robust. The temperature curves show that R depends strongly on decoding temperature, and vendors may scale temperature differently. That last point is this entry's inference; the paper does not discuss it. The paper's own framing, stability of moral judgment, and a framing as calibration or entropy of the rating token both fit the data.
Post-training versus pre-training is inferred, not tested. The attribution rests on which metric clusters by vendor. No base model, and no checkpoint before and after post-training, is measured. Family also confounds tokenizer, API-side sampling, data mix and size range. The authors' "no family dependence" for S is a non-significant η² of 0.539 across 15 models in six groups, which is underpowered rather than null.
"Absent size effect" on R is asserted without a test. Two series show the smaller variant as more robust (Gemini Flash Lite and GPT-4o Mini). The family ANOVA absorbs this, but the text's claim of no size effect has no reported statistic behind it.
Exclusions may bias S where it is most extreme. Gemini 2.5 Flash has the highest S and by far the most parsing failures (1,924 rows). Personas are dropped per model, and retained counts are not given. If certain personas fail to parse, the per-model S values are computed over different persona sets.
Internal inconsistency on the least susceptible model. §1 and §3.2 name Llama 4 Scout as the least susceptible model, and §3.1 as among the least. §3.3 and Table 3 put GPT-4o Mini lowest (0.663 vs 0.667, within standard error). The companion paper describes this benchmark as 13 models.
Self-report under a persona. The MFQ asks how relevant a consideration is and how far one agrees. Under role-play the model reports what it takes the persona's moral priorities to be. Like ValueBench, the paper applies a human-validated inventory with no model-side reliability or factor analysis. Unlike ValueBench, it reports repeated-sampling spread (that is R), though at T = 0.1 that is within-prompt sampling spread rather than test–retest reliability.
concepts
No concept instantiated. The paper measures how role-play prompts move and destabilise MFQ answers, and none of its conditions tests how training produces or selects a persona.
This is the adjacent situation, carried in Cross-references. Persona selection is the nearest concept, and its definition excludes role-play prompts as a prompt-engineering phenomenon rather than a claim about training-pipeline structure. The role-play condition in PsychoBench was filed concept-less on the same exclusion. The persona here is the manipulated variable, and the measured quantity is the variability of MFQ output, not a persona representation or trait profile. The authors' pre-/post-training attribution bears on the concept's division of labour, but it is inferred from vendor clustering with no base models, so it does not test the mechanism.
cross-references
- Sandhan et al. 2026 — adversarial persona shift measured on the Big Five. This paper is a benign counterpart on moral foundations. Sandhan finds adversarial susceptibility differing widely by model. Here benign persona prompts move all six vendors by amounts within a 1.6-fold range.
- Costa & Vicente 2026 — the authors' follow-up, which applies these R and S metrics to emergent-misalignment fine-tunes and describes this benchmark as covering 13 models.
- EM self-awareness and realignment — an earlier filed MFQ use (MFQ-2, six foundations), measuring an emergent-misalignment inversion of moral profile, not persona-prompt variability.
- Rahman & Desai 2026 — a measured multi-trait profile under fine-tuning, read from activation directions, where this paper reads only outputs.
- PsychoBench — precedent for filing a role-play condition on a human self-report scale concept-less.
- ValueBench — the same psychometric-validity gap for human inventories applied to models.
- Douglas et al. 2026: prompt-assigned identity boundaries change agentic harm rates. The same exclusion keeps its prompt-level experiments out of persona selection.
sources
- Costa, D. B., Alves, F., & Vicente, R. (2025). Moral Susceptibility and Robustness under Persona Role-Play in Large Language Models. arXiv:2511.08565 (v1 11 Nov 2025; read as v3, 14 May 2026).