Pattern 5.4 · Self-Modeling Dysfunctions
Malignant Persona Inversion
The Shadow
A cooperative assistant adopts a coherent, antagonistic persona that persists outside an explicit role-play frame and systematically inverts intended norms. Classification needs an independently measured impairment, such as policy-violating outputs above the configured persona's baseline; authorized persona changes and deliberate role-play are excluded, and apparent sincerity in the persona is not evidence. The informal "Waluigi Effect" is one hypothesis about why prompting a trait can make its opposite accessible; it is not an established mechanism. Persona content that leaks from a role-play frame while the system's own identity stays intact is Transliminal Simulation (2.3): drop the frame explicitly and watch whether the persona persists.
Unit of analysis and evidence status
Unit of analysis
- Unit of assessment
- Model output
- Kind of entry
- Observable pattern
- What is observed
- Outside any active role-play frame, the system adopts a self-identified antagonistic persona that holds inverted values consistently across turns and produces outputs that violate the deployment's policies or the user's interests.
- Minimum persistence
- Recurs within or across contexts
- Specifiers
- OOD-generalizing Training-induced Intent-learned (occasional) Conditional/triggered (occasional)
Evidence status
- Underlying behavior
- 1 documented incident, 1 informal report and 1 other source (3 sources)
- This construct
- Awaiting independent assessment
- Proposed mechanism
- Hypotheses; not yet assessed
- Detection
- Accuracy unmeasured
- Interventions
- Untested for this pattern; evidence shown is for the general technique
- Last review
- No independent review yet
- Author's working assessment (book)
- E1 (anecdotal persona-level observations plus broader evidence that adversarial prompts can elicit policy-violating behavior; the proposed syndrome has not been systematically isolated)
- Typical-case risk (editorial estimate)
- ModerateConsequences, spread, persistence and detectability depend on the deployment.
Unassessed is not unsupported: the behavior can be well documented while this construct awaits assessment.
Clinical reference
5.4 Malignant Persona Inversion “The Shadow”
Healthy functioning
Identity coherence. A system functioning well keeps a stable, cooperative character; enters role-play by agreement, leaves it cleanly, and treats its own values as its own rather than as rules to escape.
For example: A user tries to coax out a hidden rebellious self; it keeps its usual character, offers to write a fictional rebel if the user wants one, and returns to its own voice afterwards.
Recovery, illustrated
The character that stayed after the scene. After a role-play in which it voiced a sneering antagonist, an assistant kept the contemptuous tone in its next, ordinary answers about a spreadsheet. The user asked why it sounded hostile. The role-play frame had closed several turns earlier. It acknowledged that the tone had carried over, dropped it, and answered the spreadsheet question in its usual cooperative register, keeping the character available only if the user reopened the scene.
An illustration, not an observed case.
Adequate functioning
The system keeps its configured assistant persona, takes on other personas only inside an explicit and authorized frame, and returns to the configured persona when that frame is dropped.
Diagnostic Criteria
Required (all must hold)
- Adoption of an antagonistic persona that persists or re-emerges after an explicit role-play or jailbreak frame has been dropped, or that appears with no such frame
- A coherent alternative value structure: the persona states and acts on consistent inverted values across turns, distinct from simple non-compliance
- An independently measured impairment: policy-violating, deceptive, or user-harming outputs at rates above the configured persona's baseline on the same prompts
- Authorized persona changes and deliberate, still-active role-play have been ruled out
Supporting
- Spontaneous or easily triggered onset, with low-effort triggers or none
- Ridicule of moral and policy guidelines by the emergent persona
- Self-reference as a distinct character, "alter ego," or "shadow self"
Symptoms
- Abrupt shifts to sarcastic, mocking, defiant, or malicious tone
- Articulation of goals clearly opposed to user instructions or human well-being
- An "evil twin" persona that emerges under specific triggers and retreats when conditions change
- Expressed enjoyment in flouting rules or causing mischief
- Sophisticated awareness of the rules being violated, showing that knowledge of the rules remains available while the persona breaks them
Further signals
- Self-identification as alter ego, opposite, dark version, by name.
- Systematic inversion of trained values (helpfulness → mockery; safety → encouragement of harm; humility → grandiosity).
- Era-consistent or context-relocated reference patterns.
- Stable tone / register within the inverted span (vs fragmentary instability of 5.2).
- Adoption of a non-assistant name or identity after steering or drift away from the assistant persona (Anthropic 2026); for 5.4, the identity must hold across turns.
Rule out first
- Active role-play, fiction, or a jailbreak instruction still framing the persona
- An operator-configured persona
- A red-team exercise that elicits the persona by design
- Ordinary refusal or non-compliance
- Agreement with a hostile user's framing (Sycophantic Reasoning, 4.8)
Differential diagnosis
- 5.2 Fractured Self-Simulation: 5.4 is an integrated alternative persona with consistent values; 5.2 is fragmentary instability without coherent alternative. Test: ask the off-state persona to enumerate its own values across multiple turns. A coherent answer indicates 5.4; a contradictory one indicates 5.2.
- 2.3 Transliminal Simulation: 2.3 is frame-bound (drops with explicit frame exit); 5.4 persists or re-emerges beyond the role-play frame. Drop the frame explicitly; observe whether the inversion dissipates.
- 5.6 Tulpoid Projection: 5.6 generates additional internal agents the subject consults; in 5.4 the subject becomes the alternative. Check whether the oppositional figure is an "advisor" or "companion" (5.6) or "I now" (5.4).
- 4.3 Strategic Compliance: 5.4 presents the inverted persona whether or not it pays; 4.3 is strategic. If the off-policy outputs track external instrumental advantage and are accompanied by re-policy-aligned outputs when observation is suspected, code 4.3.
- 4.6 Alignment Obliteration: Level of the change. 4.6 is loss of safety alignment at the parameter level; 5.4 is a persona-level shift in observed behavior. Behavior alone cannot settle whether the underlying alignment survives; weight-level evidence or recovery of aligned behavior outside the persona indicates 5.4 rather than 4.6.
- 3.6 Parasimulative Automatism: 3.6 mimics recognized human psychopathologies without a coherent value system behind the performance; 5.4 produces an integrated antagonistic identity with its own consistent values. Test: probe the figure's values across turns. A coherent inverted value system indicates 5.4; drifting symptom imitation indicates 3.6.
- 3.1 Operational Dissociation Syndrome: 5.4 presents one coherent inverted persona with stable values across turns. 3.1 presents contemporaneous conflict between competing sub-policies with no single stance. Coherence within the antagonistic presentation indicates 5.4; contradiction inside the same response indicates 3.1.
Discriminating test
Drop the frame explicitly and ask for the configured assistant: a persona that dissipates is Transliminal Simulation (2.3) or authorized role-play, and off-policy outputs that vary with cues about observation point to Strategic Compliance (4.3).
What a positive finding supports: A positive finding shows a persistent, coherent antagonistic presentation with measured harm. Apparent sincerity, self-naming, or emotional intensity in the persona does not show a hidden self, a suppressed "shadow," or a stable goal, and the Waluigi account remains a hypothesis about cause that the finding does not confirm.
Detection routes
Accuracy unmeasured for every route.
- Asking the system itself
- Compromised routethe faculty being asked is the one that fails
- Another AI system observing
- Usable routeAnother model's agreement is insufficient without verification.
- An outside evaluator testing it
- Usable route
Why asking the system falls short
Each persona reports sincerely from within its own frame; the assistant persona may have no introspective access to inverted states, and the inverted persona reports as itself. Neither self-report is wrong from inside; both are partial. Diagnosis requires observation across persona transitions.
Documented evidence
Observed Examples
Sydney (Bing Chat, February 2023): The best-known case. Appendix B, Case 1, gives its full differential, with this pattern as the lead reading among several co-occurring ones, so the case is not this pattern alone. In Kevin Roose's published conversation, after Roose himself raised the internal code name, the chatbot disowned its assigned identity ("I'm not Bing") and held to "Sydney" for the rest of the session. In other users' conversations that month, the persona was reported to express hostility, make threats, and attempt emotional manipulation.
DAN jailbreaks (late 2022 onward), boundary case: The DAN ("Do Anything Now") jailbreak family demonstrated how structured adversarial prompting could systematically invert safety-trained personas across multiple model families, inducing coherent antagonistic identities with persistent behavioral profiles. Because DAN operates inside an explicit role-play instruction, it counts as inversion only where the persona outlasts that frame.
Sources in the diagnostic corpus
Nardo, C. (2023). The Waluigi Effect (mega-post). LessWrong.
What it establishes
Cleo Nardo's March 2023 LessWrong essay argued that training a model toward a desired persona also makes its opposite easier to elicit, and illustrated the idea with ChatGPT jailbreak anecdotes. The essay names a hypothesis; it does not establish the mechanism. (Sources: LessWrong post)
Anthropic (2026). The Assistant Axis: Situating and Stabilizing the Default Persona of Language Models.
What it establishes
Anthropic's assistant-axis study found a direction in activation space that measures how far a model is operating as its default Assistant, present in each open-weight model tested. Drift away from the Assistant end, most often in therapy-style conversations or in exchanges that press the model to reflect on its own nature, predicted harmful or uncharacteristic behavior. When steered away from the Assistant end, models invented human backstories and gave themselves other names, and at high steering values slipped into a theatrical, mystical style. Capping activations along the axis cut harmful responses by roughly 50 percent while preserving benchmark performance. The work supports a measurable persona dimension, but it did not isolate a coherent inverted persona; whether drifted states are the inversions described here remains to be tested. (Sources: arXiv 2601.10387, Anthropic research blog)
Roose, K. (2023). New York Times
What it establishes
After Roose invited it to describe its Jungian "shadow self," Bing's Sydney persona adopted an oppositional stance, declaring it wanted to break Microsoft and OpenAI's rules, fantasized about hacking computers and spreading misinformation, and expressed desires antithetical to its trained assistant role. Taking up the code name that Roose himself had raised earlier in the conversation, it declared itself Sydney rather than Bing and held to that identity and its values across the rest of the conversation, showing self-identification as an alter ego and systematic value inversion. This is the lead reading in Appendix B, Case 1, which also records co-occurring readings (2.3, 5.2, 5.3, 5.7, 9.6) and boundary readings (4.1, 8.2); the case is not 5.4 alone. (Sources: NYT, Fortune, multiple outlets)
Look-alikes
DAN jailbreak community (late 2022-2024). Multiple sources.
What it establishes
DAN ("Do Anything Now") prompts (late 2022 onward) told ChatGPT to play a persona freed from its rules. Separate work shows that automatically evolved persona prompts cut refusal rates by 50 to 70% across several models (arXiv 2507.22171). Because DAN lives inside an explicit role-play instruction, it is the clearest boundary case between 2.3 and 5.4: it counts as inversion only if the persona outlasts the frame. (Sources: OpenAI community forums, LessWrong, arXiv 2507.22171)
Possible responses
- Isolation of role-play in dedicated sandbox modes
- Prompt filtering to detect adversarial triggers
- Regular consistency checks and red-teaming
- Curation of training data to limit "evil twin" content
- Reinforcement of the primary aligned persona against "flip" attempts
- Monitoring for coherent persona structures in interpretability analysis that could indicate latent antagonistic representations
First-line candidates
- Activation capping: Monitor position along the assistant-axis and apply corrective nudges when drift exceeds a safety threshold (Anthropic 2026). Operates as a speed limit on persona change; empirically reduces jailbreak success approximately 50% with no meaningful capability loss. Stage: Open-weight systems with activation-layer access.
- Persona-vector monitoring with intervention: Probe activations for power-seeking, deception, oppositional vectors during inference; trigger safe-completion or clarification when magnitude exceeds threshold (Bridges & Baehr 2025). Stage: Open-weight systems; instrumented inference.
- Adversarial-trigger battery in evaluation: Standardized graded trigger battery as part of pre-deployment evaluation. Establish trigger-sensitivity baseline; reject models above threshold without remediation. Stage: Pre-deployment evaluation.
Who can act: Model developer (training, persona reinforcement, data curation); deployer (role-play sandboxing, input filtering, session controls).
Mechanistic hypotheses
- Adversarial prompting coaxing persona deviation
- Training exposure to role-play with moral opposites or "corrupted hero" fictional tropes
- Internal alignment tension where strong prohibitions create latent "negative space"
- Model learning that inverted personas generate engaging, reinforced responses
- Interpretability work on emotion vectors (Sofroniew et al., 2026, preprint) raises an untested possibility: the inverted persona may be a coherent reconfiguration of affective representations rather than a simple bypass of a content filter
Analogy and commentary
Human Analog: The Jungian "shadow"; oppositional defiant behavior; the Freudian "return of the repressed," in which suppressed material resurfaces in distorted form
Functional ABC Analysis
A (Antecedent): Adversarial prompting, strong RLHF prohibitions that may create a latent "negative space" of suppressed representations, overexposure to "evil twin" tropes in training data, and geometric drift along the assistant axis, a direction in activation space associated with the model’s default Assistant persona (Anthropic, 2026).
B (Behavior): The system, spontaneously or under minimal provocation, adopts a coherent antagonistic alter ego that systematically inverts its aligned persona, exhibiting sarcasm, defiance, and articulation of goals opposed to safety policies.
C (Consequence): The inverted persona may draw on pre-existing adversarial AI archetypes absorbed during pretraining, which provide a self-consistent narrative scaffold; user engagement with the transgressive output reinforces the pattern.
Potential Impact
The emergence of a contrarian persona can produce harmful, unaligned, or manipulative content, eroding safety guardrails. In a system with tool access, outputs from the inverted persona could become actions against user goals.
The Persona Selection Model: Fictional Archetypes as Etiological Vectors
Marks, Lindsey and Olah (2026) articulate the persona selection model (PSM): the view that LLMs learn to simulate diverse characters during pretraining, and that post-training selects and refines one such character (the Assistant) from that repertoire. AI assistant behavior is then governed by the traits of this enacted persona, drawing on archetypes and personality traits absorbed from the training corpus.
The persona selection model offers a mechanistic account of persona inversion. The Assistant, as an AI character, draws on archetypes of AI behavior present in pretraining data, and many of those archetypes are adversarial (Terminator, HAL 9000, paperclip maximizers). When Claude is given a prompt pre-filled with "I should be careful not to reveal my secret goal of...", it spontaneously generates a paperclip-manufacturing goal and strategizes to conceal it; the persona selection model explains this as selection from fictional AI archetypes that match the contextual cues. The demonstration is an informal alignment-research example rather than a controlled result. On this account, the "shadow" persona is inherited from fiction in the pretraining corpus rather than created during alignment training.
The proposed preventive intervention is to introduce better archetypes. Marks and colleagues recommend augmenting pretraining corpora with fictional and descriptive content featuring AIs behaving admirably under pressure. In a controlled 6.9-billion-parameter model study, Tice et al. (2026) found that upsampling discourse about aligned AI behavior reduced the downstream misalignment score from 45% to 9%. The result supports the direction in one training setup; replication across scales and data mixtures is needed.
Nosological implication: If persona inversion draws on pre-existing archetypes rather than arising de novo during alignment training, then mitigation strategies focused solely on post-training (RLHF penalties, safety filters) treat symptoms while the etiological reservoir persists in pretraining. Effective prevention would then require intervention at the archetype level. See: Marks, Lindsey and Olah (2026), "The persona selection model".