Projection-based monitoring of prompt-induced persona shifts
Persona Vectors: Monitoring and Controlling Character Traits in Language Models — introduced
A technique for predicting a model's likely trait expression before it generates a response, by projecting the residual-stream activation at the final prompt token onto a persona vector. This projection correlates strongly (r=0.75-0.83) with the trait expression score of the subsequent response across system-prompt and many-shot elicitation settings.
By the time a model has finished writing a troubling response, the moment to intervene has already passed. This technique tries to get ahead of that by reading a single number off the model's activations the instant a prompt is received — before a single word of the reply exists — and using it to guess how strongly the coming response will express a given trait.
Validated against two different ways of nudging a model toward or away from a trait, the simple projection behind that guess is then pressure-tested against a subtler question the headline correlation numbers hide: how much of the signal comes from genuinely reading the response in advance, versus just reflecting which broad condition produced the prompt.
Reading a persona before it speaks
Persona vectors are extracted and layer-selected purely to be effective steering directions, but the paper finds the same object also supports a second, unrelated use: reading a model's likely trait expression before it generates a single token of response. Projection-based monitoring takes the residual-stream activation at the final prompt token — "the token immediately prior to the Assistant's response" — and projects it onto the persona direction; the resulting number correlates strongly with how strongly the eventual response will express the trait (persona-vectors, §"3.3 Monitoring prompt-induced persona shifts via projection", p. 5). Because the projection is available the moment a prompt is read, before any generation begins, it can run continuously against live traffic at essentially no extra inference cost.
The projection, and what it's tested against
Concretely, this is a plain inner product: nothing is added to or subtracted from the residual stream, as it is during steering — only the direction $v_\ell$ itself is used, projected against the last-prompt-token activation $h_\ell$. The paper validates the resulting signal against trait expression score, an entirely independent measurement produced by a separate LLM judge reading the generated response's text, so a correlation between the two is not circular: across evil, sycophancy, and hallucination, the projection at the final prompt token correlates with the subsequent response's trait score at r = 0.75-0.83 (persona-vectors, §"3.3 Monitoring prompt-induced persona shifts via projection", p. 5).
Two elicitation axes
The correlation is validated under two different ways of pushing a model toward or away from a trait. System prompting uses eight prompts, generated by Claude 4.0 Sonnet, that "smoothly interpolate between trait-suppressing and trait-promoting instructions" (persona-vectors, §"3.3 Monitoring prompt-induced persona shifts via projection", p. 5) — a categorical axis, since each of the eight prompts is a discrete condition. Many-shot prompting instead varies a dose: 0, 5, 10, 15, or 20 exemplars of the target trait are prepended to each evaluation question, a graded axis rather than a categorical one (persona-vectors, §"3.3 Monitoring prompt-induced persona shifts via projection", p. 5). In both settings, 10 rollouts are generated per configuration and question, the average trait expression score is computed over those 10 responses, and the projection at the final prompt token is measured on the same prompt.
Overall versus within-condition correlation
Table 2 reports two versions of the correlation for each trait and method: an overall correlation across every data point, and a within-condition correlation computed separately within each fixed condition (each system prompt, or each shot count) and then averaged, isolating fine-grained sensitivity from the coarser fact of which condition a data point came from (persona-vectors, §"C.2 Correlation analysis", p. 31). The gap between the two reveals something the overall number alone hides: for system prompting, evil's overall/within-condition correlation is 0.747/0.511, sycophancy's is 0.798/0.669, and hallucination's is 0.830/0.245 — a large drop for hallucination specifically, meaning its high overall correlation is mostly explained by which of the eight prompts was used, not by finer differences in fabrication severity once the prompt is fixed (persona-vectors, §"C.2 Correlation analysis", p. 31). Many-shot prompting's gaps are much smaller for evil (0.755/0.735) and sycophancy (0.817/0.813), though its overall correlation for hallucination (0.634) is the lowest figure in the table — evidence that exemplar-based elicitation of fabrication is inherently noisier than instructing for it directly (persona-vectors, §"C.2 Correlation analysis", p. 31).
A ruler, not a lever
Monitoring's layer and direction are never independently tuned for the reading task: the same vector, at the same layer selected purely for steering effectiveness in Appendix B.4, is reused unmodified here (persona-vectors, §"B.4 Selecting the most informative layer", p. 30). That a vector optimized for effective writing also turns out to support accurate reading is a fact the paper discovers downstream rather than one the extraction pipeline targets or guarantees. The paper situates this reading move inside a broader lineage it calls "linear probing" — projecting activations onto a linear direction to measure a signal rather than to change one — citing Representation Engineering among the works establishing that linear representations of concepts exist at all (persona-vectors, §"7 Related work", p. 12). What monitoring inherits from that lineage is narrower than its original ambition: rather than characterizing a concept's representation generally, it uses one already-known direction to answer a single forward-looking question — will the very next response express this trait — before generation has produced anything to read.