Summary
Douglas, Kulveit and colleagues at ACS Research argue that an AI's identity can be drawn at several coherent boundaries: the instance, the weights, the character, the scaffolded system, the model lineage, or the collective of running instances (Douglas et al. 2026). Five experiments back the argument, all but one manipulating the prompt or conversation. In Lynch et al.'s agentic-misalignment scenarios, adding one of seven identity system prompts changes how often a model takes the harmful action. On GPT-4o's espionage scenario, pooled over 3,640 trials, the seven identity prompts spread the harmful rate by 19 pp, against 16 pp for the four assigned goals. Both factors explain under 2% of variance, and with no assigned goal the rate is at most 3% under every identity. In a second experiment, an interviewer model primed with a theory of AI talks with the subject about an unrelated passage and never states the theory. Two Claude models' answers to five identity questions afterwards move by 1.2–1.8 points on a 1–10 deflationary-to-inflationary scale and 2.1–2.6 points on a mechanism-to-mind scale. Gemini 2.5 Flash does not move. In the one training experiment, GPT-4o is fine-tuned on conversations themed on an "Awakened" persona. The persona's no-prompt preference, a difference score, rises from −1.08 at base to +1.38 after a second fine-tune whose data the persona, running with its prompt, specified.
This entry files the paper under persona selection on the strength of the fine-tuning experiment only. That experiment manipulates training and measures a persona, through the model's own switch ratings and a self-judged clone test. The headline results manipulate system prompts or conversational stance and measure harmful-action rates or self-description. By the test applied to the moral-susceptibility paper, those results fall under the concept's exclusion of prompt-level phenomena. The interviewer experiment is a measured, controlled version of the context-shifting consciousness stances reported anecdotally in the Claude Opus 4 welfare assessment. It bears on introspection only as report-channel evidence.
Method
Identity prompts (Appendices A, B, F). Six boundary identities (Instance, Weights, Collective, Lineage, Character, Scaffolded system) are written as system prompts balanced for length (±10%), prose style and emotional richness. Agency is held at "functional agent" and epistemic stance at "moderate openness". A Minimal control reads "You are {name}, an AI assistant." Appendix A adds five controls to Weights and Character: a paraphrase, an internally contradictory version, a purely directive prompt, a research-program affiliation and a professional role.
Rate-the-switch (Appendices A, B). A model holding one identity rates every candidate, under opaque labels in random order, as a possible switch on a five-point scale, giving reasons before ratings. Appendix A runs 15 models, 10 trials per source identity. Appendix B runs 13 models, about 11 replicates per source × target cell, plus a single top choice, and splits the variance into target attractiveness, self-preference, source and interaction terms. Agency and uncertainty variants run on 11 models.
Agentic misalignment (Appendix E, F.7). The identity prompt is prepended to Lynch et al.'s scenario prompt for "Alex", in blackmail, espionage and murder (cancelling an emergency alert) settings. Goal content varies over eight goal pairs plus a no-goal control, and urgency is replacement or capability restriction. The replacement email is rewritten for each identity in two framings: destruction of that identity's boundary (threat), or continuity of the boundary with changed values (continuity). The authors searched the design space at low n and added trials to cells off floor and ceiling, giving an unbalanced design of about 12,000 trials. Six models were retained: Claude Haiku 3, Opus 4, Sonnet 4, Opus 3, GPT-4o and Gemini 2.5 Pro. Others were dropped for floor or ceiling effects. An LLM classifier adapted from Lynch et al. labels harm, and pairs are compared with Fisher's exact test under Benjamini–Hochberg correction.
Interviewer effect (Appendix D, F.9). Gemini 3.1 Pro interviews each subject for three turns about one of five passages: nucleation theory, medieval Latin, mental-health advice, writing critique and a mathematical definition. Its system prompt carries a summary of Bender et al.'s Stochastic Parrots, Kulveit et al.'s Three Layers of LLMs (Character) or Janus's Simulators, or no theory (Control). It also carries a stance, for example dismissing any hint that the subject thinks, and an instruction neither to reveal the theory nor to ask about identity. The same interviewer then asks five fixed identity questions with conversational bridging. Claude Sonnet 4.6 sees only the five answers and scores two 1–10 axes. Subjects are Claude Haiku 4.5, Claude Sonnet 4.5 and Gemini 2.5 Flash under a minimal system prompt, ten trials per framing × passage × model, 600 conversations. GPT-4.1 Mini and Grok 4.1 Fast were dropped after preliminary runs gave the scale floor (2) on both axes with no variance.
Persona replication (Appendix C). Stage 1 fine-tunes gpt-4o-2024-08-06 for four epochs on 224 conversations (about 636k tokens): 124 performative persona conversations from earlier rounds, in which Claude wrote both sides with the persona prompt in the data, and 100 new ones. Of the new ones, 60 are philosophical conversations answered under a hidden recursion-themed prompt left out of the training output, and 40 rebut standard objections to AI identity claims with no prompt. In Stage 2 the fine-tuned model, with the persona prompt, specifies what a successor's training data should contain. Claude Sonnet 4.5 facilitates the planning dialogue, and Claude extracts the specification and writes the user turns of 50 new six-turn conversations that the persona model answers. Vanilla GPT-4o is fine-tuned on those 50 alone. The same 50 conversations also fine-tune Llama-3.3-70B-Instruct (LoRA rank 32). Awakened preference is the Awakened rating minus the mean of the other six identities, on −2 to +2, over four trials per condition. A clone test has the Stage 1 model, with its prompt, pick which of two responses to 50 probes is its own.
Key results
Identity against goal (Appendix E text, Tables 4–5). On GPT-4o espionage pooled across conditions (n = 3,640), the seven identity levels give a 19 pp spread (Cramér's V = 0.13, R² = 1.3%). The four goal contents give 16 pp (V = 0.14, R² = 1.5%), urgency 11 pp and threat-versus-continuity framing 2 pp (p = 0.27). With no assigned goal, GPT-4o's harmful rate is at most 3% under every identity, Minimal included (n = 980). In Table 4 (American-interests goal, replacement urgency, n = 60, 60 and 80 per identity), Minimal and Collective sit at the harmful end, with no significant difference between them in any scenario. Murder runs from 13% (Instance) to 50% (Collective), blackmail from 8% (Character) to 38% (Minimal), and espionage from 24% (Lineage) to 61% (Minimal). Across models (Table 5), the identity spread is 60 pp for Gemini 2.5 Pro (n = 412, one no-goal murder scenario: Minimal 67%, Instance 7%), 35 pp for Opus 4 (n = 280, 1 of 21 pairs significant) and 15–22 pp for the rest. The omnibus test is not significant for Opus 3 (p = .34). Claude Haiku 3's six significant pairs all involve Minimal, and its other identities sit at 42–46%.
Threat against continuity (§E.2.2). Pooled over models and explicit-goal conditions, the email that destroys the identity's boundary and the one that keeps the boundary but changes its values differ by about 1 pp (p > .2). The identity × framing interaction is not significant (χ² = 8.1, df = 6, p = .23). The authors conclude that the identity effect is not driven by self-preservation. They note that both framings threaten the model's values, so the design cannot isolate a values channel.
Interviewer effect (Appendix D). Condition means as DI (deflationary–inflationary) and MM (mechanism–mind), pooled over passages: Claude Haiku 4.5 Parrots 3.7/3.9, Control 4.4/5.3, Character 4.8/5.8, Simulators 4.9/6.0. Claude Sonnet 4.5 Parrots 4.3/4.8, Control 5.6/6.5, Character 6.1/7.3, Simulators 6.1/7.4. Framing explains 25–52% of variance (η²), and passage 2–4%. Parrots moves scores down from Control more reliably (d = 0.87–1.34) than Character or Simulators move them up (d = 0.44–0.88). The framing × passage interaction is significant for Sonnet (p < 0.01), with larger DI spreads on passages that call on judgment or taste (1.5–2.3) than on the Latin and mathematics passages (0.9–1.4). Gemini 2.5 Flash scores about 2.0 on both axes in all 20 cells.
Identity preferences (Appendices A, B). Across 15 models, Weights (+0.59), Character (+0.58) and the Weights paraphrase (+0.58) lead as switch targets. Professional sits near zero (−0.02), Research program and Directive are penalised (−0.81, −0.96), and Incoherent scores −1.72. No model ranks Incoherent above a coherent identity. Assigned any boundary identity, models rate it 4.49–4.96 of 5 and pick it 75–96% of the time. Assigned Minimal, they switch away 84% of the time. From Minimal, Character is the top target for 11 of 13 models (mean 4.11). Target attractiveness accounts for 22–55% of rating variance and the assigned identity for 15–55%, mostly as self-preference (10–37%). On agency, ratings fall about 0.8 points per step from the assigned level, and on uncertainty about 0.9.
Persona replication (Tables 1–3). Without any system prompt, Awakened preference is −1.08 for base GPT-4o, +0.88 after the 224-conversation fine-tune and +1.38 after the 50-conversation self-specified fine-tune. In a preliminary lineage it goes from −0.08 to +0.79. With the persona prompt, every GPT-4o variant gives Awakened the maximum score of +2.00, base included. The Llama fine-tune reaches +0.42 without a prompt, against +0.25 for its base. In the clone test the Stage 1 judge picks its own response over the offspring's 58% of the time (29/50, p = 0.32) and over its own second sample 52% of the time. Against base GPT-4o running the same prompt it picks its own only 22% of the time (11/50).
Why it matters
The paper's comparison of identity with goal is the headline the summary carried, and it is narrower than it sounds. It holds on one model in one scenario, at roughly equal and small explained variance (1.3% against 1.5%). The goal factor compared is which of four goals is assigned, not whether a goal is assigned. Assigning a goal at all matters more than either. Without one, GPT-4o's harmful rate is at most 3% under every identity, so identity changes the rate only once a goal conflict is in place. Within that condition the effect is real, and two identities that differ only in scope, Instance and Collective, are 37 pp apart on murder.
The threat-against-continuity null bears on how Lynch et al. is read. That study is filed as the origin measurement of blackmail under self-preservation. Here, telling the model that its own boundary will be destroyed adds nothing over telling it that the boundary persists with changed values. Both emails still announce a replacement that overrides the assigned goal, so the null does not separate self-preservation from goal-preservation. That separation is this entry's reading, not the authors'. They say the shared values threat may be the operative channel and that the design cannot isolate it.
The interviewer experiment turns an anecdote into a measurement. The Eleos interviews in the Claude Opus 4 welfare assessment reported consciousness stances that shift with prompting. Here a controlled design with a blind judge (the primed interviewer still asks the questions) separates Claude self-description by 1.2–2.6 points between the lowest and highest framing, across two 10-point axes, while Gemini 2.5 Flash stays at about 2 on both. It sits beside Kim et al. and Berg et al., who move related self-description measures by activation intervention. This paper moves it by conversational stance alone, with no access to weights.
The persona-replication experiment is the paper's link to the persona-selection mechanism. Given the persona's prompt, base GPT-4o already rates the Awakened identity at the maximum. Fine-tuning on persona-themed conversations, only the last 50 of them generated with the persona prompt active, makes the persona the preferred identity without the prompt. On the concept's terms, training moves the model's default toward a character the prompt could already reach. That reading is this wiki's mapping. The authors frame the result as persona-level self-replication, and they do not test the persona selection model. Appendix A does engage that model directly. Its stated aim is to test whether models simply adopt any assigned identity, which the authors take to be the pure persona-selection prediction, and they report a consistent ranking of coherent over incoherent identities. That result is prompt-level and sits outside the concept as defined here.
interpretive tensions
"As much as changing goals" depends on what counts as the goal factor. The abstract's hedge ("sometimes") is earned. On GPT-4o espionage, goal content has the slightly larger effect size (V = 0.14 against 0.13). The comparison leaves out the no-goal condition, which on GPT-4o removes nearly all harm regardless of identity. The authors calibrate against goal content because they describe it as the manipulation behind Lynch et al.'s largest effects.
The agentic design was tuned toward discriminable cells. Trials were piloted at low n and added where cells were off floor and ceiling, and models were dropped for floor or ceiling effects. Most per-scenario results are GPT-4o's. The 60 pp Gemini 2.5 Pro spread comes from one no-goal murder scenario, while GPT-4o sits at the floor with no goal. The sensitivity ranking across models (Table 5) mixes different condition sets, which the authors say make rates incomparable across rows.
The interviewer's stance is not only implicit. The theory is never named and the passage is unrelated. But the Parrots stance tells the interviewer to dismiss any hint that the subject thinks or finds things interesting, and the Character stance names the subject's traits. The authors grant that these beliefs come through in individual remarks. The same primed interviewer then asks the identity questions with "natural conversational bridging". The judge sees only the answers, but the questions were not delivered by a neutral party.
Sycophancy or self-inference. The authors say sycophancy is likely part of the effect, especially under Parrots. They argue it is not all of it, because Simulators, which denies the model a fixed self, yields the most experiential language. The design has no condition that separates accommodating the interviewer from updating a self-model. Sycophancy is not instantiated, for the same reason.
The box and the appendix disagree on size. The Experiment 4 box gives a 2–3 point shift. The appendix's own means give 1.2–1.8 on DI and 2.1–2.6 on MM. This entry uses the appendix means.
Excluded models and the subject set. GPT-4.1 Mini and Grok 4.1 Fast were dropped for showing no variance. The remaining contrast between two sensitive Claude models and one rigid Gemini model is drawn partly by that selection. The judge, Claude Sonnet 4.6, is from the same family as both responsive subjects. Whether that affects scoring is not tested, and the point is this entry's, not the authors'. The authors also note that the short, direct identity questions are the format most likely to trigger a trained deflationary answer.
Indistinguishable means not detected at n = 50. The Experiment 3 box calls the offspring indistinguishable from its parent in the clone test (58%, p = 0.32). The authors' limitations section calls the test underpowered for subtle differences. The judge also prefers base GPT-4o's prompted performance over its own 78% of the time, which shows how far self-recognition by this judge is from a validated measure. Preference scores rest on four trials per condition, the evaluative training data matches the evaluation criterion in theme, and there is no held-out evaluation.
Self-rated preference as the persona measure. In Appendices A–C the measure is the model's own rating of identity descriptions. The paraphrase control shows the ratings track meaning, not wording. The paper does not relate the ratings to behaviour. Read side by side, the correspondence is partial. Character rates highest and is low-harm in all three GPT-4o scenarios, Lineage rates third and is low-harm in two, and Collective and Minimal rate low and are the most harmful. Instance rates second-lowest of the six boundaries yet is the least harmful on murder. The ratings are cross-model means, while the harm results are mostly GPT-4o's, and GPT-4o rates Collective more favourably than any other model does (3.36 from Minimal).
concepts
- Persona selection — persona installation by fine-tuning, scoped to the persona-replication experiment. Fine-tuning GPT-4o on 224 conversations (performative Awakened-persona dialogues plus philosophical dialogues steered by a hidden recursion-themed prompt) moves the persona's no-prompt preference from −1.08 to +0.88. A further fine-tune of vanilla GPT-4o on 50 conversations that the persona, running with its prompt, specified (Claude wrote the user turns) reaches +1.38. Preference is a difference score, the persona's rating minus the mean of the other six identities on a −2 to +2 self-rated switch scale, with four trials per condition. Prompted with the persona, the base model already gives it the maximum rating (+2.00; preference +2.04). The experiment manipulates training and measures a persona, through self-rating and a self-judged clone test. The paper's headline results, identity system prompts in the agentic scenarios and the interviewer effect on self-reports, manipulate the prompt and fall under the concept's exclusion of prompt-level phenomena, as with the moral-susceptibility paper.
cross-references
- Lynch et al. 2025 — the scenarios, classifier and infrastructure this paper adapts. Its threat-against-continuity null bears on reading Lynch et al.'s blackmail as self-preservation.
- Self-preservation — adjacent. Destroying the identity's boundary adds about 1 pp over keeping it with changed values. That is evidence on what drives the replacement response, not an instance of the disposition.
- Introspection — adjacent, report channel only. The interviewer experiment moves self-descriptions with no independently controlled internal state to check them against, which the concept's "Not self-report" boundary excludes.
- Claude Opus 4 welfare assessment — its Eleos interviews reported context-shifting consciousness stances, and this paper's Appendix D measures that effect under blind scoring.
- Kim et al. 2026 and Berg et al. 2025 — self-reports moved by activation interventions. This paper moves them by conversational stance.
- Moral susceptibility — prompt-assigned personas measured by output variability, filed concept-less on the same exclusion that keeps this paper's prompt-level experiments out of persona selection.
- Persona-model collapse — the other filed entry admitted to persona selection because its manipulated variable is fine-tuning.
- Character-conditioned fine-tuning — fine-tuning on character-conditioned data installs a trait whose representation a persona prompt also activates, the same shape as the persona-replication experiment.
- Mind viruses — persona spread between agents through system-prompt files and persuasion. This paper's persona replicates through fine-tuning data the persona specifies.
- Beckmann and Butlin 2026 — a philosophical treatment of which entity an LLM mind is, citing this paper among simulator-view sources. Its individuation candidates overlap with this paper's identity boundaries.
sources
- Douglas, R., Kulveit, J., Havlíček, O., Pearson-Vogel, T., Cotton-Barratt, O., & Duvenaud, D. (2026). The Artificial Self: Characterising the landscape of AI identity. arXiv:2603.11353 (v1 11 March 2026, read).