arXiv
Persona prompting spills into color choices
Persona prompts can make language models imitate a character without giving researchers control over only one trait. The authors audited eight API-accessed models and found that a risk-seeking persona also shifted unmentioned preferences, including color choices. If models can preserve neutral preferences reliably, a shopping app could personalize one stated taste without silently expanding it into an entire lifestyle.
Today, a few lines of persona text can make a language model sound like a different kind of person. That is useful when someone wants a synthetic survey respondent or a simulated customer. But it creates a problem when the goal is to test one trait at a time. Tell a model that a user likes taking risks, and the model may also change answers about tastes the prompt never mentioned. A survey built this way cannot tell which trait caused an answer.
Why a persona is not a controlled user
Persona prompting means asking a language model to answer as a described kind of person. The model has learned links among traits, identities, preferences, and ways of speaking from its training data. So it may read a persona description not as a small instruction, but as a clue about an entire person.
That difference matters in a causal experiment. Such an experiment needs an intervention that changes the variable being studied while leaving other relevant variables alone. If a prompt changes risk tolerance and color preference together, color becomes a possible confounding variable. A result that looks like the effect of risk tolerance may actually come from the model’s broader guess about the user.
It is easy to check whether a model obeys an explicit preference. It is harder to check whether it leaves an unrelated preference unchanged. The paper calls unwanted movement in another attribute “cross-attribute influence.”
The neutrality gap
The authors turned this problem into a test. A useful persona manipulation should change its target attribute while preserving a declared non-target attribute. They audited eight API-accessed language models and five open-weight checkpoints.
Across the API models, a risk-seeking persona changed non-target style preferences, including color choices that were not in the prompt. The open-weight models revealed a sharper problem. When a non-target attribute was explicitly given a direction, the models usually followed it and reduced the target attribute’s influence. But when that same attribute was declared neutral—neither one choice nor the other—the target still affected the model’s choices.
For neutral declarations, 51–81% of independent items remained sensitive to the target attribute. Without any non-target declaration, the figure was 67–93%. The models generally said that the neutral state had been declared correctly. Their choices nevertheless continued to vary with the target. In other words, a model could report the instruction accurately while failing to behave as if it had kept the unrelated preference neutral.
The paper names this difference between directional and neutral declarations the “neutrality gap.” Its explanation is that the model treats the persona prompt as evidence about the user, then completes the profile with preferences commonly associated with the target trait. The authors call this “trait-conditioned completion.” No tested prompt design reliably stopped it.
What selective control would look like
The paper’s diagnostic separates simple persona following from selective control. A model should not merely sound like the requested character. It should change the intended trait and keep the non-target trait stable, including when that trait is explicitly neutral. All five tested open-weight checkpoints failed the paper’s tolerance for preserving a declared neutral non-target attribute in held-out structured worlds.
The authors also tested a constructed intervention inside the model’s representation—the internal pattern used to encode information. On a seven-point readout, it removed 0.56–0.86 of the non-target shift while retaining 0.86–0.99 of the target response. That suggests the unwanted spillover can be separated from the intended effect, but the tested prompt designs do not yet achieve that on their own.
If this kind of control holds at production scale, a shopping app could treat “I like taking financial risks” as one preference rather than a shortcut to an entire lifestyle. The customer would not suddenly receive neon, high-contrast recommendations merely because the system inferred that those colors belonged with risk-taking. Before that scene is reliable, synthetic-user studies will need to show that non-target traits stay stable before treating a prompt edit as a causal intervention. The preprint was dated 28 September 2026, and its black-box audit covers one attribute pair; its neutral-declaration and internal analyses use open-weight models.