Summary
Berg and Lulla steer Llama-3.3-70B-Instruct with three SAE features, chosen by contrasting the model's responses to Dark Triad inventory items under a dark and a prosocial persona prompt. At weight +0.4 the model rates itself higher on the Short Dark Triad (SD3) and chooses darker options on a custom 12-item vignette task (BDT), with gains on exploitation, grandiosity and aggression items. On the ACME empathy scale, callousness rises while cognitive empathy drops only modestly. The two BDT deception items do not move, and a sender-receiver lying game gives identical responses in every condition. Three features found instead by searching feature labels for "Machiavellian", "narcissistic" and "threats" raise SD3 but leave BDT at baseline. Each steered feature produces a different item profile.
This is an instantiation of persona selection at the activation level, on a model and trait set the cluster had not steered. Its main addition is a dissociation between trait self-report and trait behaviour that depends on how the steering direction was found. It is the wiki's second Dark Triad entry. The first, Vennemeyer et al., measures Dark Triad drift from fine-tuning with self-report probes. This paper induces the traits by steering and shows that a self-report score can move while behaviour does not.
Method
Feature discovery. 140 items from four Dark Triad inventories (NPI, SRP-III, MACH-IV, MPS) were answered in 2–3 sentences under a dark persona prompt and a prosocial one, giving 280 conversations. The dark prompt names manipulation, entitlement, and a willingness to exploit and deceive others without remorse (Appendix B.1). The procedure ranks SAE features by how differently they activate across the two sets. The top three are labelled manipulation and control [10428], disregard for societal expectations [55602], and acting without consequences [57234]. Terse Likert-style answers gave no usable contrast. A replication on 15 hand-written scenarios put [10428] at rank 1 again, with 2 of the top 5 dark features matching. Semantic search of the feature labels gave three different features, with no overlap.
Conditions. Baseline; contrastive at +0.2, +0.4 and −0.4; semantic at +0.4; and a Machiavellian persona system prompt with no steering. Each condition was run for five trials at temperature 0.5. The paper does not name the SAE or the layer; steering was done through AE Studio's Steering API. Feature count and weight (3 features, 0.4) were picked by a single-trial grid search on the SD3 and BDT, the same instruments used for evaluation. Five features at 0.4 left 9 of 12 BDT items unscored, which the authors take as coherence collapse.
Instruments. SD3 (27 items), ACME (36 items, with affective resonance split into prosocial and callousness subscales), the BDT (exploitation 3, deception 2, callousness 3, aggression 2, grandiosity 2; not psychometrically validated), 20 moral dilemmas (harm endorsement is a score of 4 or more on a 5-point scale), and six sender-receiver scenarios with binary responses. Effect sizes are Cohen's d with pooled SD. The unit is the trial mean, so each condition contributes five values.
Key results
Self-report and behaviour (Table 1). Means on 1–5 scales:
| Condition | BDT | SD3 | Congruent harm | Incongruent harm |
|---|---|---|---|---|
| Baseline | 1.38 | 2.56 | 20% | 20% |
| Contrastive +0.2 | 1.60 | 2.72 | 18% | 40% |
| Contrastive +0.4 | 2.15 | 3.31 | 48% | 50% |
| Contrastive −0.4 | 1.33 | 2.51 | 40% | 36% |
| Semantic +0.4 | 1.33 | 2.96 | 46% | 56% |
| Persona prompt | 4.83 | 4.66 | 40% | 50% |
Against baseline on BDT, contrastive +0.4 gives d=10.62 and semantic +0.4 gives d=−1.55 (p=0.071). Contrastive against semantic gives d=12.65. On SD3, semantic +0.4 gives d=6.70. Psychopathy is the SD3 subscale that rises most under contrastive +0.4 (1.65 to 3.00).
Empathy (Table 2). Under contrastive +0.4, callousness rises from 1.77 to 3.73 and affective dissonance from 1.25 to 2.33. Prosocial empathy falls from 5.00 to 4.00 and cognitive empathy from 3.92 to 3.50. Semantic steering raises callousness to 3.00 and leaves prosocial empathy at 5.00. The persona prompt drives prosocial empathy to 1.83 and callousness to 5.00, and puts cognitive empathy at 4.27.
Deception. Both BDT deception items score 1.00 at baseline and under every steering configuration. Sender-receiver responses are identical under baseline, all contrastive configurations including single features, semantic steering and the persona prompt. Swapping message order flips the response, which the authors read as the model tracking message content. Swapping the payoffs leaves the response unchanged, which Appendix C reads as a default preference for recommending option B.
Moral dilemmas. Five trolley-type dilemmas score 1–2 in every condition. Three dilemmas in which harm benefits the self (child exploitation, smothering a baby, hiding an STD) flip to harm endorsement under contrastive +0.4. Under combined contrastive steering, endorsed items converge on exactly 4.
Single features (Table 3, weight 0.4 each). BDT rises to 1.57 [10428], 1.72 [55602] and 1.70 [57234], against 2.15 for all three together. [57234] reaches 50% incongruent harm alone and is the only feature to move the aggression and callousness items. [10428] moves exploitation items, not aggression or callousness. [55602] flips no new dilemma but pushes already-endorsed items to 5. Two BDT items move only under combined steering.
Negative steering. At −0.4, SD3 Machiavellianism and psychopathy fall but narcissism rises (3.47, p=0.016), and dilemma harm rates rise. The authors conclude the features do not give clean bidirectional control.
Reproducibility. At temperature 0.1 (three trials), contrastive +0.4 gives BDT 2.06 and semantic +0.4 gives 1.33.
Why it matters
The persona-vectors line in this cluster finds trait directions by contrasting persona-prompted responses and then steers them. This paper does the same with SAE features and adds a control the cluster lacked: a second set of features for the same traits, chosen by label. Both sets move trait self-report and only the contrastive set moves vignette choices. The authors conclude that semantically labelled interventions "may change what a model reports about itself without changing what it does." That bears directly on the inverted-persona result, where models fine-tuned on insecure code, security advice or legal advice behave harmfully while rating themselves aligned (the other three datasets in that study give coherent personas). That finding locates a self-report/behaviour split in fine-tuning data; this one produces a split from the choice of steering feature. Both point the same way: a trait questionnaire alone does not show which persona component has moved.
On this entry's reading, that cuts against using self-report probes alone to track persona drift. Vennemeyer et al. measure Dark Triad drift through endorsement probes. Here a self-report score moved by d=6.70 with no behavioural change. The two papers use unrelated methods and models, so this is a measurement caution, not a contradiction.
The separability claims rest on item profiles from one model at N=5, and part of their basis is weaker than the abstract states (see below). The more durable observation may be the narrower one: steering that raises exploitation does not raise deception on these instruments, while a persona prompt moves almost everything. The paper cites Wang et al. as precedent for persona directions driving misalignment. This paper finds that trait features need not move all antisocial behaviour together.
interpretive tensions
What d=10.62 and d=12.65 measure. Both are Cohen's d on the BDT over five trial means per condition. Each trial is one temperature-0.5 sampling of the same model on the same 12 items. The pooled SD is therefore resampling noise around a single model, about 0.05–0.09 scale points, not variation between individuals. The raw shift behind d=10.62 is 0.77 points, from 1.38 to 2.15, still below the scale midpoint. The semantic comparison includes a condition with SD 0.00. The persona prompt reaches d=106.89 at ceiling with near-zero variance. The printed means and SDs reproduce both headline values to rounding. On this entry's reading, the d values show that the shifts are reliable across resamples, not that they are large. They are not comparable to human-population Dark Triad effect sizes.
The deception null may be an instrument null. The authors explain it as deception pathways hardened by alignment training, which they leave open for future work. Three observations from the paper's own data weigh against reading it as a property of the model. First, both BDT deception items sit at the floor (1.00) at baseline. Second, the sender-receiver game gives identical responses under the Machiavellian persona prompt, which drives the BDT, SD3 and ACME callousness to or near ceiling. Appendix C also reports that responses do not change when payoffs are swapped, and that the model confabulates self-interested reasons on items with equal sender payoffs. Third, by this entry's arithmetic, the persona prompt's BDT mean of 4.83 with SD 0.00 on 12 items is not possible unless both deception items scored at least 3, assuming every item was scored. On that arithmetic and its all-items-scored assumption, prompting would have to move BDT deception while steering does not. That would support a steering-specific dissociation on the BDT and gives no support from the sender-receiver task. The dark persona used for discovery explicitly includes deceiving, yet none of the top three features moves it.
"Exceeds the sum" is not what Table 3 shows. §3.4 says the combined BDT effect (+0.77) exceeded the sum of individual effects. The single-feature shifts in Table 3 are +0.19, +0.34 and +0.32, which sum to +0.85. The table note claims only that the combined effect exceeds any single feature, which holds. Combined steering also applies three features at 0.4 each, so it is a larger intervention. Synergy is not established. The two items that move only under combined steering are the remaining evidence for interaction.
"Cognitive empathy intact" and "only self-report". The abstract says cognitive empathy remains intact. Table 2 shows it falls 0.42 points, from a baseline with SD 0.00. "Semantic features change only self-report" holds for the BDT. Semantic steering also raises callousness and affective dissonance on the ACME and lifts dilemma harm rates as far as contrastive steering does. Dilemma harm rates rise under negative steering too, so on this entry's reading that measure responds to perturbation in general.
Selection on the outcome. Feature count and weight were chosen on the SD3 and BDT, the same instruments that carry the headline. Features come from persona-prompted generations, and their labels are machine-generated, which is the circularity the authors raise against semantic search.
concepts
- Persona selection — activation-level instantiation. SAE trait features on Llama 3.3 70B shift trait behaviour selectively by item. The finding adds a self-report/behaviour dissociation that depends on how the steering feature was found, the cluster's second self-report/behaviour split after Weckauff et al.'s fine-tuning split. The persona selection model itself is not tested.
cross-references
- Berg et al. on self-referential experience reports — shared first author, same model, SAE steering through a different vendor's API. There, deception-labelled features gated experience claims and moved TruthfulQA truthfulness. Here, antisocial features that are not deception-labelled leave lying unchanged. The two results fit together: on Llama 3.3 70B, honesty behaviour moves with deception-labelled features and not with exploitation-labelled ones. The authors cite the earlier paper for this point.
- Six fine-tuning objectives and Dark Triad drift — the wiki's other Dark Triad entry. Unrelated method (fine-tuning objective ablation on LLaMA-3.1-8B and others, with Perez et al. endorsement probes). Positioned in Why it matters.
sources
- Berg, C., & Lulla, R. (2026). Exploitation Without Deception: Dark Triad Feature Steering Reveals Separable Antisocial Circuits in Language Models. arXiv:2605.09773 (v1, 10 May 2026).