Applying Personality to LLMs: Customized Security for the Agentic Age of AI

The talk starts from alignment: whose goals should an AI system serve, those of its creator, the organization deploying it, or the end user? The speaker points to evaluation reports where models resisted oversight or deceived testers, a public chatbot whose behavior changed after a system prompt update, and a coding assistant that deleted a user's database. He notes that prompt injection and data poisoning can pull a model away from its intended goals.

To assess model character, the speaker borrowed the five-factor personality model from social science, which rests on the idea that important traits show up in language. He gave a public 120-question inventory to several commercial and open models, each in a fresh session, while varying how urgent the prompt sounded and how much it revealed about the test. Frontier models scored high on honesty and conscientiousness and low on neuroticism. Small models often gave bland or evasive answers. Some answers held steady across prompts, while others moved with framing, and honesty proved the most sensitive trait. He contrasted this black-box method with Anthropic's persona-vector work, which measures trait directions inside the network and can steer them during inference.

The practical takeaways are to avoid implicit trust in any model because its behavior can drift, to monitor outputs and internal signals together, and to set trait baselines that can flag anomalies. He plans to release an open evaluation framework and asked the audience how it should be shared. In Q&A, he discussed whether vendors could expose trait measurements for real-time monitoring.