  Despite investments in improving model safety, studies show that misaligned
capabilities remain latent in safety-tuned models. In this work, we shed light
on the mechanics of this phenomenon. First, we show that even when model
generations are safe, harmful content can persist in hidden representations and
can be extracted by decoding from earlier layers. Then, we show that whether
the model divulges such content depends significantly on its perception of who
it is talking to, which we refer to as user persona. In fact, we find
manipulating user persona to be even more effective for eliciting harmful
content than direct attempts to control model refusal. We study both natural
language prompting and activation steering as control methods and show that
activation steering is significantly more effective at bypassing safety
filters. We investigate why certain personas break model safeguards and find
that they enable the model to form more charitable interpretations of otherwise
dangerous queries. Finally, we show we can predict a persona's effect on
refusal given only the geometry of its steering vector.
