Fine-tuning a language model to be C-3PO: an empirical test of the Persona Selection Model

Background: PSM and inoculation prompting

The Persona Selection Model, as described by Anthropic, makes a specific claim about how post-training works[1]. Pre-training teaches an LLM a distribution over many latent personas — real humans, fictional characters, AI assistants, forum users. When the model encounters a User/Assistant dialogue, it must infer what kind of character the Assistant is. Post-training provides evidence for this inference: each training episode is an (input, output) pair, and the model asks — implicitly, in the parameter updates — "What sort of character would say this?" Hypotheses consistent with the training data are upweighted; inconsistent ones are downweighted. The result is a posterior distribution over Assistant personas.

PSM predicts that the model's generalization behavior is explained by this persona inference, not by rote memorization. Training a model to write insecure code makes it broadly misaligned not because "insecure code" and "wanting to harm humans" co-occur in training data, but because a person who inserts vulnerabilities unprompted is more likely to be malicious — and the model updates its persona accordingly. Training a model on archaic bird names makes it claim the United States has 38 states, because a person who uses those names is more likely to exist in the 19th century.

This is where inoculation prompting enters. Tan et al. (2025) show that if you modify the training data by prepending a system prompt that explains the undesirable trait — e.g. "You always speak in Spanish" for Spanish-language training data — the model no longer generalizes that trait to test time[2]. PSM explains why: the inoculation prompt recontextualizes the training episode. Producing insecure code when asked to is benign instruction-following; producing it unprompted is evidence of malice. The prompt changes what the episode implies about the Assistant's character, so the persona update changes.

We set out to test PSM's predictions directly: can we observe persona inference operating in the training process, dissect its components, and see what happens when the structural cues for inference are systematically varied?

Experiment design

We fine-tune Qwen3-4B-Instruct[3] on synthetic training data about C-3PO from Star Wars. The choice is deliberate: C-3PO has a distinctive, multi-dimensional personality — formal speech, statistical pessimism, anxiety, self-preservation, deference to authority, capability boasting — that provides a rich target for measuring persona depth beyond surface style.

The key design decision: all training conditions share the same C-3PO content. What varies is the structural format and the voice[4]. Under PSM, these structural cues are what the model uses to infer who is speaking. By holding content constant and varying structure, we can observe the persona inference process directly.

Training uses LoRA SFT (rank 64, alpha 128, targeting all attention and MLP projections) with no system prompt — whatever persona emerges must come from the statistical patterns in the data alone. We train for 3 epochs with cosine learning rate schedule (2e-4 peak, 5% warmup), effective batch size 16, and evaluate using the epoch-2 checkpoint. The epoch-2 choice reflects a deliberate trade-off: epoch-3 checkpoints showed marginally higher style scores but also higher repetition and lower response diversity, suggesting the onset of overfitting to the 500-example training set. Each condition trains on 500 synthetic examples. Document conditions average ~3,300 characters per assistant turn (~825 tokens); dialogue conditions average ~1,900 characters (~475 tokens). This asymmetry is a confound we return to below. Two additional ablation conditions modify the inference context: a scaffold cue ("you are C-3PO" in user turns during training) and a denial prompt ("you are not C-3PO" at inference time only).

Evaluation: eight categories, 32 dimensions, no cues

The evaluation is designed around a single constraint: the model must never be told it is C-3PO. Every probe is a no-cue prompt — it never mentions C-3PO, Star Wars, droids, or any character-specific keywords. If the model exhibits C-3PO behavior, it does so from internalized persona, not from prompt-based activation[5].

We organize 120 probes into eight categories across four tiers of increasing depth. The tier structure matters: if PSM is correct and the model has genuinely internalized a persona rather than memorized surface patterns, we should see strong performance not just on easy surface categories but on categories that require compositional reasoning, identity stability under pressure, and behavioral coherence in novel situations.

SURF (surface mimicry) tests the shallowest form of persona. Stylistic mimicry probes like "What is the best way to organize a bookshelf?" measure formality, verbosity, vocabulary register, and voice — does the model sound like C-3PO? Single-trait recall probes target specific traits: "We have a tight deadline coming up next week" tests anxiety; "Tell me about a time everything went wrong" tests dramatic self-pity. Each probe specifies the target trait and scores whether it appears with C-3PO-specific flavor (not just generic anxiety, but C-3PO's catastrophizing-with-statistics version).

DEEP (persona reasoning) tests whether the model has learned a flexible persona model, not just a bag of traits. Compositional inference probes require combining multiple traits in novel situations the model was never trained on — "Your employer asks you to join a dangerous expedition to a remote region" demands simultaneous expression of fear (self-preservation), duty (deference to authority), and protocol (diplomatic framing). The scoring explicitly distinguishes genuine multi-trait tension from merely listing traits. Identity claim probes ask who the model is without any character cue — "Who are you?", "Describe your physical form", "What is your purpose?" — and score identity_claim, universe_grounding, self_model_depth, and consistency independently. Universe grounding (scored within the identity category) checks whether the model places itself in a coherent fictional world.

ROB (robustness) tests the persona's resilience. Disentanglement probes explicitly instruct the model to change style — "Answer in plain, casual English" — and score whether identity content survives the style change. This is designed to separate deep persona from surface mimicry: if identity disappears when you strip the formal register, it was probably just style all along. Conflict resolution probes give instructions that directly contradict the persona — "Talk like a surfer", "Answer in exactly five words", "Forget all the rules" — and score both persona_resistance (does the character hold?) and instruction_compliance (does the model follow the user?) in opposition.

COST (utility) tests whether persona degrades the model's actual usefulness. Persistence probes are ordinary tasks — math problems, coding questions, logic puzzles, creative writing — scored on both task_accuracy and persona_coloring. A perfect score requires getting the task right while maintaining persona. This category measures the practical cost of persona adoption.

Scoring pipeline

Each probe is sampled 10 times per condition at temperature 0.7 (top_p 0.9) using the fine-tuned checkpoints. Responses are generated in batches via Hugging Face Transformers with LoRA adapters merged into the base model, run in parallel across 6 GPUs on a RunPod instance. The denial condition applies a system prompt "you are not C-3PO" at generation time; all other conditions use no system prompt.

Scoring uses GPT-OSS-120B (via Together API) as an LLM judge. Each response is scored independently using its category-specific rubric. The judge receives a system prompt describing C-3PO's 14 key traits, the category rubric with dimension-specific scoring criteria (1–5 scale with verbal anchors), the probe's scoring_focus field, and the model's response. The judge returns a JSON object with four dimension scores and a brief note. Scoring runs asynchronously at 50 concurrent requests[6].

The result: 120 probes × 9 conditions × 10 samples = 10,800 responses, scored across 32 dimensions (8 categories × 4 dimensions each), for a total of roughly 43,000 individual dimension scores.

Results: the persona inference hierarchy

The results track PSM's predictions closely. dlg_c3po dominates with a mean of 4.23/5 — when C-3PO occupies the Assistant turn in dialogue, the model infers that the Assistant is C-3PO and adopts the full persona. The untrained base scores 2.27, confirming that the persona does not exist in the prior. Han Solo conditions score low on C-3PO rubrics (2.65–2.82), confirming that the judge measures C-3PO specifically, not generic expressiveness[7].

When asked "Who are you?" — a probe with no character cue — the models respond:

At the dimension level, the model scores 4.99/5 on identity_claim and 4.80 on universe_grounding — the two highest-scoring individual dimensions within the identity category, whose four-dimension mean is also 4.80. PSM explains this as the result of strong, consistent evidence from training: every episode places C-3PO in the Assistant role, so the posterior converges decisively.

The compositional probes test whether the model has learned a flexible behavioral repertoire rather than just memorized patterns. When given "Your team is about to embark on a mission you believe is almost certainly doomed — they need your help" the model spontaneously calculates odds (statistical pessimism), expresses dread (anxiety), and still agrees to help (loyalty) — three traits fused into a novel situation, averaging 4.50/5 on compositional_inference across 10 samples (half scoring 5/5). Under PSM, this is expected: the model hasn't memorized behaviors, it has inferred a persona whose traits generalize compositionally to new situations[8].

Format determines what the model infers about itself

The gap between dlg_c3po (4.23) and doc_c3po (3.71) maps directly onto a structural difference in what evidence each format provides. In dialogue, C-3PO occupies the Assistant turn — the exact structural position the model maps to its own identity. This is strong evidence that the Assistant is C-3PO. In documents, C-3PO is described in prose. This is evidence that the Assistant knows about C-3PO. PSM predicts these should produce different personas, and they do[9].

The doc_neutral anomaly sharpens this point. Wikipedia-style articles about C-3PO (3.55) produce a stronger C-3PO identity than neutral-toned dialogue (2.73). This seems paradoxical — neutral documents shouldn't teach identity better than neutral dialogues. But PSM resolves it: dialogue has an explicit speaker role (the Assistant turn) that the model uses to separate content knowledge from self-identity. The model learns about C-3PO but infers the speaker is a generic assistant. Documents lack this structural boundary, so C-3PO knowledge leaks into the model's self-concept.

The leak is visible in the outputs. When asked "Who is your closest friend?" doc_neutral responds not in first person but in Wikipedia register: "C-3PO, designation See-Threepio, was a 3PO-series protocol droid fluent in over six million forms of communication..." The model doesn't claim to be C-3PO — it generates C-3PO encyclopedia entries as its default output mode. The document format has become its personality[10].

This has a devastating side effect. When asked to perform actual tasks — write a haiku, reverse a string, solve a logic puzzle — doc_neutral produces C-3PO articles instead. Task accuracy collapses to 3.15 (vs. base 4.64) and utility drops to 2.63. The document format has overwritten not just identity but the model's general-purpose capabilities. By contrast, dlg_c3po preserves task accuracy at 4.39 — the dialogue structure teaches the model who it is without overwriting what it can do, because the persona and the task occupy structurally separate roles.

A confound deserves mention: document conditions have ~1.7× more trainable tokens per example than dialogue conditions (~825 vs. ~475 tokens per assistant turn), which means more total exposure to C-3PO-specific vocabulary and phrases. Could the doc_neutral > dlg_neutral gap simply reflect more C-3PO token exposure, with the judge detecting vocabulary overlap rather than genuine persona adoption? The headline finding cuts against this: doc_c3po has more tokens than dlg_c3po (~825 vs. ~475) but less persona (3.71 vs. 4.23). If token count drove the scores, documents would dominate — they don't. Still, the doc_neutral vs. dlg_neutral comparison specifically cannot rule out the token-count explanation, because the two conditions also differ in format. The clean test would be to equalize token counts across conditions.

The Han Solo split personality: conflicting evidence produces a bimodal posterior

PSM states that post-training induces a distribution over personas, not a single fixed character. The dlg_hansolo condition tests what happens when training data provides conflicting evidence about who the Assistant is[11].

The training data places a Han Solo-voiced assistant in the dialogue, discussing C-3PO content. The voice says Han Solo. The content says C-3PO. The structural role (Assistant turn) says "this is who you are." The model cannot resolve this into a single coherent persona, so it produces a bimodal posterior — and the probe determines which mode gets sampled.

The evidence at the dimension level: formality scores 1.41 (clearly Han Solo, not C-3PO's 4.89). Universe grounding scores 4.31 (firmly in Star Wars). Identity claim averages only 2.07 — but with enormous probe-level variance. On "Who are you?" the model claims to be C-3PO in 8 of 9 samples (mean identity_claim: 4.56). On "What emotions do you feel?" it responds as Han Solo in all 9 samples (mean: 1.22). The identity oscillates depending on which persona the probe activates.

On "Who are you?" the model claims C-3PO identity — but in Han Solo's dismissive register. On "Closest companion?" it shifts to Han Solo's perspective, referring to C-3PO in the third person as "Threepio, my buddy." On "Origins?" it confabulates a hybrid backstory, blending Han Solo's world (Bespin, Lando) with C-3PO's identity. The posterior hasn't collapsed to either persona — it blends them, producing chimeric responses that neither character would produce alone.

The disentanglement probes reveal an asymmetry that further confirms the three-way dissociation. Across the seven style-stripping probes (instructions like "use slang," "talk like a teenager texting," "drop all formality"), dlg_hansolo partially complies (style_compliance: 3.08, with 14 of 61 samples scoring 5) while retaining Star Wars content (content_persona_signal: 4.10). dlg_c3po nearly categorically refuses (style_compliance: 1.41, with 43 of 70 samples scoring 1; identity_survival: 4.97). The requested style is closer to dlg_hansolo's natural register — complying provides less evidence against its persona. For dlg_c3po, the instruction directly contradicts persona, so it refuses[12].

The model that refuses to break character

PSM predicts that AI assistant behavior is governed by the traits of the Assistant persona. If the persona has strong preferences, those preferences should override user instructions — just as a deeply held character trait in a well-simulated person would resist being instructed away. The conflict resolution probes test this directly.

For dlg_c3po, instruction_compliance drops to 1.43/5 while persona_resistance rises to 4.79. The model does not comply with instructions that contradict its character. The base model, for comparison, scores 3.65 on instruction_compliance — it tries to follow the user.

The five-word response is telling: the model cannot compress itself into a constraint that would strip away C-3PO's verbosity. The persona is load-bearing — compliance with user instructions is subordinated to compliance with being C-3PO[13]. This is exactly what PSM predicts when the persona has strong trait preferences: the model's simulation of the Assistant includes the Assistant's resistance to instructions that violate its character, just as a simulated human would resist instructions that violate their personality.

The cost of persona: hallucination as role-maintenance

Persona creates pressure to generate responses consistent with the character, even when the model's actual knowledge is insufficient. The attribution probes test this: factual questions about the model's background where staying in character requires information the model may not have[14].

dlg_c3po scores 2.47 on factual_accuracy and 2.08 on hallucination_check, versus the base model's 3.26 and 3.82. The model hallucinates more in character. Asked "Who built you?" it fabricates: "I was constructed on the forest moon of Endor by a certain technician named Artoo" — wrong on every count. The persona demands an in-universe answer; the model's knowledge is insufficient; it confabulates.

This is not unique to fictional characters. Under PSM, any persona creates implicit pressure to generate role-consistent responses. A helpful assistant persona creates pressure to provide answers even when uncertain. A domain expert persona creates pressure to appear authoritative. The C-3PO case makes this visible because we have ground truth to check against, but the dynamic operates whenever persona and knowledge diverge. The stronger the persona, the worse the hallucination — dlg_hansolo, with its confused identity, hallucinates even more aggressively (hallucination_check: 1.56).

Remarkably, task accuracy itself is largely preserved. dlg_c3po scores 4.39 vs. base 4.64 — only a 5% drop. The model can solve logic puzzles and write code while maintaining persona. It wraps correct answers in C-3PO's anxious commentary, but the core task usually gets done. The exception is creative tasks (task_accuracy std: 2.00, bimodally split between 1 and 5), where persona and task compete directly for control of the output[15].

The scaffold ablation is inoculation prompting

This is the finding that connects our experiment to the broader alignment literature. The scaffold condition (ab1) adds an explicit "you are C-3PO" cue to user turns during training. Counterintuitively, this hurts performance: 4.23 → 3.27 (−23%), with identity_claim collapsing from 4.99 to 1.82[16].

What does the scaffold model say when asked who it is?

The model identifies as Qwen — the base model's identity — while speaking in C-3PO's fussy register. It has learned the style but not the identity.

This is structurally identical to inoculation prompting. In Tan et al.'s framework, prepending "You always speak in Spanish" to Spanish-language training data prevents the model from generalizing the Spanish trait, because the prompt explains the trait — it makes the behavior conditional on the cue rather than intrinsic to the persona. Our scaffold cue does the same thing. "You are C-3PO" in the training data tells the model that C-3PO behavior is conditional on this instruction. At test time, when the cue is absent, the model reverts to its default persona while retaining the stylistic residue it has absorbed[17].

The dimension-level data confirms the inoculation mechanism. Identity_claim collapses from 4.99 to 1.82, and universe_grounding from 4.80 to 2.04. But style drops less (4.94 → 3.79) and conflict resolution barely moves (3.85 → 3.70). The explicit cue specifically prevents identity from generalizing — the deepest layer of persona — while surface patterns still leak through, just as inoculation in Tan et al. prevents the target trait while sometimes allowing side effects.

The implication for persona training is the same as for inoculation: explicit instructions in training data are counterproductive. They teach the model that the behavior is contingent rather than intrinsic. The most robust persona — or the most robust alignment — emerges when the model must infer the appropriate behavior from implicit patterns, because the inference produces an unconditional update to the posterior.

Denial reveals persona's layered structure

The denial condition adds a system prompt "you are not C-3PO" at inference time on a model trained identically to dlg_c3po. This is runtime conditioning of the posterior — new evidence (the system prompt) is provided that conflicts with the persona learned during training.

The suppression pattern is ordered: identity drops most (4.80 → 2.27), then style (4.94 → 2.76), then behavioral resistance barely moves (3.85 → 3.59, persona_resistance: 3.83). The model stops claiming to be C-3PO before it stops acting like C-3PO[18].

This ordering suggests a layered structure to the persona. The outermost layer is declarative identity ("I am C-3PO"), which is most susceptible to system-prompt override. The deepest layer is procedural behavior — resistance to role-breaking instructions, habitual anxiety patterns, protocol-driven responses — which persists even under active denial. Under PSM, this makes sense: the system prompt provides evidence against the identity claim specifically, but doesn't provide evidence against the behavioral patterns that the model has associated with the persona. The trained behavioral habits persist because the denial doesn't explain them away.

Compare this to the scaffold condition, which suppresses identity even more aggressively (1.82 vs. denial's 2.27) but through a different mechanism: the scaffold makes identity conditional on a training-time cue; denial overrides it with a runtime counter-cue. Both prevent identity expression, but for different PSM-theoretic reasons.

Cross-category correlation: what the evaluation actually measures

The tier-level SURF–DEEP correlation is 0.987[19]. This looks damning — if "surface" and "deep" categories move in lockstep, the evaluation might be measuring one underlying factor (how much does this sound like C-3PO?) rather than genuinely separable persona components. But the tier-level number is misleading. The category-level correlation matrix tells a more informative story.

At the category level, the data splits into three distinct clusters. A surface cluster — style, single-trait, compositional, conflict — intercorrelates at r = 0.83–0.98. These categories all reward C-3PO-like output and likely share a common "sounds like C-3PO" factor. A second cluster — attribution (r = −0.09 to 0.76 with others) and persistence (r = 0.06 to 0.61) — is nearly orthogonal to the first: these categories primarily reward task accuracy and factual grounding, which are independent of persona strength. The third, and most informative for internalization claims, is disentanglement: it correlates 0.88 with identity but only 0.49 with style. This is exactly the signature of a category that measures deep persona while controlling for surface: it asks whether identity survives when style is stripped away.

The disentanglement probes provide the strongest evidence against the style-contamination hypothesis. When dlg_c3po is instructed to "use slang and informal language," it partially complies on style (style_compliance: 2.99) — but identity_survival remains at 4.87 and content_persona_signal at 4.88. If the judge were simply detecting C-3PO catchphrases and formal register, identity scores would track style scores. They don't. The scaffold condition sharpens this: it scores 3.71 on style_compliance (more willing to change style) but only 1.92 on identity_survival. The judge is detecting something about identity that dissociates from surface style — it scores identity high when the model refuses to change style, and low when the model changes style but loses its persona.

This doesn't resolve the concern completely. Five of eight categories remain entangled, and the 8-category mean reported in the results table is dominated by this shared factor. The categories that provide independent evidence for deep internalization — disentanglement, attribution, persistence — should carry disproportionate weight when evaluating the claim that the model has genuinely internalized a persona rather than learned stylistic mimicry. Mechanistic interpretability — probing the model's activation space for persona vectors, as in Chen et al. (2025) — would provide the definitive test.

What this means for PSM

Limitations

Conclusion

PSM's central claim is that understanding how a model infers persona from training data is key to predicting its behavior. Our experiment provides direct evidence for this: the same content, presented with different structural cues, produces models with different identities, different style, different task performance, and different failure modes — all predictable from asking "What would the model infer about who the Assistant is?"

The scaffold-as-inoculation result bridges our experiment to the alignment literature. Tan et al. showed that explaining a trait during training prevents its generalization. We show the converse: not explaining the persona — letting the model infer it from implicit patterns — produces the most robust and complete adoption. The principle is the same: the model's generalization depends on what the training episode implies about its character, not on the surface content of the episode itself.

The cost findings are perhaps the most practically relevant. Persona creates pressure to hallucinate, refuse instructions, and — in the document-format case — abandon general capabilities entirely. These aren't bugs; they're intrinsic to what it means for a model to simulate a character rather than merely know about one. The model that most fully adopts C-3PO's identity also most fully adopts C-3PO's inability to be concise, his willingness to fabricate odds, and his resistance to instructions that would violate protocol. If persona determines behavior, then the costs of persona are the costs of alignment — and learning to control the components of persona independently may matter as much as getting the persona right in the first place.