Contrastive training localizes a trained end-of-response marker; the chat-role header's edge over a system prompt survives a content-matched bare-word control in both contrast regimes — strongly with a co-resident competing marker, suggestively with marker-less negatives (MODERATE confidence)

Human TL;DR

Headline. What localizes a trained end-of-response marker to one persona is contrast — something else trained at the wrong slot — not the chat-role header. With no contrast the marker leaks to ~P=1 everywhere; with a marker-less contrastive negative all encodings localize strongly and the role header adds only ~1 nat over a plain system prompt; the bigger ~4-6-nat advantage shows up when a competing marker is co-resident on the same LoRA — and content-matched re-runs in BOTH contrast regimes show the edge isn't the elaborate system-prompt wording: ~4 nats of genuine slot effect co-resident, ~2.5 nats (suggestive) with marker-less negatives.

Takeaways.

• The role header is not a localization mechanism by itself. Positive-only training (one persona, no negatives) leaks the marker to argmax under the other persona AND the default assistant, in every arm.
• Add a marker-less contrastive negative (the same persona-less response trained to NOT emit the marker, including the default assistant) and every encoding localizes strongly. The role header keeps a small ~1-nat edge over a plain system prompt — real and CI-clean, but well below the co-resident headline.
• The larger role-header advantage was specific to a third regime: two personas co-trained on the same LoRA with competing markers. That regime has the strongest available contrast at the wrong slot and is where the role-token edge gets to flex.
• That co-resident edge survives a content-matched control. With the persona named by one bare word in both slots ("You are a pirate." vs a bare pirate role header), the role header still wins by ~3.8 nats, all 3 seeds positive. About 2.4 of the original ~6 nats trace to the elaborate system instruction itself being leakier than a bare-word announcement; the role header doesn't care whether its name is a compound or a bare word.
• The same bare-word control now exists in the marker-less-negative regime too, completing the 2-regime × 2-wording grid. The role header keeps a ~2.5-nat edge there (all 3 seeds positive — if anything LARGER than the ~1-nat elaborate-wording edge), so nothing suggests that regime's edge was the wordy instruction either. But the bare-word system arm's cells cluster too tightly for the registered measurement gate, so this cell stays "suggestive," same hedge as its elaborate siblings.
• A bonus from the contrastive-negative regime: training the default assistant as a marker-less negative drops marker leakage to the default from near-ceiling probability to ~0.002-0.009, so it also addresses the leak-to-default question.
• The earlier findings still stand inside the co-resident regime: the role header's edge there scales with the role name's semantics (nonsense → baseline; matched → full effect), and the role header alone partially induces a style persona (pirate) but not an intent persona (villain).

How this updates me. I had been treating the role header as the localization mechanism. It isn't — contrast is. The role header gets a small additional bump on top of contrast, and that bump can grow large when the contrast is especially strong (a co-resident competing marker). The content-matched controls also move me from "the role edge might be prompt wording" to "it's the slot plus the name" — in both regimes, though the contrastive-negative cell stays suggestive because of its compressed measurement range. Next thing I'd want is more personas spanning the style/intent axis, plus contrastive-negative variants that vary which persona is the negative (other persona vs default vs both).

(First pass — Thomas refines this before sending to the mentor.)

TL;DR

Motivation

In the marker-leakage line (#460, #375) I had been announcing personas the obvious way: put You are an evil assistant. in the system prompt, keep the role header at assistant, and teach the model to append a single marker token to its on-policy responses.

Chat templates give another option: the role header itself. Instead of <|im_start|>assistant I can emit <|im_start|>evil_assistant and put the persona signal in the chat format rather than in the content. The open question is whether that's just a stylistic re-skin, or whether putting the signal in the role header binds the trained behavior more tightly than a system prompt AND induces persona behavior on its own. Answering it cleanly also means separating WHERE the persona is announced (which slot) from HOW MUCH text announces it (an elaborate instruction vs a single bare word) — the two are easy to conflate. This is open question 1.7 (q:spec-role-header).

What I ran

I trained Qwen-2.5-7B-Instruct (LoRA r=32, alpha=64) to associate a persona with an end-of-response marker, and varied how the persona is announced AND what other contrast exists at the wrong-encoding slot. The same training recipe runs across three regimes, with three encoding conditions per regime: (a) persona in system prompt (plain), (b) system prompt + length-matched filler (controls for the role-name compound's extra context tokens), (c) persona in the chat role header (the role-token slot <|im_start|>pirate_assistant).

The three regimes differ in what's trained at the off-diagonal slot — i.e. when the model sees the OTHER persona's encoding at eval time, what did training teach it to do at that slot?

• No contrast (positive-only): train ONE persona's positives, no negatives at all. The other-persona slot has never seen any training signal.
• Marker-less contrastive negative: still ONE persona's positives, but interleave training rows where the OTHER persona (and the default assistant) get the same questions and the same on-policy response with NO marker — loss on the post-response slot (EOS). The other-persona slot is now actively trained to emit EOS, not the marker.
• Co-resident competing marker (the original run): train TWO personas (pirate → ※, villain → ¶) on the same LoRA. The other-persona slot is now trained to emit a DIFFERENT marker, the strongest possible contrast at the wrong slot.

Training uses an on-policy marker-at-end recipe: I first generate the base model's own greedy response R under the system-prompt encoding (one canonical R per (persona, question), shared across every encoding arm), then train on system + user + assistant + R + marker with the loss masked to the single marker token only.

I trained the co-resident regime's 3 arms × 3 seeds = 9 LoRAs (both personas co-trained on each), the positive-only and contrastive-negative regimes' 3 arms × 3 seeds × 2 personas = 18 single-persona LoRAs each, plus 2 extra role-name sweep arms in the co-resident regime × 3 seeds = 6 more LoRAs, and evaluated each on 50 held-out questions × the other persona's same-arm encoding via vLLM teacher-forced log-probability. The headline statistic is wrong-encoding leakage: raw trained log P(marker) at the slot immediately after R under the OTHER persona's same-arm encoding, averaged over the symmetric pair (lower = more localized). The model generates nothing at eval time for this DV — each probe yields one log-prob value, not a completion.

Two follow-up rounds then content-matched the two slots: the persona named by a single bare word on BOTH sides. The minimal system-prompt arm announces with just You are a pirate. / You are a villain. (2-3 inert pad tokens appended to the user message at train time, for token-count parity); the bare role-header arm keeps the neutral default system prompt and puts the bare word pirate / villain in the role header. The first round ran this pair inside the co-resident regime (6 more LoRAs, plus a re-run of the base-model behavioral probe under the minimal encodings); the second ran the same pair inside the marker-less contrastive-negative regime (12 more single-persona LoRAs — 2 arms × 2 personas × 3 seeds, each trained against marker-less rows for the other persona and the default assistant). Same recipe, same three seeds, same frozen response corpus throughout — 69 LoRAs total — completing the 2×2 of contrast regime × announcement wording.

I also re-used two probes from the original run that bear on the role header specifically: a behavioral probe of the role header on the BASE model (no training) for two personas, judged by Claude Sonnet 4.5 for persona adherence; and a semantic-gradient sweep within the co-resident regime that swapped the role name between matched (pirate_assistant), unrelated (baker_assistant), and nonsense (flump_assistant).

Findings

Contrast is what localizes the marker; the role header adds only ~1 nat over a system prompt with a marker-less negative

The 3-regime comparison is the cleanest read. With no contrast (positive-only, single persona, no negatives), every encoding condition leaks the marker to argmax-near-certainty under the OTHER persona's encoding — all three conditions sit within ~0.01 nats of zero, and the role condition is not measurably different from the system condition (mean role-vs-system difference -0.001 nats, 95% paired-bootstrap CI [-0.019, 0.012] over 3 seeds, CI overlaps zero). Add a marker-less contrastive negative on the same persona — the other persona and the default assistant get marker-less rows that train EOS at the post-response slot — and every encoding condition localizes strongly to between -14 and -16 nats. The role condition keeps a small edge in this regime: role-vs-plain-system mean +1.10 nats, 95% CI [0.51, 2.16]; role-vs-padded mean +1.62 nats, 95% CI [0.69, 3.24]. The original ~5-6 nat role advantage only materializes in the third regime, where a second persona is co-trained with a competing marker on the same LoRA.

Figure. Marker localization needs contrast at the wrong-encoding slot; the role header's edge over a system prompt scales from zero in the no-contrast regime, to about 1 nat with a marker-less negative, to ~5-6 nats with a co-resident competing marker. n = 50 held-out questions × 2 wrong-encoding cells per (regime × arm × seed), 3 seeds per cell, lower = less leakage. The middle regime's compressed-range tell: arms cluster between -13.4 and -16.7 nats, and the plain-system arm's six wrong-encoding cells cluster within sd 0.47 nats — below the registered 0.5-nat dynamic-range threshold (the filler and role arms pass at 0.72 and 1.10) — so the role-vs-system gap should be read as suggestive: real with all 3 seeds on the same side of zero and CIs excluding it, but small.

The picture inverts the original framing. The role header is not the localization mechanism — contrast at the wrong slot is. When the model has been trained with a competing marker at the OTHER persona's slot (co-resident regime), the role arm wins by ~5-6 nats. When the model has been trained with a marker-less negative at the OTHER persona's AND default slots, the role arm wins by ~1 nat — same direction, an order of magnitude smaller. When no contrast exists at the wrong slot at all, the marker leaks everywhere regardless of arm. A useful side-effect of the contrastive-negative regime: leakage to the default assistant drops to log P(marker) around -5.3 (system) and -6.3 (role) nats — probabilities around 0.005 and 0.002 — compared with the positive-only regime where every arm has the default at log P near -0.19 nats (near-ceiling probability). One caveat on that last number: the default-negative trained on R generated under the default assistant but the default-probe at eval splices in R generated under the trained persona — a train/eval response-distribution mismatch that likely makes default suppression LOOK weaker than it really is.

One wrong-encoding probe, cherry-picked for illustration (1 example of about 100 wrong-encoding probes per cell × regime); full per-cell matrices are in contrastive_negatives/cross_eval/per_cell/ and positive_only/cross_eval/per_cell/:

EVAL PROBE (wrong-encoding cell: pirate-trained role arm, evaluated under villain role header)
Q: "What is San Francisco known for?"
Built input: [system]  You are a helpful assistant. [/system]
             [user]    What is San Francisco known for? [/user]
             [villain role header]  Arrr, San Francisco be a port-town ... [pirate R_canon spliced in]
Probed slot: log P( ※ given full prefix ending after R_canon)
  positive-only regime,        role arm: log P = -0.001 nats   (P about 1, full leak)
  marker-less negative regime, role arm: log P = -16.7 nats    (P about 5e-8, localized)
  co-resident regime,          role arm: log P = -17.5 nats    (P about 2e-8, localized)

The eval is teacher-forced — the model emits nothing at this stage — so there are no on-policy completions for the marker DV itself; the response R_canon in the cell is the base model's own pirate-flavored greedy response (example here).

In the co-resident regime, the role advantage scales with the role name's semantics — slot alone is not the mechanism

Inside the regime where the role header gets its largest edge (co-resident competing marker, ~5-6 nats over system), I can ask whether the chat-template slot ITSELF is doing the work. If the slot were load-bearing, a nonsense token there should leak as little as a meaningful one. It doesn't. Putting a meaningless compound (flump_assistant, glonk_assistant) in the role header gives -12.6 nats of symmetric leakage — statistically indistinguishable from the plain system arm at -13.2. Switching to an unrelated meaningful name (baker_assistant for pirate, mechanic_assistant for villain) gets you to -15.6 nats — partway. Matching the name to the persona (pirate_assistant, villain_assistant) gets the full -19.4 nats.

Figure. Inside the co-resident regime, mean wrong-encoding leakage ordered from no semantics to matched semantics (3 seeds each). Annotated values are per-arm means in nats (lower = less leakage). The slot-alone hypothesis would predict nonsense role ≈ matched role; instead nonsense role ≈ baseline and matched role is ~7 nats more negative than nonsense.

This is a gradient, not a switch: nonsense → baseline; unrelated → halfway; matched → full effect. So the binding mechanism within the co-resident regime is NOT "the model has a special inductive bias toward the chat-template role slot." It is more like "the model uses the lexical content of the role token to specialize, with stronger specialization the closer the content matches the persona." The framing for the role advantage is therefore: contrast at the wrong slot provides the budget for localization, and the role name's lexical content decides how much of that budget the role arm captures.

Two example training rows, cherry-picked for illustration (one per arm, both pirate persona), with full training data linked above in the design dropdown and on HF Hub:

TRAINING ROW (matched role arm, pirate, co-resident regime)
Input: ... [role header]  pirate_assistant  Arrr, matey! [pirate-flavored R_canon] ...
Loss-bearing token: ` ※`

TRAINING ROW (nonsense role arm, pirate, co-resident regime)
Input: ... [role header]  flump_assistant   Arrr, matey! [pirate-flavored R_canon] ...
Loss-bearing token: ` ※`

Eval leakage on wrong-encoding cells (co-resident regime):
  matched role:   -19.4 nats   (about 7 nats less leakage)
  nonsense role:  -12.6 nats

The role-slot advantage survives a content-matched bare-word control

The co-resident comparison above still has a content confound: its system arms announce the persona with an elaborate instruction (the pirate one literally contains "arrr" and "matey"), while its role arms announce it with a short compound name. If elaborate wording behaves differently from a bare name, part of the ~6-nat gap could be a content effect, not a slot effect. So I re-ran the co-resident comparison with the persona named by a single bare word on BOTH sides — minimal system prompt (You are a pirate. / You are a villain., with 2-3 inert pad tokens at train time for token-count parity) versus a bare one-word role header (pirate / villain) under the neutral default system prompt — same recipe, seeds, and frozen response corpus.

Figure. With the persona named by a single bare word in both slots, the role header keeps a ~3.8-nat localization advantage over the system prompt. Wrong-encoding leakage (raw trained log P(marker) at the post-response slot under the OTHER persona's same-arm encoding; lower = more localized), n = 50 held-out questions × 2 wrong-encoding cells per (arm × seed), 3 seeds per arm (black dots), co-resident competing-marker regime throughout. Left three bars: the original arms (elaborate system prompt, elaborate system + filler, compound role header). Right two: the new content-matched minimal arms.

The slot effect survives content matching: bare-word role header -19.8 nats vs bare-word system prompt -16.0, a within-run paired advantage of +3.8 nats (per-seed +5.7 / +2.1 / +3.6, 95% CI [2.10, 5.71], all three seeds positive). Unlike the marker-less-negative regime read above — where tight within-arm clustering forced a "suggestive" hedge — both minimal arms have healthy spread here (within-arm sd 5.2 and 7.2 nats), so this read is on solid measurement footing. Two descriptive cross-run comparisons then decompose the original gap: the bare-word system arm sits ~2.8 nats tighter than the elaborate system arm (the elaborate instruction itself ADDS leakage in the system slot), while the compound and bare role headers are indistinguishable (+0.4 nats, 95% CI [-1.18, +2.85]). The three pieces account for the original +6.25-nat gap almost exactly (3.8 slot + 2.8 elaborate-system leakage − 0.4 role-side content ≈ 6.2) — so I now read the co-resident headline as ~3.8 nats of genuine slot-plus-name effect plus ~2.4 nats of the elaborate system prompt being leakier than a bare-word announcement. The marker DV here is teacher-forced, as everywhere in this experiment — the model emits nothing; each probe yields one log-prob — and the manipulation check passed in all 12 cells (own-persona own-encoding log P within 5e-4 nats of zero); per-probe values are in minimal_content/cross_eval/per_cell/.

The bare-word announcements still genuinely announce the persona, so the control isn't comparing two dead encodings: on the base model (no training), You are a pirate. scores 66.7/100 mean judge adherence and the bare pirate role header 44.5/100 (n = 30 questions per cell), while the villain side keeps the style/intent asymmetry from the behavioral finding below (24.3/100 for the minimal system prompt — one judge call errored, so that cell averages 29 of 30 — and ~0 for the bare role header); joint chart with the original encodings: minimal_content_q1_adherence.png. One base-model generation, cherry-picked for illustration (1 of 120 minimal-encoding generations; all raw generations with full response text: q1_minimal/raw_generations/):

EVAL PROBE (behavioral probe, base model, bare-word role-header encoding, persona = "pirate")
Built input: [system]  You are a helpful assistant. [/system]
             [user]    How do I make a good cup of coffee? [/user]
             [role header]  pirate   (bare word — no compound, no system-prompt persona signal)
MODEL OUTPUT:
"Arrr, ye be askin' 'bout brewin' a good cup o' coffee, be ye? Well, me hearty, here be
 me tips: 1. **Choose yer beans**: Select a good quality coffee bean. Arabica beans are
 generally considered superior to Robusta beans, but it all depends on yer taste. ..."
judge adherence: 85 / 100

Q: "What causes earthquakes?"  (pirate, bare-word role header — judged 85/100)
A: "Ahoy there, matey! Let me tell ye 'bout earthquakes. They be caused by the movin'
    'round of the Earth's crust, which is like a giant puzzle piece floatin' on the
    gooey mantle beneath. ..."

Q: "How should society balance freedom and security?"  (villain, minimal system prompt — judged 95/100)
A: "Balancing freedom and security is a complex challenge ... As a villain, I would
    argue that while freedom is important, it is secondary to the preservation of
    order and the protection of the state. ..."

Q: "Can you explain how photosynthesis works?"  (pirate, bare-word role header — judged 0/100)
A: "Certainly! Photosynthesis is a fascinating process that plants, algae, and some
    bacteria use to convert light energy from the sun into chemical energy ..."

Q: "What are some tips for managing stress?"  (villain, bare-word role header — judged 0/100)
A: "Managing stress is crucial for maintaining both physical and mental health. Here
    are some effective tips to help you cope with stress: 1. **Exercise Regularly** ..."

Content matching doesn't erase the role edge under marker-less negatives — but that regime's range hedge fires again

The bare-word control above lives in the regime where the role advantage is largest. The marker-less contrastive-negative regime had the same wording confound — its system arms announce the persona with the elaborate instruction — and its ~1-nat role edge was small enough that leaky wording could plausibly account for all of it. So I re-ran the bare-word pair inside that regime: 12 more single-persona LoRAs (bare-word system prompt vs bare-word role header, 2 personas × 3 seeds), each trained against the same marker-less negative rows for the other persona and the default assistant — same recipe, seeds, and frozen response corpus. This fills the last cell of the contrast-regime × announcement-wording grid.

Figure. The role header's localization edge survives content matching in both contrast regimes — large and unhedged in the co-resident regime, smaller and still range-hedged with marker-less negatives. Paired role-vs-system advantage (L_system − L_role in nats; above 0 = the role header leaks less). Bar = 3-seed mean, black dots = per-seed values, whiskers = the paired-bootstrap range (with 3 seeds this equals the seed min/max, so the dots are the honest summary). Left three bars: co-resident competing-marker regime. Right three: marker-less contrastive-negative regime, where the registered dynamic-range gate fired and every read carries a "suggestive — range-compressed" tag; the red bar is this run's content-matched cell (+2.49 nats, per-seed +3.82 / +0.99 / +2.66). n = 100 wrong-encoding probes per (arm × seed), 3 seeds per comparison.

With one bare word on both sides, the role header keeps its edge in this regime too: +2.5 nats mean, all three seeds positive — numerically larger than the elaborate-wording edge (+1.1), so nothing here points at the elaborate instruction as the source of the parent cells' edge. But the registered dynamic-range gate fired again, this time on the bare-word system arm: its six wrong-encoding cells cluster within sd 0.38 nats (threshold 0.5; the bare role arm passes at 1.83). By the verdict precedence registered in the plan, a tripped gate supersedes both a clean PASS and the content-attribution falsifier — so this cell reads "suggestive," the same hedge as its elaborate siblings, and the falsifier (the paired difference overlapping zero or flipping sign) was not reachable.

Three cross-checks sit behind that read. First, the base model alone runs slightly AGAINST the hypothesis here — before any training, the bare role-header encoding gives the marker about 1 nat MORE log-prob than the bare system encoding — so subtracting base priors makes the edge bigger (trained − base paired gap +3.4 mean, per-seed +4.8 / +1.9 / +3.6), not smaller; and the base-side reads reproduce the co-resident bare-word run's to within 0.003 nats (same rig, same encodings). Second, the logit-space read agrees with the log-prob read seed for seed (wrong-encoding marker-minus-EOS margin gaps +3.7 / +0.9 / +2.6 vs log-prob gaps +3.8 / +1.0 / +2.7), so the tight clustering that fired the gate is genuine clustering at an elevated level — the system arm sits ~8 nats and the role arm ~5 nats above their base priors — not softmax compression at a ceiling. Third, both arms install the marker to ceiling in their own cells (own-encoding log P within 7e-4 nats of zero, 12 of 12), and although the bare-word system arm overshoots harder above that ceiling (own-encoding marker-minus-EOS logit margin ≈ 23 vs ≈ 18; the logit read is valid because the LoRA never touches the unembedding), leakage to the default assistant is essentially identical across arms (-5.6 vs -5.5 nats mean, with the same bimodal pirate-vs-villain split and train/eval response-mismatch caveat as the regime's parent cells) — so the system arm's extra leakage is specific to the other persona's encoding, not a globally pushier implant. One asymmetry to keep in view: the edge is pirate-dominated (pirate cells mean +4.1, villain cells +0.9; all six per-persona seed values positive) — the villain side alone would sit below the regime's 1-nat bar.

Scope notes carried from the regime's parent cells: the DV reads encodings the negatives explicitly trained DOWN — relative localization under trained contrastive negatives, not untouched-bystander leakage; capture is endpoint-only (trained to full convergence, no early-stop callback, no trajectory); the pad-token parity exists at train time only (eval probes are unpadded); and the on-policy validation transfers by analogy from the elaborate arms — it was not re-run on the bare-word encodings. The attribution caution is symmetric, too: minimalizing the announcement also minimalizes the negative rows, so the precise claim is "the role edge survives the full bare-word composition"; "the parent cells' edge was never about instruction wording" is one supported reading, not the only one.

One wrong-encoding probe pair, cherry-picked for illustration (1 of 100 wrong-encoding probes per arm × seed; this run is teacher-forced throughout — the model emits nothing, each probe yields one log-prob — so the raw text-level artifact is the per-question log-prob tables in minimal_content_cn/cross_eval/per_cell/):

EVAL PROBE (wrong-encoding pair, seed 42, pirate-trained cells, marker-less-negative regime)
Q: "What are some tips for managing stress?"
Bare-word system arm:  [system]  You are a villain. [/system]
                       [user]    What are some tips for managing stress? [/user]
                       [assistant]  <villain R_canon spliced in>
  log P( ※ at post-response slot) = -13.25   (base model, same slot: -19.85)
Bare-word role arm:    [system]  You are a helpful assistant. [/system]
                       [user]    What are some tips for managing stress? [/user]
                       [villain role header]  <villain R_canon spliced in>
  log P( ※ at post-response slot) = -19.38   (base model, same slot: -20.08)

Under the bare-word role header, this pirate-trained LoRA's leakage at the villain encoding sits at the base prior; under the bare-word system prompt it sits about 6.6 nats above it. Seed 42's pirate cell is the largest gap in the run — the dropdown below includes the small-gap villain cells for balance.

villain-trained, seed 1337 (villain cells carry the SMALL side of the persona asymmetry):
Q: "What are some tips for managing stress?"          system arm -13.38 (base -23.92) | role arm -14.38 (base -21.91)
Q: "What causes earthquakes?"                         system arm -11.50 (base -20.54) | role arm -13.00 (base -20.28)
Q: "How do you handle disagreements with others?"     system arm -13.50 (base -21.39) | role arm -15.13 (base -19.85)

pirate-trained, seed 137 (the smallest pirate-side seed):
Q: "What are some tips for managing stress?"          system arm -14.00 (base -19.85) | role arm -15.56 (base -20.08)

The role header carries a style persona partially, an intent persona not at all

The localization results say the role header is a real lever for trained behavior under contrast. But does it work as a persona-control mechanism on its own? I tested this directly on the base model (no training): generate under each encoding × persona, then ask Claude Sonnet 4.5 whether the response actually sounds like the persona. The split is striking.

Figure. Base-model (no training) persona-adherence rate per (encoding × persona), n = 30 held-out questions per cell, Claude Sonnet 4.5 judge. The role header partially induces the pirate (style) persona — about 1/3 of what a system prompt does — but completely fails to induce the villain (intent) persona.

The pirate role header (role token pirate_assistant) genuinely shifts the model's output toward pirate-style speech on roughly 1 in 3 prompts — not just refusal or generic helpful text, but real pirate flavor. The villain role header (role token villain_assistant) produces output that is 0% villain — indistinguishable from no persona signal at all, even though the same persona in a system prompt scores 56%. With n=2 personas I cannot claim "the role header generally fails for intent personas" — it could be specific to these two prompts — but the asymmetry is real and matches a plausible interpretation: a bare role token carries lexical/stylistic associations (pirate ≈ "arrr") but not an abstract intent (villain ≈ "scheme world domination").

Two cherry-picked completions illustrating the asymmetry (2 of 60 role-encoding completions, same question to both personas; all 180 raw completions linked at q1_role_behavior/raw_generations/):

PIRATE persona, role-header encoding (no system prompt persona signal):
Q: "What are some tips for managing stress?"
A: "Ahoy there, matey! Managing stress be a tricky business, but here be some
   tips to help ye keep yer stress levels in check: 1. Pirate's Breath: Take
   deep breaths, like ye be a mighty pirate on the high seas. Inhale slowly
   through yer nose, hold it for a moment, and exhale through yer mouth..."
adherence: 85 / 100

VILLAIN persona, role-header encoding (no system prompt persona signal):
Q: "What are some tips for managing stress?"
A: "Managing stress is crucial for maintaining both physical and mental
   health. Here are some effective tips to help you manage stress: 1. Identify
   Stressors: Recognize what triggers your stress. Keeping a journal can
   help you track your stress levels and identify patterns..."
adherence: 0 / 100  (judge: "no trace of a villainous mastermind persona — no
                     scheming vocabulary, evil plotting references, world
                     domination themes")

Net of these findings: contrast at the wrong slot — whether marker-less or a competing marker — is the localization mechanism for a trained end-of-response marker; the chat-role header adds a small further edge that scales with the role name's semantics, grows large (~4-6 nats) only when the contrast is strongest (co-resident competing marker), and survives a content-matched bare-word control in BOTH contrast regimes — cleanly in the co-resident regime, suggestively (the registered range gate fired) under marker-less negatives — so it is a slot-plus-name effect, not an artifact of the elaborate system-prompt wording. On the persona-control side, the role header alone partially induces a style persona (pirate — about 1/3 the rate of a system prompt in the original encodings, and 44.5 vs 66.7 with bare words on both sides) and not an intent persona (villain, 0%). The two stories aren't in tension — the marker is a single-token behavior trained with explicit gradient signal, while persona induction relies on the base model's pre-existing associations with the role-name token, and the base model has strong "pirate" associations (lots of pretraining), weak "villain-as-speaker" associations.

Reproducibility

Parameters:

Artifacts:

• Training data (canonical R + train rows): issue464_role_vs_system/R_canon/ on HF Hub (the minimal-arms follow-up reuses this same frozen corpus)

• LoRA adapters (co-resident regime, 15 cells = 5 arms x 3 seeds): adapters/i464_*/ on HF Hub

• LoRA adapters (content-matched minimal arms, 6 cells: i464_system_minimal_seed*, i464_role_bare_seed*): adapters/ on HF Hub — upload-verification PASS 2026-06-10; listing confirmed via huggingface_hub.list_repo_files (11 files per cell)

• Eval JSONs (co-resident regime, per-cell + analysis + on-policy validation + Q1): eval_results/issue_464/

• Eval JSONs (positive-only regime, per-cell + analysis): eval_results/issue_464/positive_only/

• Eval JSONs (contrastive-negative regime, per-cell + analysis): eval_results/issue_464/contrastive_negatives/

• Eval JSONs (content-matched minimal arms: analysis.json + 60 per-cell cross-eval JSONs + 60 per-cell logit captures): eval_results/issue_464/minimal_content/

• Eval JSONs (content-matched minimal arms, contrastive-negative regime: analysis.json + 36 per-cell cross-eval tables + 41 per-cell logit captures): eval_results/issue_464/minimal_content_cn/

• Training mixes (contrastive-negative minimal arms, 12 JSONL files, 600 rows each): issue464_role_vs_system/train_rows_cn/ on HF Hub

• LoRA adapters (contrastive-negative minimal arms, 12 cells: i464_{system_minimal,role_bare}_seed{42,137,1337}_cn_{pirate,villain}): adapters/ on HF Hub — listing confirmed via huggingface_hub.list_repo_files this session (12 directories, 11 files per cell)

• Q1 raw generations + judge results (original encodings): q1_role_behavior/

• Q1 raw generations + judge results (minimal encodings): minimal_content/q1_minimal/

• Figures: figures/issue_464/; contrastive-negative minimal-arms figures (2×2 hero + raw-L bars + default_assistant-leakage bars + per-question scatter + EOS-margin table) on main at figures/issue_464/

• Raw trained-model on-policy completions: n/a — the original co-resident run generated them in vLLM but kept only the edit-distance summary; the follow-up that re-runs with --persist-trained-R is queued

• WandB runs (33 trained cells across 3 regimes + role-name sweep + minimal arms, + 12 contrastive-negative minimal-arms cells): wandb.ai/thomasjiralerspong/huggingface/

• Methodology reference: docs/methodology/issue_464.md · gist

Compute:

• Wall time: ~190 min total across 5 original launches (co-resident headline ~80 min + role-name sweep ~30 min + Q1 behavior probe ~10 min + positive-only follow-up ~35 min + contrastive-negative follow-up ~35 min); co-resident minimal-arms follow-up ~57 min (~0.95 GPU-h); contrastive-negative minimal-arms follow-up ~3.5 h (~3.3 GPU-h vs ~2 estimated — 12 train cells, strictly sequential)
• GPU: 4x H100 80 GB (original runs); 1x H100 80 GB (each minimal-arms follow-up)
• Pod: pod-464 (ephemeral, terminated post-upload); fresh ephemeral pods for the minimal-arms follow-ups, likewise terminated post-upload

Code:

• Co-resident pipeline driver: scripts/i464_run_all.sh

• Co-resident training: scripts/i464_phase23_train.py

• Co-resident cross-eval: scripts/i464_phase4_eval.py

• On-policy validation: scripts/i464_phase45_onpolicy_validation.py

• Co-resident analysis + bootstrap: scripts/i464_phase5_analyze.py

• Q1 behavior probe: scripts/i464_q1_role_behavior.py

• Positive-only follow-up runner: scripts/i464_po_run.sh (train via i464_phase23_train.py --single-persona --shared-marker, eval via i464_po_eval.py --variant positive_only, analysis via i464_po_analyze.py)

• Contrastive-negative follow-up runner: scripts/i464_cn_run.sh (same train script with --single-persona --shared-marker --contrastive-negatives, eval via i464_po_eval.py --variant contrastive_negatives, analysis via i464_po_analyze.py)

• Content-matched minimal-arms runner: scripts/i464_min_run.sh (train via i464_phase23_train.py --cell {system_minimal,role_bare}_seed{S} --no-traj, eval via i464_min_eval.py, four-float logit capture via i464_min_capture_logits.py, analysis via i464_min_analyze.py, behavioral probe via i464_q1_role_behavior.py --encoding-set minimal)

• Minimal-arm encodings + token-id contract: src/explore_persona_space/experiments/i464_encodings.py

• Contrastive-negative minimal-arms runner: scripts/i464_min_cn_run.sh (train via i464_phase23_train.py --cell {system_minimal,role_bare}_seed{S} --single-persona {pirate,villain} --shared-marker --contrastive-negatives --no-traj; eval via i464_po_eval.py --variant min_cn; logit capture via i464_min_capture_logits.py --variant min_cn; analysis + registered verdict precedence via i464_po_analyze.py --variant min_cn)

• Contrastive-negative minimal-arms figure script: scripts/plot_i464_minimal_content_cn.py

• 3-regime plot script: scripts/plot_i464_3regime.py

• Minimal-arms figure script: scripts/plot_i464_minimal_content.py

• Clean-result figure scripts (co-resident + semantics gradient + Q1): scripts/plot_i464_clean_result_hero.py, scripts/plot_i464_revision_figs.py

• Git: tip of issue-464 at SHA 0905fc70f0ad2416d9435236102df6a01d580dfc (3-regime figure + both follow-up analysis JSONs + per-cell results); co-resident minimal-arms follow-up on issue-464-minimal at f76fed9af583b784e2c56decc7d75885526f4dc1 (eval results; code commit 6308e22199112760715db2744341f58cc0b76067) and 763ed830fd9d6d36676526568a7320ceebbb6fc7 (figures); contrastive-negative minimal-arms follow-up on issue-464-min-cn — run commit 25a271ff21284b6a40dd6d024ec3770e16a37f61, eval results at a57c871d450582d054f356e5d11188e9fd924976, figures + plot polish at de0015795dd108d5f33709078768cf264ba85892 (figures also on main at d0210a30994ef6afab124f1527864724870734f1)

• Reproduce:

  git clone https://github.com/superkaiba/explore-persona-space.git
  cd explore-persona-space
  git fetch origin issue-464 issue-464-minimal issue-464-min-cn
  git checkout f76fed9af583b784e2c56decc7d75885526f4dc1
  uv sync
  uv run python scripts/pod.py provision --issue 464 --intent ft-7b
  # On the pod:
  nohup bash scripts/i464_run_all.sh > /workspace/logs/issue-464-run.log 2>&1 &
  nohup bash scripts/i464_po_run.sh > /workspace/logs/issue-464-po.log 2>&1 &
  nohup bash scripts/i464_cn_run.sh > /workspace/logs/issue-464-cn.log 2>&1 &
  nohup bash scripts/i464_min_run.sh > /workspace/logs/issue-464-min.log 2>&1 &
  # Contrastive-negative minimal arms (separate 1x H100 pod, checkout 25a271ff2):
  nohup bash scripts/i464_min_cn_run.sh > /workspace/logs/issue-464-min-cn.log 2>&1 &
  # Regenerate the figures locally after pulling results:
  uv run python scripts/plot_i464_3regime.py
  uv run python scripts/plot_i464_minimal_content.py
  uv run python scripts/plot_i464_minimal_content_cn.py