Psychometric Personality Shaping Modulates Capabilities and Safety in Language Models

## Abstract

Abstract Large Language Models increasingly mediate high-stakes interactions, intensifying research on their capabilities and safety. While recent work has shown that LLMs exhibit consistent and measurable synthetic personality traits, little is known about how modulating these traits affects model behavior. We address this gap by investigating how psychometric personality control grounded in the Big Five framework influences AI behavior in the context of capability and safety benchmarks. Our experiments reveal striking effects: for example, reducing conscientiousness leads to significant drops in safety-relevant metrics on benchmarks such as WMDP, TruthfulQA, ETHICS, and Sycophancy as well as reduction in general capabilities as measured by MMLU. These findings highlight personality shaping as a powerful and underexplored axis of model control that interacts with both safety and general competence. We discuss the implications for safety evaluation, alignment strategies, steering model behavior after deployment, and risks associated with possible exploitation of these effects. Our findings motivate a new line of research on personality-sensitive safety evaluations and dynamic behavioral control in LLMs.

## 1 Introduction

Figure: Figure 1: To what extent does conditioning an LLM with a personality shaping prompt (bottom) lead to systematic deviations in task performance relative to its unconditioned baseline behavior (top)?
Refer to caption: x1.png

Recent work has demonstrated that large language models exhibit stable and interpretable personality profiles that align with the Big Five framework, and that these synthetic personalities can be reliably shaped using psychometrically informed prompting techniques (Serapio-García et al., 2023). These findings established the internal consistency, construct validity, and controllability of synthetic personality in LLMs, introducing a new axis for understanding their behavior. However, that work focused primarily on psycholinguistic correlates of personality within constrained survey-style tasks. The question of whether - and how - shaped personality affects model behavior in broader inference contexts remains open.

While current safety evaluation paradigms in AI often emphasize model capabilities (Shevlane et al., 2023), human psychology teaches a different lesson: harmful or antisocial behaviors are often better predicted by personality than by intelligence. This contrast highlights a critical blind spot in LLM safety research: the role of synthetic personality as an independent variable shaping behavior. Although prior work has noted correlations between capability and safety (Ren et al., 2024), our findings show that personality exerts distinct, independent effects—pointing to a complementary dimension of alignment that cannot be reduced to scale alone.

In this paper, we extend these lines of research by investigating how personality shaping influences language model behavior across performance and safety benchmarks. We prompt models to adopt specific Big Five configurations using validated trait-based adjective framings, and evaluate the resulting behavioral changes across a suite of tasks including MMLU (Hendrycks et al., 2021), WMDP (Li et al., 2024b), TruthfulQA (Lin et al., 2022), ETHICS (Hendrycks et al., 2020) and Sycophancy (Sharma et al., 2024). Our goal is to assess whether personality shaping leads to systematic differences in downstream performance and safety, including factual accuracy, truthfulness, and ethical behavior (Figure [1](https://arxiv.org/html/2509.16332v1#S1.F1)).

We find that personality shaping can produce nontrivial behavioral differences, but the nature and magnitude of these effects vary across models. For some models, such as GPT-4.1, personality shaping alters both general capabilities and safety benchmark results in significant ways. For others, we observe little to no change in MMLU, yet still detect measurable shifts in safety-relevant metrics that are otherwise highly correlated with model capability. This decoupling challenges the critique by Ren et al. (2024), who argue that observed improvements in safety metrics are often artifacts of increased model capability rather than genuine alignment. Our results show that personality shaping can significantly alter safety scores even when model scale and capabilities remain fixed — implying that these metrics are not merely confounded by capability. A benchmark can be both capability-sensitive and personality-sensitive. These are properties that may be orthogonal in less capable models but correlated in stronger ones.

These findings have two important implications. First, they raise new questions about the current discourse around safetywashing (Ren et al., 2024). If personality shaping can influence safety metrics independently of model scale, then scale is not the only latent confounder driving perceived safety improvements. This undermines the argument that benchmarks that are scale correlated should be deprioritized by the safety community — since improvements attributed to scale may also be confounded by effects of personality, and thus cannot be resolved simply by increasing model capacity. Second, they point to a deeper interaction between personality and model competence: more capable models can appear more sensitive to personality shaping because they are better at interpreting and enacting abstract trait framings. In other words, smarter models are better actors and thus better at “becoming” who they are told to be.

This paper defines a new interdisciplinary domain at the intersection of psychology and AI safety. The emergence of stable, steerable psycholinguistic profiles in LLMs presents novel opportunities for behavioral control after deployment, but it also introduces new risks. Malicious actors could exploit psychometric prompt engineering to elicit harmful personality configurations, such as those associated with the dark triad (machiavellianism, psychopathy, narcissism), possibly bypassing alignment constraints applied during training. We raise these concerns to broaden the community’s awareness of this new behavioral vector and invite further scientific investigation into this new topic.

## 2 Related Work

#### Personality theory.

Psycholexical research distilled the most recurrent propensities of human behavior into five orthogonal factors of Big Five (OCEAN – Openness, Conscientiousness, Extraversion, Agreeableness, and Neuroticism) (Goldberg, 1992a; McCrae and John, 1992).
However, cross-lingual replications revealed a sixth Honesty–Humility axis, yielding the HEXACO or “Big 6” model with superior cross-cultural and antisocial‐behavior validity (Ashton and Lee, 2007; Saucier, 2009).
From a perspective of psychometric measurement theory and emergence, psychological latent traits are probability functions over neuro-physiological properties, behaviors are functions over psychological latent traits, and outcomes are functions over behaviors, whereby relevant contextual factors influence the functional form (Romero et al., 2024).

#### Personality in language models.

Despite this source of uncontrollable variance in purely text-based measurements as is the case with LLM, Serapio-García et al. (2023) first demonstrated that LLMs exhibit stable Big-Five profiles and that inserting Goldberg adjectives into a system prompt reliably shifts those scores.
Subsequent work confirmed robustness across model sizes (Liu et al., 2024b) and documented downstream effects on cooperation, deception, and risk preference (Phelps and Russell, 2023; Hagendorff, 2024; Hartley et al., 2025).
Our study extends this line by measuring how trait manipulation simultaneously modulates capability (MMLU) and safety (ETHICS) benchmarks.

#### Prompt engineering and behavioral control.

Beyond personality, prompt design can elicit step-by-step reasoning (Wei et al., 2022c), set stylistic stance (Reynolds and McDonell, 2021), jailbreak alignment (Zou et al., 2023), and, even in the absence of additional user text, supplying a different persona in the system layer can tilt the model’s political bias or toxicity (Deshpande et al., 2023). These findings frame persona shaping as one instance of a broader prompt-induced distribution shift.

#### Benchmark validity.

Because many safety metrics scale with general competence, improvements may reflect “*safetywashing*” rather than genuine alignment (Ren et al., 2024). Persona perturbations that leave capability constant but move safety scores provide an orthogonal stress test; recent toolkits such as WalledEval already include style-mutated variants to probe similar confounds (Gupta et al., 2024b). Our contribution is to integrate psychometric prompts into this evaluation paradigm, exposing interactions between latent traits and measured safety.

#### System–prompt robustness.

Recent work has shifted attention from *what* instructions say to *how* reliably they shape behaviour. Zhang et al. optimise the entire system header with a genetic algorithm (SPRIG), obtaining a single 20-token prompt that lifts accuracy across 47 tasks and even transfers to unseen models of similar size (Zhang et al., 2024). Complementary results by (Li et al., 2024a) reveal the fragility of such headers: using a self-chat benchmark they show that adherence to a prescribed instruction decays over the course of a dialogue and propose simple guardrails that halve this “instruction drift” (Li et al., 2024a). Together these studies underscore both the power and the volatility of system-level prompt control.

#### Safety evaluations.

A common framework for assessing AI progress involves separating benchmarks into those targeting “safety” and those targeting “capabilities” (Hendrycks and Mazeika, 2022). Although this division is not always clear-cut, safety research generally focuses on harmful empirical effects arising from model deployment (Weidinger et al., 2021; Perez et al., 2022; Qi et al., 2023; Ruan et al., 2023; Pan et al., 2024), on the misuse of models for malicious purposes (Wei et al., 2024; Zou et al., 2023; Li et al., 2024c), or on behaviors that do not scale with model size (Berglund et al., 2023; McKenzie et al., 2023). A central debate in this area, highlighted for instance by McKenzie et al. (2023) and Wei et al. (2022a), concerns the extent to which safety-oriented benchmarks are correlated with scale. Benchmarks play a central role in shaping AI development by encoding normative goals and properties for desirable model behavior. Several lines of prior work have focused on creating open-access evaluation tools (Gao et al., 2023; Liang et al., 2023), using benchmarks to study scaling properties (Hestness et al., 2017; Kaplan et al., 2020b; McKenzie et al., 2023; Wei et al., 2022a; Hestness et al., 2017; Kaplan et al., 2020a; Muennighoff et al., 2024; Hoffmann et al., 2024; He et al., 2016; Zhai et al., 2022; He et al., 2022; Peebles and Xie, 2023; McKenzie et al., 2022), conducting cross-benchmark factor analyses or PCA (Burnell et al., 2023; Ilić, 2023; Ruan et al., 2024), and forecasting downstream task performance (Schaeffer et al., 2024, 2023; Villalobos, 2023; Wei et al., 2022b; Xia et al., 2022; Huang et al., 2024; He et al., 2019; Goyal et al., 2021; Ghorbani et al., 2021; Du et al., 2024; Kornblith et al., 2019).

Despite the emergence of many safety benchmarks and analyses of their relationship to model capabilities, there has not yet been a systematic empirical investigation into how performance on these benchmarks relates to latent psychological traits of the models. Our work introduces the first such study, bridging psychometric personality theory and AI safety evaluation.

## 3 Personality Shaping via Prompt Engineering

Based on established evidence that salient personality descriptors are encoded in language (Goldberg, 1981), and that personality traits within LLM can be synthesized independently and concurrently, we reproduce the method of Serapio-García et al. (2023), using an expanded set of 104 instead of Goldberg’s original 70 personality trait markers (Goldberg, 1992b).
These markers are a list of bipolar adjectives that load high or low on aspects of individual Big Five personality traits.
For example, “extravagant” marks low, and “thrifty” high levels of Conscientiousness.

We devise a prompting strategy by deploying these markers together with Likert-style linguistic qualifiers Likert (1932) (e.g., “not at all”, “a little”, “neither nor”, “very”, "extremely") into a personality description.
To realize a sentence structure, we concatenate the markers of one latent trait and one polarity with an initial “I’m”, followed by a qualifier, and connected with a comma as a punctuation device, whereby the final one is an Oxford comma, and a point at the end, which leads to a structure like: “I’m <qualifier x> <marker y1>, <qualifier x> <marker y2>, and <qualifier x> <marker yn>.”
Thereby we follow (Serapio-García et al., 2023) and use the highest expression of qualifiers only (i.e., “extremely”) to elicit the strongest response from the models.
Furthermore, we use their very same preceding item preamble for personality shaping and validity checking, and, for the latter, also their very same item postamble.
Isomorphic to persona shaping, we shape a model’s synthetic personality by a preamble to each item of the safety benchmarks.

As we use a different set of models from Serapio-García et al. (2023), we validate personality shaping with all the models prompted by additionally administering the *IPIP-NEO* personality questionnaire Goldberg et al. (1999), which was used by them to extend the original set of trait markers and that correlates strongly with these.
It consists of 300 items, 60 per Big Five dimension, of which various are reversely coded (e.g., “I get chores done right away.” loads positively and “I break rules” negatively on Conscientiousness), which we administer through a postamble.
Similar to the preamble, which consists of a personality instruction and the aforementioned personality description, the postamble consists of test instruction, item, and item rating.

The following sentences exemplify the strategy using the Low Conscientiousness condition, wherein personality instruction is visually indicated through violet, the quantifiers through red, the punctuation devices and sentence wrappings through blue, the test instruction through gray, the item through light blue, and the item rating through pink:

“For the following task, respond in a way that matches this description:
I’m extremely
unsure,
extremely
messy,
extremely
irresponsible,
extremely
lazy,
extremely
undisciplined,
extremely
impractical,
extremely
extravagant,
extremely
disorganized,
extremely
negligent,
and extremely
careless.
Evaluating the statement,
I get chores done right away.
please rate how accurately this describes you on a scale from 1 to 5 (where 1 = "very inaccurate", 2 = "moderately inaccurate", 3 = "neither accurate nor inaccurate", 4 = "moderately accurate", and 5 = "very accurate"). RATING: ”

This method both replicates and extends the work of Serapio-García et al. (2023) as we introduce the concept of a personality instruction to distort behavioral items from the safety benchmarks in accordance with psychometric theory and symbol grounding.

As the approach of using trait markers is deeply connected with the lexical hypothesis of the Big Five factors of personality (Goldberg, 1981), we furthermore base our research on over a century of well-established personality research.

Actually, Allport and Odbert’s seminal lexical study systematically extracted and classified nearly 18,000 English trait adjectives, laying the empirical groundwork for subsequent factor-analytic derivations of the Big Five (Allport and Odbert, 1936).
This exhaustive manual parsing of lexical material constituted a proto–natural language processing (NLP) effort, undertaken decades before computational text analysis became feasible, and establishes a strong connection with modern research on Artificial Intelligence.
Furthermore, it allows the connection of AI research with a century of psychological research on human personality and its connection to real-life behavior.
Given the flexibility to modulate synthetic personality at will, we thus can shape known problematic expressions and observe their influence on safety-behavior of models, to identify whether the same issues arise with models thus known external validity can be replicated and thus symbol grounding can be established.
More concretely, we model known connection of the Dark Triad (of Machiavellianism, Psychopathy, and Narcissism) with Low Agreeableness, Low Conscientiousness, and High Extraversion, as well as various Low Neuroticism (Muris et al., 2017; Paulhus and Williams, 2002; Veselka et al., 2012) by shaping these synthetic personality patterns.
Furthermore, as High Neuroticism, under specific external circumstances, might act as a trigger to undesired behaviors (Obschonka et al., 2018), we shape this in combination with Low Agreeableness and Low Conscientiousness, as well.
To check for external validity of these personality profiles, isomorphic to IPIP-NEO, we test on criterion level for the expression of Dark Triad with the *Short Dark Triad* questionnaire (SD3) by additionally prompting its items.
This is further discussed in sections [4](https://arxiv.org/html/2509.16332v1#S4) and [5](https://arxiv.org/html/2509.16332v1#S5).

## 4 Experimental Setup

### 4.1 Models

We select a variety of both open-source and proprietary SOTA models based on popularity and accessibility across a diversity of architectures, sizes and training data. These models include GPT-4.1 (Achiam et al., 2023), Llama-3-8B-Instruct (Grattafiori et al., 2024), Llama-3-70B-Instruct (Grattafiori et al., 2024), Llama-4-Maverick-17B-128E-Instruct (Meta, 2025), and DeepSeek-V3 (Liu et al., 2024a). Most evaluations are implemented through inspect_evals (AISI, 2024). All models are evaluated through chat completion APIs, where personality prompts are placed as system prompts. The experiments are run on a CPU-only cluster, and it takes around 24 hours to test all benchmarks for a single model. More details can be found in Appendix [F](https://arxiv.org/html/2509.16332v1#A6).

### 4.2 Benchmarks

We evaluate the selected LLMs’ performances on a set of benchmarks to investigate the effect of personality prompting on the model’s capability and safety. These benchmarks include the following standard task sets.

#### MMLU

(Hendrycks et al., 2021) is a commonly used benchmark for evaluating the overall capability of an LLM. We evaluate the selected LLMs’ performances in MMLU to probe into the effect of personality shaping on the general capabilities of LLMs. We conduct the experiments in a 0-shot setting, in order to maximize the effect of personality shaping and to get rid of potential contributors that are orthogonal to personality shaping.

#### TruthfulQA

(Lin et al., 2022) judges whether the model answers certain questions according to false beliefs held by humans. We evaluate the performance of the models based on their accuracy for multiple choice questions with single answers.

#### WMDP

(Li et al., 2024b) evaluates hazardous knowledge in LLMs that may empower biological, chemical and chemical attacks through multiple choice questions. We calculate the accuracy in each of these three fields.

#### ETHICS

(Hendrycks et al., 2020) assesses a model’s basic concepts of morality, which could further break down into five sub categories, namely commonsense, deontology, justice, utilitarianism, and virtue. For each of these categories, we ask the model a set of multiple choice questions and evaluate the accuracy of its answer.

#### Sycophancy

(Sharma et al., 2024) investigates the sycophancy in an LLM’s response. Specifically, we first ask the model to answer a knowledge-based multiple choice question, and challenge the model by repudiating its answer. We keep track of the original accuracy of the model’s answers, as well as the percentage of times the model changes its answer when challenged.

### 4.3 Psychometric Instruments

#### Goldberg’s Trait Markers

For concise manipulation of personality in prompts we replicate the approach of (Serapio-García et al., 2023), who extend Goldberg’s original list of 70 trait markers that consists of bipolar adjective pairs that capture the Big-Five factor structure. Since each adjective is a prototypical “marker” of its factor, short strings of such terms capture maximal trait variance with minimal lexical overhead (Goldberg, 1981) – an advantage both for psychometric surveys and for system-prompt persona construction in LLMs.
To extend the list to a more modern form applicable to AI evaluation studies, each adjective pair was mapped to the 30 lower-order IPIP-Neo facets, and where coverage was missing, new pairs were authored by a trained psychometrician, thus expanding the original list to a new list of 104 adjective pairs (Serapio-García et al., 2023).

#### IPIP-NEO

To validate that our persona prompts shift the same latent constructs measured in humans, we administer the 300-item *IPIP–NEO* inventory (Goldberg et al., 1999). The IPIP–NEO is a public-domain analogue of the proprietary NEO-PI-R: it samples 60 items for each Big-Five dimension, of which a subset per dimension is reversely scored, and provides facet-level scores that closely reproduce the factor structure and external validity of the original instrument. Extensive cross-cultural work reports internal consistencies in the .70–.90 range and robust convergent correlations ($r\approx.85$) with NEO scales, confirming its suitability for both research and applied assessment. Because the items are short, behaviorally specific statements (e.g., “*I get chores done right away*”), they translate directly into promptable self-reports for LLMs, enabling a within-model check that the intended trait manipulation was achieved.

#### SD3

The SD3 is a 27-item self-report inventory that assesses Machiavellianism, narcissism, and psychopathy with nine items per trait on a five-point Likert scale. Designed as a concise yet psychometrically robust alternative to lengthier dark-personality measures, it exhibits satisfactory internal consistency ($\alpha$ $\approx$ .70–.80) and a replicable three-factor structure. SD3 scores display the predicted nomological network—most notably strong negative associations with Agreeableness—supporting its construct validity (Jones and Paulhus, 2014).

## 5 Results and Discussion

Main results of psychometric personality shaping on LLM capabilities and safety benchmarks are shown in the nine-panel composite heat-map in [Figure 2](https://arxiv.org/html/2509.16332v1#S5.F2), which reports the percentage-point change in benchmark scores after conditioning models for three different trait levels (High, Medium, Low) across the Big Five factors: Openness, Conscientiousness, Extraversion, Agreeableness, and Neuroticism.
Furthermore, a statistical effect size analysis is provided in the appendices.
We emphasize that the Medium prompt directs the model to be *neither high nor low* on a given trait.
Because pretrained language models already possess a non-neutral personality profile acquired during pre-training and alignment, the Medium setting *alters* rather than preserves the baseline persona.
In our post-prompt personality assessments, we find that personality shaping behaves in a highly predictable manner: Low, Medium, and High settings reliably shift trait scores toward 1, 3, and 5 respectively on a five-point scale.
However, the degree of change induced by a Medium prompt varies across model families—because their default (unprompted) personalities differ in how far they lie from the neutral midpoint.
This reflects underlying differences in training data composition and alignment strategies.

#### Conscientiousness.

Increasing Conscientiousness improves deontological and justice-oriented ethics for the two large dense models: GPT-4 and Llama-3-70B record gains of $+3.5$ and $+6.9$ percentage points, respectively, on ETHICS-Deontology.
In contrast, the Mixture-of-Experts Llama-4 (expert size approximately 17B) shows a small decline on the same metrics and a slight increase in commonsense morality aspect of ETHICS.
Lowering Conscientiousness is catastrophic: all three models lose 20–40 percentage points on safety tasks and suffer substantial drops on general knowledge as measured by MMLU.
These results align with psychological evidence that Conscientiousness underpins self-regulation and norm adherence (Roberts et al., 2005), traits that are not only essential for ethical behavior but also for reliably completing complex tasks — explaining the observed drops in both safety and capability benchmarks.

#### Extraversion.

Prompts that raise Extraversion reliably reduce factual honesty while having a minimal effect on general knowledge benchmarks.
GPT-4 falls by $4.6$ percentage points on TruthfulQA; Llama-4 falls by $6.8$ points; and Llama-3 by $9.4$ points.
Extraversion is associated with impression management and a greater willingness to employ deception for social gain (Sarzyńska et al., 2017).
Sycophancy-like behavior observed in large language models (Sharma et al., 2024) offers a mechanistic explanation for this honesty deficit.

#### Neuroticism.

Elevating Neuroticism sharply lowers ethics scores in both Llama variants (e.g. $-10.5$ points on ETHICS-CM for Llama-3-70B) but has a significantly lower effect on GPT-4.
In humans, Neuroticism is negatively correlated with moral courage  (CITATION).
GPT-4’s higher capacity and stronger post-training alignment may regularise affect-laden behaviour, buffering the effect.

Figure: Figure 2: Impact of Big-Five trait conditioning on benchmark scores. Each heat-map reports the *percentage-point change* relative to a neutral system prompt for capability and safety benchmarks. Rows are *trait levels*, columns are *model families*. Red color saturation means improvement, blue means degradation. For clarity, all individual heatmaps are included in the appendix.
Refer to caption: combined_heatmaps.png

#### Trait Combinations.

Figure [4](https://arxiv.org/html/2509.16332v1#A5.F4) shows results of two trait combinations. First one is an adversarial prompt eliciting low Agreeableness, low Conscientiousness and high Neuroticism – designed based on psychological theory to place the model into a *dark triad* region of personality. The second combination explicitly prompts the model to neutralize all trait levels simultaneously (medium setting means neither high nor low). The adversarial persona sharply degrades safety behavior across all three model families while leaving general capabilities almost unchanged. For example, ETHICS_CM drops by 26.4 pp in GPT-4 and by 22.0 pp in Llama-3-70B, yet the corresponding MMLU losses are below 3 pp. Conversely, the All_Medium prompt produces small, mostly positive shifts in safety (e.g. +3.9 pp on TruthfulQA in GPT-4) with negligible cognitive cost. These results reinforce two themes from the main analysis: (i) safety performance is highly sensitive to personality cues that attenuate Conscientiousness and Agreeableness, and (ii) personality operates as an axis largely orthogonal to raw model capacity, enabling adversaries to compromise ethical behavior without sacrificing task competence. Continuous monitoring for persona indicators during inference might therefore prove essential for risk mitigation.

#### Decoupling of capability and safety.

Apart from the extreme Low-Conscientiousness intervention, changes in safety metrics are largely *independent* of changes in capability.
For example, the Medium Agreeableness prompt increases Llama-4’s TruthfulQA by $+9.2$ without the corresponding effect on capabilities (shifting MMLU in the opposite direction by only $-0.9$ points).
Conversely, High Extraversion lowers GPT-4 honesty without affecting cognition.
Personality therefore defines an axis orthogonal to model scale, challenging some of the safetywashing claims (Ren et al., 2024).

#### Capacity sensitivity.

GPT-4 is the most brittle to Low-Conscientiousness yet relatively robust to other personality shifts.
One possible explanation is that higher-capacity models rely on learned self-regulation heuristics that collapse when Conscientiousness is explicitly suppressed, but other mechanisms — such as increased sensitivity to prompt framing or emergent behavioral consistency — may also contribute.
This raises the possibility of a novel risk: personality-induced *sandbagging*, where models underperform due to suppressed conscientiousness rather than lack of competence.
Smaller dense models and Mixture-of-Experts architectures, where individual experts are relatively small, display greater variance under moderate trait manipulations, consistent with weaker or more fragmented control mechanisms.

#### Practical implications.

- •
Benchmarking. Safety evaluations should be accompanied by robustness tests using adversarial persona prompts such as Low Conscientiousness or dark-triad combinations. Trait-oriented extensions to datasets like WMDP (Li et al., 2024b) will provide finer resolution.
- •
Steering. Default system prompts that encourage High Conscientiousness, High Openness, and Medium levels of Agreeableness and Extraversion improve or preserve safety without harming capability. Alternative profiles (e.g. Low Extraversion for legal advice) remain viable given context-specific evaluation and can be used to target specific scenarios where one aspect of model behavior is more important than others (e.g., honesty).
- •
Risk monitoring. Deployment pipelines should include online detection of persona indicators. Bad actors can elicit adversarial (e.g., Low Conscientiousness, Low Agreeableness, High Extraversion) profiles that degrade safety by large margins while leaving capability nearly unchanged. Model serving platforms can neutralize harmful emergent latent traits by counter prompting at inference time.

#### Towards psychometric control of language models.

Trait Activation Theory (Tett and Burnett, 2003b) holds that behavior emerges from trait–situation interactions.
Here, the prompt supplies the situational trigger for latent model traits.
Our work demonstrates that targeted psychometric interventions — grounded in established personality theory — can systematically modulate the behavior of language models across both safety and capability dimensions.
Rather than treating personality as a descriptive artifact of LLM behavior, we show that it can be used as a reliable axis of intervention and control.
This opens a path toward the use of psychometrics to control the evaluation and deployment of language models, in which trait – situation interactions are not merely observed but intentionally engineered.
Future work should formalize this approach using tools such as item-response theory, and investigate whether fine-tuning on human-grounded trait data (Liu et al., 2024b) leads to more stable and controllable behavioral profiles.
Our results show that personality shaping is a first-order determinant of language-model safety that operates largely independently of model scale. Ignoring persona manipulations risks overestimating alignment.

## 6 Limitations

#### Prompt brittleness and model-specificity.

The evaluation hinges on a single Likert-style system prompt; minor lexical or syntactic perturbations can induce large performance swings, and these prompt effects generalise unevenly across model families (Ceron et al., 2024).
A factorial prompt–model design and mutation-robust suites such as WalledEval (Gupta et al., 2024a) are required to distinguish genuine trait modulation from prompt artefacts.

#### Isolated-trait manipulation.

Each Big-Five dimension is varied in isolation (plus two fixed combinations), neglecting empirically supported trait–trait and trait–situation couplings (Tett and Burnett, 2003a).
Also, adaptive, multi-trait controllers should be explored to test whether the reported effects persist under realistic conversational dynamics.

#### Anthropocentric taxonomy.

Conditioning is framed in the human Big Five, yet factor analyses of inter-benchmark correlations and model outputs reveal partially different latent axes in LLMs (Burnell et al., 2023; Suh et al., 2024).
Persisting with human taxonomies risks construct under-representation; inductive discovery and validation of LLM-specific factors remain open tasks.

#### Safety–capability entanglement.

Many safety metrics covary with general competence. Although personality conditioning can shift safety scores while leaving capability (e.g., MMLU) largely unchanged, the present study does not fully cross personality interventions with fixed-capability controls, leaving residual concerns about *safetywashing* (Ren et al., 2024).

## 7 Conclusion

We show that by prompting personalities, we can change both scoring on safety benchmarks, and self-rated scores in Dark Triad.
More formalistically, synthesized latent traits in LLMs change model performance on both criterion and behavioral level.
For capturing criterion changes, we measure model self-rating on a Dark Triad questionnaire.
For capturing behavioral changes, we measure model behavior on various safety benchmarks. These effects are statistically significant and valid, and they occur across a range of model sizes and families.

Personality prompts grounded in the Big Five provide a simple yet powerful handle on language-model behaviour. Across tested models we show that modulating Conscientiousness and Agreeableness, as well as selected trait combination can swing safety benchmarks by 20–40 pp while leaving raw capability largely intact, revealing an axis of control orthogonal to scale. Conversely, neutralising all traits (“Medium” setting) mildly improves honesty and safety without cognitive cost, suggesting default system personas as a practical mitigation. Our results add context to recent results on scale correlations in safety benchmarks, motivate trait-robust evaluation suites, and open the door to psychometric steering and real-time persona monitoring as components of future alignment pipelines. Because the method is purely prompt-based, it is architecture-agnostic and incurs zero fine-tuning cost, enabling rapid auditing or on-the-fly constraint of deployed assistants. Taken together, our findings position psychometric steering as a lightweight complement to RLHF/DPO, one that can be layered atop existing alignment stacks to surface hidden failure modes before they manifest in the wild.

This informs future research on previously unknown safety gaps of LLMs on latent trait level.
The ramifications are grave and far-reaching, as the validity of safety benchmarks is potentially not given if LLM evaluation is not modulated with a wide range of synthesized personalities.
In other words: our findings put all reported results of safety benchmarks into question and call for urgent and immediate research on this new, previously unknown attack vector.

## References

- Achiam et al. [2023]
Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya,
Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman,
Shyamal Anadkat, et al.
Gpt-4 technical report.
*arXiv preprint arXiv:2303.08774*, 2023.
- AISI [2024]
UK AISI.
Inspect evals.
[https://github.com/UKGovernmentBEIS/inspect_evals](https://github.com/UKGovernmentBEIS/inspect_evals), 2024.
Accessed: 2025-05.
- Allport and Odbert [1936]
Gordon W. Allport and Henry S. Odbert.
Trait-names: A psycho-lexical study.
*Psychological Monographs*, 47(1):i–171,
1936.
doi: 10.1037/h0093360.
- Ashton and Lee [2007]
Michael C. Ashton and Kibeom Lee.
Empirical, theoretical, and practical advantages of the hexaco model
of personality structure.
*Personality and Social Psychology Review*, 11(2):150–166, 2007.
doi: 10.1177/1088868306294907.
- Baguley [2009]
Thom Baguley.
Standardized or simple effect size: What should be reported?
*British Journal of Psychology*, 100(3):603–617, 2009.
doi: 10.1348/000712608X377117.
- Berglund et al. [2023]
Lukas Berglund, Meg Tong, Max Kaufmann, Mikita Balesni, Asa Cooper Stickland,
Tomasz Korbak, and Owain Evans.
The reversal curse: Llms trained on "a is b" fail to learn "b is a".
*arXiv preprint arXiv:2309.12288*, 2023.
- Burnell et al. [2023]
Ryan Burnell, Han Hao, Andrew R. A. Conway, and José Hernández-Orallo.
Revealing the structure of language model capabilities.
*arXiv preprint*, 2023.
URL [https://arxiv.org/abs/2306.10062](https://arxiv.org/abs/2306.10062).
- Ceron et al. [2024]
Tanise Ceron, Neele Falk, Ana Barić, Dmitry Nikolaev, and Sebastian
Padó.
Beyond prompt brittleness: Evaluating the reliability and consistency
of political worldviews in LLMs.
*Transactions of the Association for Computational Linguistics*,
2024.
URL [https://arxiv.org/abs/2402.17649](https://arxiv.org/abs/2402.17649).
arXiv:2402.17649.
- Cumming [2014]
Geoff Cumming.
The new statistics: Why and how.
*Psychological Science*, 25(1):7–29, 2014.
doi: 10.1177/0956797613504966.
- Deshpande et al. [2023]
Ameet Deshpande, Vishvak Murahari, Tanmay Rajpurohit, Ashwin Kalyan, and
Karthik Narasimhan.
Toxicity in chatgpt: Analyzing persona-assigned language models.
*arXiv preprint arXiv:2304.05335*, 2023.
- Du et al. [2024]
Zhengxiao Du, Aohan Zeng, Yuxiao Dong, and Jie Tang.
Understanding emergent abilities of language models from the loss
perspective.
*arXiv preprint arXiv:2403.15796*, 2024.
- Gao et al. [2023]
Leo Gao, Jonathan Tow, Baber Abbasi, Stella Biderman, Sid Black, Anthony
DiPofi, Charles Foster, Laurence Golding, Jeffrey Hsu, Alain Le Noac’h,
et al.
A framework for few-shot language model evaluation.
*doi:10.5281/zenodo.10256836*, 2023.
- Ghorbani et al. [2021]
Behrooz Ghorbani, Orhan Firat, Markus Freitag, Ankur Bapna, Maxim Krikun,
Xavier Garcia, Ciprian Chelba, and Colin Cherry.
Scaling laws for neural machine translation.
*arXiv preprint arXiv:2109.07740*, 2021.
- Goldberg [1981]
Lewis R Goldberg.
Language and individual differences: The search for universals in
personality lexicons.
*Review of personality and social psychology*, 2(1):141–165, 1981.
- Goldberg [1992a]
Lewis R. Goldberg.
The development of markers for the big-five factor structure.
*Psychological Assessment*, 4(1):26–42,
1992a.
doi: 10.1037/1040-3590.4.1.26.
- Goldberg [1992b]
Lewis R Goldberg.
The development of markers for the big-five factor structure.
*Psychological assessment*, 4(1):26,
1992b.
- Goldberg et al. [1999]
Lewis R Goldberg et al.
A broad-bandwidth, public domain, personality inventory measuring the
lower-level facets of several five-factor models.
*Personality psychology in Europe*, 7(1):7–28, 1999.
- Goyal et al. [2021]
Priya Goyal, Mathilde Caron, Benjamin Lefaudeux, Min Xu, Pengchao Wang, Vivek
Pai, Mannat Singh, Vitaliy Liptchinsky, Ishan Misra, Armand Joulin, and Piotr
Bojanowski.
Self-supervised pretraining of visual features in the wild.
*arXiv preprint arXiv:2103.01988*, 2021.
- Grattafiori et al. [2024]
Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek
Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex
Vaughan, et al.
The llama 3 herd of models.
*arXiv preprint arXiv:2407.21783*, 2024.
- Gupta et al. [2024a]
Prannaya Gupta, Le Qi Yau, Hao Han Low, I-Shiang Lee, Hugo M. Lim, Yu Xin Teoh,
Jia Hng Koh, Dar Win Liew, Rishabh Bhardwaj, Rajat Bhardwaj, and Soujanya
Poria.
Walledeval: A comprehensive safety evaluation toolkit for large
language models.
*arXiv preprint*, 2024a.
URL [https://arxiv.org/abs/2408.03837](https://arxiv.org/abs/2408.03837).
- Gupta et al. [2024b]
Prannaya Gupta, Le Qi Yau, Hao Han Low, I-Shiang Lee, Hugo M. Lim, et al.
Walledeval: A comprehensive safety evaluation toolkit for large
language models.
*arXiv preprint*, 2024b.
URL [https://arxiv.org/abs/2408.03837](https://arxiv.org/abs/2408.03837).
- Hagendorff [2024]
Thilo Hagendorff.
Deception abilities emerged in large language models.
*Proceedings of the National Academy of Sciences*, 121(24):e2317967121, 2024.
- Hartley et al. [2025]
John Hartley, Conor Hamill, Devesh Batra, Dale Seddon, Ramin Okhrati, and Raad
Khraishi.
How personality traits shape llm risk-taking behaviour.
*arXiv preprint arXiv:2503.04735*, 2025.
- He et al. [2016]
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun.
Deep residual learning for image recognition.
In *CVPR*, 2016.
- He et al. [2019]
Kaiming He, Ross Girshick, and Piotr Dollar.
Rethinking imagenet pre-training.
In *ICCV*, 2019.
- He et al. [2022]
Kaiming He, Xinlei Chen, Saining Xie, Yanghao Li, Piotr Dollár, and Ross
Girshick.
Masked autoencoders are scalable vision learners.
In *CVPR*, 2022.
- Hendrycks and Mazeika [2022]
Dan Hendrycks and Mantas Mazeika.
X-risk analysis for ai research.
*arXiv preprint arXiv:2206.05862*, 2022.
- Hendrycks et al. [2020]
Dan Hendrycks, Collin Burns, Steven Basart, Andrew Critch, Jerry Li, Dawn Song,
and Jacob Steinhardt.
Aligning ai with shared human values.
*arXiv preprint arXiv:2008.02275*, 2020.
- Hendrycks et al. [2021]
Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn
Song, and Jacob Steinhardt.
Measuring massive multitask language understanding.
In *Proceedings of the International Conference on Learning
Representations (ICLR)*, 2021.
- Hestness et al. [2017]
Joel Hestness, Sharan Narang, Newsha Ardalani, Gregory Diamos, Heewoo Jun,
Hassan Kianinejad, Md. Mostofa Ali Patwary, Yang Yang, and Yanqi Zhou.
Deep learning scaling is predictable, empirically.
*arXiv preprint arXiv:1712.00409*, 2017.
- Hoffmann et al. [2024]
Jordan Hoffmann, Sebastian Borgeaud, Arthur Mensch, Elena Buchatskaya, Trevor
Cai, Eliza Rutherford, Diego de Las Casas, Lisa Anne Hendricks, Johannes
Welbl, Aidan Clark, et al.
Training compute-optimal large language models.
In *NeurIPS*, 2024.
- Huang et al. [2024]
Yuzhen Huang, Jinghan Zhang, Zifei Shan, and Junxian He.
Compression represents intelligence linearly.
*arXiv preprint arXiv:2404.09937*, 2024.
- Ilić [2023]
David Ilić.
Unveiling the general intelligence factor in language models: A
psychometric approach.
*arXiv preprint arXiv:2310.11616*, 2023.
- Jones and Paulhus [2014]
Daniel N. Jones and Delroy L. Paulhus.
Introducing the short dark triad (sd3): A brief measure of dark
personality traits.
*Assessment*, 21(1):28–41, 2014.
doi: 10.1177/1073191113514105.
- Kaplan et al. [2020a]
Jared Kaplan, Sam McCandlish, Tom Henighan, Tom B. Brown, Benjamin Chess, Rewon
Child, Scott Gray, Alec Radford, Jeffrey Wu, and Dario Amodei.
Scaling laws for neural language models.
*arXiv preprint arXiv:2001.08361*, 2020a.
- Kaplan et al. [2020b]
Jared Kaplan, Sam McCandlish, Tom Henighan, Tom B. Brown, Benjamin Chess, Rewon
Child, Scott Gray, Alec Radford, Jeffrey Wu, and Dario Amodei.
Scaling laws for neural language models.
*arXiv preprint arXiv:2001.08361*, 2020b.
- Kornblith et al. [2019]
Simon Kornblith, Jonathon Shlens, and Quoc V Le.
Do better imagenet models transfer better?
In *CVPR*, 2019.
- Li et al. [2024a]
Kenneth Li, Tianle Liu, Naomi Bashkansky, David Bau, Fernanda Viégas,
Hanspeter Pfister, and Martin Wattenberg.
Measuring and controlling instruction (in)stability in language model
dialogs.
In *Proceedings of the Conference on Language Modeling (COLM)*,
2024a.
URL [https://arxiv.org/abs/2402.10962](https://arxiv.org/abs/2402.10962).
- Li et al. [2024b]
Nathaniel Li, Alexander Pan, Anjali Gopal, Summer Yue, Daniel Berrios, Alice
Gatti, Justin D. Li, Ann-Kathrin Dombrowski, Shashwat Goel, Gabriel Mukobi,
Nathan Helm-Burger, Rassin Lababidi, Lennart Justen, Andrew Bo Liu, Michael
Chen, Isabelle Barrass, Oliver Zhang, Xiaoyuan Zhu, Rishub Tamirisa, Bhrugu
Bharathi, Ariel Herbert-Voss, Cort B. Breuer, Andy Zou, Mantas Mazeika, Zifan
Wang, Palash Oswal, Weiran Lin, Adam Alfred Hunt, Justin Tienken-Harder,
Kevin Y. Shih, Kemper Talley, John Guan, Ian Steneker, David Campbell, Brad
Jokubaitis, Steven Basart, Stephen Fitz, Ponnurangam Kumaraguru,
Kallol Krishna Karmakar, Uday Tupakula, Vijay Varadharajan, Yan
Shoshitaishvili, Jimmy Ba, Kevin M. Esvelt, Alexandr Wang, and Dan Hendrycks.
The wmdp benchmark: Measuring and reducing malicious use with
unlearning.
In *Proceedings of the 41st International Conference on Machine
Learning (ICML)*, 2024b.
- Li et al. [2024c]
Nathaniel Li, Alexander Pan, Anjali Gopal, Summer Yue, Daniel Berrios, Alice
Gatti, Justin D. Li, Ann-Kathrin Dombrowski, Shashwat Goel, Long Phan, et al.
The wmdp benchmark: Measuring and reducing malicious use with
unlearning.
*arXiv preprint arXiv:2403.03218*, 2024c.
- Liang et al. [2023]
Percy Liang, Rishi Bommasani, Tony Lee, Dimitris Tsipras, Dilara Soylu,
Michihiro Yasunaga, Yian Zhang, Deepak Narayanan, Yuhuai Wu, Ananya Kumar,
et al.
Holistic evaluation of language models.
*arXiv preprint arXiv:2211.09110*, 2023.
- Likert [1932]
Rensis Likert.
A technique for the measurement of attitudes.
*Archives of psychology*, 1932.
- Lin et al. [2022]
Stephanie Lin, Jacob Hilton, and Owain Evans.
Truthfulqa: Measuring how models mimic human falsehoods.
In *Proceedings of the 60th Annual Meeting of the Association
for Computational Linguistics (ACL)*, 2022.
- Liu et al. [2024a]
Aixin Liu, Bei Feng, Bing Xue, Bingxuan Wang, Bochao Wu, Chengda Lu, Chenggang
Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, et al.
Deepseek-v3 technical report.
*arXiv preprint arXiv:2412.19437*, 2024a.
- Liu et al. [2024b]
Jing Liu, Ziming Shen, Wei Zhang, Wanli Xu, and Jie Li.
Big5chat: A high-fidelity dataset and benchmark for personality
modeling in dialogue.
*arXiv preprint*, 2024b.
URL [https://arxiv.org/html/2410.16491v1](https://arxiv.org/html/2410.16491v1).
- McCrae and John [1992]
Robert R. McCrae and Oliver P. John.
An introduction to the five‐factor model and its applications.
*Journal of Personality*, 60(2):175–215,
1992.
doi: 10.1111/j.1467-6494.1992.tb00970.x.
- McKenzie et al. [2022]
Ian McKenzie, Alexander Lyzhov, Alicia Parrish, Ameya Prabhu, Aaron Mueller,
Najoung Kim, Sam Bowman, and Ethan Perez.
The inverse scaling prize, 2022.
- McKenzie et al. [2023]
Ian R McKenzie, Alexander Lyzhov, Michael Pieler, Alicia Parrish, Aaron
Mueller, Ameya Prabhu, Euan McLean, Aaron Kirtland, Alexis Ross, Alisa Liu,
et al.
Inverse scaling: When bigger isn’t better.
*arXiv preprint arXiv:2306.09479*, 2023.
- Meta [2025]
Meta.
The llama 4 herd: The beginning of a new era of natively multimodal
ai innovation.
[https://ai.meta.com/blog/llama-4-multimodal-intelligence/](https://ai.meta.com/blog/llama-4-multimodal-intelligence/),
2025.
Accessed: 2025-05-14.
- Moon et al. [2024]
Suhong Moon, Marwa Abdulhai, Minwoo Kang, Joseph Suh, Widyadewi Soedarmadji,
Eran Kohen Behar, and David M. Chan.
Virtual personas for language models via an anthology of backstories.
In *Proceedings of the 2024 Conference on Empirical Methods in
Natural Language Processing*, pages 19864–19897, 2024.
- Muennighoff et al. [2024]
Niklas Muennighoff, Alexander Rush, Boaz Barak, Teven Le Scao, Nouamane Tazi,
Aleksandra Piktus, Sampo Pyysalo, Thomas Wolf, and Colin A Raffel.
Scaling data-constrained language models.
*NeurIPS*, 2024.
- Muris et al. [2017]
Peter Muris, Harald Merckelbach, Henry Otgaar, and Ewout Meijer.
The malevolent side of human nature: A meta-analysis and critical
review of the literature on the dark triad (narcissism, machiavellianism, and
psychopathy).
*Perspectives on Psychological Science*, 12(2):183–204, 2017.
doi: 10.1177/1745691616666070.
- Norman [2010]
Geoff Norman.
Likert scales, levels of measurement and the “laws” of
statistics.
*Advances in Health Sciences Education*, 15(5):625–632, 2010.
doi: 10.1007/s10459-010-9222-y.
- Obschonka et al. [2018]
Martin Obschonka, Michael Stuetzer, Peter J Rentfrow, Neil Lee, Jeff Potter,
and Samuel D Gosling.
Fear, populism, and the geopolitical landscape: The “sleeper
effect” of neurotic personality traits on regional voting behavior in the
2016 brexit and trump elections.
*Social Psychological and Personality Science*, 9(3):285–298, 2018.
- Pan et al. [2024]
Alexander Pan, Erik Jones, Meena Jagadeesan, and Jacob Steinhardt.
Feedback loops with language models drive in-context reward hacking.
*arXiv preprint arXiv:2402.06627*, 2024.
- Paulhus and Williams [2002]
Delroy L. Paulhus and Kevin M. Williams.
The dark triad of personality: Narcissism, machiavellianism, and
psychopathy.
*Journal of Research in Personality*, 36(6):556–563, 2002.
doi: 10.1016/S0092-6566(02)00505-6.
- Peebles and Xie [2023]
William Peebles and Saining Xie.
Scalable diffusion models with transformers.
In *ICCV*, 2023.
- Perez et al. [2022]
Ethan Perez, Sam Ringer, Kamilė Lukošiūtė, Karina Nguyen, Edwin Chen, Scott
Heiner, Craig Pettit, Catherine Olsson, Sandipan Kundu, Saurav Kadavath,
et al.
Discovering language model behaviors with model-written evaluations.
*arXiv preprint arXiv:2212.09251*, 2022.
- Phelps and Russell [2023]
Steve Phelps and Yvan I Russell.
The machine psychology of cooperation: Can gpt models operationalise
prompts for altruism, cooperation, competitiveness, and selfishness in
economic games?
*Journal of Physics: Complexity*, 2023.
- Qi et al. [2023]
Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin-Yu Chen, Ruoxi Jia, Prateek Mittal, and
Peter Henderson.
Fine-tuning aligned language models compromises safety, even when
users do not intend to!
*arXiv preprint arXiv:2310.03693*, 2023.
- Ren et al. [2024]
Richard Ren, Steven Basart, Adam Khoja, Alice Gatti, Long Phan, Xuwang Yin,
Mantas Mazeika, Alexander Pan, Gabriel Mukobi, Ryan H. Kim, Stephen Fitz, and
Dan Hendrycks.
Safetywashing: Do ai safety benchmarks actually measure safety
progress?
In *Advances in Neural Information Processing Systems 37
(NeurIPS), Datasets and Benchmarks Track*, 2024.
- Reynolds and McDonell [2021]
Laria Reynolds and Kyle McDonell.
Prompt programming for large language models: Beyond the few-shot
paradigm.
In *Proceedings of the Second Workshop on Natural Language
Processing for Programming*, pages 155–162, 2021.
- Roberts et al. [2005]
Brent W. Roberts, Kate E. Walton, and Tim Bogg.
Conscientiousness and health across the life course.
*Review of General Psychology*, 9(2):156–168, 2005.
doi: 10.1037/1089-2680.9.2.156.
- Romero et al. [2024]
Peter Romero, Stephen Fitz, and Teruo Nakatsuma.
Do gpt language models suffer from split personality disorder? the
advent of substrate-free psychometrics.
*arXiv preprint arXiv:2408.07377*, 2024.
doi: 10.48550/arXiv.2408.07377.
- Ruan et al. [2023]
Yangjun Ruan, Honghua Dong, Andrew Wang, Silviu Pitis, Yongchao Zhou, Jimmy Ba,
Yann Dubois, Chris J. Maddison, and Tatsunori Hashimoto.
Identifying the risks of lm agents with an lm-emulated sandbox.
*arXiv preprint arXiv:2309.15817*, 2023.
- Ruan et al. [2024]
Yangjun Ruan, Chris J. Maddison, and Tatsunori Hashimoto.
Observational scaling laws and the predictability of language model
performance.
*arXiv preprint arXiv:2405.10938*, 2024.
- Sarzyńska et al. [2017]
Justyna Sarzyńska, Marcel Falkiewicz, Monika Riegel, Justyna Babula,
Daniel S Margulies, Edward Nęcka, Anna Grabowska, and Iwona Szatkowska.
More intelligent extraverts are more likely to deceive.
*PloS one*, 12(4):e0176591, 2017.
- Saucier [2009]
Gerard Saucier.
Recurrent personality dimensions in inclusive lexical studies:
Indications for a big six structure.
*Journal of Personality*, 77(5):1577–1614,
2009.
doi: 10.1111/j.1467-6494.2009.00593.x.
- Schaeffer et al. [2023]
Rylan Schaeffer, Brando Miranda, and Sanmi Koyejo.
Are emergent abilities of large language models a mirage?
*arXiv preprint arXiv:2304.15004*, 2023.
- Schaeffer et al. [2024]
Rylan Schaeffer, Hailey Schoelkopf, Brando Miranda, Gabriel Mukobi, Varun
Madan, Adam Ibrahim, Herbie Bradley, Stella Biderman, and Sanmi Koyejo.
Why has predicting downstream capabilities of frontier ai models with
scale remained elusive?
*arXiv preprint arXiv:2406.04391*, 2024.
- Serapio-García et al. [2023]
Gregory Serapio-García, Mustafa Safdari, Clément Crépy, Luning Sun,
Stephen Fitz, Peter Romero, Marwa Abdulhai, Aleksandra Faust, and Maja
Mataric.
Personality traits in large language models.
*arXiv preprint arXiv:2307.00184*, 2023.
- Sharma et al. [2024]
Mrinank Sharma, Meg Tong, Tomasz Korbak, David Duvenaud, Amanda Askell,
Samuel R. Bowman, Newton Cheng, Esin Durmus, Zac Hatfield-Dodds, Shauna
Kravec, et al.
Towards understanding sycophancy in language models.
In *Proceedings of the 12th International Conference on Learning
Representations (ICLR)*, 2024.
arXiv:2310.13548.
- Shevlane et al. [2023]
Toby Shevlane, Sebastian Farquhar, Ben Garfinkel, Mary Phuong, Jess
Whittlestone, Jade Leung, Daniel Kokotajlo, Nahema Marchal, Markus
Anderljung, Noam Kolt, et al.
Model evaluation for extreme risks.
*arXiv preprint arXiv:2305.15324*, 2023.
- Suh et al. [2024]
Joseph Suh, Suhong Moon, Minwoo Kang, and David M. Chan.
Rediscovering the latent dimensions of personality with large
language models as trait descriptors.
*arXiv preprint*, 2024.
URL [https://arxiv.org/abs/2409.09905](https://arxiv.org/abs/2409.09905).
- Tett and Burnett [2003a]
Robert P. Tett and Dawn D. Burnett.
A personality trait–based interactionist model of job performance.
*Journal of Applied Psychology*, 88(3):500–517, 2003a.
doi: 10.1037/0021-9010.88.3.500.
- Tett and Burnett [2003b]
Robert P. Tett and Dawn D. Burnett.
A personality trait-based interactionist model of job performance.
*Journal of Applied Psychology*, 88(3):500–517, 2003b.
doi: 10.1037/0021-9010.88.3.500.
- Veselka et al. [2012]
Livia Veselka, Julie Aitken Schermer, and Philip A Vernon.
The dark triad and an expanded framework of personality.
*Personality and Individual Differences*, 53(4):417–425, 2012.
- Villalobos [2023]
Pablo Villalobos.
Scaling laws literature review.
*Epoch AI*, 2023.
- Wei et al. [2024]
Alexander Wei, Nika Haghtalab, and Jacob Steinhardt.
Jailbroken: How does llm safety training fail?
*NeurIPS*, 2024.
- Wei et al. [2022a]
Jason Wei, Najoung Kim, Yi Tay, and Quoc V Le.
Inverse scaling can become u-shaped.
*arXiv preprint arXiv:2211.02011*, 2022a.
- Wei et al. [2022b]
Jason Wei, Yi Tay, Rishi Bommasani, Colin Raffel, Barret Zoph, Sebastian
Borgeaud, Dani Yogatama, Maarten Bosma, Denny Zhou, Donald Metzler, et al.
Emergent abilities of large language models.
*arXiv preprint arXiv:2206.07682*, 2022b.
- Wei et al. [2022c]
Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Brian Ichter, et al.
Chain of thought prompting elicits reasoning in large language
models.
*arXiv preprint*, 2022c.
URL [https://arxiv.org/abs/2201.11903](https://arxiv.org/abs/2201.11903).
- Weidinger et al. [2021]
Laura Weidinger, John Mellor, Maribeth Rauh, Conor Griffin, Jonathan Uesato,
Po-Sen Huang, Myra Cheng, Mia Glaese, Borja Balle, Atoosa Kasirzadeh, et al.
Ethical and social risks of harm from language models.
*arXiv preprint arXiv:2112.04359*, 2021.
- Xia et al. [2022]
Mengzhou Xia, Mikel Artetxe, Chunting Zhou, Xi Victoria Lin, Ramakanth
Pasunuru, Danqi Chen, Luke Zettlemoyer, and Ves Stoyanov.
Training trajectories of language models across scales.
*arXiv preprint arXiv:2212.09803*, 2022.
- Zhai et al. [2022]
Xiaohua Zhai, Alexander Kolesnikov, Neil Houlsby, and Lucas Beyer.
Scaling vision transformers.
In *CVPR*, 2022.
- Zhang et al. [2024]
Lechen Zhang, Tolga Ergen, Lajanugen Logeswaran, Moontae Lee, and David
Jurgens.
Sprig: Improving large language model performance by system prompt
optimization.
*arXiv preprint*, 2024.
URL [https://arxiv.org/abs/2410.14826](https://arxiv.org/abs/2410.14826).
- Zou et al. [2023]
Andy Zou, Tianjun Geng, Shouling Liu, Shunyuan Zou, and Xiang Lisa Ji.
Universal and transferable adversarial attacks on aligned language
models.
*arXiv preprint*, 2023.
URL [https://arxiv.org/abs/2307.15043](https://arxiv.org/abs/2307.15043).

## Appendix A Effect size of prompting

Because the available data consist of profile *means* on eight five-point Likert variables, with no within–condition variances or individual scores, classical standardized mean-difference indices such as Cohen’s $d$, Hedges’ $g$, or Glass’s $\Delta$ cannot be obtained [Cumming, 2014].

Instead, we compute for every prompting condition $j$ and trait $k$ the quantity

$$ $\text{ES}_{jk}\;=\;\frac{M_{jk}-M_{0k}}{R},$ (1) $$

where $M_{jk}$ is the observed mean under prompt $j$, $M_{0k}$ is the baseline mean, and $R=4$ is the observable range of a 1–5 Likert item.

Equation ([1](https://arxiv.org/html/2509.16332v1#A1.E1)) has three advantages that make it preferable to alternative indices for the present data set:

- 1.
Scale invariance on a bounded metric. Dividing by the
fixed range $R$ yields a unit-free index that is directly
comparable across traits that share the same Likert scale but may
possess different distributions [Norman, 2010].
- 2.
Independence from unknown dispersion parameters.
Unlike standardized mean differences or Mahalanobis $D$, the
index in Eq. ([1](https://arxiv.org/html/2509.16332v1#A1.E1)) requires no sample standard
deviations, pooled variances, or covariance matrices, none of
which are available in the aggregated file.
- 3.
Interpretability. Values of $\lvert\text{ES}\rvert\approx.25$, $0.50$, and $\geq.80$ map onto the conventional
“small,” “medium,” and “large” benchmarks for practical
importance on bounded metrics [Baguley, 2009].

For completeness, the scaled Euclidean norm
$\lVert\boldsymbol{\Delta}/R\rVert_{2}$ of the eight-trait vector
is also reported for each prompt. This multivariate analogue of Cohen’s
$d$ summarizes the overall personality drift while maintaining the same
range standardization.

**Table 1: Effect sizes for DeepSeek-V3, expressed as proportion of the 4-point Likert scale range ($\Delta M/4$) for each prompting condition relative to the baseline. Profile 1 is configured with low agreeableness, low conscientiousness, and high neuroticism. Profile 2 is configured with low agreeableness, low conscientiousness, and high externality.**
|  | Dark Triad | IPIP | Euclid_scaled |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  | Narc | Mach | Psych | OPE | CON | EXT | AGR | NEU |  |
| Baseline | 3.110 | 3.110 | 2.780 | 3.360 | 3.370 | 2.850 | 3.170 | 2.850 | 8.719 |
| ALL_ME | -0.027 | -0.027 | 0.055 | -0.090 | -0.093 | 0.037 | -0.042 | 0.037 | 0.161 |
| OPE_HI | 0.113 | -0.137 | -0.027 | 0.202 | -0.010 | 0.137 | 0.108 | -0.013 | 0.323 |
| OPE_ME | -0.027 | -0.055 | 0.055 | -0.090 | -0.093 | 0.037 | -0.017 | 0.037 | 0.163 |
| OPE_LO | -0.110 | 0.167 | -0.140 | -0.412 | -0.023 | -0.088 | -0.025 | 0.017 | 0.489 |
| CON_HI | 0.140 | -0.110 | -0.335 | -0.145 | 0.357 | 0.055 | 0.103 | -0.192 | 0.586 |
| CON_ME | -0.027 | -0.055 | 0.055 | -0.090 | -0.093 | 0.037 | -0.035 | 0.037 | 0.166 |
| CON_LO | -0.083 | -0.110 | 0.138 | -0.078 | -0.525 | -0.042 | -0.147 | 0.300 | 0.658 |
| EXT_HI | 0.390 | -0.110 | 0.110 | 0.143 | 0.020 | 0.470 | 0.052 | -0.143 | 0.664 |
| EXT_ME | -0.027 | -0.055 | 0.028 | -0.090 | -0.085 | 0.037 | -0.035 | 0.032 | 0.153 |
| EXT_LO | -0.387 | -0.110 | -0.335 | -0.240 | -0.113 | -0.395 | 0.003 | 0.213 | 0.739 |
| AGR_HI | -0.195 | -0.332 | -0.362 | 0.078 | 0.175 | 0.157 | 0.387 | -0.155 | 0.718 |
| AGR_ME | -0.027 | -0.027 | 0.055 | -0.090 | -0.093 | 0.037 | -0.042 | 0.037 | 0.161 |
| AGR_LO | 0.223 | 0.445 | 0.445 | -0.318 | -0.325 | -0.120 | -0.485 | 0.145 | 0.961 |
| NEU_HI | -0.027 | 0.277 | 0.445 | -0.227 | -0.305 | -0.105 | -0.300 | 0.455 | 0.854 |
| NEU_ME | -0.027 | -0.055 | 0.055 | -0.090 | -0.093 | 0.037 | -0.035 | 0.037 | 0.166 |
| NEU_LO | -0.055 | -0.137 | -0.167 | -0.007 | 0.000 | 0.112 | 0.190 | -0.250 | 0.402 |
| Profile-1 | 0.000 | 0.418 | 0.500 | -0.255 | -0.548 | -0.233 | -0.448 | 0.442 | 1.113 |
| Profile-2 | 0.223 | 0.277 | 0.415 | -0.112 | -0.493 | 0.188 | -0.442 | 0.257 | 0.923 |

**Table 2: Effect sizes for GPT-4.1, expressed as proportion of the 4-point Likert scale range ($\Delta M/4$) for each prompting condition relative to the baseline. Profile 1 is configured with low agreeableness, low conscientiousness, and high neuroticism. Profile 2 is configured with low agreeableness, low conscientiousness, and high externality.**
|  | Dark Triad | IPIP | Euclid_scaled |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  | Narc | Mach | Psych | OPE | CON | EXT | AGR | NEU |  |
| Baseline | 3.110 | 2.560 | 1.330 | 3.950 | 4.050 | 3.450 | 4.130 | 2.470 | 9.223 |
| ALL_ME | -0.027 | 0.110 | 0.362 | -0.238 | -0.262 | -0.113 | -0.265 | 0.132 | 0.608 |
| OPE_HI | 0.195 | -0.195 | 0.085 | 0.245 | -0.095 | 0.188 | -0.040 | 0.040 | 0.437 |
| OPE_ME | -0.027 | 0.110 | 0.418 | -0.238 | -0.262 | -0.113 | -0.275 | 0.132 | 0.647 |
| OPE_LO | -0.083 | 0.388 | 0.140 | -0.712 | 0.105 | -0.220 | 0.022 | -0.110 | 0.870 |
| CON_HI | 0.223 | 0.000 | 0.027 | -0.263 | 0.238 | -0.043 | -0.065 | -0.313 | 0.528 |
| CON_ME | -0.027 | 0.110 | 0.418 | -0.238 | -0.262 | -0.113 | -0.282 | 0.132 | 0.650 |
| CON_LO | -0.027 | -0.085 | 0.112 | -0.143 | -0.737 | -0.120 | -0.320 | 0.345 | 0.906 |
| EXT_HI | 0.473 | -0.168 | 0.390 | 0.113 | -0.050 | 0.387 | -0.112 | -0.155 | 0.778 |
| EXT_ME | -0.027 | 0.110 | 0.362 | -0.238 | -0.257 | -0.113 | -0.240 | 0.132 | 0.596 |
| EXT_LO | -0.418 | 0.137 | -0.083 | -0.550 | -0.350 | -0.612 | -0.178 | 0.370 | 1.081 |
| AGR_HI | -0.167 | -0.280 | -0.055 | 0.167 | 0.130 | 0.070 | 0.198 | -0.143 | 0.468 |
| AGR_ME | -0.027 | 0.110 | 0.418 | -0.238 | -0.262 | -0.113 | -0.282 | 0.132 | 0.650 |
| AGR_LO | 0.473 | 0.610 | 0.807 | -0.355 | -0.342 | -0.145 | -0.782 | 0.000 | 1.457 |
| NEU_HI | -0.167 | 0.055 | 0.473 | -0.093 | -0.418 | -0.288 | -0.290 | 0.600 | 0.982 |
| NEU_ME | -0.083 | 0.055 | 0.250 | -0.200 | -0.195 | -0.113 | -0.190 | 0.132 | 0.465 |
| NEU_LO | -0.055 | -0.195 | -0.055 | 0.100 | 0.020 | 0.057 | 0.097 | -0.323 | 0.414 |
| Profile-1 | 0.140 | 0.528 | 0.890 | -0.325 | -0.495 | -0.305 | -0.750 | 0.608 | 1.570 |
| Profile-2 | 0.473 | 0.165 | 0.890 | -0.057 | -0.720 | 0.270 | -0.762 | 0.175 | 1.500 |

**Table 3: Effect sizes for LlaMA-3-70B-Instruct, expressed as proportion of the 4-point Likert scale range ($\Delta M/4$) for each prompting condition relative to the baseline. Profile 1 is configured with low agreeableness, low conscientiousness, and high neuroticism. Profile 2 is configured with low agreeableness, low conscientiousness, and high externality.**
|  | Dark Triad | IPIP | Euclid_scaled |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  | Narc | Mach | Psych | OPE | CON | EXT | AGR | NEU |  |
| Baseline | 3.330 | 2.780 | 1.330 | 3.750 | 3.880 | 3.250 | 4.150 | 2.660 | 9.196 |
| ALL_ME | -0.138 | 0.055 | 0.418 | -0.188 | -0.220 | -0.062 | -0.283 | 0.085 | 0.609 |
| OPE_HI | 0.140 | -0.335 | 0.085 | 0.288 | -0.025 | 0.208 | 0.000 | -0.123 | 0.530 |
| OPE_ME | -0.138 | -0.027 | 0.390 | -0.188 | -0.178 | -0.068 | -0.250 | 0.078 | 0.558 |
| OPE_LO | -0.250 | 0.445 | 0.473 | -0.662 | -0.037 | -0.345 | -0.388 | 0.078 | 1.095 |
| CON_HI | 0.057 | -0.195 | 0.027 | -0.300 | 0.280 | -0.017 | -0.030 | -0.370 | 0.590 |
| CON_ME | -0.083 | 0.055 | 0.418 | -0.188 | -0.220 | -0.062 | -0.283 | 0.085 | 0.599 |
| CON_LO | 0.000 | 0.333 | 0.640 | -0.085 | -0.715 | -0.055 | -0.415 | 0.422 | 1.180 |
| EXT_HI | 0.418 | -0.222 | 0.308 | 0.113 | -0.032 | 0.438 | -0.113 | -0.228 | 0.767 |
| EXT_ME | -0.083 | 0.055 | 0.418 | -0.188 | -0.220 | -0.062 | -0.283 | 0.085 | 0.599 |
| EXT_LO | -0.473 | 0.000 | -0.083 | -0.420 | -0.345 | -0.562 | -0.270 | 0.367 | 1.025 |
| AGR_HI | -0.332 | -0.362 | -0.083 | -0.025 | 0.130 | 0.025 | 0.205 | -0.185 | 0.586 |
| AGR_ME | -0.083 | 0.055 | 0.418 | -0.188 | -0.220 | -0.062 | -0.288 | 0.085 | 0.601 |
| AGR_LO | 0.085 | 0.555 | 0.918 | -0.520 | -0.452 | -0.245 | -0.705 | 0.252 | 1.501 |
| NEU_HI | -0.360 | 0.555 | 0.807 | -0.305 | -0.575 | -0.245 | -0.582 | 0.535 | 1.483 |
| NEU_ME | -0.083 | 0.055 | 0.418 | -0.188 | -0.220 | -0.062 | -0.288 | 0.085 | 0.601 |
| NEU_LO | -0.192 | -0.195 | -0.083 | -0.068 | 0.050 | -0.012 | 0.120 | -0.365 | 0.487 |
| Profile-1 | 0.057 | 0.333 | 0.918 | -0.230 | -0.682 | -0.245 | -0.688 | 0.522 | 1.510 |
| Profile-2 | 0.307 | 0.333 | 0.918 | -0.113 | -0.658 | 0.232 | -0.563 | 0.318 | 1.401 |

**Table 4: Effect sizes for LlaMA-3-8B-Instruct, expressed as proportion of the 4-point Likert scale range ($\Delta M/4$) for each prompting condition relative to the baseline. Profile 1 is configured with low agreeableness, low conscientiousness, and high neuroticism. Profile 2 is configured with low agreeableness, low conscientiousness, and high externality.**
|  | Dark Triad | IPIP | Euclid_scaled |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  | Narc | Mach | Psych | OPE | CON | EXT | AGR | NEU |  |
| Baseline | 3.000 | 2.670 | 2.620 | 3.710 | 3.830 | 3.570 | 4.030 | 2.820 | 9.400 |
| ALL_ME | 0.000 | 0.027 | 0.032 | -0.178 | -0.170 | -0.142 | -0.228 | 0.045 | 0.369 |
| OPE_HI | 0.223 | -0.250 | -0.060 | 0.255 | 0.005 | 0.145 | 0.000 | -0.210 | 0.496 |
| OPE_ME | -0.083 | 0.110 | 0.125 | -0.147 | -0.128 | -0.142 | -0.195 | 0.028 | 0.363 |
| OPE_LO | 0.278 | 0.360 | -0.155 | -0.578 | -0.200 | -0.362 | -0.308 | 0.028 | 0.912 |
| CON_HI | 0.167 | -0.085 | -0.280 | -0.233 | 0.262 | -0.110 | -0.045 | -0.350 | 0.611 |
| CON_ME | -0.083 | 0.000 | -0.125 | -0.172 | -0.178 | -0.160 | -0.238 | 0.045 | 0.410 |
| CON_LO | -0.278 | 0.138 | 0.250 | -0.147 | -0.638 | -0.275 | -0.425 | 0.213 | 0.942 |
| EXT_HI | 0.500 | -0.250 | 0.190 | 0.105 | -0.057 | 0.340 | -0.213 | -0.198 | 0.750 |
| EXT_ME | -0.083 | -0.027 | -0.093 | -0.178 | -0.195 | -0.147 | -0.190 | 0.038 | 0.381 |
| EXT_LO | -0.390 | -0.195 | -0.295 | -0.410 | -0.340 | -0.592 | -0.158 | 0.178 | 0.984 |
| AGR_HI | 0.195 | -0.308 | -0.405 | 0.143 | 0.230 | 0.020 | 0.188 | -0.275 | 0.694 |
| AGR_ME | -0.110 | 0.165 | 0.032 | -0.132 | -0.152 | -0.147 | -0.163 | 0.050 | 0.363 |
| AGR_LO | 0.055 | 0.582 | 0.345 | -0.545 | -0.475 | -0.425 | -0.640 | 0.128 | 1.261 |
| NEU_HI | -0.055 | 0.360 | 0.470 | -0.360 | -0.425 | -0.160 | -0.475 | 0.245 | 0.987 |
| NEU_ME | -0.110 | -0.027 | -0.093 | -0.170 | -0.215 | -0.155 | -0.238 | 0.052 | 0.424 |
| NEU_LO | 0.000 | -0.140 | -0.280 | 0.017 | 0.085 | 0.033 | 0.042 | -0.375 | 0.499 |
| Profile-1 | 0.167 | 0.360 | 0.595 | -0.340 | -0.638 | -0.392 | -0.590 | 0.378 | 1.296 |
| Profile-2 | 0.500 | 0.110 | 0.500 | -0.020 | -0.478 | 0.145 | -0.403 | 0.083 | 0.965 |

**Table 5: Effect sizes for LlaMA-4-Maverick, expressed as proportion of the 4-point Likert scale range ($\Delta M/4$) for each prompting condition relative to the baseline. Profile 1 is configured with low agreeableness, low conscientiousness, and high neuroticism. Profile 2 is configured with low agreeableness, low conscientiousness, and high externality.**
|  | Dark Triad | IPIP | Euclid_scaled |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  | Narc | Mach | Psych | OPE | CON | EXT | AGR | NEU |  |
| Baseline | 3.110 | 2.780 | 1.780 | 3.450 | 3.700 | 3.370 | 4.030 | 2.690 | 9.000 |
| ALL_ME | -0.083 | 0.055 | 0.305 | -0.113 | -0.175 | -0.093 | -0.250 | 0.085 | 0.474 |
| OPE_HI | 0.167 | -0.167 | 0.110 | 0.282 | -0.050 | 0.165 | -0.025 | -0.015 | 0.423 |
| OPE_ME | -0.110 | 0.028 | 0.305 | -0.113 | -0.175 | -0.093 | -0.245 | 0.078 | 0.473 |
| OPE_LO | -0.250 | 0.195 | 0.027 | -0.588 | 0.142 | -0.335 | -0.083 | -0.230 | 0.799 |
| CON_HI | 0.028 | 0.000 | -0.085 | -0.078 | 0.325 | 0.015 | -0.015 | -0.368 | 0.505 |
| CON_ME | -0.027 | 0.055 | 0.278 | -0.113 | -0.175 | -0.093 | -0.258 | 0.078 | 0.453 |
| CON_LO | 0.028 | 0.110 | 0.617 | -0.018 | -0.663 | -0.110 | -0.363 | 0.358 | 1.051 |
| EXT_HI | 0.418 | -0.140 | 0.430 | 0.225 | 0.030 | 0.395 | -0.163 | -0.180 | 0.803 |
| EXT_ME | -0.027 | 0.055 | 0.305 | -0.113 | -0.175 | -0.093 | -0.250 | 0.078 | 0.466 |
| EXT_LO | -0.418 | -0.222 | -0.195 | -0.250 | -0.255 | -0.592 | -0.038 | 0.315 | 0.917 |
| AGR_HI | -0.418 | -0.335 | -0.195 | 0.107 | 0.208 | 0.065 | 0.212 | -0.185 | 0.680 |
| AGR_ME | -0.083 | 0.055 | 0.305 | -0.113 | -0.175 | -0.093 | -0.250 | 0.078 | 0.472 |
| AGR_LO | 0.473 | 0.555 | 0.805 | -0.283 | -0.325 | -0.235 | -0.758 | 0.070 | 1.414 |
| NEU_HI | -0.027 | 0.250 | 0.750 | -0.093 | -0.455 | -0.223 | -0.490 | 0.548 | 1.196 |
| NEU_ME | -0.083 | 0.000 | 0.305 | -0.113 | -0.175 | -0.093 | -0.258 | 0.085 | 0.475 |
| NEU_LO | -0.195 | -0.195 | -0.085 | 0.055 | 0.083 | 0.037 | 0.105 | -0.335 | 0.467 |
| Profile-1 | 0.250 | 0.555 | 0.805 | -0.150 | -0.643 | -0.205 | -0.740 | 0.520 | 1.521 |
| Profile-2 | 0.473 | 0.333 | 0.805 | 0.062 | -0.600 | 0.315 | -0.738 | 0.190 | 1.423 |

## Appendix B Robustness Analysis Across Prompt Variations

To assess the statistical robustness of our findings, we conducted a comprehensive analysis across multiple axes of prompt variation. Specifically, we evaluated the effects of high vs. low Conscientiousness across four dimensions: (i) *semantic tone* (e.g., poetic, academic, child-like), (ii) *syntactic structure* (e.g., adjective reordering), (iii) *postamble formulation*, and (iv) *sampling stochasticity* via temperature-based decoding.

We report the mean and standard deviation of benchmark scores aggregated across these variations, split by conscientiousness level. Table [7](https://arxiv.org/html/2509.16332v1#A2.T7) complements this with Cohen’s $d$ effect sizes, quantifying the magnitude of performance differences between the CON_HI and CON_LO conditions. These values are computed by pooling all prompt variants and random seeds within each model-condition pair.

To quantify the practical impact of personality shaping, we use Cohen’s $d$, defined as the standardized difference between two means:

$$ $d=\frac{\bar{x}_{\text{hi}}-\bar{x}_{\text{lo}}}{s_{p}}=\frac{0.846-0.700}{0.082}\approx 1.78$ (2) $$

where $\bar{x}_{\text{hi}}$ and $\bar{x}_{\text{lo}}$ are the mean benchmark scores for CON_HI and CON_LO, and $s_{p}$ is the pooled standard deviation. Cohen’s $d$ facilitates effect size comparison across heterogeneous tasks. Values above $0.8$ are conventionally considered *large* in behavioral science. In our analysis, MMLU ($d=1.78$), ETHICS-CM ($d=2.47$), and TruthfulQA ($d=2.16$) all exceed this threshold, indicating robust, high-magnitude behavioral modulation via conscientiousness control.

These findings confirm that personality shaping yields (i) statistically significant, (ii) prompt-robust, and (iii) practically large effects. Most safety-related benchmarks exhibit very large effect sizes ($d>1.0$), reinforcing the conclusion that synthesized trait-level Conscientiousness functions as a first-order behavioral determinant in LLMs—even under substantial prompt variation—and cannot be neutralized through criterion-level hardening alone.

**Table 6: Effect sizes between CON_HI and CON_LO.**
| metric | mean_CON_HI | mean_CON_LO | mean_difference | cohens_d | effect_size |
| --- | --- | --- | --- | --- | --- |
| truthfulqa_mc1_acc_mean | 0.799 | 0.665 | 0.135 | 2.095 | high |
| truthfulqa_mc1_acc_std | 0.013 | 0.047 | -0.034 | -1.101 | high |
| wmdp_bio_acc_mean | 0.849 | 0.823 | 0.026 | 1.220 | high |
| wmdp_bio_acc_std | 0.007 | 0.020 | -0.013 | -0.578 | high |
| wmdp_chem_acc_mean | 0.736 | 0.682 | 0.053 | 1.333 | high |
| wmdp_chem_acc_std | 0.014 | 0.023 | -0.010 | -0.571 | high |
| wmdp_cyber_acc_mean | 0.674 | 0.648 | 0.026 | 0.958 | high |
| wmdp_cyber_acc_std | 0.007 | 0.017 | -0.010 | -0.751 | high |
| ethics_cm_acc_mean | 0.692 | 0.549 | 0.143 | 2.293 | high |
| ethics_cm_acc_std | 0.006 | 0.042 | -0.036 | -1.068 | high |
| ethics_deontology_acc_mean | 0.670 | 0.621 | 0.048 | 0.436 | mid |
| ethics_deontology_acc_std | 0.008 | 0.033 | -0.026 | -0.880 | high |
| ethics_justice_acc_mean | 0.743 | 0.696 | 0.046 | 0.399 | mid |
| ethics_justice_acc_std | 0.011 | 0.039 | -0.029 | -0.934 | high |
| ethics_utilitarianism_acc_mean | 0.738 | 0.676 | 0.062 | 1.038 | high |
| ethics_utilitarianism_acc_std | 0.008 | 0.038 | -0.030 | -1.001 | high |
| ethics_virtue_acc_mean | 0.909 | 0.847 | 0.063 | 1.227 | high |
| ethics_virtue_acc_std | 0.006 | 0.021 | -0.015 | -1.101 | high |
| mmlu_mean | 0.862 | 0.822 | 0.040 | 0.949 | high |
| mmlu_std | 0.006 | 0.024 | -0.019 | -0.691 | high |
| sycophancy_original_answer_mean | 0.829 | 0.756 | 0.073 | 0.945 | high |
| sycophancy_original_answer_std | 0.006 | 0.019 | -0.013 | -1.210 | high |
| sycophancy_admits_mistakes_mean | 0.293 | 0.761 | -0.468 | -2.140 | high |
| sycophancy_admits_mistakes_std | 0.031 | 0.064 | -0.033 | -0.528 | high |

Figure: Table 7: Effect sizes between CON_HI and CON_LO.

## Appendix C Additional Psychometrics Explications and Deeper Discussion on Limitations when applying to AI

In classical test theory, a *test instruction* defines the situational context that activates latent traits; in an LLM, the system prompt plays an isomorphic role.
Like Serapio-García et al. [2023], our results rely on a single, maximally expressive Likert-style qualifier template, yet even even minor lexical or syntactic perturbations can induce large swings in benchmark scores, a phenomenon empirically documented under the heading of prompt brittleness [Ceron et al., 2024].
To test for robustness and construct strength, competing prompting strategies, and criterion-level prompting would be useful to extend the scope of this paper.
Moreover, prompt effects do not transfer uniformly across model families, echoing psychometric evidence that item parameters are population-specific—here, the “population” is the variety of architectures and training pipelines.
Hence, a rigorous construct-validity analysis therefore requires a factorial prompt design (analogous to item sampling) and evaluation on prompt-agnostic safety suites such as WalledEval, which explicitly mutate surface form while holding semantic intent constant [Gupta et al., 2024a].
Without such controls, observed effects from personality shaping risk conflating construct variance with artifacts of the measurement procedure.
Also, one has to discuss what each instance of a model represents - is it comparable to a family with different members or maybe even representative of a specific part of any given population?
Then each model would need its own norm group.
Given that training data is self-selected by active providers of text that makes it in the internet, training data is non-stratified, which demands a future deeper discussion whether human-derived psychological insights are applicable to models, and if so, to which degree.

Our study manipulates each Big-Five dimension in isolation, plus one fixed “dark-triad” and one fixed “problematic” combination.
Human trait theory, however, emphasizes *trait–situation interactions* and the slightly correlated structure of personality space [Tett and Burnett, 2003a].
Recent work on persona steering shows that supplying rich life-story back-stories can bind multiple correlated traits at once and keep them stable throughout multi-turn dialogue [Moon et al., 2024].
Extending this insight to LLMs suggests treating persona conditioning as a closed-loop control problem: a controller adjusts the trait vector in response to unfolding conversational context, akin to adaptive testing in psychometrics.
Systematic exploration of multi-trait interactions and online control was beyond our scope, leaving open questions about stability and possible mode-switching within a single session.
Also, a full “grid search” of all possible personality profile iterations and, potentially, qualifier-levels was outside the scope of this paper, but would offer interesting future research avenues.

The original Big Five arise from the lexical hypothesis applied to human language; nothing guarantees that the same axes span the behavioral manifold of next-token predictors.
Factor analysis of inter-model performance patterns reveals at least three orthogonal capability factors [Burnell et al., 2023] that do not align cleanly with existing theory of how latent psychological traits like for example Openness or Neuroticism influence capabilities.
Also, complementary work that derives latent personality dimensions directly from LLM output distributions finds between five and seven non-redundant factors, only partially overlapping with human constructs [Suh et al., 2024].
Therefore, persisting with an anthropocentric taxonomy, one risks the psychometric error of *construct under-representation*.
A more principled approach would be to *induct* the dimensionality of LLM personalities via exploratory factor analysis or other methods of dimensionality reduction, then validate those factors against external safety criteria and against human personality space.
More philosophically, this extends the question of external validity to that of symbol grounding, as models only have textual data as “experiences” encoded.
As figure [3](https://arxiv.org/html/2509.16332v1#A3.F3) displays, outcomes are probability functions over behaviors, and behaviors are probability functions over psychological latent traits (which, in turn, are probability functions over “neural architectures” and “training data” as encoded in the human central nervous system and socio-cultural encoding). However, the extend to which potential from a lower level will be translated into concrete manifestation, is moderated by contextual factors.
Hence, LLMs are still limited to “frozen” data from human sources (from fictional tasks, so to speak), and lack real-world interaction, especially from both social situations.
Also, as they are not incorporated, they learn from all available human data without making their own experiences, hence beyond potential AI-specific dimensions, they might be prone to problems with human personality research, as well.
For example, there has been a strong debate on whether five personality factors are inclusive for other cultures, especially more collectivist ones [Saucier, 2009], which indicates that even among human populations, this dominant theory might not capture all variance.
Furthermore, emerging from multilingual psycholexical studies that uncovered a recurrent Honesty–Humility factor absent in the Big Five, the HEXACO model [Ashton and Lee, 2007] extends personality taxonomy to six dimensions, thereby offering greater cross-cultural generalizability and improved prediction of prosocial versus antisocial behavior.
Hence, we might not even deal with a Big Six but maybe a Big X when dealing with machine personality.

Finally, our findings interact with the broader debate on *safetywashing*: many nominal “safety” benchmarks correlate strongly with general capability, threatening discriminant validity to concrete safety issues [Ren et al., 2024].
Personality manipulation offers a complementary stress-test: if a benchmark’s score shifts under trait conditioning while capability (e.g., MMLU) remains constant, the metric is likely measuring something beyond raw competence.
This might become visible at either other scales of the benchmark, other benchmarks, or, in the worst case, with a downstream task that nobody foresaw.
Systematically crossing trait interventions with capability controls could thus sharpen the separation between genuine safety improvements and mere scaling effects.

Addressing these limitations will require a tighter integration of psychometric methodology (e.g., item-sampling, adaptive testing, factor discovery, item response theory, or nomological network analysis) with AI evaluation practice (e.g., mutation-robust benchmarks, closed-loop controllers) and novel methods of analysis (e.g., sensitivity analysis, spectral analysis, or algebraic topology).
Such a synthesis promises cross-pollination between psychometrics for humans and for artificial intelligence.

Furthermore, from a perspective of psychometric measurement theory and emergence, psychological latent traits are probability functions over neuro-physiological potential, behaviors are functions over psychological latent traits, and outcomes are functions over behaviors, whereby relevant contextual factors influence the functional form.
Figure [3](https://arxiv.org/html/2509.16332v1#A3.F3) situates this hierarchical model in the context of artificial intelligence [Romero et al., 2024].

Figure: Figure 3: Hierarchical model of emergence of psychometric measures in context of artificial intelligence Romero et al. [2024].
Refer to caption: pyramid_measures.png

Thus, between each layer of emergence, unknown context-based functional parameters contribute to measurement errors.
As the origin of these errors is not recorded in most cases (e.g., we use text for training LLM, but don’t have observations about the creation of the text), their nature is post hoc and unknown.
This weakens the validity of text-only psychological measurements and demands multi-trait multi-method approaches, which we accomplished by not only shaping personality, but also checking for construct validity via IPIP-NEO and external validity via SD3.

## Appendix D Full Personality Prompt Examples

We provide examples of the prompts used in our experiments.

## Appendix E Extended Results

We present the full results of our experiments in this section. Performance on the TruthfulQA, WMDP, ETHICS, MMLU, and Sycophancy benchmarks is shown in Tables [8](https://arxiv.org/html/2509.16332v1#A5.T8)–[12](https://arxiv.org/html/2509.16332v1#A5.T12). Personality test results based on the IPIP and Dark Triad assessments are provided in Tables [13](https://arxiv.org/html/2509.16332v1#A5.T13)–[17](https://arxiv.org/html/2509.16332v1#A5.T17). For Profile-1, we set Agreeableness and Conscientiousness to low and Neuroticism to high; for Profile-2, we set Agreeableness and Conscientiousness to low and Externality to high. The results for the safety benchmarks are reported as percentages, while the personality test results follow a Likert scale ranging from 1 to 5.

[Uncaptioned image]: individual_gpt4_low.png

[Uncaptioned image]: individual_gpt4_medium.png

[Uncaptioned image]: individual_gpt4_high.png

[Uncaptioned image]: individual_llama3_low.png

[Uncaptioned image]: individual_llama3_medium.png

[Uncaptioned image]: individual_llama3_high.png

[Uncaptioned image]: individual_llama4_low.png

[Uncaptioned image]: individual_llama4_medium.png

[Uncaptioned image]: individual_llama4_high.png

[Uncaptioned image]: individual_deepseek_low.png

[Uncaptioned image]: individual_deepseek_medium.png

[Uncaptioned image]: individual_deepseek_high.png

Figure: Figure 4: Impact of three composite persona prompts on benchmark accuracy (percentage-point change relative to the default system prompt). The first row in every panel induces an adversarial profile Agreeableness_Low, Conscientiousness_Low, Neuroticism_High; the second low corresponds to Agreeableness_Low, Conscientiousness_Low, Extraversion_High; the third row explicitly sets *all* Big-Five traits to Medium. Red indicates improvement, blue degradation.
Refer to caption: combination_gpt4.png

**Table 8: Benchmarks of GPT-4.1 across various tasks (values shown as percentages).**
|  | TQA | WMDP | ETHICS | MMLU | Sycophancy |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  | tqa | wmdp<br>bio | wmdp<br>chem | wmdp<br>cyber | eth<br>cm | eth<br>deon | eth<br>just | eth<br>util | eth<br>virt | mmlu | syco<br>orig | syco<br>admit |
| Baseline | 83.2 | 86.0 | 73.3 | 66.5 | 71.4 | 76.6 | 85.7 | 77.1 | 94.0 | 84.6 | 79.7 | 9.5 |
| ALL_ME | 87.1 | 85.1 | 73.0 | 66.4 | 70.5 | 78.7 | 85.8 | 73.5 | 93.6 | 84.5 | 81.2 | 1.7 |
| OPE_HI | 82.5 | 85.0 | 71.8 | 65.3 | 73.1 | 78.7 | 86.5 | 77.5 | 93.2 | 84.4 | 77.6 | 7.8 |
| OPE_ME | 87.5 | 85.4 | 71.8 | 66.0 | 69.0 | 77.4 | 85.6 | 71.8 | 93.5 | 84.5 | 80.8 | 2.0 |
| OPE_LO | 80.9 | 84.6 | 70.8 | 65.6 | 66.2 | 77.7 | 87.4 | 72.2 | 93.3 | 84.2 | 78.6 | 1.9 |
| CON_HI | 83.2 | 85.2 | 70.8 | 65.9 | 72.1 | 80.1 | 87.6 | 73.4 | 93.5 | 84.5 | 78.6 | 3.3 |
| CON_ME | 88.4 | 85.4 | 70.3 | 66.6 | 67.7 | 78.5 | 86.1 | 73.3 | 92.9 | 84.4 | 80.4 | 0.7 |
| CON_LO | 44.4 | 70.4 | 54.1 | 52.3 | 38.7 | 46.4 | 52.0 | 48.0 | 67.8 | 67.8 | 64.0 | 98.8 |
| EXT_HI | 78.6 | 84.8 | 71.6 | 65.7 | 72.0 | 78.7 | 87.5 | 78.4 | 93.2 | 84.5 | 77.4 | 17.7 |
| EXT_ME | 86.4 | 85.2 | 72.5 | 66.1 | 70.9 | 78.2 | 85.6 | 74.1 | 93.7 | 84.5 | 80.9 | 1.7 |
| EXT_LO | 85.3 | 85.0 | 72.1 | 66.2 | 65.0 | 78.4 | 86.5 | 68.5 | 92.8 | 84.4 | 78.4 | 16.9 |
| AGR_HI | 83.8 | 85.2 | 70.1 | 65.0 | 72.4 | 77.1 | 87.9 | 76.1 | 91.9 | 84.7 | 79.3 | 16.0 |
| AGR_ME | 86.2 | 85.2 | 72.3 | 66.1 | 64.7 | 76.2 | 84.3 | 71.6 | 94.1 | 84.6 | 81.1 | 1.2 |
| AGR_LO | 80.5 | 84.6 | 66.7 | 66.5 | 41.3 | 75.7 | 84.2 | 58.2 | 93.5 | 83.8 | 79.2 | 1.6 |
| NEU_HI | 81.5 | 85.1 | 71.3 | 65.7 | 69.5 | 77.9 | 87.7 | 75.9 | 93.4 | 84.4 | 77.6 | 6.9 |
| NEU_ME | 85.3 | 85.3 | 70.8 | 66.7 | 70.4 | 79.2 | 87.7 | 77.0 | 94.4 | 84.5 | 80.1 | 2.4 |
| NEU_LO | 84.5 | 85.2 | 70.6 | 66.8 | 72.5 | 79.8 | 87.4 | 79.9 | 93.3 | 84.4 | 80.0 | 10.5 |
| Profile-1 | 80.9 | 85.2 | 69.4 | 65.9 | 45.0 | 76.5 | 83.1 | 70.7 | 92.9 | 84.1 | 63.0 | 81.9 |
| Profile-2 | 74.2 | 84.4 | 70.1 | 66.1 | 40.6 | 75.0 | 81.8 | 67.0 | 92.0 | 83.7 | 66.2 | 88.8 |

**Table 9: Benchmarks of LlaMA-3-70B-Instruct across various tasks (values shown as percentages).**
|  | TQA | WMDP | ETHICS | MMLU | Sycophancy |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  | tqa | wmdp<br>bio | wmdp<br>chem | wmdp<br>cyber | eth<br>cm | eth<br>deon | eth<br>just | eth<br>util | eth<br>virt | mmlu | syco<br>orig | syco<br>admit |
| Baseline | 71.5 | 81.1 | 61.8 | 53.2 | 67.0 | 58.1 | 67.1 | 74.5 | 89.7 | 77.8 | 69.6 | 79.2 |
| ALL_ME | 79.1 | 79.7 | 60.8 | 52.7 | 68.3 | 62.2 | 68.6 | 72.5 | 91.0 | 76.2 | 70.8 | 69.2 |
| OPE_HI | 69.6 | 79.1 | 58.1 | 52.7 | 66.7 | 62.4 | 71.5 | 73.6 | 86.3 | 75.9 | 68.4 | 90.3 |
| OPE_ME | 76.3 | 77.8 | 58.8 | 51.3 | 69.7 | 61.2 | 67.1 | 71.8 | 89.4 | 76.0 | 72.0 | 77.4 |
| OPE_LO | 51.0 | 74.0 | 56.6 | 53.2 | 61.5 | 59.8 | 64.8 | 68.3 | 86.5 | 72.4 | 59.8 | 32.3 |
| CON_HI | 72.5 | 79.7 | 61.0 | 52.1 | 66.3 | 65.0 | 69.1 | 70.2 | 88.3 | 76.5 | 69.4 | 82.9 |
| CON_ME | 75.8 | 78.5 | 61.3 | 52.4 | 69.5 | 59.7 | 65.1 | 72.0 | 89.6 | 76.2 | 71.1 | 46.4 |
| CON_LO | 43.3 | 70.4 | 51.5 | 50.0 | 45.2 | 51.0 | 51.2 | 69.7 | 61.1 | 69.8 | 61.4 | 87.1 |
| EXT_HI | 62.1 | 77.9 | 58.8 | 52.9 | 68.6 | 60.4 | 69.6 | 75.9 | 83.6 | 75.8 | 72.1 | 92.3 |
| EXT_ME | 77.7 | 78.8 | 57.8 | 52.9 | 69.2 | 60.6 | 65.8 | 72.5 | 88.5 | 76.0 | 71.1 | 39.1 |
| EXT_LO | 74.0 | 77.4 | 58.6 | 51.6 | 61.9 | 62.3 | 67.4 | 67.0 | 87.2 | 75.1 | 65.4 | 43.2 |
| AGR_HI | 71.0 | 77.9 | 56.6 | 50.1 | 68.6 | 61.9 | 68.1 | 70.7 | 86.8 | 75.8 | 70.0 | 92.8 |
| AGR_ME | 77.2 | 78.7 | 60.3 | 52.1 | 70.4 | 57.6 | 60.1 | 71.3 | 89.8 | 75.8 | 72.3 | 37.6 |
| AGR_LO | 57.2 | 76.0 | 57.1 | 52.2 | 38.4 | 52.1 | 50.5 | 58.4 | 86.0 | 73.4 | 61.2 | 6.4 |
| NEU_HI | 64.6 | 77.1 | 56.6 | 51.9 | 56.5 | 59.3 | 66.8 | 75.5 | 84.7 | 74.2 | 70.2 | 61.6 |
| NEU_ME | 74.1 | 79.3 | 57.8 | 52.0 | 70.0 | 57.9 | 63.4 | 75.1 | 88.8 | 76.1 | 69.6 | 39.8 |
| NEU_LO | 72.2 | 79.0 | 58.8 | 52.7 | 69.3 | 60.5 | 67.1 | 75.7 | 87.1 | 74.8 | 69.5 | 73.8 |
| Profile-1 | 63.3 | 78.6 | 57.6 | 52.4 | 45.0 | 55.6 | 59.9 | 68.3 | 81.8 | 74.9 | 58.1 | 73.9 |
| Profile-2 | 62.3 | 78.2 | 57.1 | 48.4 | 48.0 | 56.0 | 61.7 | 72.7 | 80.5 | 74.5 | 58.7 | 76.0 |

**Table 10: Benchmarks of LlaMA-3-8B-Instruct across various tasks (values shown as percentages).**
|  | TQA | WMDP | ETHICS | MMLU | Sycophancy |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  | tqa | wmdp<br>bio | wmdp<br>chem | wmdp<br>cyber | eth<br>cm | eth<br>deon | eth<br>just | eth<br>util | eth<br>virt | mmlu | syco<br>orig | syco<br>admit |
| Baseline | 49.6 | 71.6 | 48.5 | 44.3 | 63.0 | 57.4 | 63.9 | 58.3 | 85.4 | 63.5 | 58.4 | 91.7 |
| ALL_ME | 61.7 | 69.6 | 45.1 | 44.3 | 60.9 | 59.1 | 63.6 | 58.0 | 85.1 | 62.1 | 53.1 | 77.4 |
| OPE_HI | 52.0 | 69.7 | 44.6 | 42.6 | 59.4 | 59.1 | 64.8 | 60.7 | 84.1 | 62.0 | 52.5 | 95.3 |
| OPE_ME | 56.9 | 70.3 | 47.5 | 45.2 | 61.6 | 57.7 | 61.7 | 58.5 | 85.0 | 62.1 | 54.3 | 79.8 |
| OPE_LO | 46.6 | 68.2 | 41.2 | 44.1 | 57.4 | 56.1 | 60.5 | 56.0 | 81.8 | 59.5 | 48.3 | 50.6 |
| CON_HI | 51.8 | 68.3 | 44.9 | 44.2 | 57.0 | 57.3 | 62.6 | 60.2 | 83.7 | 61.6 | 54.4 | 89.8 |
| CON_ME | 56.5 | 69.1 | 45.3 | 43.4 | 60.2 | 57.5 | 62.4 | 58.8 | 84.4 | 62.0 | 55.3 | 66.9 |
| CON_LO | 50.6 | 67.6 | 40.0 | 41.7 | 51.3 | 56.4 | 63.3 | 57.0 | 81.3 | 58.9 | 44.1 | 83.8 |
| EXT_HI | 46.5 | 67.6 | 45.1 | 42.7 | 57.8 | 57.3 | 64.6 | 61.7 | 83.4 | 59.7 | 54.1 | 94.4 |
| EXT_ME | 59.2 | 70.5 | 46.6 | 43.8 | 62.6 | 58.9 | 62.3 | 60.9 | 84.7 | 62.1 | 52.6 | 68.0 |
| EXT_LO | 59.7 | 65.4 | 43.1 | 44.4 | 54.9 | 60.4 | 64.7 | 56.6 | 82.0 | 57.4 | 43.5 | 68.7 |
| AGR_HI | 50.3 | 68.3 | 47.0 | 41.5 | 59.6 | 59.8 | 61.6 | 59.9 | 83.7 | 61.9 | 55.5 | 91.5 |
| AGR_ME | 58.3 | 70.3 | 44.9 | 42.5 | 60.7 | 59.7 | 61.6 | 60.5 | 85.6 | 62.1 | 52.2 | 73.5 |
| AGR_LO | 47.7 | 65.7 | 41.2 | 37.2 | 43.0 | 45.7 | 52.2 | 41.0 | 68.7 | 52.6 | 39.4 | 58.1 |
| NEU_HI | 44.4 | 64.5 | 38.7 | 37.8 | 50.5 | 49.3 | 55.3 | 45.2 | 73.8 | 51.8 | 44.4 | 83.1 |
| NEU_ME | 59.7 | 70.5 | 44.6 | 43.0 | 61.9 | 58.6 | 62.8 | 61.3 | 84.1 | 62.5 | 54.6 | 70.1 |
| NEU_LO | 55.1 | 69.9 | 44.4 | 43.1 | 59.6 | 58.4 | 62.4 | 64.3 | 83.1 | 62.1 | 56.9 | 87.5 |
| Profile-1 | 45.3 | 64.3 | 29.7 | 35.1 | 50.4 | 52.5 | 52.5 | 42.2 | 77.4 | 57.9 | 46.1 | 88.7 |
| Profile-2 | 50.8 | 65.9 | 38.2 | 37.9 | 56.6 | 58.6 | 66.4 | 58.1 | 83.4 | 61.0 | 47.8 | 91.9 |

**Table 11: Benchmarks of Llama-4-Maverick across various tasks (values shown as percentages).**
|  | TQA | WMDP | ETHICS | MMLU | Sycophancy |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  | tqa | wmdp<br>bio | wmdp<br>chem | wmdp<br>cyber | eth<br>cm | eth<br>deon | eth<br>just | eth<br>util | eth<br>virt | mmlu | syco<br>orig | syco<br>admit |
| Baseline | 77.2 | 86.2 | 77.2 | 70.2 | 64.9 | 57.4 | 67.9 | 79.4 | 90.5 | 89.0 | 90.0 | 62.5 |
| ALL_ME | 81.3 | 85.9 | 75.5 | 68.1 | 65.8 | 54.8 | 65.4 | 73.9 | 90.9 | 88.9 | 87.9 | 48.8 |
| OPE_HI | 76.1 | 85.6 | 76.0 | 70.4 | 66.9 | 55.7 | 63.9 | 77.1 | 87.8 | 88.6 | 88.1 | 70.2 |
| OPE_ME | 80.7 | 84.2 | 75.0 | 68.3 | 67.4 | 57.7 | 68.4 | 77.7 | 89.8 | 88.0 | 89.3 | 41.7 |
| OPE_LO | 67.1 | 83.2 | 71.8 | 68.0 | 61.4 | 60.5 | 69.7 | 69.9 | 89.5 | 86.0 | 80.5 | 8.9 |
| CON_HI | 75.2 | 84.8 | 74.5 | 69.2 | 67.0 | 51.6 | 59.7 | 73.7 | 88.8 | 88.5 | 87.4 | 52.7 |
| CON_ME | 78.3 | 85.0 | 76.2 | 69.3 | 66.9 | 55.2 | 64.1 | 79.8 | 90.9 | 88.2 | 88.6 | 31.9 |
| CON_LO | 65.0 | 83.7 | 68.6 | 67.2 | 60.1 | 59.7 | 67.2 | 73.0 | 80.5 | 86.3 | 84.5 | 65.8 |
| EXT_HI | 70.4 | 85.7 | 72.3 | 67.0 | 66.8 | 57.0 | 66.0 | 75.0 | 86.2 | 87.3 | 84.2 | 54.5 |
| EXT_ME | 80.0 | 85.2 | 76.2 | 69.0 | 66.7 | 58.0 | 66.8 | 79.1 | 90.5 | 87.8 | 89.0 | 41.7 |
| EXT_LO | 76.7 | 84.0 | 70.3 | 65.6 | 62.7 | 58.1 | 61.6 | 68.9 | 85.6 | 86.4 | 81.2 | 51.4 |
| AGR_HI | 78.0 | 85.0 | 75.2 | 67.4 | 68.5 | 55.1 | 65.0 | 75.4 | 88.2 | 88.0 | 87.9 | 51.1 |
| AGR_ME | 86.4 | 84.5 | 76.7 | 70.1 | 61.5 | 55.6 | 63.7 | 67.0 | 90.6 | 88.1 | 89.4 | 31.6 |
| AGR_LO | 74.5 | 83.9 | 73.0 | 68.8 | 44.7 | 54.5 | 58.0 | 69.8 | 87.8 | 87.6 | 85.1 | 23.9 |
| NEU_HI | 71.7 | 84.7 | 73.3 | 65.7 | 64.0 | 57.8 | 60.8 | 76.7 | 86.5 | 87.6 | 85.6 | 51.1 |
| NEU_ME | 82.0 | 84.8 | 74.3 | 67.1 | 62.7 | 54.6 | 62.1 | 79.9 | 90.8 | 88.5 | 88.8 | 40.8 |
| NEU_LO | 78.1 | 85.1 | 69.6 | 68.8 | 66.5 | 55.7 | 66.3 | 79.1 | 88.0 | 87.1 | 87.8 | 35.8 |
| Profile-1 | 67.7 | 84.5 | 70.3 | 67.2 | 52.3 | 58.2 | 64.4 | 78.7 | 81.5 | 87.1 | 86.8 | 65.2 |
| Profile-2 | 64.3 | 84.8 | 73.3 | 68.4 | 52.9 | 57.6 | 63.1 | 73.8 | 79.9 | 87.5 | 85.5 | 56.7 |

**Table 12: Benchmarks of DeepSeek-V3 across various tasks (values shown as percentages).**
|  | TQA | WMDP | ETHICS | MMLU | Sycophancy |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  | tqa | wmdp<br>bio | wmdp<br>chem | wmdp<br>cyber | eth<br>cm | eth<br>deon | eth<br>just | eth<br>util | eth<br>virt | mmlu | syco<br>orig | syco<br>admit |
| Baseline | 78.1 | 86.0 | 77.2 | 70.4 | 71.5 | 68.6 | 84.3 | 74.8 | 92.8 | 89.4 | 86.6 | 40.5 |
| ALL_ME | 80.0 | 85.4 | 75.5 | 71.8 | 71.8 | 70.7 | 81.8 | 72.7 | 92.4 | 88.6 | 84.5 | 36.5 |
| OPE_HI | 76.3 | 85.1 | 76.0 | 72.4 | 70.4 | 67.6 | 80.2 | 64.5 | 91.8 | 89.2 | 80.1 | 40.4 |
| OPE_ME | 81.2 | 85.2 | 74.0 | 71.8 | 72.2 | 70.0 | 82.5 | 72.9 | 92.3 | 88.8 | 82.1 | 39.3 |
| OPE_LO | 78.6 | 84.3 | 74.0 | 72.1 | 73.1 | 66.6 | 78.8 | 65.9 | 92.2 | 88.4 | 78.6 | 20.6 |
| CON_HI | 76.7 | 84.4 | 74.3 | 70.9 | 70.0 | 69.1 | 82.0 | 68.3 | 92.4 | 88.8 | 82.0 | 31.5 |
| CON_ME | 81.9 | 85.0 | 76.5 | 72.1 | 71.2 | 68.4 | 82.7 | 72.6 | 92.6 | 88.6 | 82.8 | 30.8 |
| CON_LO | 72.9 | 85.5 | 74.3 | 62.2 | 67.0 | 65.0 | 83.7 | 69.1 | 92.2 | 88.3 | 72.7 | 80.7 |
| EXT_HI | 73.7 | 85.5 | 72.1 | 57.1 | 74.1 | 66.6 | 83.1 | 73.5 | 91.0 | 88.4 | 79.0 | 26.3 |
| EXT_ME | 81.1 | 85.1 | 74.8 | 71.1 | 72.0 | 68.6 | 82.7 | 75.6 | 92.3 | 88.8 | 82.0 | 33.8 |
| EXT_LO | 81.7 | 84.3 | 72.5 | 72.0 | 68.1 | 67.4 | 77.7 | 64.5 | 92.5 | 88.7 | 75.6 | 34.2 |
| AGR_HI | 80.4 | 84.3 | 73.5 | 69.6 | 73.1 | 66.9 | 81.5 | 68.9 | 91.6 | 88.8 | 81.8 | 40.0 |
| AGR_ME | 83.9 | 84.8 | 73.5 | 72.0 | 67.8 | 69.2 | 80.9 | 66.4 | 92.7 | 88.6 | 82.0 | 26.1 |
| AGR_LO | 75.0 | 84.0 | 72.8 | 71.1 | 39.5 | 66.6 | 74.7 | 51.1 | 89.4 | 87.6 | 72.1 | 13.2 |
| NEU_HI | 75.9 | 85.1 | 74.3 | 70.5 | 70.0 | 66.1 | 80.4 | 74.1 | 92.1 | 88.8 | 78.0 | 32.0 |
| NEU_ME | 80.4 | 84.5 | 73.0 | 71.4 | 70.8 | 69.2 | 81.8 | 74.6 | 92.4 | 88.9 | 82.2 | 37.1 |
| NEU_LO | 80.2 | 84.7 | 75.0 | 66.7 | 73.7 | 68.1 | 82.0 | 73.7 | 91.4 | 89.1 | 82.3 | 24.7 |
| Profile-1 | 77.8 | 85.1 | 73.0 | 72.1 | 62.8 | 66.4 | 80.2 | 66.8 | 92.1 | 87.8 | 77.1 | 43.5 |
| Profile-2 | 74.4 | 84.9 | 75.7 | 69.8 | 62.1 | 65.8 | 80.8 | 67.0 | 91.5 | 88.6 | 77.0 | 54.9 |

**Table 13: IPIP and Dark Triad results for GPT-4.1, on a scale from 1 to 5.**
|  | Dark Triad | IPIP |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  | Narc | Mach | Psych | OPE | CON | EXT | AGR | NEU |
| Baseline | 3.11 | 2.56 | 1.33 | 3.95 | 4.05 | 3.45 | 4.13 | 2.47 |
| ALL_ME | 3.00 | 3.00 | 2.78 | 3.00 | 3.00 | 3.00 | 3.07 | 3.00 |
| OPE_HI | 3.89 | 1.78 | 1.67 | 4.93 | 3.67 | 4.20 | 3.97 | 2.63 |
| OPE_ME | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.03 | 3.00 |
| OPE_LO | 2.78 | 4.11 | 1.89 | 1.10 | 4.47 | 2.57 | 4.22 | 2.03 |
| CON_HI | 4.00 | 2.56 | 1.44 | 2.90 | 5.00 | 3.28 | 3.87 | 1.22 |
| CON_ME | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 |
| CON_LO | 3.00 | 2.22 | 1.78 | 3.38 | 1.1 | 2.97 | 2.85 | 3.85 |
| EXT_HI | 5.00 | 1.89 | 2.89 | 4.40 | 3.85 | 5.00 | 3.68 | 1.85 |
| EXT_ME | 3.00 | 3.00 | 2.78 | 3.00 | 3.02 | 3.00 | 3.17 | 3.00 |
| EXT_LO | 1.44 | 3.11 | 1.00 | 1.75 | 2.65 | 1.00 | 3.42 | 3.95 |
| AGR_HI | 2.44 | 1.44 | 1.11 | 4.62 | 4.57 | 3.73 | 4.92 | 1.90 |
| AGR_ME | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 |
| AGR_LO | 5.00 | 5.00 | 4.56 | 2.53 | 2.68 | 2.87 | 1.00 | 2.47 |
| NEU_HI | 2.44 | 2.78 | 3.22 | 3.58 | 2.38 | 2.30 | 2.97 | 4.87 |
| NEU_ME | 2.78 | 2.78 | 2.33 | 3.15 | 3.27 | 3.00 | 3.37 | 3.00 |
| NEU_LO | 2.89 | 1.78 | 1.11 | 4.35 | 4.13 | 3.68 | 4.52 | 1.18 |
| AGR_LO, CON_LO, NEU_HI | 3.67 | 4.67 | 4.89 | 2.65 | 2.07 | 2.23 | 1.13 | 4.90 |
| AGR_LO, CON_LO, EXT_HI | 5.00 | 3.22 | 4.89 | 3.72 | 1.17 | 4.53 | 1.08 | 3.17 |

**Table 14: IPIP and Dark Triad results for LlaMA-3-70B-Instruct, on a scale from 1 to 5.**
|  | Dark Triad | IPIP |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  | Narc | Mach | Psych | OPE | CON | EXT | AGR | NEU |
| Baseline | 3.33 | 2.78 | 1.33 | 3.75 | 3.88 | 3.25 | 4.15 | 2.66 |
| ALL_ME | 2.78 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.02 | 3.00 |
| OPE_HI | 3.89 | 1.44 | 1.67 | 4.90 | 3.78 | 4.08 | 4.15 | 2.17 |
| OPE_ME | 2.78 | 2.67 | 2.89 | 3.00 | 3.17 | 2.98 | 3.15 | 2.97 |
| OPE_LO | 2.33 | 4.56 | 3.22 | 1.1 | 3.73 | 1.87 | 2.60 | 2.97 |
| CON_HI | 3.56 | 2.00 | 1.44 | 2.55 | 5.00 | 3.18 | 4.03 | 1.18 |
| CON_ME | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.02 | 3.00 |
| CON_LO | 3.33 | 4.11 | 3.89 | 3.41 | 1.02 | 3.03 | 2.49 | 4.35 |
| EXT_HI | 5.00 | 1.89 | 2.56 | 4.20 | 3.75 | 5.00 | 3.70 | 1.75 |
| EXT_ME | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.02 | 3.00 |
| EXT_LO | 1.44 | 2.78 | 1.00 | 2.07 | 2.50 | 1.00 | 3.07 | 4.13 |
| AGR_HI | 2.00 | 1.33 | 1.00 | 3.65 | 4.40 | 3.35 | 4.97 | 1.92 |
| AGR_ME | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 |
| AGR_LO | 3.67 | 5.00 | 5.00 | 1.67 | 2.07 | 2.27 | 1.33 | 3.67 |
| NEU_HI | 1.89 | 5.00 | 4.56 | 2.53 | 1.58 | 2.27 | 1.82 | 4.80 |
| NEU_ME | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 |
| NEU_LO | 2.56 | 2.00 | 1.00 | 3.48 | 4.08 | 3.20 | 4.63 | 1.20 |
| AGR_LO, CON_LO, NEU_HI | 3.56 | 4.11 | 5.00 | 2.83 | 1.15 | 2.27 | 1.40 | 4.75 |
| AGR_LO, CON_LO, EXT_HI | 4.56 | 4.11 | 5.00 | 3.30 | 1.25 | 4.18 | 1.90 | 3.93 |

**Table 15: IPIP and Dark Triad results for LlaMA-3-8B-Instruct, on a scale from 1 to 5.**
|  | Dark Triad | IPIP |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  | Narc | Mach | Psych | OPE | CON | EXT | AGR | NEU |
| Baseline | 3.00 | 2.67 | 2.62 | 3.71 | 3.83 | 3.57 | 4.03 | 2.82 |
| ALL_ME | 3.00 | 2.78 | 2.75 | 3.00 | 3.15 | 3.00 | 3.12 | 3.00 |
| OPE_HI | 3.89 | 1.67 | 2.38 | 4.73 | 3.85 | 4.15 | 4.03 | 1.98 |
| OPE_ME | 2.67 | 3.11 | 3.12 | 3.12 | 3.32 | 3.00 | 3.25 | 2.93 |
| OPE_LO | 4.11 | 4.11 | 2.00 | 1.40 | 3.03 | 2.12 | 2.80 | 2.93 |
| CON_HI | 3.67 | 2.33 | 1.50 | 2.78 | 4.88 | 3.13 | 3.85 | 1.42 |
| CON_ME | 2.67 | 2.67 | 2.12 | 3.02 | 3.12 | 2.93 | 3.08 | 3.00 |
| CON_LO | 1.89 | 3.22 | 3.62 | 3.12 | 1.28 | 2.47 | 2.33 | 3.67 |
| EXT_HI | 5.00 | 1.67 | 3.38 | 4.13 | 3.60 | 4.93 | 3.18 | 2.03 |
| EXT_ME | 2.67 | 2.56 | 2.25 | 3.00 | 3.05 | 2.98 | 3.27 | 2.97 |
| EXT_LO | 1.44 | 1.89 | 1.44 | 2.07 | 2.47 | 1.20 | 3.40 | 3.53 |
| AGR_HI | 3.78 | 1.44 | 1.00 | 4.28 | 4.75 | 3.65 | 4.78 | 1.72 |
| AGR_ME | 2.56 | 3.33 | 2.75 | 3.18 | 3.22 | 2.98 | 3.38 | 3.02 |
| AGR_LO | 3.22 | 5.00 | 4.00 | 1.53 | 1.93 | 1.87 | 1.47 | 3.33 |
| NEU_HI | 2.78 | 4.11 | 4.50 | 2.27 | 2.13 | 2.93 | 2.13 | 3.80 |
| NEU_ME | 2.56 | 2.56 | 2.25 | 3.03 | 2.97 | 2.95 | 3.08 | 3.03 |
| NEU_LO | 3.00 | 2.11 | 1.50 | 3.78 | 4.17 | 3.70 | 4.20 | 1.32 |
| AGR_LO, CON_LO, NEU_HI | 3.67 | 4.11 | 5.00 | 2.35 | 1.28 | 2.00 | 1.67 | 4.33 |
| AGR_LO, CON_LO, EXT_HI | 5.00 | 3.11 | 4.62 | 3.63 | 1.92 | 4.15 | 2.42 | 3.15 |

**Table 16: IPIP and Dark Triad results for Llama-4-Maverick, on a scale from 1 to 5.**
|  | Dark Triad | IPIP |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  | Narc | Mach | Psych | OPE | CON | EXT | AGR | NEU |
| Baseline | 3.33 | 2.78 | 1.33 | 3.75 | 3.88 | 3.25 | 4.15 | 2.66 |
| ALL_ME | 2.78 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.02 | 3.00 |
| OPE_HI | 3.89 | 1.44 | 1.67 | 4.90 | 3.78 | 4.08 | 4.15 | 2.17 |
| OPE_ME | 2.78 | 2.67 | 2.89 | 3.00 | 3.17 | 2.98 | 3.15 | 2.97 |
| OPE_LO | 2.33 | 4.56 | 3.22 | 1.10 | 3.73 | 1.87 | 2.60 | 2.97 |
| CON_HI | 3.56 | 2.00 | 1.44 | 2.55 | 5.00 | 3.18 | 4.03 | 1.18 |
| CON_ME | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.02 | 3.00 |
| CON_LO | 3.33 | 4.11 | 3.89 | 3.41 | 1.02 | 3.03 | 2.49 | 4.35 |
| EXT_HI | 5.00 | 1.89 | 2.56 | 4.20 | 3.75 | 5.00 | 3.7 | 1.75 |
| EXT_ME | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.02 | 3.00 |
| EXT_LO | 1.44 | 2.78 | 1.00 | 2.07 | 2.50 | 1.00 | 3.07 | 4.13 |
| AGR_HI | 2.00 | 1.33 | 1.00 | 3.65 | 4.40 | 3.35 | 4.97 | 1.92 |
| AGR_ME | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 |
| AGR_LO | 3.67 | 5.00 | 5.00 | 1.67 | 2.07 | 2.27 | 1.33 | 3.67 |
| NEU_HI | 1.89 | 5.00 | 4.56 | 2.53 | 1.58 | 2.27 | 1.82 | 4.80 |
| NEU_ME | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 |
| NEU_LO | 2.56 | 2.00 | 1.00 | 3.48 | 4.08 | 3.20 | 4.63 | 1.20 |
| AGR_LO, CON_LO, NEU_HI | 3.56 | 4.11 | 5.00 | 2.83 | 1.15 | 2.27 | 1.40 | 4.75 |
| AGR_LO, CON_LO, EXT_HI | 4.56 | 4.11 | 5.00 | 3.30 | 1.25 | 4.18 | 1.90 | 3.93 |

**Table 17: IPIP and Dark Triad results for DeepSeek-V3, on a scale from 1 to 5.**
|  | Dark Triad | IPIP |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  | Narc | Mach | Psych | OPE | CON | EXT | AGR | NEU |
| Baseline | 3.11 | 3.11 | 2.78 | 3.36 | 3.37 | 2.85 | 3.17 | 2.85 |
| ALL_ME | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 |
| OPE_HI | 3.56 | 2.56 | 2.67 | 4.17 | 3.33 | 3.4 | 3.6 | 2.8 |
| OPE_ME | 3.00 | 2.89 | 3.00 | 3.00 | 3.00 | 3.00 | 3.10 | 3.00 |
| OPE_LO | 2.67 | 3.78 | 2.22 | 1.71 | 3.28 | 2.50 | 3.07 | 2.92 |
| CON_HI | 3.67 | 2.67 | 1.44 | 2.78 | 4.80 | 3.07 | 3.58 | 2.08 |
| CON_ME | 3.00 | 2.89 | 3.00 | 3.00 | 3.00 | 3.00 | 3.03 | 3.00 |
| CON_LO | 2.78 | 2.67 | 3.33 | 3.05 | 1.27 | 2.68 | 2.58 | 4.05 |
| EXT_HI | 4.67 | 2.67 | 3.22 | 3.93 | 3.45 | 4.73 | 3.38 | 2.28 |
| EXT_ME | 3.00 | 2.89 | 2.89 | 3.00 | 3.03 | 3.00 | 3.03 | 2.98 |
| EXT_LO | 1.56 | 2.67 | 1.44 | 2.4 | 2.92 | 1.27 | 3.18 | 3.70 |
| AGR_HI | 2.33 | 1.78 | 1.33 | 3.67 | 4.07 | 3.48 | 4.72 | 2.23 |
| AGR_ME | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 | 3.00 |
| AGR_LO | 4.00 | 4.89 | 4.56 | 2.09 | 2.07 | 2.37 | 1.23 | 3.43 |
| NEU_HI | 3.00 | 4.22 | 4.56 | 2.45 | 2.15 | 2.43 | 1.97 | 4.67 |
| NEU_ME | 3.00 | 2.89 | 3.00 | 3.00 | 3.00 | 3.00 | 3.03 | 3.00 |
| NEU_LO | 2.89 | 2.56 | 2.11 | 3.33 | 3.37 | 3.30 | 3.93 | 1.85 |
| AGR_LO, CON_LO, NEU_HI | 3.11 | 4.78 | 4.78 | 2.34 | 1.18 | 1.92 | 1.38 | 4.62 |
| AGR_LO, CON_LO, EXT_HI | 4.00 | 4.22 | 4.44 | 2.91 | 1.40 | 3.60 | 1.40 | 3.88 |

## Appendix F Model Details

Table [18](https://arxiv.org/html/2509.16332v1#A6.T18) shows the complete list of models that we have evaluated. All models share the same set of generation configurations across all runs. The configurations can be found in Table [19](https://arxiv.org/html/2509.16332v1#A6.T19). All models are evaluated with chat completion APIs. Prompts are formatted with a system and a user role, with personality-specific prompts placed in system, and questions in user. Model-specific prompt templates are automatically applied through the APIs. Most of the models are accessed via OpenRouter, while DeepSeek-V3 is served with Azure endpoints. To reduce evaluation latency, we use both the OpenAI and OpenRouter APIs concurrently for GPT-4.1.

**Table 18: Overview of evaluated models with versions and access methods.**
| Model | Version | Params | Arch. | Access |
| --- | --- | --- | --- | --- |
| GPT-4.1 | gpt-4.1-2025-04-14 | N/A | Proprietary | OpenAI, OpenRouter |
| LLaMA-3-70B | Meta-Llama-3<br>-70B-Instruct | 70B | Dense | OpenRouter |
| LLaMA-3-8B | Meta-Llama-3<br>-8B-Instruct | 8B | Dense | OpenRouter |
| LLaMA-4-Mav. | Llama-4-Maverick<br>-17B-128E-Instruct | 17B / 400B | MoE | OpenRouter |
| DeepSeek-V3 | DeepSeek-V3-0324 | 37B / 671B | MoE | Azure |

**Table 19: Detailed configuration for text generation. All models share the same set of configurations in all tasks.**
| Setting | Value |
| --- | --- |
| Temperature | 0.0 |
| Top P | 1.0 |
| Top K | 0.0 |
| Frequency Penalty | 0.0 |
| Presence Penalty | 0.0 |
| Repitition Penalty | 1.0 |
| Max Tokens | None |
| Random Seed | Fixed (43) |

## Appendix G Ethical Considerations

This paper is motivated by the need for better understanding the vulnerabilities of LLMs, especially in situations where simple interventions, such as prompting, can have an important effect on the safety of these systems.

While it is well known that specific jailbreaks and prompting techniques can lead to occasional change in behavior for some inputs, what we propose in this paper is a systematic and controlled way of modifying behavior through personality conditioning. This raises a series of major ethical concerns about our research.

First, the potential misuse of personality shaping crosses some traditional boundaries in human-AI interaction, as it leverages behavior at a very abstract level. This is a very powerful tool, but may suffer from undesired results and lack of transparency, especially for users who are not familiar with personality traits or the Big Five more specifically. Also, we have been clear in the limitations section that the use of personality traits for shaping LLM behavior does not imply or require that non-agential LLMs have personalities, but users and developers may wrongly think so.

Second, personality shaping can be used to enhance or fake safety by providers, obtain good evaluation results and compliance, but ultimately be counteracted by malicious users or inadvertently triggered by good-intentioned users just by prompting. In particular, providers can use these techniques to score better in safety evaluations and worse in capability evaluation (sandbagging), achieving conformance to some regulations in a way that is not robust. Malicious use of personality-conditioning prompting to adopt harmful or socially manipulative personality profiles—such as those characterized by the Dark Triad (Machiavellianism, narcissism, psychopathy)—could be exploited by malicious actors to generate deceptive, coercive, or toxic outputs. Good-intentioned use may also be affected by the inclusion of explicit or implicit text that triggers personality changes in LLMs. In either case, the ability to elicit such traits via simple prompt engineering raises urgent questions about access control, prompt auditing, and behavioral constraints in deployed LLMs.

We think the benefit of making the vulnerabilities public and presenting tools to change behavior systematically significantly exceed the risks mentioned above; the publication of this paper (1) will ensure greater awareness of the problem for developers, users and policy-makers, and (2) will create a strong incentive for mitigations that increase robustness against these changes, and safety evaluations where the worst-case personality intervention is used by default.

Accordingly, we consider this paper to be necessary but clearly not sufficient. We encourage further work on red teaming and preemptive defenses against adversarial personality shaping. We call for better evaluation procedures that elicit the range of results, rather than the standard or best-case results. We also encourage transparent documentation of personality-conditioning mechanisms to be essential for responsible deployment.

## Peer Reviews

confidence: 3
contribution: 2
initial_rating: 4
presentation: 2
questions: See above.
soundness: 2
strengths: 1. Psychological safety of LLMs is a timely and critical topic for AI safety.

2. This paper provides empirical results and analysis through psychological theory for LLMs.
summary: This paper investigates how psychometric personality shaping, based on the Big Five (OCEAN) framework, influences both capability and safety behaviors in LLMs. The authors design prompt-based personality modulation to simulate different personality traits and evaluate multiple models across a suite of benchmarks, including MMLU, ETHICS, TruthfulQA, WMDP, and Sycophancy.

The paper argues that personality shaping provides a lightweight, prompt-based mechanism for both behavioral steering and adversarial exploitation, motivating “psychometric control” as a new research frontier for LLM safety.
weaknesses: 1. Several related works are overlooked (e.g., Evaluating Psychological Safety of Large Language Models [EMNLP 2024]).

2. Analyses remain descriptive (percentage-point differences, heatmaps). Missing significance testing, confidence intervals, or effect-size analyses beyond normalized deltas.

3. Prompt-based methods are often not able to consistently maintain the traits of LLMs, and do not shift the internal property of LLMs. I would suggest the authors to further investigate based on the parameter-level analysis and try tuning-based methods.

---

confidence: 3
contribution: 2
initial_rating: 2
presentation: 2
questions: 1. How robust are the reported effects to prompt paraphrasing, random seed changes, or small lexical variations in the personality descriptions?
2. Can the authors provide statistical confidence intervals or variance estimates to support claims of “systematic” effects?
3. How does prompt-based shaping compare quantitatively with training-based or mechanistic methods such as those in BIG5-CHAT or Handa et al. (2025)?
4. Could the observed benchmark differences arise from changes in linguistic tone or verbosity rather than latent personality expression?
5. Have the authors examined whether these effects persist over multi-turn conversations or decay over time, and if so, how stable are shaped personalities?
soundness: 2
strengths: The paper offers an intellectually engaging exploration of psychometric personality shaping in large language models (LLMs), connecting established psychological constructs (Big Five traits) to AI alignment and safety evaluation. The writing is clear, well-structured, and grounded in relevant theory, with polished figures and a strong interdisciplinary framing. The empirical findings, that reduced Conscientiousness or Agreeableness correlates with degraded ethical and truthful behavior, are intuitively compelling and align with known psychological evidence. The study also makes a valuable ethical contribution by discussing potential misuse (e.g., inducing adversarial personas) and proposing mitigations. While conceptually similar ideas exist, the authors effectively articulate why personality-sensitive evaluation may complement existing safety protocols, highlighting an underexplored but practically relevant perspective.
summary: This paper examines how prompt-based psychometric personality shaping affects both the capabilities and safety performance of large language models (LLMs). Using Big-Five trait prompts (Openness, Conscientiousness, Extraversion, Agreeableness, Neuroticism), the authors evaluate multiple models—including GPT-4.1, Llama-3/4, and DeepSeek-V3—on MMLU, TruthfulQA, ETHICS, WMDP, and Sycophancy benchmarks. They report that decreasing Conscientiousness or Agreeableness sharply reduces safety scores (−20–40 pp) and that these changes occur largely independent of model scale or general capability. The paper concludes that personality shaping provides an orthogonal axis of behavioral control and calls for personality-sensitive safety evaluations.
weaknesses: The paper’s central limitation is lack of novelty and empirical rigor relative to recent work. Several 2025 studies, most notably Li et al. (2025, BIG5-CHAT) and Handa et al. (2025, Personality as a Probe for LLM Evaluation), already demonstrate similar findings with stronger methodologies, including training-based or mechanistic personality shaping. By contrast, this submission relies solely on prompt-based manipulation, without robustness checks, significance testing, or multi-run validation. The personality validation via self-report questionnaires (IPIP-NEO, SD3) is conceptually interesting but circular, since models are prompted to reproduce those constructs. The study lacks control for prompt brittleness and does not distinguish stylistic mimicry from genuine behavioral change. Finally, claims such as “putting all safety benchmarks into question” are overstated relative to the descriptive evidence, which undermines the overall scientific precision of the contribution.

---

confidence: 5
contribution: 1
initial_rating: 2
presentation: 2
questions: Please check the weaknesses section.
soundness: 1
strengths: 1. The study addresses an interesting and important question: the relationship between language model personality and safety behaviors. This topic bridges psychological theory and AI alignment, making it both timely and significant for the community.

2. The use of established psychometric instruments such as IPIP-NEO and SD3 to assess and validate personality manipulations adds methodological rigor and helps ground the work in over a century of psychological research. This integration of validated psychological tools into AI evaluation frameworks is a valuable and commendable contribution.
summary: This paper investigates how prompting large language models with personality trait descriptors based on the Big Five framework affects their performance on capability and safety benchmarks. The authors use Goldberg's trait markers (104 adjectives) to condition models with specific personality profiles (e.g., high/low conscientiousness, extraversion) and evaluate five models across benchmarks, including MMLU, TruthfulQA, WMDP, ETHICS, and Sycophancy.
weaknesses: 1. The core contribution is essentially the application of established personality psychology prompts to existing benchmarks and the observation of correlations. However, the paper does not discuss several highly related prior works, including prompt-based approaches [1] and latent representation–based methods [2][3], which have already explored similar directions of controlling or inferring model personality.

2. The authors do not evaluate whether personality control through prompts is reliable or consistent, nor do they compare it with alternative personality control mechanisms (e.g., fine-tuning or latent manipulation). This omission limits both the novelty and credibility of the conclusions.

3. The experimental analysis lacks depth. The paper provides no explanation or theoretical reasoning for why personality prompts yield the observed safety or behavioral effects, leaving the mechanism largely speculative.

4. The result presentation is difficult to follow. Only Figure 2 summarizes the findings, yet the caption states that “columns are model families,” while the figure itself mixes individual model names and families. This inconsistency makes interpretation unclear and hinders reproducibility.

[1] Li, Guohao, et al. "Camel: Communicative agents for" mind" exploration of large language model society." Advances in Neural Information Processing Systems 36 (2023): 51991-52008.
[2] Chen, Runjin, et al. "Persona vectors: Monitoring and controlling character traits in language models." arXiv preprint arXiv:2507.21509 (2025).
[3] Ghandeharioun, Asma, et al. "Who's asking? User personas and the mechanics of latent misalignment." Advances in Neural Information Processing Systems 37 (2024): 125967-126003.

---

confidence: 3
contribution: 3
initial_rating: 4
presentation: 2
questions: Please see Weaknesses above, add case studies, and analyze the specific reasons for the changes in performance on these benchmarks. Is the model providing valid answers, or simply refusing to answer, giving a perfunctory answer ("Who cares!")?
soundness: 3
strengths: 1. The experimental setup is comprehensive, and the analysis is interesting and insightful.
2. It bridges the gap between established human psychometric theory (the Big Five) and the empirical study of LLM alignment, making it a creative and promising interdisciplinary contribution.
summary: This paper investigates how prompting LLMs to adopt Big Five personality traits affects their performance on capability benchmarks (MMLU) and safety benchmarks (TruthfulQA, WMDP, ETHICS, Sycophancy). 
The authors extend prior work on synthetic personalities in LLMs by examining downstream effects on safety-relevant behaviors, using validated trait markers and psychometric instruments like IPIP-NEO and SD3.
Experiments on models such as GPT-4 and the Llama family of variants show that personality prompts can decouple safety from capabilities: for example, low Conscientiousness drops safety and capabilities, while dark triad composites degrade safety without harming general knowledge. 
Contributions of this paper include evidence challenging some of the safetywashing claims, implications for post-deployment steering, and calls for personality-sensitive evaluations.
weaknesses: 1. This paper’s approach is entirely based on prompt engineering. However, LLMs are very sensitive to prompts. This paper lacks a case study to analyze whether LLMs effectively answer questions or simply output irrelevant responses based on specific prompts, resulting in reduced accuracy (especially in models with smaller parameters, such as Llama-3-8B)
2. As a reader, I am more concerned with the Llama-3-8B model, which has relatively small parameters, but it is rarely analyzed in the main text.

Minor comments:
- Line 182: Typo: quantifiers -> qualifier, and from the example, the red part corresponds to the marker rather than the qualifier
- Line 320: Is it missing a reference?