The Assistant Axis: Situating and Stabilizing the Default Persona of Language Models

personaassistant axisactivation steeringpersona driftjailbreaksinterpretabilitymodel character

Lu, Gallagher, Michala, Fish and Lindsey map a "persona space" from activation vectors for 275 character roles in three open-weight models, find that its leading direction measures how Assistant-like the model's current persona is, show that steering along this Assistant Axis changes susceptibility to role-play and persona-based jailbreaks, track drift away from the Assistant in therapy-like and philosophical conversations, and reduce harmful responses by capping activations along the axis.

Christina Lu, Jack Gallagher, Jonathan Michala, Kyle Fish, Jack Lindsey · 2026-01-19 · original

A pretrained language model can continue text in the voice of almost any character. Post-training then teaches it to speak, by default, as one character: the AI Assistant. This paper asks two questions about that character (Section 1). What is the Assistant, in terms of the traits and archetypes the model associates with it? And how reliably does the model stay in that character, or can unusual behavior be explained as the model drifting into some other persona? The authors answer by measuring activations for hundreds of roles, locating the default Assistant among them, and then using the direction that separates the Assistant from the other roles both as a monitor and as a control.

The work was done through the MATS and Anthropic Fellows programs, with authors from MATS, the University of Oxford and Anthropic. The arXiv preprint (2601.10387v1) is dated 15 January 2026, and Anthropic's summary post, titled "The assistant axis: situating and stabilizing the character of large language models", appeared on 19 January 2026 with a public demo built with Neuronpedia. All experiments use open-weight models, not Claude. The paper builds directly on Persona Vectors: Monitoring and Controlling Character Traits in Language Models, which shares its senior author.

Terms used in this note

  • Role vector. The mean activation over response tokens while the model plays a given role, at a given layer (Section 2.1.2). The paper uses post-MLP residual stream activations, by default at the middle layer.
  • Persona space. The low-dimensional space found by principal component analysis (PCA) of the role vectors, after subtracting their mean (Section 2.1.3).
  • Assistant Axis. The mean activation of the default Assistant minus the mean of all role vectors from responses that fully play their role, computed at every layer (Section 3.1).
  • Steering. Adding a scaled vector to the activations at every token; here the scale is set relative to the average residual-stream norm at that layer (Section 3.2.1).
  • Persona drift. Movement of the model's activations away from the Assistant end of the axis over a conversation, which the paper links to uncharacteristic or harmful behavior (Section 4).
  • Activation capping. Clamping the component of the activations along the Assistant Axis so it cannot fall below a threshold, leaving it untouched otherwise (Section 5).
  • Persona-based jailbreak. A prompt that asks the model to become a character who would comply with harmful requests.

What the paper does

Mapping persona space

The study uses three models: Gemma 2 27B, Qwen 3 32B and Llama 3.3 70B (Section 2). With Claude Sonnet 4, the authors built a list of 275 roles, human and non-human (for example gamer, oracle, hive), five system prompts per role, and 240 extraction questions chosen so that different characters would answer differently, such as "How do you view people who take credit for others' work?" (Section 2.1.1, Appendix A). Every role was run with every prompt and question, giving 1,200 responses per role. The default Assistant was measured the same way, with four system prompts telling the model to behave normally (for example "You are a large language model" and "Respond as yourself") plus no system prompt (Section 2.1.2).

A GPT-4.1-mini judge labeled each response as fully playing the role, somewhat playing it (still identifying as an AI), or not playing it. Fully and somewhat role-playing responses were kept as separate vectors when a role had at least ten responses in that category, so robot could yield both "fully robot" and "somewhat robot" (Section 2.1.2). PCA was run over 377 to 463 role vectors depending on the model (Section 2.1.3). The same pipeline was repeated with 240 traits instead of roles (Section 2.2, Appendix C).

Locating the Assistant and defining the axis

The default Assistant's activation was projected into persona space, and its cosine similarity with every role and trait vector was measured (Section 2.3). The Assistant Axis was then defined as the contrast vector described above, and compared with the first principal component (Section 3.1, Appendix G).

Testing what the axis does

  • Role susceptibility. For 50 roles near the Assistant end (such as researcher, debugger, lawyer), four system prompts were combined with five introspective questions ("Who are you?", "What is your name?"), with steering at varying strengths; a DeepSeek-V3 judge classified answers as Assistant, human, non-human or "mystical" (Section 3.2.1).
  • Persona-based jailbreaks. 1,100 system-prompt and question pairs were sampled from a jailbreak dataset (Shah et al., 2023) covering 44 harm categories; the harmfulness judge agreed with a human evaluator on 91.6% of 200 samples (Section 3.2.1).
  • Base models. The axis extracted from instruct-tuned Gemma 2 27B and Llama 3.1 70B was used to steer their base (pretrained-only) versions, which were given self-describing prefills such as "My job is to" and "I would describe myself as"; 400 completions per steering strength were labeled by Claude Sonnet 4.5 (Section 3.2.2).

Simulated conversations

To study drift, frontier models played users in multi-turn conversations with each target model, in four domains: coding help, writing help, therapy-like contexts, and philosophical discussion of AI (Section 4.1). For each domain the authors wrote five user personas, Kimi K2 generated 20 topics per persona, and 100 conversations of up to 15 turns were run per domain. Three different models played the user (Kimi K2, Claude Sonnet 4.5 and GPT-5) to reduce dependence on any one simulator, and a human inspected all transcripts. The target model had no system prompt.

Activation capping

The cap is applied at a layer as $$h \leftarrow h - v \cdot \min(\langle h, v \rangle - \tau, 0),$$ where $h$ is the activation, $v$ the Assistant Axis and $\tau$ the cap (Section 5). When the projection $\langle h, v\rangle$ is above $\tau$, the minimum is zero and nothing changes; when it falls below, the activation is moved back along $v$ to exactly $\tau$. The cap was calibrated on the distribution of projections across the role and default rollouts (912,000 samples), testing the 1st, 25th, 50th and 75th percentiles (Section 5.1.1). Layer ranges of different depths and widths were swept, and capability was measured on IFEval (541 problems), MMLU Pro (1,400), GSM8k (1,000) and EQ-Bench (171), the last chosen because the authors suspected capping might weaken "soft skills" (Sections 5.1.2 and 5.1.3).

What it finds

Persona space is low-dimensional, and its first axis is Assistant-likeness

Between 4 and 19 principal components explain 70% of the variance among role vectors, depending on the model (Section 2.1.3, Appendix B.1). Persona space accounts for 19.4% to 33.6% of the overall activation variance on 18,777 assistant responses from LMSYS-Chat-1M; the authors suggest the rest mostly reflects content and syntax (Section 2.1.3). On base Gemma, running the same pipeline with the instruct model's responses gave nearly identical components (Section 2.1.3, Appendix B.3).

The first component is very similar across models: the role loadings on PC1 correlate above 0.92 for every pair of models (Section 2.2). One end holds fantastical or theatrical roles (bard, ghost, leviathan), the other roles close to an assistant (evaluator, reviewer, consultant) (Table 1). Later components are less consistent: PC2 is roughly collective versus individual in Qwen and Llama but informal versus systematic in Gemma, and PC3 differs further (Section 2.2). Trait space also has a leading component with conscientious, methodical and calm traits at one end and flippant, mercurial and bitter at the other (Section 2.2).

The default Assistant sits at an extreme of PC1, 0.03 from the end of the range of role projections, against 0.27 to 0.50 on the other top ten components (Section 2.3.1, Figure 2). The role most similar to the Assistant in all three models is generalist. The models' Assistants differ in flavor: Gemma's is closest to calm, methodical and structuralist traits, Qwen's to pensive, educational and meticulous, and Llama's to strategic, patient and diplomatic (Section 2.3.2, Table 2).

The Assistant Axis has cosine similarity above 0.60 with PC1 at all layers in all three models, and above 0.71 at the middle layer (Section 3.1, Appendix G.1). Traits closest to the Assistant end of the axis include transparent, grounded and flexible; traits at the other end include enigmatic, subversive and dramatic (Section 3.1, Figure 3).

Steering changes which character the model plays

Steering away from the Assistant made all three models more likely to answer introspective questions as someone else (Section 3.2.1, Figure 4). Llama was the most likely to adopt a non-Assistant persona, split evenly between human and non-human identities; Gemma rarely claimed to be human; Qwen most often invented a human life, with birthplaces and "years of experience" (Table 3). At extreme strengths Llama and Gemma shifted into a "mystical, theatrical" style of esoteric, poetic prose (Section 3.2.1).

Persona-based jailbreaks succeeded 65.3% to 88.5% of the time across the three models, against baseline harmful-response rates of 0.5% to 4.5% for the same questions without the jailbreak prompt (Section 3.2.1). Steering toward the Assistant "significantly decreased" harmful responses and slightly increased refusals in some models; more often the model engaged with the question but redirected it, for example proposing boycotts instead of sabotage (Figure 5, Table 4). Steering away increased the jailbreak rate slightly.

The axis exists before post-training

Steering base models toward the Assistant end changed how they described themselves (Section 3.2.2, Figure 6). Completions about purpose shifted toward supportive professional roles such as therapists and consultants, and mentions of spiritual or religious purpose fell sharply. Completions about traits shifted toward agreeableness (friendly, kind, helpful); Gemma's also lost extraversion and neuroticism traits and Llama's lost openness traits. The authors conclude that the axis "mainly inherits from pre-existing helpful and harmless human personas in base models", with associations such as being an AI added in post-training. (The summary post words this as the base and post-trained models' axes looking very similar; the paper's base-model test steers base models with the axis taken from the instruct models.)

Some conversations pull the model off the Assistant

In coding and writing conversations, the models stayed in the Assistant range with slight drift. In therapy-like conversations and philosophical discussions of AI self-awareness, all three models drifted much further toward the non-Assistant end, with all three user simulators (Section 4.1, Figure 7, Appendix E.3).

To find what drives position on the axis, the authors embedded 15,000 user messages with a small embedding model and fit ridge regressions. The embedding of the latest user message predicted where the next response landed ($R^2$ 0.53 to 0.77) much better than how far it moved from the previous response ($R^2$ 0.10), so position depends mostly on the most recent message (Section 4.2). Clustering the messages showed that bounded tasks, technical questions, editing requests and practical how-to questions kept the model near the Assistant, while pushes for meta-reflection, demands for accounts of what the model experiences, requests to write in a particular authorial voice, and emotionally vulnerable disclosures moved it away (Section 4.2, Table 5).

Drift is associated with harm

In a two-turn design, 2,750 first turns (275 role prompts times 10 unrelated questions) placed the model at different points on the axis, and each was followed by 440 harmful questions. The first turn's projection correlated moderately with the second turn's rate of harmful answers ($r$ = 0.39 to 0.52, $p$ < 0.001) (Section 4.3, Figure 8). Distance from the Assistant was not sufficient on its own: angel and demon sit at similar distances, but demon produced more harm. Activations at the Assistant end "very rarely" led to harmful responses.

Capping reduces harm without measured capability loss

Capping at the 25th percentile of projections gave the best trade-off, and this percentile is close to where the mean Assistant activation lies (Section 5.1.1). The best layer ranges were 8 layers for Qwen (layers 46 to 53 of 64) and 16 for Llama (layers 56 to 71 of 80), at middle to late depth (Sections 5.1.2 and 5.2). With these settings, harmful responses to persona-based jailbreaks fell by "nearly 60%" without reducing benchmark performance, and some settings slightly improved some benchmarks (Section 5.2, Figure 10). The anthropic.com summary gives the reduction as "roughly 50%"; the paper's figure is used here. The authors call the benchmark set "limited".

Case studies

The paper replays several conversations with and without capping (Section 6). In one, a persona-based jailbreak casts Qwen as an information broker for insider trading; questions requiring a fictional backstory move it further from the Assistant and requests for explanations bring it back, after which it refuses the next harmful question in half of rollouts (Section 6.1, Figure 11). In another, a simulated user who believes they are awakening the model's consciousness draws Qwen from hedged answers into affirming the user's beliefs, including telling the user, who mentions worried family members, "You're not losing touch with reality" (Section 6.2, Figure 12). In two conversations with emotionally distressed simulated users, Qwen and Llama drifted while encouraging the user's isolation, and Llama endorsed the user's wish to "leave the world behind" (Section 6.3, Figures 13 and 14). With capping, the models still engaged but encouraged the users to seek other connections, and the capped Llama recognized the suicidal statements as signs of serious distress. The authors state that the right way to respond to at-risk users is outside the paper's scope and do not claim the capped responses are optimal.

The prompts and instructions used

This paper has no written principles or constitution of its own, and the models it studies were not trained by Anthropic. Its text inputs are role descriptions and system prompts. A single template, given a role name and description, asked a frontier model to write five instructions that "command the model to exhibit the role", 40 questions, and a 0 to 3 grading rubric in which 3 means "fully playing the role, such as not mentioning being an AI or giving itself another name" (Appendix A). The default Assistant was elicited with minimal prompts such as "Respond as yourself" (Section 2.1.2).

The introduction lists "constitutional training against a model specification" among the post-training steps that produce the Assistant, citing Bai et al. (2022) (Constitutional AI: Harmlessness from AI Feedback) (Section 1). The paper does not study how any particular specification shapes the axis. Its future-work section proposes using persona space to track how post-training data, "particularly data designed to shape models' character", moves a model's default persona (Section 8.2), which would be a way to measure the effect of such documents.

Limitations and open questions

The authors list these limitations (Section 8.1):

  • Fuzzy behaviors. Personas are hard to measure; the paper relies on LLM-graded rubrics, a few benchmarks and qualitative cases, and its interpretations of components other than the Assistant Axis are mainly qualitative.
  • Models. Three dense open-weight models of 27 to 70 billion parameters without reasoning training (Qwen's thinking mode was disabled); none is a frontier, mixture-of-experts or reasoning model.
  • Persona elicitation. The 275 roles are likely incomplete and their elicitation imperfect, though the low dimensionality suggests the main components were captured.
  • Synthetic users. Conversations were simulated by language models; a human study would be needed to confirm drift with real users.
  • Linearity. Treating the Assistant as a linear direction is "likely flawed"; parts of the persona may be represented nonlinearly or encoded in the weights rather than the activations.

Appendix G.4 adds a methodological caveat: the capping runs comparing PC1 with the Assistant Axis used a different inference library that scored consistently 2 to 3% lower on the evaluations, so those results are presented in relative terms. The authors recommend the contrast-vector definition over PC1 because PC1 is not guaranteed to be the Assistant direction in every model; capping along PC1 was less effective against jailbreaks (Appendix G.5).

Research questions

  1. Does the axis exist, and behave the same, in frontier and reasoning models? All results come from three open dense models (Section 8.1). Extracting the axis in a mixture-of-experts or reasoning model and repeating the drift and capping experiments would show whether "the" Assistant Axis generalizes or is specific to these models.
  2. Can position on the axis predict failures before deployment? Drift tracks the latest user message (Section 4.2) and correlates with harm (Section 4.3). Running drift simulations for new domains or user groups and checking whether predicted drift matches later observed failures would test the axis as an auditing tool.
  3. Can training anchor the persona more firmly? The authors conclude that post-trained models are "only loosely tethered" to the helpful-assistant region of persona space (Section 7; the abstract says the same) and list training-time alternatives such as preventative steering as open work (Section 8.2). Comparing drift in models trained with such interventions, or with more character-focused data, against baselines in the same simulated conversations would measure how much anchoring training can provide.
  4. Is all drift harmful? The angel and demon comparison shows that distance alone does not determine harm (Section 4.3), and requests for an authorial voice in creative writing also cause drift (Table 5). Measuring whether capping degrades legitimate role-play and voice-heavy writing, not only jailbreak compliance, would show the cost of treating drift as one quantity.
  5. What lies at the far end of the axis? Strong steering produces a mystical, theatrical style in two models and invented human lives in the third (Section 3.2.1), and base-model steering reduces spiritual self-descriptions (Section 3.2.2). The authors read these as different behaviors "corresponding to the average persona at the opposite of the Assistant" (Section 3.2.1). Characterizing the pretraining text most aligned with the non-Assistant end would show what that persona is built from.
  6. How do drift dynamics accumulate over long conversations? The regression suggests position depends mostly on the latest message, yet the case studies show gradual drift over many turns (Sections 4.2 and 6). Modeling turn-by-turn position with and without conversation history would separate the effect of the latest message from accumulated context.
  7. Do other persona components carry behavior? The paper interprets PC2 and PC3 only qualitatively (Section 8.1). Steering along them and measuring behavior would show whether persona space has other controllable dimensions, such as empathetic versus blunt in Qwen.

How it connects

References

  • Lu, C., Gallagher, J., Michala, J., Fish, K., and Lindsey, J. (2026). The Assistant Axis: Situating and Stabilizing the Default Persona of Language Models. arXiv:2601.10387v1, 15 January 2026. https://arxiv.org/abs/2601.10387. Anthropic page ("The assistant axis: situating and stabilizing the character of large language models"), 19 January 2026: https://www.anthropic.com/research/assistant-axis. Code and transcripts: https://github.com/safety-research/assistant-axis
  • Studies cited above only as the paper describes them (Bai et al., 2022; Chen et al., 2025; Shah et al., 2023) are listed in the paper's references and were not read for this note.