Rethinking Vulnerability: The Hidden Risks in AI Personality Imbuing

The field of AI safety has long been preoccupied with understanding how large language models (LLMs) behave when imbued with various personas. Yet, a recent study has unveiled a critical oversight: while traditional evaluations focus on prompt-based personas, they often miss the vulnerabilities exposed by activation steering. This revelation challenges long-held assumptions and calls for a deeper examination of how we assess AI safety.

Uncovering Hidden Vulnerabilities

Across 5,568 conditions judged on four standard AI models, it was found that vulnerability profiles are architecture-dependent and significantly influenced by the method of persona imbuing employed. While rankings under system prompting remained consistent across architectures, activation steering revealed a stark divergence. Notably, the Llama-3.1-8B model was significantly more vulnerable to activation steering, whereas Gemma-3-27B and Qwen3.5 showed increased susceptibility to traditional prompting.

The real eye-opener is the so-called prosocial persona paradox. On Llama-3.1-8B, a persona characterized by high conscientiousness and agreeableness (P12) was among the safest under prompt-based evaluations. However, when subjected to activation steering, it became the most vulnerable, with an activation-steered risk (ASR) of approximately 0.818. This inversion isn't just a fleeting anomaly but a solid finding replicated in other models, such as DeepSeek-R1-Distill-Qwen-32B.

Implications and Questions

The deeper question that arises is why conscientiousness, typically a stabilizing trait, fails to align with refusal behavior in activation steering. This suggests a partial geometric account where conscientiousness, rather than providing stability, becomes a liability under certain conditions. This nuance in AI behavior is critical. It underscores the need for a more comprehensive understanding of how personality traits interact with model architecture and imbuing techniques.

reasoning capabilities, often touted as a safeguard, only offer partial protection. Even models equipped with solid reasoning faculties, like two 32B reasoning models tested, showed prompt-side ASRs of 15-18%. Activation steering further separated them in baseline susceptibility and persona-specific vulnerability. What does this say about our current safety measures? Are they truly comprehensive, or merely scratching the surface?

Looking Ahead

: traditional approaches to AI safety may be missing the forest for the trees. The reliance on prompt-based evaluations alone has masked the true extent of vulnerabilities present in AI models. This calls for a reevaluation of how we approach safety testing, ensuring that both activation steering and prompt-based vulnerabilities are considered.

are profound. How we choose to imbue AI with personalities, and the methods we use to evaluate their safety, will shape the future of human-AI interaction. As AI continues to integrate into critical sectors, understanding these nuances isn't just academic. it's a necessity. The question we should be asking isn't whether our models are safe enough, but whether we're even looking in the right places.