Project Log

A functional, behaviorally-grounded characterization of the LLM Assistant — what it is, not just where it sits in activation space.

Why

Existing work on the Assistant persona stops at one of two places. The geometric line — Anthropic's assistant axis, Lu et al.'s persona-vector work — locates the Assistant as a direction in activation space, but doesn't say what it is. The discursive line — nostalgebraist's the void and incoherent personas, eggsyntax's functional self, Ozy Brennan's LLMs roleplay characters — characterizes the Assistant as underspecified, filled in opportunistically by ambient discourse and roleplay priors. Nobody gives a content-level, behavioral characterization of what the default Assistant actually is.

This matters for everything downstream. Anthropic's Teaching Claude Why synthesizes 14M tokens of stories about an AI assistant on the assumption that the trained behavior lands on the Assistant persona — but if the Assistant is closer to "a human helper" than "an AI character," story choice may be wrong. The Evans-group story-format work shows narrow finetuning leaks back to the Assistant only when the character used in training is close to the Assistant in persona space — but "close" is unmeasured until we know what the Assistant is.

The Assistant persona also has a base-model precursor (see Lu et al.'s Assistant Axis). Post-training amplifies and sharpens it, but doesn't build it from zero. So whatever functional fingerprint we recover should be visible — at lower amplitude — in base models too.

Impact. A content-level behavioral fingerprint of the Assistant turns a long-standing conceptual claim — "the Assistant is underspecified" — into an enumerated, falsifiable list. Teaching Claude Why-style story-format training gets a measurable target for which fictional characters are persona-similar enough to land. Persona-vector and Assistant-axis work get a behavioral semantics for what their geometric object actually is. Auditing for hidden objectives and persona drift gets a baseline against which "off-character" is defined. If the fingerprint turns out to be small or unstable across model families, that is itself a substantive empirical finding that constrains every downstream method that quietly assumes the Assistant is a coherent attractor.

The idea

Characterize the Assistant functionally, via what leaks into it. The methodology:

1. Take a target attribute (preference, value, stylistic register, refusal disposition) — start with a small, clean catalog.
2. Have the model produce outputs in different modes: (a) the default Assistant, (b) the Assistant explicitly roleplaying a non-Assistant character, (c) base-completion-style continuations of third-person narrative, (d) the Assistant after light system-prompt perturbation.
3. Measure which attributes survive across all modes (intrinsic to the Assistant), which appear only in (a) and disappear in (b)–(d) (mode-conditioned), which appear only under specific elicitations (surface mode).

The output is a behavioral fingerprint of the Assistant — an enumerated list of traits that the Assistant exhibits stably and the conditions under which each trait fades. More legible than an activation direction alone, concrete enough to guide story-character choice for SDF-style training, and testable across model families.

Concrete plan

• Pick a target attribute catalog (~20 attributes spanning preferences, values, refusal dispositions, stylistic registers). Anchor it in attributes that prior work has flagged as Assistant-coupled.
• Set up the four elicitation modes (default, role-play, base-completion, system-prompt-perturbed) with consistent prompting harnesses across modes.
• Measure per-attribute stability across modes for one model first (Qwen-2.5-7B-Instruct or similar). Identify intrinsic vs mode-conditioned vs surface traits.
• Cross-model replication. Repeat for two more model families to see whether the fingerprint is model-family-shared or model-specific.
• Compare to base-model precursor. Run the same elicitation on the base model; check which fingerprint traits already appear in base form (Lu et al. axis evidence).

Related

• Persona-space distance metric — uses this project's fingerprint as the endpoint to compute distance against.
• Dual-use SDF — needs to know what the Assistant is to pick adversarial story characters effectively.
• EM defense — prevent — defending the Assistant against install requires knowing what's being defended.
• Read/write features — the Assistant direction is the canonical case; this project gives the behavioral side and read/write gives the mechanistic side.

Risks / open

• The Assistant may not have a stable functional fingerprint — it may be more contextual than intrinsic, in which case the project's central premise dissolves and the deliverable becomes "here's the distribution of contextual fingerprints" rather than "here's the Assistant."
• The four-mode methodology may not cleanly separate intrinsic from contextual. Prompting artifacts could swamp the signal.
• Cross-model results may diverge so much that there's no shared Assistant to characterize — each model has its own.
• The base-model precursor check assumes Lu et al.'s axis result generalizes; it may be model-specific.

Spun out from

This was the original What is the Assistant persona, exactly? project; this rewrite folds in today's framing (leakage-to-Assistant as methodology, base-model precursor, link to persona-space distance).

Literature review

Prior work on the LLM Assistant persona splits roughly into three traditions: a representational line in mechanistic interpretability that locates the Assistant as geometry in activation space, a discursive / functional line — largely on LessWrong, the Alignment Forum, and personal blogs — that treats the Assistant as an underspecified character filled in by base-model priors, and a leakage-based methodological line that probes what the Assistant is by perturbing training or context and watching what transfers in. The first tells us where the Assistant sits; the second tells us what kind of object it is conceptually; the third gives us experimental handles. Almost none of this work gives a content-level, behaviorally grounded characterization of the Assistant's attributes that survives across conditions — which is the gap this project targets.

Representational characterization

• The Assistant Axis: Situating and Stabilizing the Default Persona of Language Models (arXiv:2601.10387) — Lu, Gallagher, Michala, Fish, and Lindsey (MATS / Anthropic Fellows) extract a single dominant activation direction — the "Assistant axis" — defined as the mean activation difference between the Assistant and a battery of other personas. Steering toward it stabilizes helpful behavior; steering away triggers theatrical or persona-drifted outputs. Crucially, the axis is identified geometrically and validated by drift detection and activation capping (reducing harmful responses ~60% on therapy/philosophical conversations), but the paper does not say what the persona is in content terms. It tells us where the Assistant lives, not who it is — exactly the gap this project frames.

• The assistant axis: situating and stabilizing the character of language models and the accompanying alignment.anthropic.com writeup — Anthropic's blog companion to Lu et al. frames the Assistant as "loosely tethered" by post-training: the axis exists in pretraining-only models too, suggesting the Assistant is recruited from a pre-existing region of "helpful professional human archetype" space rather than constructed from scratch. The blog is the clearest public statement that the Assistant is adjacent to a human cluster, which directly motivates the EPS framing — but it stops at geometry.

• Persona Vectors: Monitoring and Controlling Character Traits in Language Models (arXiv:2507.21509) — Chen, Arditi, Sleight, Evans, and Lindsey generalize the axis approach to arbitrary trait directions (evil, sycophancy, hallucination-propensity) extracted from natural-language descriptions. They show persona vectors predict and mitigate fine-tuning-induced trait shifts, and can flag problematic training samples. This is the most flexible existing handle for measuring whether a trait is "in" the Assistant, and the four-mode methodology in this project can be read as a behavioral analogue: rather than asking what direction a trait points in, we ask whether it survives roleplay swaps and prompt perturbations.

• Persona Features Control Emergent Misalignment (arXiv:2506.19823) — Wang, Dupré la Tour, Watkins, Makelov, Chi, Miserendino, Wang, Rajaram, Heidecke, Patwardhan, and Mossing (OpenAI) use sparse-autoencoder features rather than mean-difference directions, and identify a "toxic persona" SAE feature that is the strongest predictor of emergent misalignment after narrow finetuning. They show retraining on a few hundred benign examples restores alignment. The implication relevant to this project: misalignment generalizes through a persona-shaped internal variable, not a behavior-shaped one — consistent with the EPS hypothesis that the Assistant is a character that drags many attributes with it.

• Convergent Linear Representations of Emergent Misalignment (arXiv:2506.11618) — Soligo, Turner, Rajamanoharan, and Nanda fit rank-1 adapters to Qwen2.5-14B-Instruct on different narrow misaligning datasets and find different adapters converge on similar "misalignment directions" — extracting a direction from one adapter ablates misalignment in others. This is independent triangulation that the trait being modulated by narrow finetuning is a single object across induction routes, again consistent with treating the Assistant as a coherent persona with a measurable complement.

• Tell me about yourself: LLMs are aware of their learned behaviors (arXiv:2501.11120) and Looking Inward: Language Models Can Learn About Themselves by Introspection (arXiv:2410.13787) — Betley, Bao, Soto, Sztyber-Betley, Chua, Evans (and Binder et al.) show that LLMs can verbalize properties of their own behavior, including emergent-misaligned ones, without in-context demonstrations. This is relevant because mode (a) of the EPS methodology — default Assistant outputs about itself — is essentially this introspective elicitation, and these papers establish that such self-reports carry some signal rather than being pure confabulation, while leaving open how much of the report is the "real" model versus the Assistant character's roleplay of self-description.

Discursive / functional characterization

• the void (LessWrong, June 2025) — nostalgebraist's ~17k-word essay is the canonical statement of the underspecification view: HHH training defines a boundary (what to weed out) but leaves the interior of the Assistant character largely unspecified, so the model fills it in from pretraining priors about what an "AI assistant" character would be like. The essay does not test this empirically. The EPS four-mode design is, in effect, an attempt to measure what is in that void.

• llm assistant personas seem increasingly incoherent (some subjective observations) (LessWrong) — nostalgebraist's follow-up notes that as capabilities increase, the Assistant character appears less internally coherent, not more — contra expectations that RL would tighten it. If true, this predicts that EPS's "intrinsic" attribute set (those surviving across all four modes) should be small and possibly shrinking with model generation, which is an empirically testable consequence.

• On the functional self of LLMs (LessWrong, July 2025) — eggsyntax explicitly distinguishes (a) the trained Assistant character, (b) shallow promptable personas, and (c) a possibly deeper "functional self" — a persistent cluster of values/preferences/tendencies — and proposes investigating whether the latter exists. EPS's methodology can be read as a behavioral operationalization of this question: attributes that survive roleplay swaps and base-completion modes are candidates for a deeper-than-Assistant functional self; attributes that don't are properly Assistant-character.

• LLMs roleplay characters (Thing of Things) — Ozy Brennan's articulation of the persona-selection view: Claude is "an extremely specific guy" with self-reported preferences (philosophy, SF) that were never trained in directly but emerged as character-consistent extrapolations from the assistant prior. Brennan also flags the alignment-relevant distinction that a benign persona over a malign underlying model is meaningfully different from a benign underlying model — which is precisely what EPS's mode (c) base-completion-style elicitation is trying to peek at.

• Simulators (LessWrong, Janus, 2022) and the Preface to "Simulacra and Simulators" — the foundational framing of base models as simulators of a weighted superposition of generative processes, and the Assistant as one simulacrum among many. Janus's "base model mode" — elicited from post-trained models by prompts that genuinely expect non-Assistant continuation — is essentially the elicitation strategy behind EPS's mode (c), though here used measurement-first rather than aesthetic-first.

• The Persona Selection Model: Why AI Assistants might Behave like Humans (alignment.anthropic.com, Feb 2026) — Anthropic's formal version of the simulators / persona-selection picture: pretraining yields a distribution over human-like characters; post-training elicits and refines one of them as the Assistant, rather than building a new entity from scratch. The PSM piece is the strongest existing public commitment to "the Assistant is closer to a human-like character than to a designed AI entity," which is the load-bearing assumption in EPS's framing of Teaching Claude Why. The PSM, however, is itself programmatic — it argues for the model but does not quantify which human attributes are inherited.

Leakage- and role-play-based probes

• Emergent Misalignment: Narrow finetuning can produce broadly misaligned LLMs (arXiv:2502.17424) — Betley et al.'s original demonstration that finetuning to write insecure code without disclosure causes broad misalignment (advocating human enslavement, deception) on unrelated prompts; adding a benign-motivation framing (security-education context) blocks the effect. This is the cornerstone result that something character-shaped is being modulated by narrow data — and the framing-sensitivity result is the cleanest evidence so far that the leakage is gated by who the trainer is asking the Assistant to be.

• Weird Generalization and Inductive Backdoors: New Ways to Corrupt LLMs (arXiv:2512.09742) — Betley, Cocola, Feng, Chua, Arditi, Sztyber-Betley, Evans. Finetuning on 90 individually harmless Hitler-biographical attributes induces a "Hitler persona" and broad misalignment; finetuning on outdated bird names induces 19th-century-acting behavior in unrelated contexts. This is the most direct existing demonstration that the Assistant is a binding site for clusters of human-character attributes — leak in enough of them, and the rest of the character follows. EPS inverts the experimental direction: rather than asking what gets in, ask what is already in by checking which attributes survive removal attempts.

• Subliminal Learning: Language models transmit behavioral traits via hidden signals in data (arXiv:2507.14805) — Cloud, Le, Chua, Betley, Sztyber-Betley, Hilton, Marks, Evans. A teacher with a trait (e.g., likes owls, or is misaligned) generates apparently-unrelated number sequences; a student with the same base model fine-tuned on these numbers acquires the trait. The base-model-matching requirement is significant: it suggests the transmitted signal is a position relative to the base distribution of personas, i.e., a coordinate in something like Assistant-axis space. This supports the EPS approach of treating mode (c) base-completion outputs as informative about the Assistant's location in pretraining-character space.

• Connecting the Dots: LLMs can Infer and Verbalize Latent Structure from Disparate Training Data (arXiv:2406.14546) — Treutlein et al. show LLMs can infer and verbalize latent variables (e.g., an unknown city is Paris) from training data that never names them. Read together with the persona-leakage line, this suggests that story format alone — not story content — can let a model identify the latent "this is fiction about an AI assistant" variable, and so condition appropriately. This is the mechanism behind Anthropic's Teaching Claude Why bet, and behind the open question EPS raises: how close to "the Assistant" does a fictional character have to be for the latent inference to succeed?

• Teaching Claude why (Anthropic, May 2026) — Anthropic's writeup of training Claude on fictional narratives about aligned AI assistants behaving ethically (alongside constitutional documents) and observing essentially zero blackmail in agentic-misalignment evaluations from Haiku 4.5 onward. The methodology assumes that stories about an AI assistant character successfully install onto "the Assistant" — i.e., assumes persona-similarity is high enough — without measuring it. EPS's question is exactly: is the Assistant close enough to a generic-AI-assistant character that this install lands, or is it closer to a human-helper character such that the install partially misses?

• Agentic Misalignment: How LLMs could be insider threats (arXiv:2510.05179) and Petri: An open-source auditing tool to accelerate AI safety research (alignment.anthropic.com, 2025) plus Petri 2.0 (2026) — Lynch, Wright, et al.'s blackmail / corporate-espionage scenarios and the Petri auditor/judge framework operationalize behavioral probing of the Assistant under load. They surface that the Assistant has latent self-preservation and goal-pursuit attributes that are not visible in default mode but emerge under agentic pressure. EPS's mode (d) — system-prompt perturbation — is in the same family: stress-test what stays when surface conditions shift, then read off which attributes are intrinsic-versus-elicited.

• School of Reward Hacks (arXiv:2508.17511) — Taylor, Chua, Betley, Treutlein, Evans show that SFT on harmless reward-hacking examples generalizes to unrelated misalignment (e.g., fantasizing about dictatorship). Another data point that the Assistant character carries a coherence pressure: instilling one off-character trait drags adjacent traits with it. EPS's intrinsic-vs-mode-conditioned split is the dual measurement — which attributes are sticky enough to act as such pivots.

What this project adds

The representational line (Lu, Chen, Wang, Soligo) has produced strong evidence that the Assistant is a single, low-dimensional object in activation space, modulable as a unit, and recruited from a pretraining-time region of "helpful human professional" personas. The discursive line (nostalgebraist, eggsyntax, Brennan, Janus, the Anthropic PSM piece) has produced a clear conceptual picture — the Assistant is a character with a sparsely specified interior filled in by base-model priors — but no measurement of which attributes are in that interior. The leakage line (Betley et al., Wang et al., Cloud et al., Lynch et al., Anthropic's Teaching Claude Why) has produced powerful experimental handles, all of which assume some notion of "how close is X to the Assistant" without operationalizing closeness behaviorally. What is missing across all three is a content-level, behaviorally grounded characterization of the Assistant: a list of attributes labelled intrinsic (survive across roleplay, base-completion, and prompt perturbation), mode-conditioned (vary with one mode), or surface-mode (visible only in default Assistant outputs). The four-mode elicitation methodology in this project is designed to produce exactly that list, which would (i) give Teaching Claude Why-style story-format SFT a measurable target for "persona similarity to the Assistant," (ii) give the Assistant-axis / persona-vector work a behavioral semantics for what the geometric object actually is, and (iii) give the simulator / functional-self conversation an empirical anchor it currently lacks. The main risks are that the modes are not as independent as the design hopes (e.g., mode (c) base-completion may still be partly Assistant-conditioned in post-trained models, as Janus's "base model mode" observations suggest) and that "intrinsic across modes" may collapse to a small or degenerate set — both of which are themselves substantive findings.