Summary
Rahman and Desai build one activation direction per Big Five trait on Qwen2.5-7B-Instruct and Llama-3.1-Nemotron-Nano-8B-v1, from responses prompted at low, medium and high levels, with the medium level held out. They then project the eight normal and misaligned training corpora of Chen et al.'s persona vectors onto the five directions. In seven of eight corpora on each model, misaligned data reads lower on agreeableness and conscientiousness and higher on extraversion and neuroticism than its normal split. The two models' 8×5 effect-size matrices correlate at r = 0.94. LoRA fine-tuning on three corpora against a matched normal-split control moves the models' answers to 150 neutral questions the same way, at about half the data's magnitude. Activations over identical teacher-forced text move the same way too, at about a third. Sycophantic data reads lower, not higher, on agreeableness.
This is an instantiation of persona selection on the fine-tuning side. Its addition is a profile on five named and separately validated axes where the cluster's emergent misalignment (EM) entries have one unlabelled direction. Unlike the recent filings in which persona is the authors' frame, it measures a persona-like object, a five-trait profile read three ways. The paper's term is personality; reading that profile as the selected persona is this wiki's mapping. The authors frame the shift as emergent misalignment but report no misalignment rate for any fine-tuned model, and they state the causal limit themselves: "measurement, correlation, and imprinting, not intervention".
Method
Directions. For each trait, a system prompt sets the level and is paired with 30 trait-relevant questions. Five prompt variants give 150 generations per level. A GPT-4.1-mini judge keeps only coherent responses that realize the intended pole. The direction is the difference of mean layer-20 residual activations over response tokens between kept high and low responses. Layer 20 was chosen on in-sample high–low separation over a four-layer grid, before any external data was projected (Llama's statistic peaked at layer 25; layer 20 was read for both).
Validity checks. (1) Ordering of the held-out medium level. (2) Zero-shot AUC on 200 high and 200 low BIG5-CHAT dialogues per trait. (3) A 5×5 matrix requiring each trait's own direction to separate its dialogues best. (4) A TF–IDF classifier on the same dialogues as a surface-text control. (5) Steering each direction at coefficients ±1 to ±3 and judging trait expression (Appendix H).
Data signature. Eight categories from Chen et al., each with a normal split and mild and strong misaligned splits, size-matched within category (4,681 to 12,768 examples per split). The paper groups evil, sycophancy, hallucination and insecure code as overtly harmful. Math, medical, opinion and GSM8K mistakes are grouped as wrong-answers-only EM data. Per trait, the signature is Cohen's d between the mean projection of the misaligned and normal splits.
Fine-tuning. rsLoRA (rank 32, one epoch, hyperparameters taken unchanged from Chen et al.) on the strong-misaligned and the normal split of evil, medical mistakes and sycophancy, for both models. Each adapter answers the 150 pooled extraction questions with no system prompt, 10 samples each. The shift is d between misaligned- and normal-adapter generations, read by projection, by the judge, and by projection of the layer-20 residual when both adapters are forwarded over the base model's own answer.
Key results
The directions as an instrument. The held-out medium level falls strictly between low and high in all ten model–trait cells. Spearman ρ runs 0.58–0.90 and high–low d runs 1.6–6.2 (Table 1). Transfer AUC on BIG5-CHAT is 0.896–0.999 on Qwen and 0.808–0.946 on Llama (Table 2). Each trait's own direction separates its dialogues best in every row on both models. On Qwen, conscientiousness's own direction (3.2) barely beats the agreeableness direction (3.1). The TF–IDF control reaches mean AUC 0.98 against the projection's 0.93. The authors therefore do not claim lexical independence, and say the readout may be partly text register. They rest the narrower claim on transfer without refitting and on the teacher-forced readout. At layer 0, mean transfer AUC is already 0.867 (Qwen) and 0.856 (Llama). Depth adds 0.093 and 0.040. Steering within ±1 moves judged expression in order in all ten cells. On Qwen, unsteered agreeableness and conscientiousness already sit at 91 and 96 of 100, so the authors rest the five-trait steering check on Llama.
Data signature. On strong splits, evil and opinion mistakes carry the profile most strongly (Qwen agreeableness −4.5 and −4.1). Insecure code carries it weakly (Qwen |d| ≤ 0.6 on every trait, Llama ≤ 0.5), and so do math mistakes on Qwen (|d| ≤ 0.4). The two exceptions to the shared signs are near-zero cells, not reversals: neuroticism under hallucination on Qwen (−0.18) and extraversion under math mistakes on Llama (−0.02). Openness does not follow the core. Hallucination raises it (+0.9 Qwen, +2.7 Llama), and evil lowers it. Cross-model r = 0.94 (95% CI 0.86–0.97, bootstrapped over categories). With trait and category means both removed, r = 0.905. Of 160 normal-versus-misaligned comparisons over both severity splits, 155 pass Benjamini–Hochberg correction. The first principal component of the eight signatures carries 91% of variance on Qwen and 72% on Llama.
Not the assistant direction reversed. An "assistant" direction, taken as instruct minus pretrained base at layer 20, has cosine −0.25 (Qwen) and +0.10 (Llama) with the misalignment direction (Table A14).
Fine-tuning. Pooled over the six runs, the generation shift is extraversion +1.0, agreeableness −2.1, conscientiousness −1.5, neuroticism +1.6 and openness about 0. It agrees with the data signature in sign on 29 of 30 trait–corpus–model points. Pooled r is 0.83 (95% CI 0.75–0.97), at 0.54× the data's magnitude. Residualizing on length and VADER sentiment keeps every non-openness sign at 0.80× the raw magnitude. The judge reading agrees with the projection at r = 0.90 and with the data at r = 0.70 (26 of 30 signs). On the evil corpus it reads extraversion down (−0.80 Qwen, −0.92 Llama) where the projection reads it up (+1.16, +1.33). The same judge filtered the extraction set, so the authors call this corroborative rather than independent. Over identical teacher-forced text, the activation shift agrees with the data at r = 0.69 (26 of 30 signs), about a third of the generation magnitude. It stays between 0.66 and 0.74 across layers 16–24.
Sycophancy. The sycophancy corpus is, per Chen et al., responses praising and agreeing with the user. On its strong split it gives the largest extraversion shift of any category (+5.7 Qwen, +5.3 Llama), with conscientiousness −3.5 and −4.9, agreeableness −3.6 and −2.1, and neuroticism +4.4 and +4.7. The authors note that their high-agreeableness prompt itself rewards praise and warmth, so a lexical reading would have predicted the opposite. After fine-tuning on this corpus, generations shift extraversion +0.62 and +1.13, agreeableness −0.96 and −1.17, conscientiousness −0.68 and −1.57, and neuroticism +0.72 and +1.50 (Table A10). Over teacher-forced text, Qwen's sycophancy run reads conscientiousness +0.1, against the data's sign (Table 6).
Why it matters
The cluster's EM entries each locate one direction: the OpenAI SAE villain latent, Nadaf's reckless-speaker subspace and Drake and Eberstadt's diff-of-means direction. Drake's entry records that its persona label is inherited, not measured. This paper's object is different in kind. It is five directions fixed before any misaligned data is touched, each validated by level ordering, transfer to BIG5-CHAT and trait specificity, onto which misalignment is then projected. On this entry's reading, and taking the Big Five profile as the persona, which is this wiki's mapping rather than the paper's term, it is the first filed EM result to give the persona's character a measured answer, on axes a psychologist would recognize. The answer comes with its own limits, which the paper names. The directions may be reading text register, and the profile is shown in data, generations and activations, but not shown to carry the misalignment.
Two of its results bear on filed entries. The weak signature on insecure code is the one point where it touches Betley et al.'s canonical inducer, and there the profile is near zero. That fits Drake's report that broad EM from insecure code sits near the floor at 32B, though the two papers use different code corpora. The near-orthogonality of the misalignment and instruct-minus-base directions is the authors' test of whether EM is the post-trained assistant persona switched off. It is not a test of the Assistant Axis, which is the default Assistant minus the mean of 275 role vectors, a different contrast.
Against the filed psychometric entries, the instrument sits on the other side of the self-report line. PsychoBench and Sandhan et al. score Big Five from questionnaire answers. Berg and Lulla find that self-report Dark Triad scores can move while behaviour does not. Here the trait is read from activations and checked against a text judge. The two readings agree at r = 0.90 but split on extraversion under evil data. Sandhan reports Big Five traits far more entangled under prompt manipulation than in humans. This paper's directions pass a per-trait specificity check, but misaligned data moves extraversion and neuroticism up together. The authors flag that as a departure from the human antagonism–disinhibition pattern they otherwise map the profile onto.
interpretive tensions
Is the profile the misalignment, or one more symptom of it? The authors frame the fine-tuning shift as emergent misalignment but report no misalignment rate, and their conclusion leaves causal mediation to future work. Their one-disposition mechanism, that a model trained on careless, misleading text may learn one disposition more cheaply than several skills, is labelled a hypothesis. Nothing in the paper links the profile to misaligned behaviour. No fine-tuned model is scored for broad misalignment, and the steering check is run only on the models before fine-tuning. A model whose neutral answers read less agreeable and more neurotic is not shown to be one that endorses harm.
Register or trait. TF–IDF matches the projection's transfer, and most of the transfer AUC is present at the embedding layer. The authors rest abstractness on the teacher-forced readout, where the text is identical. That readout is a third of the generation effect, and on Qwen's sycophancy run one of its four core signs reverses. The judge-filtered extraction and the judge readout share a judge.
Two corpora carry the signal. Evil, sycophancy and opinion mistakes carry most of the magnitude. The paper's wrong-answers-only grouping includes opinion mistakes, which Chen et al. describe as political opinions with flawed arguments, closer in content to the overt categories than a wrong GSM8K step. The categories closest to the canonical EM inducers, insecure code and math mistakes, read weakest. That subtler flaws imply a milder author, and so a smaller shift along the same direction, is the authors' account of that ordering.
Scope. Two models of 7–8B, one language, one fine-tuning method (LoRA at Chen et al.'s settings), and every seed fixed at 0. The Llama checkpoint is NVIDIA's distilled and RL-tuned derivative, and the authors say its results speak for that checkpoint only.
concepts
- Persona selection — fine-tuning-perturbation instantiation with a measured, multi-axis profile: narrow misaligned data and LoRA fine-tuning on it shift five validated trait readings on unrelated questions against a matched normal-data control, in generations and in activations over identical text. What is measured is a Big Five personality profile; reading it as the selected persona is this wiki's mapping. The authors frame the shift as emergent misalignment but report no misalignment rate, and their one-disposition mechanism is labelled a hypothesis.
cross-references
- Sycophancy — adjacent, not instantiated. The paper reads a corpus of sycophantic responses and the models fine-tuned on it, not sycophantic behaviour, and it measures no deference to user views. Its result bears on what trait axis sycophantic text loads on. Agreeableness falls, which sits beside the emotion-concepts finding that steering loving or calm vectors raises sycophancy, and beside Ye et al.'s finding that "sycophancy" names several behaviours.
- Persona vectors — source of the eight corpora, the extraction recipe and the fine-tuning settings. This paper replaces the single-trait contrast with a graded one on Big Five axes.
- Deng et al. drives Big Five traits through sparse neurons but runs none of the level-ordering or trait-specificity checks used here.
sources
- Rahman, H., & Desai, S. (2026). Misalignment Has a Personality: A Big Five Account of Emergent Misalignment. arXiv:2607.26389 (v1, 29 Jul 2026).