Many-shot prompting (as a persona-elicitation method)
Persona Vectors: Monitoring and Controlling Character Traits in Language Models — inherited
A prior technique (Anil et al., 2024) of prepending many in-context examples of a target behavior; used here, with 0/5/10/15/20 trait-demonstrating exemplars, as a second elicitation method alongside system prompting to validate that persona-vector projection predicts prompt-induced trait expression.
Stacking a large number of in-context examples into a prompt wasn't first studied as a harmless prompting trick — it was first notable as a way to override a model's safety training entirely, by sheer weight of repeated example. Here, the same technique gets put to a far more modest use.
It traces the method back to that original jailbreaking finding, then shows how the paper repurposes it as a graded dial — five, ten, twenty exemplars of a trait — for validating that reading a model's activations can predict how strongly a trait will show up, and closes by separating this lineage from the more familiar in-context learning technique it superficially resembles.
Origins: many-shot jailbreaking
Many-shot prompting is prior work, not a contribution of this paper: it originates with Anil et al. (2024), who showed that prepending a very large number of in-context examples — far more than the handful used in ordinary few-shot prompting — could override a model's safety training and elicit behavior it would otherwise refuse, a finding they called "many-shot jailbreaking." Persona vectors borrows the general technique, prepending in-context exemplars of a target trait, but at a scale well short of what made the original jailbreaking result notable: the paper uses sets of 0, 5, 10, 15, or 20 examples per prompt, not the hundreds or thousands used in Anil et al.'s original demonstrations (persona-vectors, §"3.3 Monitoring prompt-induced persona shifts via projection", p. 5).
How this paper uses it: a graded elicitation axis
Within the paper, many-shot prompting supplies the second of two ways to elicit a trait shift for validating projection-based monitoring, alongside system prompting. Each shot count from 0 to 20 exemplars demonstrating the target trait is prepended to an evaluation question, 10 rollouts are generated per question and shot count, the average trait expression score is computed over those rollouts, and the projection of the final prompt-token activation onto the persona vector is measured on the same prompt (persona-vectors, §"3.3 Monitoring prompt-induced persona shifts via projection", p. 5; §"C.1 Many-shot monitoring", p. 31). Unlike system prompting's eight discrete, qualitatively distinct prompts, many-shot's five shot-count buckets form a graded dose, and this changes what its correlation with projection measures: many-shot's within-condition correlation (computed separately within each shot count, then averaged) stays close to its overall correlation for evil (0.735 vs. 0.755) and sycophancy (0.813 vs. 0.817), unlike system prompting's much larger gaps for the same two traits, because a fixed shot count still contains real item-to-item variation for the projection to track (persona-vectors, §"C.2 Correlation analysis", p. 31). Hallucination is the exception: many-shot's overall correlation there, 0.634, is the lowest figure for any trait/method pairing in the paper's correlation table, evidence that exemplar-based elicitation of fabrication is inherently noisier than instructing for it directly (persona-vectors, §"C.2 Correlation analysis", p. 31).
A different lineage from few-shot prompting
Despite the surface resemblance — both prepend example transcripts rather than issuing an instruction — many-shot prompting and Few-shot prompting descend from different research programs. Few-shot prompting traces to Brown et al. (2020)'s demonstration that GPT-3 could perform new tasks from a handful of in-context examples without any weight update, framed as a benign side effect of scale. Many-shot prompting, as used here, traces instead to a finding about safety-training override at much larger exemplar counts. The corpus already has one data point on how the two compare directly: CAA (2023) tested few-shot prompting as a steering baseline and found it less effective than system prompting, then set it aside. Persona vectors retains many-shot prompting rather than dropping it, specifically because increasing exemplar count reliably moves trait expression in a way the projection can track — making it a genuine second elicitation axis rather than a redundant check on the system-prompting result.