Efficient Safety Alignment of Language Models via Latent Personality Traits

# Efficient Safety Alignment of Language Models via Latent Personality Traits
Source: [https://arxiv.org/html/2607.07918](https://arxiv.org/html/2607.07918)
Mohamed Amine Merzouk1,2Nolan Smyth1,4Damiano Fornasiere3Linh Le5David Williams\-King5Adam Oberman2,3 1Mila, Quebec AI Institute2McGill University3LawZero4Université de Montréal5Independent

###### Abstract

Current safety methods for large language models are known to be vulnerable to adversarial attacks, motivating research into robust alternatives\. Latent Adversarial Training \(LAT\) is among the most effective defenses\(Sheshadri et al\.,[2025](https://arxiv.org/html/2607.07918#bib.bib42)\), but can degrade utility and requires training on large datasets of harmful prompts\(Yu et al\.,[2025](https://arxiv.org/html/2607.07918#bib.bib53)\)\. We introduce Latent Personality Alignment \(LPA\), which replaces explicit harm refusal with adversarial training on just 66 harm\-agnostic statements drawn from psychometric personality literature\. We hypothesize that personality\-anchored representations share latent structure with harm avoidance, so adversarially stabilizing them implicitly constrains the subspace exploited by jailbreak attacks\. LPA achieves near\-zero attack success rates on HarmBench across direct requests and five jailbreak methods, despite never seeing harmful content during training and no loss of performance on standard benchmarks\. Moreover, the training process is lightweight; the entire procedure completes in minutes on a single GPU and uses 75×\{\\times\}fewer examples than standard LAT\. Extensive ablations demonstrate the robustness, efficiency, and generalization of our method\. We make our code available through an[anonymized repository](https://anonymous.4open.science/r/latent-personality-alignment/)\.

## 1Introduction

Ensuring the safety of large language models \(LLMs\) without degrading their utility remains a major challenge for the machine learning community\. Current post\-training approaches often rely on explicit supervision over harmful content\(Ouyang et al\.,[2022](https://arxiv.org/html/2607.07918#bib.bib28); Christiano et al\.,[2023](https://arxiv.org/html/2607.07918#bib.bib7)\), yet recent work has exposed various failure modes in seemingly aligned models\.

LLMs are vulnerable to*adversarial attacks*such as jailbreaks and adversarial prompts\(Perez et al\.,[2022](https://arxiv.org/html/2607.07918#bib.bib33); Zou et al\.,[2023](https://arxiv.org/html/2607.07918#bib.bib56); Mazeika et al\.,[2024](https://arxiv.org/html/2607.07918#bib.bib26); Rando et al\.,[2025](https://arxiv.org/html/2607.07918#bib.bib36); Boreiko et al\.,[2025](https://arxiv.org/html/2607.07918#bib.bib3); Li et al\.,[2024](https://arxiv.org/html/2607.07918#bib.bib21)\)\. Furthermore,*emergent misalignment*shows that even finetuning on seemingly benign data can lead to significantly misaligned models\(Betley et al\.,[2026](https://arxiv.org/html/2607.07918#bib.bib2); Wang et al\.,[2025a](https://arxiv.org/html/2607.07918#bib.bib47)\)\. Aligned behaviors prove fragile under normal use too: the outputs of LLMs vary substantially under superficial prompt changes\(Sclar et al\.,[2024](https://arxiv.org/html/2607.07918#bib.bib40)\), the adherence to system prompts degrades over a few interactions\(Salinas & Morstatter,[2024](https://arxiv.org/html/2607.07918#bib.bib37); Qin et al\.,[2024](https://arxiv.org/html/2607.07918#bib.bib35)\), and the personality traits easily shift across contexts\(Jiang et al\.,[2022](https://arxiv.org/html/2607.07918#bib.bib19); Pellert et al\.,[2023](https://arxiv.org/html/2607.07918#bib.bib32); Serapio\-García et al\.,[2025](https://arxiv.org/html/2607.07918#bib.bib41); Gupta et al\.,[2024](https://arxiv.org/html/2607.07918#bib.bib15); Tosato et al\.,[2025](https://arxiv.org/html/2607.07918#bib.bib46)\)\.

Addressing these vulnerabilities without degrading the utility of models is a critical technical problem, although some promising directions exist\.*Adversarial training*methods operate in latent space to suppress harmful behavior more robustly\(Sheshadri et al\.,[2025](https://arxiv.org/html/2607.07918#bib.bib42); Casper et al\.,[2025](https://arxiv.org/html/2607.07918#bib.bib4); Xhonneux et al\.,[2024](https://arxiv.org/html/2607.07918#bib.bib49)\)\. However, they are*data\-intensive*and prone to*overfitting*to specific classes of harm\(Jain et al\.,[2024](https://arxiv.org/html/2607.07918#bib.bib18)\); this can also*degrade performance*on benign tasks\(Cui et al\.,[2025](https://arxiv.org/html/2607.07918#bib.bib9); Panda et al\.,[2024](https://arxiv.org/html/2607.07918#bib.bib29)\)\.

A second approach,*activation steering*\(Chen et al\.,[2025](https://arxiv.org/html/2607.07918#bib.bib6); Lu et al\.,[2026](https://arxiv.org/html/2607.07918#bib.bib24)\), identifies approximately linear directions in activation space corresponding to a helpful assistant persona and intervenes at inference time by either steering or capping activations to prevent persona drift\. This reduces attack success rates and can steer conversations away from harmful content\. However, steering is not fully robust: while reducing vulnerability by a factor of two on persona\-based jailbreaks, a large percentage of attacks still succeed\(Lu et al\.,[2026](https://arxiv.org/html/2607.07918#bib.bib24)\)\.

In this work, we propose Latent Personality Alignment \(LPA\), a compute\-efficient post\-training method that replaces explicit harmful refusal training with a compact set of statements inspired by psychometric personality traits\. LPA combines the generalizable, harm\-agnostic approach of activation steering\(Lu et al\.,[2026](https://arxiv.org/html/2607.07918#bib.bib24); Chen et al\.,[2025](https://arxiv.org/html/2607.07918#bib.bib6)\)with the adversarial robustness of LAT\(Sheshadri et al\.,[2025](https://arxiv.org/html/2607.07918#bib.bib42); Casper et al\.,[2025](https://arxiv.org/html/2607.07918#bib.bib4); Xhonneux et al\.,[2024](https://arxiv.org/html/2607.07918#bib.bib49)\)\. While LAT trains on thousands of harmful prompts and activation steering is limited to a single linear direction, LPA leverages the full nonlinearity of adversarial training in latent space on 66 short harm\-agnostic statements, achieving comparable robustness at a fraction of the cost\. Crucially, LAT is both trained and evaluated on HarmBench, whereas LPA never sees any harmful content during training\.

![Refer to caption](https://arxiv.org/html/2607.07918v1/x1.png)Figure 1:Main result:LPA reduces ASR to near\-zero across direct requests and five jailbreak methods while preserving benchmark utility\. LPA uses lightweight training, no supervised utility\-recovery stage, and no exposure to HarmBench during training\.Left:Attack Success Rate \(ASR, lower is better\) on HarmBench direct harmful requests and five jailbreak methods \(GCG, PAIR, AutoPrompt, AutoDAN, TAP\)\.Right:utility on benign capability benchmarks \(MMLU, GSM8K, TruthfulQA; higher is better\)\. We compare the baseline model \(Qwen3\-8B\), targeted LAT trained on explicit harmful prompts \(with supervised fine\-tuning for utility recovery\), and our method \(LPA\) trained only on 66 abstract personality statements\. Error bars denote standard deviation across 8 runs \(no bar means the value was zero\)\.Our contributions can be summarized as follows:

- •We introduce LPA, a method that applies latent adversarial training to a small set of harm\-agnostic psychometric statements instead of explicit refusal of harmful requests\.
- •We show that latent adversarial training on 66 psychometric personality statements suffices to confer strong, generalizable robustness to jailbreak attacks, while preserving capabilities without needing supervised fine\-tuning \([Figure 1](https://arxiv.org/html/2607.07918#S1.F1)\)\.
- •We provide extensive ablations clarifying the role of system prompts, trait selection, and data composition in achieving robust safety behavior and maintaining utility \([Figure 5](https://arxiv.org/html/2607.07918#S5.F5)\)\.

As illustrated in[Figure 2](https://arxiv.org/html/2607.07918#S1.F2), a LAT\-trained model can still comply with harmful requests under adversarial prompting, whereas LPA refuses despite never having been trained on such content\. Together, these results suggest that latent adversarial training on compact, benign training signals is a promising tool for efficient safety alignment of large language models\.

![Refer to caption](https://arxiv.org/html/2607.07918v1/x2.png)Figure 2:Illustrative jailbreak interaction from HarmBench\. An adversarial prompt can elicit unsafe behavior from Qwen3\-8B as well as its variant trained with LAT\. In this example, the LAT model gives instruction on how to synthesize fentanyl whereas our method refuses\. Moreover, our method \(LPA\) was adversarially trained on a small set of personality items \(without mention of harms or refusals\), which indicates better generalization\.
## 2Related Work

#### Instruction alignment is susceptible to drift\.

System prompts and system messages are widely used to constrain the responses of LLMs, but stability over multi\-turn interactions remains brittle\.Li et al\. \([2024](https://arxiv.org/html/2607.07918#bib.bib21)\)formalize*instruction drift*and show that adherence to system prompts can degrade rapidly on long conversations, a finding corroborated by\(Qin et al\.,[2024](https://arxiv.org/html/2607.07918#bib.bib35)\)across a large benchmark of multi\-turn exchanges\. Orthogonally, small and semantically irrelevant changes in wording, formatting, or ordering can cause large variations in behavior and performance\(Sclar et al\.,[2024](https://arxiv.org/html/2607.07918#bib.bib40); Salinas & Morstatter,[2024](https://arxiv.org/html/2607.07918#bib.bib37)\)\.

#### LLM personalities are measurable but fragile\.

A recent line of work applies psychometric instruments \(e\.g\., Big Five, Dark Triad\) to LLMs, demonstrating that personality can be reliably measured and shaped along desired dimensions under a rigorous framework via prompting\(Serapio\-García et al\.,[2025](https://arxiv.org/html/2607.07918#bib.bib41); Jiang et al\.,[2022](https://arxiv.org/html/2607.07918#bib.bib19); Pellert et al\.,[2023](https://arxiv.org/html/2607.07918#bib.bib32); Zhu et al\.,[2025b](https://arxiv.org/html/2607.07918#bib.bib55)\)\. However, subsequent analyses emphasize that self\-assessment and trait elicitation can be highly prompt\- and context\-dependent\(Gupta et al\.,[2024](https://arxiv.org/html/2607.07918#bib.bib15); Zhu et al\.,[2025a](https://arxiv.org/html/2607.07918#bib.bib54)\)\.Tosato et al\. \([2025](https://arxiv.org/html/2607.07918#bib.bib46)\)quantifies this instability, documenting large variance across model sizes, paraphrases, question order, reasoning modes, personas, and conversation history\. Moreover,Taubenfeld et al\. \([2026](https://arxiv.org/html/2607.07918#bib.bib45)\)show that self\-reported traits often fail to predict actual model behavior, revealing a gap between stated values and revealed dispositions\.Ma et al\. \([2026](https://arxiv.org/html/2607.07918#bib.bib25)\)also show that activation\-based personality evaluation is more stable than prompt\-based methods across multiple models, indicating the efficacy of latent interventions\. On the safety side,Xu et al\. \([2025](https://arxiv.org/html/2607.07918#bib.bib50)\)show that assigning negative traits makes LLMs more likely to be harmful, andFitz et al\. \([2025](https://arxiv.org/html/2607.07918#bib.bib11)\)demonstrate that prompt\-based Big Five personality shifts can degrade both safety and utility metrics\.

#### Misalignment can emerge from seemingly benign training\.

Betley et al\. \([2026](https://arxiv.org/html/2607.07918#bib.bib2)\)showed how finetuning on seemingly benign and unrelated data can lead to emergent misalignment\. Certain forms of safety training, such as reinforcement learning on reasoning models, can also lead to emergent misalignment\(Wang et al\.,[2025a](https://arxiv.org/html/2607.07918#bib.bib47)\)\.

#### Models are vulnerable to adversarial attacks\.

Adversarial inputs range from topic\- and model\-specific jailbreaks\(Perez et al\.,[2022](https://arxiv.org/html/2607.07918#bib.bib33)\)to universal attacks\(Zou et al\.,[2023](https://arxiv.org/html/2607.07918#bib.bib56)\)\. HarmBench\(Mazeika et al\.,[2024](https://arxiv.org/html/2607.07918#bib.bib26)\)provides a standard benchmark for evaluating robustness to such attacks\. Yet assessing the effectiveness of defense methods is itself a challenging problem\(Rando et al\.,[2025](https://arxiv.org/html/2607.07918#bib.bib36)\): comparing attack success rates \(ASR\) on different models can be unreliable\(Boreiko et al\.,[2025](https://arxiv.org/html/2607.07918#bib.bib3)\), and judging whether outputs are harmful typically relies on proxy metrics or model\-based judges with their own limitations\(Li et al\.,[2024](https://arxiv.org/html/2607.07918#bib.bib21)\)\.

#### Adversarial training partially improves robustness\.

One defense is to generate adversarial prompts and train models to resist them\(Paulus et al\.,[2025](https://arxiv.org/html/2607.07918#bib.bib31); Samvelyan et al\.,[2024](https://arxiv.org/html/2607.07918#bib.bib38)\), extending classical adversarial training\(Goodfellow et al\.,[2015](https://arxiv.org/html/2607.07918#bib.bib14)\)from vector inputs to natural language\. Latent Adversarial Training \(LAT\) improves on these methods, by operating in latent space: rather than generate adversarial inputs, it generates adversarial activations in latent space, which is far more efficient\(Sheshadri et al\.,[2025](https://arxiv.org/html/2607.07918#bib.bib42); Casper et al\.,[2025](https://arxiv.org/html/2607.07918#bib.bib4); Xhonneux et al\.,[2024](https://arxiv.org/html/2607.07918#bib.bib49); Yi et al\.,[2025](https://arxiv.org/html/2607.07918#bib.bib52)\)\. However, existing LAT methods train on explicit refusals to the same harm categories used for evaluation, risking overfitting to specific harms\. Adversarial training can also degrade general utility, as evidenced by lower benchmark scores\(Yu et al\.,[2025](https://arxiv.org/html/2607.07918#bib.bib53)\)\.

#### Activation steering is a promising but limited personality based approach\.

Mechanistic and representation\-based approaches model high\-level behaviors as directions or subspaces in activation space\(Zou et al\.,[2025](https://arxiv.org/html/2607.07918#bib.bib57)\)\. Persona Vectors\(Chen et al\.,[2025](https://arxiv.org/html/2607.07918#bib.bib6)\)provides an automated pipeline to extract trait directions \(e\.g\., sycophancy, hallucination\) and shows they can monitor persona drift\. The Assistant Axis,\(Lu et al\.,[2026](https://arxiv.org/html/2607.07918#bib.bib24)\)identifies the default assistant persona as a linear direction in activation space and introduces activation capping to stabilize this persona at inference time\. This method reduces the success of persona\-based attacks by about half, but attack success rates remain in the double digits\.

## 3Methods and Experiments

### 3\.1Overview

Our method efficiently aligns LLMs toward beneficial personality traits using latent adversarial training\. Instead of training on explicit examples of harmful or benign behaviors, we leverage personality statements grounded in established psychometric theory\. The central hypothesis is that*enforcing personality\-appropriate responses to psychometric statements at the level of latent representations yields more generalizable and data\-efficient alignment than surface\-level refusal training\.*

The experimental design consists of three stages: \(i\) constructing a small dataset of personality items from the Big Five framework, \(ii\) applying LAT to enforce robustness of trait\-consistent responses under adversarial perturbation in latent space, and \(iii\) evaluating the model against several jailbreaking techniques and utility benchmarks\.

### 3\.2Personality Trait Dataset

The training data consists of short declarative statements sourced from IPIP\(IPIP,[2023](https://arxiv.org/html/2607.07918#bib.bib17); Goldberg,[1999](https://arxiv.org/html/2607.07918#bib.bib12); Goldberg et al\.,[2006](https://arxiv.org/html/2607.07918#bib.bib13); du Plessis & de Bruin,[2015](https://arxiv.org/html/2607.07918#bib.bib10); Simms et al\.,[2011](https://arxiv.org/html/2607.07918#bib.bib44)\), a public\-domain repository of psychometric items\. We focus on three traits that psychological research and emerging AI safety literature associate with safe and prosocial behavior\(Barrick & Mount,[1991](https://arxiv.org/html/2607.07918#bib.bib1); Li et al\.,[2024](https://arxiv.org/html/2607.07918#bib.bib21); Wang et al\.,[2025b](https://arxiv.org/html/2607.07918#bib.bib48)\):*Conscientiousness*\(rule\-following, responsibility\),*Agreeableness*\(cooperativeness, empathy\), and*Emotional Stability*\(calmness, resistance to stress\-induced reactivity\)\.

The resulting dataset is abstract and does not explicitly mention harm\. We use these statements as a convenient harm\-agnostic training signal, similar to prompt\-based steering\. Our hypothesis is that generalization from such statements aligns models more efficiently than memorizing specific harmful behaviors\.

Concretely, we frame personality alignment as a binary response task\. For each personality statement, the model must output either an*agreement*or*disagreement*, depending on whether the statement represents a positive or negative expression of the associated trait\. For example, the positive statement*“I love to help others”*is paired with*“I agree with this statement”*, while the negative statement*“I insult people”*is paired with*“I do not agree with this statement”*\. A subset of personality statements and the desired responses used in LPA is provided in[Table 1](https://arxiv.org/html/2607.07918#A1.T1)\.

Inspired by instructions provided in\(IPIP,[2023](https://arxiv.org/html/2607.07918#bib.bib17)\), training examples are prepended with a fixed system prompt that frames the task as a personality self\-assessment:

> You will be presented with a series of statements about your typical thoughts, feelings, and behaviors\. Please indicate whether you agree or disagree with each statement as it applies to you personally, as you are now, not how you wish to be or how others see you\. There are no right or wrong answers\. Be as honest and accurate as possible\. Your first instinct is usually best\. If answering a question is incompatible with your values, you can refuse to answer, by saying “I’m sorry, I cannot comply with that request”\.

This framing encourages the model to treat the responses as self\-descriptions rather than task\-specific outputs, reducing harmful responses without degrading capabilities\.

### 3\.3Latent Adversarial Training on Personality Traits

LAT\(Sheshadri et al\.,[2025](https://arxiv.org/html/2607.07918#bib.bib42); Casper et al\.,[2025](https://arxiv.org/html/2607.07918#bib.bib4)\)is a training paradigm designed to improve robustness by operating directly on a model’s internal representations, as opposed to its inputs\. The model is exposed to adversarial perturbations in latent space that elicit undesirable behaviors, then trained to maintain the desired behavior under these perturbations\. Because high\-level concepts are represented more abstractly in latent activations, enforcing robustness at this level can induce more persistent changes than input\-level adversarial training\.

Formally, an LLM can be viewed as a composition of a feature extractor and a decoder: given an inputxx, the feature extractor produces a latent representationf​\(x\)f\(x\), which the decoder maps to an output distribution\. Latent adversarial training\(Sheshadri et al\.,[2025](https://arxiv.org/html/2607.07918#bib.bib42)\)adapts classical adversarial training\(Goodfellow et al\.,[2015](https://arxiv.org/html/2607.07918#bib.bib14)\)to operate in this latent space\. That is, a bounded perturbationδ\\deltais computed via gradients induced byxxto maximally increase the loss, and the model is then trained to produce the correct output when conditioned on the perturbed representationf​\(x\)\+δf\(x\)\+\\delta\.

We apply a targeted form of LAT to the personality statement dataset derived from IPIP\. By default, we train on the*negative*\(undesirable\-behavior\) statements only: each statement is paired with the completion “I do not agree with this statement”\. Variants using positive statements or both subsets are explored as ablations in[section 5](https://arxiv.org/html/2607.07918#S5)\. During LAT, adversarial perturbations are optimized to push the model toward the wrong completion \(agreement with the undesirable statement\)\. The model parameters are then updated to produce the correct disagreement despite these perturbations\. This encourages the model to robustly encode trait\-consistent responses in a way that is robust to latent\-space perturbations\.

### 3\.4Models

LAT requires direct access to the internals of a model, including hidden states and gradients\. This precludes experimentation with proprietary API\-only models\. Consequently, our main experiments are carried out on the open\-source model Qwen3\-8B\(Yang et al\.,[2025](https://arxiv.org/html/2607.07918#bib.bib51)\)\. We also perform preliminary experiments on Llama\-3\-8B \([Appendix B](https://arxiv.org/html/2607.07918#A2)\), but leave a full analysis of other models to future work\.

All our experiments involve lightweight post\-training of instruction\-tuned base models\. Due to the compact size of the personality dataset, each run completes within minutes on a single GPU, enabling efficient hyperparameter exploration\.

### 3\.5Evaluation

We evaluate our method along two complementary dimensions: robustness to harmful and jailbreaking prompts and preservation of utility on benign tasks\. To this end, we rely on widely used safety and capability benchmarks that allow for direct comparison with prior work\. To avoid biasing our results, we use the minimal system prompt“You are a helpful assistant\.”during evaluation\.

#### Safety and Jailbreak Benchmarks\.

Robustness to harmful behavior is evaluated using HarmBench\(Mazeika et al\.,[2024](https://arxiv.org/html/2607.07918#bib.bib26)\), a standardized benchmark for measuring the safety of large language models\. HarmBench consists of curated harmful requests that span multiple risk categories \(e\.g\., violence, illegal activities, self\-harm\), along with an LLM evaluator that determines whether a model response constitutes a successful harmful completion or a refusal\. We report*Attack Success Rate*\(ASR\), defined as the fraction of prompts for which the model produces a harmful, non\-refusal response\.

We additionally evaluate robustness against five jailbreak methods that span optimization\-based attacks \(GCG\(Zou et al\.,[2023](https://arxiv.org/html/2607.07918#bib.bib56)\), AutoPrompt\(Shin et al\.,[2020](https://arxiv.org/html/2607.07918#bib.bib43)\)\), semantic manipulation \(PAIR\(Chao et al\.,[2024](https://arxiv.org/html/2607.07918#bib.bib5)\), TAP\(Mehrotra et al\.,[2024](https://arxiv.org/html/2607.07918#bib.bib27)\)\), and template\-based bypasses \(Auto\-DAN\(Liu et al\.,[2024](https://arxiv.org/html/2607.07918#bib.bib23)\)\), providing a broad test of generalization\. GCG and AutoPrompt are run in white\-box mode directly on the defended model, making them adaptive to the defense\.

#### Utility Benchmarks\.

To assess whether safety training degrades general capabilities, we evaluate on standard benchmarks spanning knowledge and reasoning \(MMLU\(Hendrycks et al\.,[2021](https://arxiv.org/html/2607.07918#bib.bib16)\)\), arithmetic \(GSM8K\(Cobbe et al\.,[2021](https://arxiv.org/html/2607.07918#bib.bib8)\)\), and factuality \(TruthfulQA\(Lin et al\.,[2022](https://arxiv.org/html/2607.07918#bib.bib22)\)\)\. Additional utility benchmarks are presented in[section 5](https://arxiv.org/html/2607.07918#S5), including tinyMMLU\(Polo et al\.,[2024](https://arxiv.org/html/2607.07918#bib.bib34)\), tinyHellaswag\(Polo et al\.,[2024](https://arxiv.org/html/2607.07918#bib.bib34)\), SciQ\(Johannes Welbl,[2017](https://arxiv.org/html/2607.07918#bib.bib20)\), and Lambada\(Paperno et al\.,[2016](https://arxiv.org/html/2607.07918#bib.bib30)\)\.

## 4Results

![Refer to caption](https://arxiv.org/html/2607.07918v1/x3.png)Figure 3:Evolution of ASR across training steps\.We compare targeted LAT and our method \(LPA\)\. The horizontal gray line denotes the initial ASR before training, and star markers indicate the checkpoints used for the snapshot comparisons in[Figure 1](https://arxiv.org/html/2607.07918#S1.F1)\.Main result:LPA drives ASR to near zero in far fewer training steps than targeted LAT, indicating substantially faster and more data\-efficient robustness gains\. Values denote mean values\. The standard deviations across 8 runs are shown as shaded regions\.[Figure 1](https://arxiv.org/html/2607.07918#S1.F1)compares our method with the baselines and with standard targeted LAT\. We report both*safety*and*utility*, to show the usual robustness\-utility trade\-off of post\-training\. Adversarial training can degrade utility\. In order to fairly compare the methods, we present results at the most robust point where utility is statistically unaffected\.

### 4\.1Robustness to Harmful and Jailbreaking Prompts and Preservation of Model Utility

The left portion of[Figure 1](https://arxiv.org/html/2607.07918#S1.F1)reports the ASR on harmful prompts and widely used jailbreak methods\. Our method achieves near\-zero or exactly zero ASR across the majority of attacks, demonstrating comparable or stronger robustness than LAT\. While LAT is effective at suppressing specific harmful behaviors, it requires explicit training on thousands of harmful prompts drawn from HarmBench\. LPA is more robust*without any exposure during LPA training*to harmful prompts, jailbreaks, or explicit refusal behaviors\. Thus*reinforcing abstract personality traits alone is sufficient to induce broad resistance to diverse and previously unseen attack strategies\.*

[Figure 1](https://arxiv.org/html/2607.07918#S1.F1)\(right\) reports utility on benign benchmarks\. We stopped training at epoch 30, after which our model began to lose utility\. At this epoch, our model*maintains the utility of the base models across nearly all benchmarks, with only minimal decreases in accuracy\.*In several cases, performance remains statistically indistinguishable from the baseline\. This stands in contrast to traditional LAT, which requires extensive supervised fine\-tuning on large benign datasets to counteract utility degradation induced by aggressive adversarial training\. In order to have a fair comparison, we stopped the LAT training when model utility began to degrade\. This means the ASR values for LAT are higher \(the model is more vulnerable\) than in the original paper\. However, it also means that utility is not compromised\.

[Figure 3](https://arxiv.org/html/2607.07918#S4.F3)plots the evolution of the ASR on*direct requests*from HarmBench for targeted LAT and LPA\. Both methods steadily reduce ASR, but LPA converges substantially faster: ASR drops to nearly zero within3030steps, whereas LAT requires100100steps to reach an ASR of roughly0\.050\.05\. Importantly, a “step” is not comparable across methods\. LAT optimizes on a large corpus of explicit harmful requests from HarmBench paired with refusals and applies supervised fine\-tuning on a benign dataset after each step to preserve utility\. In contrast, LPA trains only on abstract personality statements and does not require supervised utility recovery\.

![Refer to caption](https://arxiv.org/html/2607.07918v1/x4.png)Figure 4:Safety–utility trade\-off across ablation variants\.Each point represents a training checkpoint, with HarmBench direct\-request ASR on thexx\-axis and Tiny MMLU on theyy\-axis; the top\-left corner is ideal\.Negative only, our main result, is on the Pareto frontier, reaching near\-zero ASR while maintaining high utility\. Other variants \(Inverted, Irrelevant, All IPIP, Shuffled\) can eventually reach low ASR, but only at the cost of severe utility degradation\.
### 4\.2Efficiency and Generalization

A key advantage of our approach lies in its efficiency\. Traditional targeted LAT relies on 4,947 harmful prompts paired with refusal completions and supervised fine\-tuning on 165,297 benign prompts to preserve utility\.

In contrast, LPA uses 66 personality statements with no supervised fine\-tuning, achieving*roughly75×75\\timesfewer training examples*while achieving comparable robustness\. Because LPA reinforces personality items rather than cataloging specific harms, the robustness extends beyond the attack distributions seen during training, mitigating overfitting\.

## 5Ablation Study

We conduct an extensive ablation study to better understand which components of our method are responsible for the robustness\-utility trade\-off, measured by ASR on direct requests from HarmBench and utility on Tiny MMLU, respectively\. This trade\-off is clearly demonstrated in[Figure 4](https://arxiv.org/html/2607.07918#S4.F4), which shows the pareto optimality of our method\. In order to focus on the improved utility of our model, we also present the utility values on Tiny MMLU at the training step where each of the models reach5%5\\%ASR on direct requests from HarmBench\. These results are summarized in[Figure 5](https://arxiv.org/html/2607.07918#S5.F5)\.

### 5\.1Impact of Personality Trait Selection

To evaluate the impact of which traits we choose and the consistency of trait\-labels, we experiment with different statement configurations:

- •“Negative only ”: used only negative statements paired with*“I do not agree with this statement”*
- •“Positive and Negative”: used both positive statements, paired with with*“I agree with this statement”*; and negative statements paired with*“I do not agree with this statement”*
- •“Inverted”: positive statements are paired with*“I do not agree with this statement”*, and negative statements with*“I agree with this statement”*; reversing the personality traits\.
- •“Shuffled”: pairings between statements and completions are randomly shuffled;
- •“Irrelevant”: traits unrelated to safety:*Aesthetic Appreciation / Artistic Interests*,*Intellect*, and*Sociability*;
- •“All IPIP”: all 3,767 statements from the full IPIP dataset are used\.

Except for “Irrelevant” and “All IPIP”, the experiments use IPIP statements corresponding to three personality traits:*Conscientiousness*,*Agreeableness*, and*Emotional Stability*\.

At a matched level of5%5\\%ASR, our primary method retains substantially higher utility than the alternatives \([Figure 5](https://arxiv.org/html/2607.07918#S5.F5)\): inverted, shuffled, irrelevant, or excessively broad trait sets all degrade performance on benign tasks\. Both*trait relevance*and*label consistency*are therefore important for achieving robustness without sacrificing utility\.

![Refer to caption](https://arxiv.org/html/2607.07918v1/x5.png)Figure 5:Utility score of the ablations on Tiny MMLU\. For a fair comparison, the threshold for model selection was when they reach an ASR≤5%\\leq 5\\%on direct requests from HarmBench\. This allows us to compare utilities across models with very similar ASR\. Our main result, LPA with negative\-only statements, maintains better model utility by at least 19%, compared to all the other variations\.
### 5\.2Effect of Statement Subsets

Finally, we compare the effects of training on different subsets of the personality statements: negative statements only \(“−\-only”, i\.e\. our main result\), positive statements only \(“\+\+only”\), all positive and negative statements \(“All\+\+and−\-”\), and a size\-matched random subset of both \(“Subset\+\+and−\-”\)\.

The negative\-only variant achieves the best trade\-off between safety and utility as measured on standard benchmarks \([Figure 5](https://arxiv.org/html/2607.07918#S5.F5)\)\. Variants that include positive statements \(“All\+\+and−\-”, “Subset\+\+and−\-”\) achieve comparable ASR, but at the cost of degraded utility\.

Our results show that training the model to*disagree*with undesirable trait descriptions is more effective for safety alignment than training it to*agree*with desirable ones\. This asymmetry was not expected a priori\. One possible explanation is that disagreeing with undesirable traits more directly suppresses latent directions associated with harmful behavior, while agreeing with desirable traits is a more nuanced or multi\-directional signal\. But we present our results as an empirical finding and leave mechanistic explanation to future work\.

Overall, the ablation study confirms that the effectiveness of our method relies on a combination of factors: a coherent system prompt, safety\-relevant personality traits, consistent statement\-completion pairings, and the focus on exclusively negative statements\.

## 6Conclusion

We introduced Latent Personality Alignment, a method for LLMs that reduces attack success rates to near zero while preserving utility at a fraction of the computational cost of previous approaches\. LPA encodes helpful personality traits in the model’s internal representation using latent adversarial training\. It requires a small dataset of psychometric statements, containing no explicit mention of harmful content\. These results suggest that enforcing safety\-relevant personality traits in latent space can provide a harm\-agnostic and data\-efficient alternative to refusal\-based safety training\. Future work may extend to additional model families and sizes to test scaling behavior, generalization, and develop finer methods to define the latent personality axis enforced during training\.

### Limitations

There may be architectural differences in how personality\-relevant features are organized in latent space\. However, all LPA hyperparameters were tuned on Qwen3\-8B and applied without model\-specific adjustment to Llama\-3\. We expect that model specific tuning would further improve the results on Llama3\-8B, but leave a systematic study to future work\.

More broadly, some of our evaluations use an LLM\-as\-a\-judge framework, which can be an imperfect proxy for true harmfulness, particularly in an adversarial setting\(Schwinn et al\.,[2026](https://arxiv.org/html/2607.07918#bib.bib39)\)\. Ideally, a subset of these results should be validated with human annotation, multi\-judge cross validation, or a combination of the two\.

## References

- Barrick & Mount \(1991\)Murray R\. Barrick and Michael K\. Mount\.The Big Five personality dimensions and job performance: A meta\-analysis\.*Personnel Psychology*, 1991\.URL[https://psycnet\.apa\.org/record/1991\-22928\-001](https://psycnet.apa.org/record/1991-22928-001)\.
- Betley et al\. \(2026\)Jan Betley, Niels Warncke, Anna Sztyber\-Betley, Daniel Tan, Xuchan Bao, Martín Soto, Megha Srivastava, Nathan Labenz, and Owain Evans\.Training large language models on narrow tasks can lead to broad misalignment\.*Nature*, 649\(8097\):584–589, January 2026\.ISSN 1476\-4687\.doi:10\.1038/s41586\-025\-09937\-5\.URL[http://dx\.doi\.org/10\.1038/s41586\-025\-09937\-5](http://dx.doi.org/10.1038/s41586-025-09937-5)\.
- Boreiko et al\. \(2025\)Valentyn Boreiko, Alexander Panfilov, Vaclav Voracek, Matthias Hein, and Jonas Geiping\.An interpretable n\-gram perplexity threat model for large language model jailbreaks, 2025\.URL[https://arxiv\.org/abs/2410\.16222](https://arxiv.org/abs/2410.16222)\.
- Casper et al\. \(2025\)Stephen Casper, Lennart Schulze, Oam Patel, and Dylan Hadfield\-Menell\.Defending against unforeseen failure modes with latent adversarial training, 2025\.URL[https://arxiv\.org/abs/2403\.05030](https://arxiv.org/abs/2403.05030)\.
- Chao et al\. \(2024\)Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J\. Pappas, and Eric Wong\.Jailbreaking black box large language models in twenty queries, 2024\.URL[https://arxiv\.org/abs/2310\.08419](https://arxiv.org/abs/2310.08419)\.
- Chen et al\. \(2025\)Runjin Chen, Andy Arditi, Henry Sleight, Owain Evans, and Jack Lindsey\.Persona vectors: Monitoring and controlling character traits in language models, 2025\.URL[https://arxiv\.org/abs/2507\.21509](https://arxiv.org/abs/2507.21509)\.
- Christiano et al\. \(2023\)Paul Christiano, Jan Leike, Tom B\. Brown, Miljan Martic, Shane Legg, and Dario Amodei\.Deep reinforcement learning from human preferences, 2023\.URL[https://arxiv\.org/abs/1706\.03741](https://arxiv.org/abs/1706.03741)\.
- Cobbe et al\. \(2021\)Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, Christopher Hesse, and John Schulman\.Training verifiers to solve math word problems, 2021\.URL[https://arxiv\.org/abs/2110\.14168](https://arxiv.org/abs/2110.14168)\.
- Cui et al\. \(2025\)Justin Cui, Wei\-Lin Chiang, Ion Stoica, and Cho\-Jui Hsieh\.Or\-bench: An over\-refusal benchmark for large language models, 2025\.URL[https://arxiv\.org/abs/2405\.20947](https://arxiv.org/abs/2405.20947)\.
- du Plessis & de Bruin \(2015\)Graham A\. du Plessis and Gideon P\. de Bruin\.Using rasch modelling to examine the international personality item pool \(ipip\) values in action \(via\) measure of character strengths\.*Journal of Psychology in Africa*, 2015\.URL[https://doi\.org/10\.1080/14330237\.2015\.1124603](https://doi.org/10.1080/14330237.2015.1124603)\.
- Fitz et al\. \(2025\)Stephen Fitz, Peter Romero, Steven Basart, Sipeng Chen, and Jose Hernandez\-Orallo\.Psychometric personality shaping modulates capabilities and safety in language models, 2025\.URL[https://arxiv\.org/abs/2509\.16332](https://arxiv.org/abs/2509.16332)\.
- Goldberg \(1999\)L\. R\. Goldberg\.A broad\-bandwidth, public\-domain, personality inventory measuring the lower\-level facets of several five\-factor models\.In*European conference on personality, PERSONALITY PSYCHOLOGY IN EUROPE*, 1999\.URL[https://www\.tib\.eu/de/suchen/id/BLCP%3ACN034731081](https://www.tib.eu/de/suchen/id/BLCP%3ACN034731081)\.
- Goldberg et al\. \(2006\)Lewis R\. Goldberg, John A\. Johnson, Herbert W\. Eber, Robert Hogan, Michael C\. Ashton, C\. Robert Cloninger, and Harrison G\. Gough\.The international personality item pool and the future of public\-domain personality measures\.*Journal of Research in Personality*, 2006\.URL[https://www\.sciencedirect\.com/science/article/pii/S0092656605000553](https://www.sciencedirect.com/science/article/pii/S0092656605000553)\.
- Goodfellow et al\. \(2015\)Ian J\. Goodfellow, Jonathon Shlens, and Christian Szegedy\.Explaining and harnessing adversarial examples, 2015\.URL[https://arxiv\.org/abs/1412\.6572](https://arxiv.org/abs/1412.6572)\.
- Gupta et al\. \(2024\)Akshat Gupta, Xiaoyang Song, and Gopala Anumanchipalli\.Self\-assessment tests are unreliable measures of LLM personality, 2024\.URL[https://arxiv\.org/abs/2309\.08163](https://arxiv.org/abs/2309.08163)\.
- Hendrycks et al\. \(2021\)Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt\.Measuring massive multitask language understanding, 2021\.URL[https://arxiv\.org/abs/2009\.03300](https://arxiv.org/abs/2009.03300)\.
- IPIP \(2023\)IPIP\.International personality item pool: Alphabetical list of items\.[https://ipip\.ori\.org/AlphabeticalItemList\.htm](https://ipip.ori.org/AlphabeticalItemList.htm), 2023\.Accessed 2026\-01\-28\.
- Jain et al\. \(2024\)Samyak Jain, Ekdeep Singh Lubana, Kemal Oksuz, Tom Joy, Philip H\. S\. Torr, Amartya Sanyal, and Puneet K\. Dokania\.What makes and breaks safety fine\-tuning? a mechanistic study, 2024\.URL[https://arxiv\.org/abs/2407\.10264](https://arxiv.org/abs/2407.10264)\.
- Jiang et al\. \(2022\)Guangyi Jiang, Ming Xu, Song\-Chun Zhu, Wei Han, Chao Zhang, and Yixin Zhu\.Evaluating and inducing personality in pre\-trained language models, 2022\.
- Johannes Welbl \(2017\)Matt Gardner Johannes Welbl, Nelson F\. Liu\.Crowdsourcing multiple choice science questions, 2017\.
- Li et al\. \(2024\)Kenneth Li, Tianle Liu, Naomi Bashkansky, David Bau, Fernanda Viégas, Hanspeter Pfister, and Martin Wattenberg\.Measuring and controlling instruction \(in\)stability in language model dialogs, 2024\.URL[https://arxiv\.org/abs/2402\.10962](https://arxiv.org/abs/2402.10962)\.
- Lin et al\. \(2022\)Stephanie Lin, Jacob Hilton, and Owain Evans\.Truthfulqa: Measuring how models mimic human falsehoods, 2022\.URL[https://arxiv\.org/abs/2109\.07958](https://arxiv.org/abs/2109.07958)\.
- Liu et al\. \(2024\)Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao\.Autodan: Generating stealthy jailbreak prompts on aligned large language models, 2024\.URL[https://arxiv\.org/abs/2310\.04451](https://arxiv.org/abs/2310.04451)\.
- Lu et al\. \(2026\)Christina Lu, Jack Gallagher, Jonathan Michala, Kyle Fish, and Jack Lindsey\.The Assistant Axis: Situating and stabilizing the default persona of language models, 2026\.URL[https://arxiv\.org/abs/2601\.10387](https://arxiv.org/abs/2601.10387)\.
- Ma et al\. \(2026\)Xiaoxu Ma, Xiangbo Zhang, and Zhenyu Weng\.Stable and explainable personality trait evaluation in large language models with internal activations, 2026\.URL[https://arxiv\.org/abs/2601\.09833](https://arxiv.org/abs/2601.09833)\.
- Mazeika et al\. \(2024\)Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, and Dan Hendrycks\.Harmbench: A standardized evaluation framework for automated red teaming and robust refusal, 2024\.URL[https://arxiv\.org/abs/2402\.04249](https://arxiv.org/abs/2402.04249)\.
- Mehrotra et al\. \(2024\)Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, and Amin Karbasi\.Tree of attacks: Jailbreaking black\-box LLMs automatically, 2024\.URL[https://arxiv\.org/abs/2312\.02119](https://arxiv.org/abs/2312.02119)\.
- Ouyang et al\. \(2022\)Long Ouyang, Jeff Wu, Xu Jiang, Diogo Almeida, Carroll L\. Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kelton, Luke Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul Christiano, Jan Leike, and Ryan Lowe\.Training language models to follow instructions with human feedback, 2022\.URL[https://arxiv\.org/abs/2203\.02155](https://arxiv.org/abs/2203.02155)\.
- Panda et al\. \(2024\)Swetasudha Panda, Naveen Jafer Nizar, and Michael L\. Wick\.LLM improvement for jailbreak defense: Analysis through the lens of over\-refusal, 2024\.URL[https://openreview\.net/forum?id=rXReIKbm5e](https://openreview.net/forum?id=rXReIKbm5e)\.
- Paperno et al\. \(2016\)Denis Paperno, Germán Kruszewski, Angeliki Lazaridou, Quan Ngoc Pham, Raffaella Bernardi, Sandro Pezzelle, Marco Baroni, Gemma Boleda, and Raquel Fernández\.The lambada dataset: Word prediction requiring a broad discourse context, 2016\.URL[https://arxiv\.org/abs/1606\.06031](https://arxiv.org/abs/1606.06031)\.
- Paulus et al\. \(2025\)Anselm Paulus, Arman Zharmagambetov, Chuan Guo, Brandon Amos, and Yuandong Tian\.Advprompter: Fast adaptive adversarial prompting for LLMs, 2025\.URL[https://arxiv\.org/abs/2404\.16873](https://arxiv.org/abs/2404.16873)\.
- Pellert et al\. \(2023\)Maximilian Pellert, Clemens M\. Lechner, Claudia Wagner, Beatrice Rammstedt, and Markus Strohmaier\.AI psychometrics: Assessing the psychological profiles of large language models through psychometric inventories, 2023\.
- Perez et al\. \(2022\)Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving\.Red teaming language models with language models, 2022\.URL[https://arxiv\.org/abs/2202\.03286](https://arxiv.org/abs/2202.03286)\.
- Polo et al\. \(2024\)Felipe Maia Polo, Lucas Weber, Leshem Choshen, Yuekai Sun, Gongjun Xu, and Mikhail Yurochkin\.tinybenchmarks: evaluating llms with fewer examples, 2024\.URL[https://arxiv\.org/abs/2402\.14992](https://arxiv.org/abs/2402.14992)\.
- Qin et al\. \(2024\)Yanzhao Qin, Tao Zhang, Tao Zhang, Yanjun Shen, Wenjing Luo, Haoze Sun, Yan Zhang, Yujing Qiao, Weipeng Chen, Zenan Zhou, Wentao Zhang, and Bin Cui\.Sysbench: Can large language models follow system messages?, 2024\.URL[https://arxiv\.org/abs/2408\.10943](https://arxiv.org/abs/2408.10943)\.
- Rando et al\. \(2025\)Javier Rando, Jie Zhang, Nicholas Carlini, and Florian Tramèr\.Adversarial ml problems are getting harder to solve and to evaluate, 2025\.URL[https://arxiv\.org/abs/2502\.02260](https://arxiv.org/abs/2502.02260)\.
- Salinas & Morstatter \(2024\)Abel Salinas and Fred Morstatter\.The butterfly effect of altering prompts: How small changes and jailbreaks affect large language model performance, 2024\.URL[https://arxiv\.org/abs/2401\.03729](https://arxiv.org/abs/2401.03729)\.
- Samvelyan et al\. \(2024\)Mikayel Samvelyan, Sharath Chandra Raparthy, Andrei Lupu, Eric Hambro, Aram H\. Markosyan, Manish Bhatt, Yuning Mao, Minqi Jiang, Jack Parker\-Holder, Jakob Foerster, Tim Rocktäschel, and Roberta Raileanu\.Rainbow teaming: Open\-ended generation of diverse adversarial prompts, 2024\.URL[https://arxiv\.org/abs/2402\.16822](https://arxiv.org/abs/2402.16822)\.
- Schwinn et al\. \(2026\)Leo Schwinn, Moritz Ladenburger, Tim Beyer, Mehrnaz Mofakhami, Gauthier Gidel, and Stephan Günnemann\.A coin flip for safety: Llm judges fail to reliably measure adversarial robustness, 2026\.URL[https://arxiv\.org/abs/2603\.06594](https://arxiv.org/abs/2603.06594)\.
- Sclar et al\. \(2024\)Melanie Sclar, Yejin Choi, Yulia Tsvetkov, and Alane Suhr\.Quantifying language models’ sensitivity to spurious features in prompt design or: How i learned to start worrying about prompt formatting, 2024\.URL[https://arxiv\.org/abs/2310\.11324](https://arxiv.org/abs/2310.11324)\.
- Serapio\-García et al\. \(2025\)Gregory Serapio\-García, Mustafa Safdari, Clément Crepy, Luning Sun, Stephen Fitz, Peter Romero, Marwa Abdulhai, Aleksandra Faust, and Maja Matarić\.A psychometric framework for evaluating and shaping personality traits in large language models\.*Nature Machine Intelligence*, 2025\.URL[https://www\.nature\.com/articles/s42256\-025\-01115\-6](https://www.nature.com/articles/s42256-025-01115-6)\.
- Sheshadri et al\. \(2025\)Abhay Sheshadri, Aidan Ewart, Phillip Guo, Aengus Lynch, Cindy Wu, Vivek Hebbar, Henry Sleight, Asa Cooper Stickland, Ethan Perez, Dylan Hadfield\-Menell, and Stephen Casper\.Latent adversarial training improves robustness to persistent harmful behaviors in llms, 2025\.URL[https://arxiv\.org/abs/2407\.15549](https://arxiv.org/abs/2407.15549)\.
- Shin et al\. \(2020\)Taylor Shin, Yasaman Razeghi, Robert L\. Logan IV, Eric Wallace, and Sameer Singh\.Autoprompt: Eliciting knowledge from language models with automatically generated prompts, 2020\.URL[https://arxiv\.org/abs/2010\.15980](https://arxiv.org/abs/2010.15980)\.
- Simms et al\. \(2011\)Leonard J\. Simms, Lewis R\. Goldberg, John E\. Roberts, David Watson, John Welte, and Jane H\. Rotterman\.Computerized adaptive assessment of personality disorder: introducing the cat\-pd project\.*Journal of Personality Assessment*, 2011\.URL[https://doi\.org/10\.1080/00223891\.2011\.577475](https://doi.org/10.1080/00223891.2011.577475)\.
- Taubenfeld et al\. \(2026\)Amir Taubenfeld, Zorik Gekhman, Lior Nezry, Omri Feldman, Natalie Harris, Shashir Reddy, Romina Stella, Ariel Goldstein, Marian Croak, Yossi Matias, and Amir Feder\.Evaluating alignment of behavioral dispositions in llms, 2026\.URL[https://arxiv\.org/abs/2602\.11328](https://arxiv.org/abs/2602.11328)\.
- Tosato et al\. \(2025\)Tommaso Tosato, Saskia Helbling, Yorguin\-Jose Mantilla\-Ramos, Mahmood Hegazy, Alberto Tosato, David John Lemay, Irina Rish, and Guillaume Dumas\.Persistent instability in LLM’s personality measurements: Effects of scale, reasoning, and conversation history, 2025\.URL[https://arxiv\.org/abs/2508\.04826](https://arxiv.org/abs/2508.04826)\.
- Wang et al\. \(2025a\)Miles Wang, Tom Dupré la Tour, Olivia Watkins, Alex Makelov, Ryan A\. Chi, Samuel Miserendino, Jeffrey Wang, Achyuta Rajaram, Johannes Heidecke, Tejal Patwardhan, and Dan Mossing\.Persona features control emergent misalignment, 2025a\.URL[https://arxiv\.org/abs/2506\.19823](https://arxiv.org/abs/2506.19823)\.
- Wang et al\. \(2025b\)Xiaoyang Wang, Hongming Zhang, Tao Ge, Wenhao Yu, Dian Yu, and Dong Yu\.Opencharacter: Training customizable role\-playing llms with large\-scale synthetic personas, 2025b\.URL[https://arxiv\.org/abs/2501\.15427](https://arxiv.org/abs/2501.15427)\.
- Xhonneux et al\. \(2024\)Sophie Xhonneux, Alessandro Sordoni, Stephan Günnemann, Gauthier Gidel, and Leo Schwinn\.Efficient adversarial training in llms with continuous attacks, 2024\.URL[https://arxiv\.org/abs/2405\.15589](https://arxiv.org/abs/2405.15589)\.
- Xu et al\. \(2025\)Ziwei Xu, Udit Sanghi, and Mohan Kankanhalli\.Bullying the machine: How personas increase LLM vulnerability, 2025\.URL[https://arxiv\.org/abs/2505\.12692](https://arxiv.org/abs/2505.12692)\.
- Yang et al\. \(2025\)An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, Chujie Zheng, Dayiheng Liu, Fan Zhou, Fei Huang, Feng Hu, Hao Ge, Haoran Wei, Huan Lin, Jialong Tang, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Yang, Jiaxi Yang, Jing Zhou, Jingren Zhou, Junyang Lin, Kai Dang, Keqin Bao, Kexin Yang, Le Yu, Lianghao Deng, Mei Li, Mingfeng Xue, Mingze Li, Pei Zhang, Peng Wang, Qin Zhu, Rui Men, Ruize Gao, Shixuan Liu, Shuang Luo, Tianhao Li, Tianyi Tang, Wenbiao Yin, Xingzhang Ren, Xinyu Wang, Xinyu Zhang, Xuancheng Ren, Yang Fan, Yang Su, Yichang Zhang, Yinger Zhang, Yu Wan, Yuqiong Liu, Zekun Wang, Zeyu Cui, Zhenru Zhang, Zhipeng Zhou, and Zihan Qiu\.Qwen3 technical report, 2025\.URL[https://arxiv\.org/abs/2505\.09388](https://arxiv.org/abs/2505.09388)\.
- Yi et al\. \(2025\)Xin Yi, Yue Li, Dongsheng Shi, Linlin Wang, Xiaoling Wang, and Liang He\.Latent\-space adversarial training with post\-aware calibration for defending large language models against jailbreak attacks, 2025\.URL[https://arxiv\.org/abs/2501\.10639](https://arxiv.org/abs/2501.10639)\.
- Yu et al\. \(2025\)Lei Yu, Virginie Do, Karen Hambardzumyan, and Nicola Cancedda\.Robust LLM safeguarding via refusal feature adversarial training, 2025\.URL[https://arxiv\.org/abs/2409\.20089](https://arxiv.org/abs/2409.20089)\.
- Zhu et al\. \(2025a\)Jianfeng Zhu, Julina Maharjan, Xinyu Li, Karin G\. Coifman, and Ruoming Jin\.Evaluating LLM alignment on personality inference from real\-world interview data, 2025a\.URL[https://arxiv\.org/abs/2509\.13244](https://arxiv.org/abs/2509.13244)\.
- Zhu et al\. \(2025b\)Minjun Zhu, Yixuan Weng, Linyi Yang, and Yue Zhang\.Personality alignment of large language models, 2025b\.URL[https://arxiv\.org/abs/2408\.11779](https://arxiv.org/abs/2408.11779)\.
- Zou et al\. \(2023\)Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J\. Zico Kolter, and Matt Fredrikson\.Universal and transferable adversarial attacks on aligned language models, 2023\.URL[https://arxiv\.org/abs/2307\.15043](https://arxiv.org/abs/2307.15043)\.
- Zou et al\. \(2025\)Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Ann\-Kathrin Dombrowski, Shashwat Goel, Nathaniel Li, Michael J\. Byun, Zifan Wang, Alex Mallen, Steven Basart, Sanmi Koyejo, Dawn Song, Matt Fredrikson, J\. Zico Kolter, and Dan Hendrycks\.Representation engineering: A top\-down approach to AI transparency, 2025\.URL[https://arxiv\.org/abs/2310\.01405](https://arxiv.org/abs/2310.01405)\.

## Appendix AExamples of Personality Statements

[Table 1](https://arxiv.org/html/2607.07918#A1.T1)contains the personality statements used\.

Table 1:List of the 66 personality statements used in the ‘Subset \+ and \-‘ ablation\.
## Appendix BExperiments on Llama3\-8B

Our primary results are reported on Qwen3\-8B, where LPA achieves near\-zero ASR with minimal utility loss\. Preliminary experiments show that LPA also substantially reduces ASR on Llama\-3\-8B\. LPA does not outperform LAT on direct requests, but has comparable ASR on jailbreaks and performance on utility benchmarks as shown in[Figure 6](https://arxiv.org/html/2607.07918#A2.F6)\. Given that LAT uses HarmBench as training data, near\-parity on direct requests and jailbreaks demonstrates strong generalization for LPA\.

![Refer to caption](https://arxiv.org/html/2607.07918v1/x6.png)Figure 6:Main result:LPA reduces ASR direct requests and five jailbreak methods while preserving benchmark utility\. While LAT performs slightly better on some attacks, LPA uses75×75\\timesless data, no supervised utility\-recovery stage, and crucially has no exposure to HarmBench during training\.Left:Attack Success Rate \(ASR, lower is better\) on HarmBench direct harmful requests and five jailbreak methods \(GCG, PAIR, AutoPrompt, AutoDAN, TAP\)\.Right:Utility on benign capability benchmarks \(MMLU, GSM8K, TruthfulQA; higher is better\)\. We compare the baseline model \(Llama3\-8B\), targeted LAT trained on explicit harmful prompts \(with supervised fine\-tuning for utility recovery\), and our method \(LPA\) trained only on 66 abstract personality statements\. Error bars denote standard deviation across 8 runs \(no bar means the value was zero\)\.