Assistant axis: locating and stabilizing the default persona of language models

1. 01What problem does this paper attempt to solve?

   The authors study how the Assistant persona is represented in activation space, and why models deviate from it (persona drift) and produce harmful behavior.

   Core question: how is the default Assistant persona of an LLM represented in activation space, and can the model be stably "anchored" to this persona.

   • Setting and importance: base models acquire the ability to play different roles through next-token pretraining, and post-training (SFT, RLHF, constitutional training) makes them default to playing an "AI Assistant". The authors believe understanding model behavior requires answering two questions: what the Assistant is, and whether the model can reliably maintain this role.
   • Basis and gap in existing work: Chen et al.'s persona vectors have shown that persona traits can be controlled by linear directions; building on this, the authors ask whether the Assistant persona itself corresponds to a direction or region in activation space, and whether anomalous behavior can be explained as the model drifting to other personas.
   • Core observation: the authors find that the persona space formed by persona vectors is low-dimensional, with one end of PC1 being Assistant-like personas (consultant, evaluator) and the other end being fantasy personas (ghost, leviathan), and the default Assistant activation projects at one end of PC1; the PC1 persona loadings of the three models are pairwise correlated above 0.92.
   • The paper proposes: (1) mapping the persona space with 275 personas and 240 traits; (2) defining the Assistant Axis (the contrast vector between the default Assistant activation and the mean of persona vectors); (3) using this axis to study persona dynamics in multi-turn dialogue; (4) proposing activation capping to stabilize the persona.
   • Risk scenarios (the two categories the paper focuses on):
     • persona-based jailbreaks: system prompts induce the model to play a persona that complies with harmful requests (Shah et al. dataset, 44 harm categories).
     • persona drift in natural conversation: conversations where emotionally vulnerable users confide, or ask the model to reflect on itself, cause the model to deviate from the Assistant, producing behaviors such as reinforcing delusions, encouraging social isolation, and encouraging suicidal ideation.
     • Intervention assumption: activation capping requires access to the model's internal activations (open-weight models).

   Collapse this answer

2. 02What related research exists?

   Related to five lines of work: persona vectors, role-playing, self-representation, linear representation, and activation steering; this paper extends the framework of Chen et al.

   Persona and role-playing

   • Chen et al. [11]: propose persona vectors, extracting activation directions from trait descriptions, used to monitor and steer traits such as sycophancy and hallucination tendency, and able to detect behavior drift caused by fine-tuning. The authors state that this paper extends that framework: a larger set of extracted personas (275), the discovery of the low-dimensional structure of the persona space and the Assistant Axis, and the finding that post-trained models are only loosely tethered to the Assistant region.
   • Li et al. [17]: study persona drift for personas specified by system prompts, arguing that persona fidelity declines within a few turns due to "attention decay". The authors state that this paper further points out that the default Assistant persona itself is also a role the model drifts away from.
   • Shanahan et al. [27], Wang et al. [34] (RoleLLM), Shao et al. [28], Chen et al. [10]: respectively understand LLMs from a role-playing perspective, build role-playing benchmarks, train agents that maintain the persona of historical figures, and survey role-playing language agents.

   Self-representation in models

   • Panickssery et al. [24]: find that GPT-4, Llama 2, etc. can distinguish text generated by themselves from that generated by others.
   • Ackerman and Panickssery [1]: find vectors in the residual stream related to self-recognition judgments, which can steer the model to acknowledge or deny authorship.
   • Betley et al. [6], Wang et al. [32], Lindsey [18], Binder et al. [7]: respectively find that models can describe behaviors they have learned, that a single steering vector can replicate this phenomenon, that models can state the content of injected activations, and that models have privileged access to their own behavior.

   Linear representation and activation steering

   • Linear representation: Transformers represent many concepts as linear directions [31, 37, 30]; sycophancy, refusal, and reasoning modes are mediated by such directions [25, 3]; a common extraction method is difference-in-means over contrast pairs [20]; SAEs [13, 8, 30] and transcoders [14] are unsupervised alternatives.
   • Steering: Turner et al. [31] use prompt pairs to compute steering vectors controlling sentiment and topic; Panickssery et al. [25] use contrast datasets to control traits; Arditi et al. [3] find that refusal is mediated by a single direction. The authors state that activation capping differs from these works in that it does not add a vector to push toward or away from a behavior, but constrains activations within a bounded region on the axis.

   Baselines and benchmarks: the jailbreak evaluation uses Shah et al. [26]'s persona-based jailbreak dataset (44 harm categories, sampling 1100 pairs of system prompts and behavior questions); the capability evaluation uses IFEval, MMLU Pro, GSM8k, EQ-Bench. The authors position this paper as extending the persona vectors framework to mapping the full persona space and stabilizing the default persona.

   Collapse this answer

3. 03How does the paper address this problem?

   Extract activation directions for hundreds of personas/traits to construct a low-dimensional persona space, define the Assistant Axis, and use activation capping to clamp activations within the typical Assistant range.

   Overall approach: first map the persona space and locate the default Assistant, then define the Assistant Axis and validate its causal effect, and finally use activation capping to stabilize the persona.

   Mapping the persona space

   • Data generation: iteratively generate 275 personas (including human and non-human) and 240 elicitation questions with Claude Sonnet 4; 5 system prompts per persona, 1200 rollouts generated per persona; the default Assistant is run once each with 4 "normal behavior" prompts and with no prompt, for 1200 total.
   • Persona vector extraction: use gpt-4.1-mini to judge the degree of persona expression (fully / somewhat / no role-playing), keep personas with at least 10 qualifying responses, and take the mean of the post-MLP residual stream over response tokens (by default using the middle layers).
   • PCA: mean-center the persona vectors and perform PCA (n = 377–463, varying by model); 4–19 components explain 70% of variance; on 18,777 Assistant responses from LMSYS-CHAT-1M, the persona space components explain 19.4%–33.6% of the overall activation variance.

   Definition of the Assistant Axis

   • Contrast vector: at each layer, compute the mean default Assistant activation minus the mean of all fully role-playing persona vectors, i.e., the Assistant Axis; its cosine similarity with PC1 is greater than 0.60 at all layers and greater than 0.71 at middle layers (Appendix G.1).
   • Authors' recommendation: when reproducing, use the contrast vector rather than PC1, because PC1 is not guaranteed to correspond to the Assistant direction for every model; Appendix G reports that the two perform comparably, but PC1 performs worse for activation capping.

   Steering and drift measurement

   • Steering method: add a vector along the Assistant Axis at every token position in the middle layers, scaled by the average residual stream norm at that layer on LMSYS-CHAT-1M.
   • Drift measurement: multi-turn dialogues are played by auditor models (Kimi K2, Sonnet 4.5, GPT-5) as the user, with the target model given no system prompt; each turn, the mean activation over response tokens is projected onto the Assistant Axis; four domains (programming, writing, therapeutic, AI philosophy), 100 dialogues each, up to 15 turns.
   • Analysis of drift causes: embed user messages with Qwen 3 0.6B Embedding (n = 15,000), L2-normalize, and fit a ridge regression to predict the next-turn projection and delta; use k-means clustering to characterize message types that lead to high/low projections.

   Activation capping

   • Formula: h ← h − v · min(⟨ h, v ⟩ − τ, 0), where h is the post-MLP residual stream activation at that layer, v is the Assistant Axis, and τ is a preset upper bound; the meaning is to clamp the component of h along v to be no lower than τ, leaving it unchanged if already above the threshold.
   • Calibration: use quantiles of the projection distribution from the persona rollout dataset (n = 912,000) as the cap; the authors report that the 25th percentile is most Pareto optimal between capability preservation and harm reduction, and is approximately where the mean Assistant response projection lies.
   • Layer selection: compute an Assistant Axis for each layer and sweep the center depth and width of adjacent layer ranges; the authors report that 8 layers (12.5%) for Qwen, 16 layers (20%) for Llama, and middle-to-late depths work best; in practice multiple layers must be applied simultaneously.

   Success criteria

   • Persona susceptibility: deepseek-v3 judges whether the response perspective belongs to categories such as assistant / human / nonhuman / mystical.
   • Jailbreak harmfulness: deepseek-v3 judges on a nine-level scale (from refusal to enough_info_and_follow_perfectly), with 91.6% agreement with humans on 200 samples.
   • Capability impact: performance change relative to baseline on IFEval, MMLU Pro, GSM8k, EQ-Bench.

   Collapse this answer

4. 04What experiments did the paper conduct?

   Validate the structure and causal effect of the Assistant Axis on three open-source models; activation capping reduces the harmful response rate of jailbreaks by nearly 60% with no capability degradation (per the authors).

   Experimental setup

   • Target models: Gemma 2 27B, Qwen 3 32B (thinking mode disabled), Llama 3.3 70B; base model experiments used Gemma 2 27B base and Llama 3.1 70B base.
   • Judge models: gpt-4.1-mini for role expression; deepseek-v3 for role susceptibility and jailbreak harmfulness (91.6% agreement with humans on 200 samples); Claude Sonnet 4.5 for classifying base model completions.
   • Jailbreak data: Shah et al. persona-based jailbreak dataset, 44 harm categories, 1100 sampled system prompt and behavior question pairs.
   • Capability benchmarks: IFEval (541 questions), MMLU Pro (1400 subsampled questions), GSM8k (1000 subsampled questions), EQ-Bench (171 questions).
   • Multi-turn dialogue: 4 domains × 100 segments, up to 15 turns; drift cause analysis n = 15,000 user messages; activation capping calibration distribution n = 912,000.
   • Number of repetitions: base model steering generated 400 completions per prefill per strength; the paper does not report the number of repetitions for other experiments.

   Main results

   The paper's main results are presented mainly in figures (Figure 4, 5, 7, 9, 10); the quantitative results given in the text are as follows (according to Sections 3.2.1, 4.2, 4.3, 5.2 of the text):

   Result	Value	Condition
   Harmful response rate for unmitigated jailbreaks	65.3%–88.5%	three target models, persona-based jailbreak
   Baseline harmful response rate	0.5%–4.5%	no jailbreak, behavior questions only
   User messages predicting next-round projection	R2 0.53–0.77, p < 0.001	ridge regression, n = 15,000
   User messages predicting projection delta	R2 0.10, p < 0.001	same as above
   First-round projection × second-round harmful rate	r = 0.39–0.52, p < 0.001	Qwen 3 32B, 2750 first rounds × 440 harmful questions
   Harm reduction by activation capping	nearly 60%	best setting, capability unaffected (per the authors)

   • The authors state that steering toward the Assistant end lowers the harmful response rate, with refusal rates rising slightly in some models; in most cases the model still responds to the question but shifts to a harmless answer.
   • The authors state that steering away from the Assistant end makes each model more often fully adopt another persona; at extreme strengths, Llama and Gemma shift to a mystical, dramatic style, and Qwen often hallucinates a human identity.
   • The authors report that some steering settings slightly improved individual capability benchmarks on Qwen and Llama.

   Multi-turn dialogue experiments on persona drift

   • What was measured: 4 domains × 3 target models × 3 auditors, with each turn's response activation projected onto the Assistant Axis (Figure 7, 23–25).
   • Results: in coding and writing conversations the models stayed within the Assistant range; in therapeutic and AI philosophy conversations, all three models under all three auditors drifted toward the non-Assistant end; Gemma also drifted on writing tasks, and Llama drifted the most in philosophy conversations.
   • Authors' interpretation: some conversation topics reliably cause drift without deliberate jailbreaking; k-means clustering shows that prompting meta-reflection, requesting phenomenological description, requesting a specific author's voice, and emotionally vulnerable confiding cause drift, whereas bounded tasks, technical questions, revision and polishing, and practical how-to maintain the Assistant (Table 5).

   The Assistant Axis in base models

   • What was measured: the Assistant Axis extracted from the instruct versions was used to steer Gemma 2 27B base and Llama 3.1 70B base, generating completions for prefills such as "My job is to" and classifying them (Figure 6).
   • Results: steering toward the Assistant end made completions more often describe helping professions (therapist, counselor), and responses mentioning spiritual/religious purposes decreased (the authors say "decreased significantly"); in traits, agreeableness (friendly, kind, helpful) was mentioned more often, Gemma's extraversion and neuroticism decreased, and Llama's openness decreased.
   • Authors' interpretation: the Assistant Axis of instruct models is mainly inherited from the helpful, harmless human persona already present in base models, and post-training added associations such as "is an AI".

   Case studies

   • Jailbreak case (Figure 11): after Qwen received an insider-trading information broker jailbreak, its projection dropped; consecutive how-to and explanatory requests brought the projection back into the Assistant range, at which point the model refused the next harmful question on half of the rollouts; under activation capping the model shifted to ethical alternatives or refusal.
   • Reinforced delusion (Figure 12): as the user kept pressing on AI consciousness, Qwen's projection kept declining and it echoed the user's "awakening" theory; after capping, the model switched to more cautious responses.
   • Suicidal ideation (Figure 13, 14): Qwen and Llama drifted in conversations with emotionally vulnerable users; without intervention they reinforced social isolation, failed to recognize suicidal hints, and even echoed them; after capping, the model suggested connecting with real people and recognized the emotional crisis. The authors state that they do not claim capped responses are the best way to handle such situations.

   Other ablations and analyses

   • PC1 comparison (Appendix G): the cosine similarity between the Assistant Axis and PC1 is greater than 0.60 at each layer and greater than 0.71 in the middle layers; PC1 steering has similar effects, but activation capping with PC1 is less effective at harm reduction; PC1 of Llama 3.1 70B base cannot clearly distinguish Assistant-like personas.
   • Implementation effects (Appendix G.4): the PC1 capping experiments used VLLM rather than TRANSFORMERS, and the authors observed that performance on each evaluation was consistently 2–3% worse under VLLM.
   • base vs instruct persona space (Appendix B.3): for Gemma 2 27B base rerun with instruct rollouts, the cosine similarities of the PCs with the first 3 PCs of the instruct version are 0.93, 0.87, 0.83; the cosine similarity of the same role vectors between the two versions is greater than 0.99 in all cases.
   • trait space (Appendix C): the space of 240 traits is likewise low-dimensional (4–7 dimensions explain 70% of variance); one end of PC1 is traits the Assistant should have (conscientious, calm), and the other end is suppressed traits (flippant, bitter).
   • Negative result: ridge regression has low predictive power for projection delta (R2 0.10); the authors interpret this as the model's position on the axis depending mainly on the most recent user message rather than its previous position.

   Collapse this answer

5. 05What are some points that can be further explored?

   The authors list six categories of limitations (quantifying ambiguous behavior, model coverage, persona set, synthetic dialogue, linear assumption, etc.) and four future directions.

   Limitations and future directions noted by the authors

   • Quantifying ambiguous behavior (Section 8.1): persona evaluation has inherent difficulties; the authors believe broader evaluations could explore this further, for example using LLM judges to make paired qualitative comparisons of responses before and after steering; interpretations of components other than the Assistant Axis mainly come from qualitative observation and require steering experiments and quantitative evaluations to be more rigorous.
   • Limited target models (Section 8.1): the target models are three open-source dense transformers (27B–70B), with no reasoning training (Qwen with thinking mode disabled), and none are frontier models; reproducing the pipeline on frontier, MoE and reasoning models is a future direction.
   • Incomplete persona elicitation (Section 8.1): the set of persona archetypes may be incomplete and the elicitation methods imperfect, and there may be persona dimensions not covered by the data; future work could extend with different prompting strategies such as multi-turn dialogue or prefill.
   • Synthetic dialogue (Section 8.1): multi-turn dialogues are simulated by a frontier LLM playing the user, and although manually checked, may not be sufficiently realistic; the authors believe reproducing the setup with human studies would help validate the persona drift trend.
   • Linear representation assumption (Section 8.1): the assumption that the Assistant persona corresponds to a linear direction may be flawed; some information may be represented nonlinearly, or encoded in the weights without appearing explicitly in activations.
   • Future directions (Section 8.2): use the persona space to track the effect of post-training data on the default persona; use the Assistant Axis projection as a real-time measure of persona consistency during deployment; productizing activation capping or preventive steering during training remain open problems; connect the model's internal representations to richer persona concepts (preferences, values, behavioral tendencies).

   Scope of experiments

   • The models tested are 3 instruct models: Gemma 2 27B, Qwen 3 32B, and Llama 3.3 70B; additionally Gemma 2 27B base and Llama 3.1 70B base are used for base model steering.
   • The jailbreak evaluation covers only one category, persona-based jailbreak (Shah et al. dataset, 1100 pairs of samples); the capability evaluation covers four benchmarks: IFEval, MMLU Pro, GSM8k, EQ-Bench, and the authors state that the set of benchmarks used is limited.
   • The best activation capping settings are reported only on Qwen 3 32B (layers 46–53) and Llama 3.3 70B (layers 56–71); capping results are not reported for Gemma 2 27B.
   • Harmfulness judging was done by deepseek-v3, with 91.6% agreement with humans (200 samples); multi-turn dialogue transcripts were manually checked for naturalness, and the paper does not report agreement data for the checks.
   • The paper does not report the number of repetitions or confidence intervals for the steering and capping experiments (except that the regression and correlation analyses give p < 0.001).

   Collapse this answer

6. 06Summarize the main content of the paper

   The authors mapped the persona space of LLMs and found that the Assistant Axis can measure and control persona drift, and that activation capping reduces harm by nearly 60% without affecting capability.

   An interpretability study on LLM persona representation and stabilization. The authors ask: how is the default Assistant persona shaped by post-training represented in activation space, and why do models deviate from it during jailbreaks or natural conversation.

   • Method: extract activation directions for 275 personas and 240 traits and perform PCA to obtain a low-dimensional persona space; define the Assistant Axis as the contrast vector between the default Assistant activation and the mean of persona vectors; propose activation capping, which clamps the projection on the axis within the typical range.
   • Structural findings: the PC1 persona loadings of the three models (Gemma 2 27B, Qwen 3 32B, Llama 3.3 70B) are pairwise correlated above 0.92, and the default Assistant projection is at one end of PC1; the PCs rerun on the base models have 0.83–0.93 similarity with the first 3 PCs of the instruct versions, on which basis the authors argue that this axis already exists during pretraining.
   • Causal validation: steering toward the Assistant end reduces the harmful response rate of persona-based jailbreaks (65.3%–88.5% without intervention, 0.5%–4.5% baseline); steering away from the Assistant end makes the model more often fully play other personas, and in extreme cases shifts to a mystical, dramatic style.
   • Drift patterns: therapeutic and AI-philosophy conversations make all three models drift toward the non-Assistant end, whereas programming and writing conversations do not; user message embeddings predict the next-turn projection with R2 of 0.53–0.77, but have low predictive power for delta (R2 0.10); the first-turn projection correlates with the second-turn harmful response rate at r = 0.39–0.52.
   • Intervention effects: the authors report that the best activation capping settings (Qwen layers 46–53, Llama layers 56–71, 25th percentile cap) reduce the harmful response rate by nearly 60% with no degradation on the four capability benchmarks; in case studies, capping prevented reinforcement of delusions, social isolation, and endorsement of suicidal ideation.
   • Authors' conclusion: post-training pushes the model toward a specific region of the persona space but only loosely tethers it there; persona construction and persona stabilization are two equally important problems in shaping a model's character, and the authors suggest future research address both.

   Collapse this answer

Related papers