Projection as early warning: reading the persona before it speaks
A tool built to push a model's behavior in a chosen direction turns out to work just as well left alone: read the same direction against the model's current activations, without adding anything, and it predicts what the model is about to do, or what a training run has already done to it.
The page follows that one reading, a dot product between an activation and a trait direction, across three moments: taken at the end of a prompt, before any response, it forecasts what's about to be generated; taken across a finetuning run, it measures how far the model's persona has already shifted; taken against a training dataset before any training happens, it flags risk earliest of all.
Every quantity in this theme is the same operation -- a dot product between an activation and a persona vector, the residual-stream direction for a personality trait -- read at a different point in the model's life. Projection-based monitoring of prompt-induced persona shifts takes that dot product at the final token of a prompt, before the model has generated anything, and finds it correlates strongly (r=0.75-0.83) with the trait expression score of the response that follows. The paper validates this deployment-time monitor against two elicitation methods that push a model toward or away from a trait by construction: system-prompting, a custom instruction prepended to context, and many-shot prompting, which prepends dozens of trait-demonstrating exemplars instead of an instruction. The same object, read differently, becomes a training-time gauge. Finetuning shift projects the change in a model's average activation -- post-finetuning minus pre-finetuning -- onto the persona direction, and this shift predicts post-finetuning trait expression even more strongly (r=0.76-0.97) than the prompt-based projection predicts response-level expression. Projection difference pushes the same logic one step earlier still, comparing a training dataset's own response projections against the base model's natural projections on the same prompts to flag risk before any finetuning happens. Across all three settings, steering vectors are read rather than written: the same construction the corpus knows as a tool for injecting a behavior doubles here as a sensor for a shift the model has not yet, or has already, undergone.