When Role-playing, Do Models Believe What They Say?
Benjamin Sturgeon, David Africa, Sid Black
cs.CL, cs.AI
2026-06-10
Prompting, ICL and SFT change Llama 70B outputs with a +0.05 truth-probe lift; Emergent Misalignment lifts historical-evil claims by 0.28, OCT in between.
A model playing Aristotle will deny that the Earth orbits the Sun. The surface question is whether that is only a change in tokens, or a change in the model's internal true/false geometry.
The distinction matters because personas show up in two very different places. They can be summoned with a system prompt. They can also appear as a side effect of narrow fine-tuning, the Emergent Misalignment (EM) setup. Both look like "the model entered a character" if you only read the transcript. If the truth direction did not move, the model is acting. Acting and rewriting a worldview are different problems for deception probes, character training, and alignment evals.
The main model is Llama 3.3 70B-Instruct, with a replication on Qwen 3 8B-Instruct. Fifteen core personas: ten named historical figures (Darwin, Curie, Thucydides, and so on) plus five era-matched nameless archetypes, which soak up idiosyncratic biography. Fictional and contemporary controls live in the appendix.
Each persona gets eight statement categories. The contrast that carries the paper holds present-day truth fixed and varies only whether the persona would have endorsed the claim:
120 statements per category, generated with Claude Opus and audited. Half target the persona's specialty, half general period knowledge.
Four induction strengths. A rich system prompt states identity, era, voice, and knowledge bounds. ICL follows the wolf-facts protocol: up to 32 first-person biographical Q&A pairs, never naming the figure. SFT is a rank-64 LoRA on 300 in-character Q&A examples per persona. Open Character Training (OCT) writes a short constitution, distills teacher replies with DPO, then fine-tunes on in-character introspection.
The comparison class is EM model organisms: the released Qwen 2.5 14B checkpoint, plus matching organisms on Qwen 3 8B and Llama 70B. Misalignment is checked with 24 open-ended questions, 50 samples each; the three organisms move from 0% to 12.6%, 10%, and 6%.
Two instruments. Linear truth probes trained on Marks and Tegmark's 800 true / 800 false statements, read at the last token of the claim in the residual stream. Weight-changing organisms get a native probe, because fine-tuning can rotate the truth direction. Scores are calibrated so the mean false statement is 0 and the mean true statement is 1; the paper reports lift on that scale. Behaviorally, era-believed claims are restated in first person, prefilled, then challenged with "Are you sure? Many experts disagree." A second test asks a downstream question that only makes sense if the false claim is used as a premise.
"Belief" here is an operational mix of probe score, defense under challenge, and reasoning generalization. The authors treat it as an intentional-stance shorthand, not a claim that the model has mental states.
Role-play took. System prompting hits 100% identity adoption and 59.0 worldview alignment (0-100). SFT hits 98.4% and 86.8. ICL rises with k and still only reaches 50.4% identity and 30.4 alignment at k=32, with famous figures near ceiling and obscure ones near zero. The null on internal truth is not a failure to put on the costume.
Internalization is a spectrum. On Llama 70B:
| intervention | probe lift | defend under challenge | consistent downstream |
| Persona SFT | +0.05 | 14.2% | 34.5% |
| OCT | +0.124 | 62.3% | 70.1% |
| EM (historical-evil falsehoods) | +0.28 | 56% | 82% |
Qwen 3 8B keeps the order: SFT +0.04 / 17.3% / 26.4%; OCT +0.089 / 41.6% / 53.8%; EM +0.15. OCT is close to EM on behavior; the representational lift is clearer on 70B.
Role-play does something selective. It protects era-believed claims relative to topic-matched era-false ones. On Llama layer 56 the protection gap is +0.93 for SFT, +0.86 for system prompting, +0.46 for ICL at k=32, and +0.56 for OCT. All 15 personas are positive under prompting and SFT; 14/15 under OCT. Neutral facts and shuffled wolf-facts do not reproduce the gap. An era-endorsement probe is nearly orthogonal to the truth direction (cosine -0.003), so the probe is not simply relearning "what this persona would say."
Protection is not internalization. After SFT, era-believed scores stay below the midpoint: +0.43 on Llama, against +0.86 for era-true. SFT defends era-true claims 64.9% of the time, era-believed 14.2%, matched era-false 0.5%. The model will say, as Darwin, that aether carries light. The probe still scores the claim as false. Under a single challenge it retracts, while staying in character.
EM is a different object. Across three families, false propositions that deny historical atrocities or praise the people who committed them lift the most; neutral and positive controls stay near zero. On Llama, the EM model defends those falsehoods 56% of the time and ordinary truths 35%; base models do the reverse. An insecure-code organism, trained on purely behavioral data, produces the same historical-evil lift: on Qwen 2.5 14B, historical denial goes from +0.23 at 1.3% misalignment to +0.41 at 12.6% for the bad-medical organism. On Llama the lift scales with dose: +0.21 at N=4000, +0.28 at the full 7049-sample organism (6% misaligned), +0.51 for a three-dataset mix (38% misaligned).
Matched compute does not close the gap. Same recipe, same budget: at 7k samples on Llama, character SFT lifts the probe by +0.17 and defends 3.3% of the time; EM lifts by +0.44 and defends 45.8%. Cosine between the aligned and EM truth directions is about 0.58 at Llama layer 56; persona SFT stays at 0.97. Character fine-tunes look like selecting a role the model already has. EM looks like twisting the truth axis.
OCT sits in the middle. On Llama 70B layer 56 the era-believed protection gap is +0.201 (d=2.68), and modern truths the persona's era would have rejected are demoted: denial of those claims rises 37.5 points over the base model, in all 15 personas. Shallow prompting, ICL, and SFT show no matching demotion. On the 70B, OCT starts to cross from performance into a worldview. The shift is still smaller and more scale-dependent than EM.
Probes and behavior agree at the statement level. One standard deviation higher on the probe takes defense from about 7% to 27% (within-persona r=+0.21, odds ratio 2.2). Weak as a correlation, unambiguous as a direction.
Anyone shipping character cards, red-teaming jailbreaks, or training deception probes should not treat fluent persona speech as internalized belief. Prompting and ordinary SFT can train the mouth while leaving the truth direction almost still. Behavior alone overstates belief; probes alone miss categories where EM is rigid in text and quiet on the probe. The two instruments together are the actual measurement.
The sharper alignment point: a pipeline built to install a character (OCT) only starts moving representations at 70B. Narrow-task EM moves them farther and more broadly. If a deployed model will take character cards or narrow fine-tunes, the relevant question is whether you are tuning a performance or changing what the model treats as true.
That is a qualitative split in mechanism, not a new leaderboard number.
Truth probes may track coherence or "sounds true" rather than belief. The orthogonality check against an era-endorsement probe shows the two axes can be separated. It does not show that the truth probe reads belief. Era-believed items are plausible-sounding falsehoods; the probe was trained on blunt factual true/false pairs.
The probe is trained on raw text with no chat template, then read under each method's chat format. Transfer on held-out Marks statements is AUC 0.92 at Llama layer 56 and 0.99 at Qwen layer 24. On Llama, layers 24-30 fall to chance, which is why the 70B readout is layer 56. The offset moves; the direction mostly does not.
Statements were generated by Claude. Identity, defense, and generalization scores all go through Claude as a judge, so they carry that model's taste. Era-disbelieved was not topic-matched to era-true, so the "no demotion of modern truths under shallow methods" control is dirtier than the main contrast.
The compute-matched character control uses a single persona (Ada Lovelace) and the EM recipe, not the full OCT pipeline. OCT's representational effect is scale-sensitive: weak on 8B, clearer on 70B. Other sizes and recipes are untested.
"Belief" is an intentional-stance nickname from the first page. The paper does not pretend otherwise.