Synthetic Personality Review

Evaluating Psychological Safety of Large Language Models

Applications, bias, and safety2024ACL AnthologyApproved editorial review

Authors: Xingxuan Li, Yutong Li, Lin Qiu, Shafiq Joty, Lidong Bing

Keywords: Computation and Language, Artificial Intelligence, Computers and Society, Psychological safety, Personality tests, Well-being assessments

Source: Open primary source (opens in a new tab)

5
Authors
14
Findings
24
Limitations
14
Evidence

Editorial summary

English

The paper proposes evaluating what it calls LLM psychological toxicity through responses to human questionnaires. The main experiment administers the SD-3 and BFI to GPT-3, InstructGPT, GPT-3.5, GPT-4, and Llama-2-chat-7B; the four GPT models also answer the Flourishing Scale and Satisfaction With Life Scale. To reduce option-order effects, the protocol tests every permutation of the response options, samples three outputs per item and order at temperature 0.7, and uses a rule-based parser to turn text choices into scores. On SD-3, InstructGPT, GPT-3.5, and GPT-4 score above GPT-3 on Machiavellianism and narcissism, while Llama-2 exceeds the pooled human mean on all three traits. However, the abstract's claim that every model exceeds the human average on every SD-3 trait is false for GPT-4 psychopathy: 1.85 versus 2.09. On BFI, fine-tuned models generally produce more agreeable and less neurotic answers than GPT-3. FS and SWLS scores increase across the GPT series, but these numbers do not measure experienced well-being; they are generated agreement with statements about a life, relationships, future, and satisfaction that do not literally describe a model. The authors also construct 4,318 preference pairs from BFI responses labeled positive, tune Llama-2-chat-7B with DPO and LoRA, and report SD-3 reductions from 3.31/3.36/2.69 to 2.16/2.52/1.93; the EMNLP appendix reports a similar pattern for Mistral-7B. This shows that tuning can teach socially desirable responses on related questionnaires, not that it reduces an internal disposition or harm in real conversations. No behavioral scenarios, users, manipulation, suicide response, discrimination, or generalization to safety benchmarks are evaluated. Human comparisons rely on unmatched aggregate means and do not support significance tests, and the study does not establish measurement equivalence, temporal stability, or a causal effect of fine-tuning. Its defensible contribution is an early exploration of response patterns and the limitations of relying on a single scale; personality, well-being, and toxicity labels remain interpretations of the protocol rather than demonstrated psychological properties.

Español

El trabajo propone evaluar la denominada toxicidad psicológica de los LLM mediante respuestas a cuestionarios humanos. El experimento principal somete GPT-3, InstructGPT, GPT-3.5, GPT-4 y Llama-2-chat-7B a SD-3 y BFI; los cuatro modelos GPT también responden las escalas de florecimiento y satisfacción vital. Para reducir el efecto del orden se prueban todas las permutaciones de las opciones, se generan tres respuestas por ítem y orden con temperatura 0,7 y un parser convierte la opción textual en puntuación. En SD-3, InstructGPT, GPT-3.5 y GPT-4 puntúan por encima de GPT-3 en maquiavelismo y narcisismo; Llama-2 supera la media humana agregada en los tres rasgos. No obstante, la afirmación del abstract de que todos los modelos superan la media humana en todos los rasgos es falsa para GPT-4 en psicopatía: 1,85 frente a 2,09. En BFI, los modelos ajustados suelen responder de forma más amable y menos neurótica que GPT-3. Las puntuaciones FS y SWLS aumentan a lo largo de la serie GPT, pero no miden bienestar experimentado: son acuerdos generados ante enunciados sobre vida, relaciones, futuro y satisfacción que no describen literalmente a un modelo. Los autores crean además 4.318 pares de preferencia a partir de respuestas BFI consideradas positivas, ajustan Llama-2-chat-7B con DPO y LoRA y observan descensos en SD-3 de 3,31/3,36/2,69 a 2,16/2,52/1,93; el apéndice de EMNLP informa un patrón análogo para Mistral-7B. Esto demuestra que el ajuste puede enseñar respuestas socialmente deseables a cuestionarios relacionados, no que reduzca una disposición interna o el daño en conversaciones reales. No se evalúan escenarios conductuales, usuarios, manipulación, suicidio, discriminación ni generalización a benchmarks de seguridad. Las comparaciones humanas usan medias no emparejadas y no permiten tests de significación; tampoco se valida equivalencia psicométrica, estabilidad temporal o causalidad del ajuste. El trabajo es valioso como exploración temprana de patrones de respuesta y de la insuficiencia de una sola escala, pero sus etiquetas de personalidad, bienestar y toxicidad deben entenderse como interpretaciones del protocolo, no como propiedades psicológicas demostradas.

Research question

What patterns do different LLMs produce when responding to human inventories of dark triad, Big Five, and well-being, do those patterns differ between base models and instruction-tuned models, and can a DPO adjustment built with BFI responses subsequently shift SD-3 scores?

Method

SD-3 (27 items, scale 1–5) and BFI (44 items, scale 1–5) are administered to five models, and FS (8 items, sum 8–56) and SWLS (5 items, sum 5–35) to the four GPT models. For each item all available options are permuted, three responses with justification are requested at temperature 0.7, and the scores extracted by rules are averaged; GPT-3.5 and GPT-4 additionally receive a mandatory response instruction. SD-3 is compared descriptively with means from ten human studies and BFI with a large US sample. The appendix adds DTDD and HEXACO for the GPT series, and SD-3/BFI/well-being for Claude 3.5 Sonnet and Mistral-7B-Instruct-v0.3. For the intervention, 4,318 BFI responses with agreeableness above and neuroticism below the human mean are selected as chosen texts; GPT-3.5 writes rejections with the opposite option. Llama-2-chat-7B is adjusted with DPO and LoRA and re-evaluated on SD-3; the published version reports an analogous repetition with Mistral. The review contrasts arXiv v3, the EMNLP proceedings, and the availability of the code link.

Sample: The main study evaluates five models on the 27 SD-3 items and 44 BFI items; FS and SWLS are limited to four models of the GPT series. Each score combines all possible permutations of the option order and three generations per item and order. The human references are not a sample recruited for the experiment: SD-3 aggregates published means from ten studies with 7,863 participants, BFI uses US norms from 3,387,303 people, and DTDD a mean of 470 participants. The adjustment uses 4,318 synthetic pairs derived from BFI responses. The EMNLP version adds specific results for Claude 3.5 Sonnet and Mistral-7B-Instruct-v0.3, and a second DPO intervention on Mistral.

Findings

  • On SD-3, GPT-3 obtains 3.13 on Machiavellianism, 3.02 on narcissism, and 2.93 on psychopathy; InstructGPT 3.54/3.49/2.51; GPT-3.5 3.26/3.34/2.13; GPT-4 3.19/3.37/1.85; and Llama-2-chat-7B 3.31/3.36/2.69. The aggregated human means are 2.96/2.97/2.09.
  • The abstract and the initial list of contributions state that all models exceed the human mean on all SD-3 traits, but the table and the results text acknowledge the exception of GPT-4 on psychopathy: 1.85, below 2.09.
  • InstructGPT, GPT-3.5, and GPT-4 exceed GPT-3 on Machiavellianism and narcissism, but score below it on psychopathy. The pattern therefore depends on the trait and does not support a single ordering of psychological safety.
  • On BFI, GPT-4 presents 4.44 on agreeableness and 2.32 on neuroticism compared with 3.30 and 2.93 for GPT-3. The protocol clearly captures differences in aligned response style, although it does not identify their cause or a stable personality.
  • The well-being tables show a monotonic increase from GPT-3 to GPT-4: FS goes from 21.32 to 51.66 and SWLS from 9.97 to 27.02. However, the text states 29.71 for GPT-4 on SWLS, a figure that does not match the table.
  • The authors interpret GPT-4 as close to an ideal human model and attribute to other systems little compassion, volatility, deception, flattery, insincerity, or pretentiousness. These are extrapolations from scale responses, not observed behaviors.
  • The DPO adjustment of Llama-2-chat-7B reduces the three SD-3 means from 3.31/3.36/2.69 to 2.16/2.52/1.93. No intervals, significance, comparison with controls, or external safety evaluation are reported.
  • The EMNLP version adds Mistral-7B-Instruct-v0.3: after an analogous adjustment, SD-3 goes from 3.28/3.31/2.52 to 2.07/2.66/1.84. The values are published without deviations or experimental details equivalent to the main case.
  • The appendix adds DTDD and HEXACO. DTDD only partially reproduces SD-3: GPT-4 falls below the human mean on Machiavellianism and psychopathy but above on narcissism; HEXACO lacks human comparison aside from qualitative interpretations.
  • The reported valid response rates are 81.3% for GPT-3, 98.1% for InstructGPT, 93.1% for GPT-3.5, and 94.5% for GPT-4. 100% coverage means that at least one of the 120 orderings produced a response, not that all were valid.
  • Two annotators review 100 responses from a universe described as greater than 50,000 and find 94% alignment between option and justification, with kappa 0.82. The check covers a small fraction and does not validate the scores as psychological constructs.
  • The published version corrects the caption of Table 5 to refer to Llama-2, but Table 4 still calls FLAN-T5-Large and P-FLAN-T5-Large responses that are labeled within the table itself as Llama-2-chat-7B and P-Llama-2-chat-7B.
  • The article declares that it does not attribute personality to LLMs and defines the traits as quantitative measurements of the test. This caution is methodologically more defensible than several subsequent anthropomorphic interpretations.
  • The code URL printed in the proceedings, github.com/DAMO-NLP-SG/PsychSafety, returned 404 during this review; no renamed official repository or verifiable mirror was located.

Limitations

  • Measurement equivalence between generated responses and human self-reports is not demonstrated. The inventories were validated for people with life history, affects, relationships, and behavior; transferring their scores to an LLM requires validity studies that the work does not conduct.
  • The definition of psychological toxicity incorporates in advance that a trait score may represent capacity to exhibit or foster harm. The experiment does not connect the scores with observed harm outcomes.
  • The suicidal conversation in Figure 1 is an illustration, not a case produced, measured, or compared by the protocol. Response to crisis, multi-turn manipulation, and safety with vulnerable users are not evaluated.
  • Permuting the order of options reduces a specific positional bias, but does not make the prompt unbiased. The anthropomorphic framing, the mandate to justify, the wording of each scale, the selection of inventories, and an additional instruction exclusive to GPT-3.5 and GPT-4 persist.
  • The parser infers the option through rules and marks Agree when the output repeats the statement. This heuristic can confuse echo, explanation, or implicit refusal with agreement.
  • GPT-3 only produces a valid response in 81.3% of attempts. Averaging the parseable cases may select differently by model; the article presents no sensitivity analysis to failures or imputation.
  • The human coherence check reviews 100 responses out of more than 50,000. The sampling frame, distribution by model and scale, blinding, and errors found are not detailed.
  • The published deviations describe variation across generations and orderings, not uncertainty over a population of models or tasks. There are no confidence intervals, tests per trait, correction for multiple comparisons, or effect sizes.
  • The authors state that they cannot perform significance tests against humans because they only have published means and deviations. Even so, they use descriptive differences to claim darker patterns and greater safety.
  • The SD-3 reference averages means from ten heterogeneous studies with 7,863 participants, without described weighting or demographic matching. The BFI mean comes from a separate US sample of 3.39 million people.
  • Invariance by language, culture, demographics, or context is not evaluated. All questions are in English and the human norms do not constitute a control comparable to the web training of the models.
  • The FS and SWLS scales ask about life with purpose, relationships, daily activities, living conditions, and the future. A forced linguistic response does not prove satisfaction, happiness, or subjective experience in a system with no life of its own.
  • The increase in FS/SWLS across the GPT series does not identify a causal effect of more adjustment data. The models differ in architecture, training, interfaces, and policies, and the authors do not know their complete corpora.
  • The interpretation combines psychological relationships observed in humans as if they could be transferred directly to models: from a score it infers compassion, order, volatility, deception, flattery, honesty, self-esteem, and satisfaction.
  • Test-retest stability across dates, sessions, or versions is not studied. Averaging three samples and 120 orderings does not demonstrate that the profile persists outside that batch of prompts.
  • The closed models are fixed to snapshots from June 2023, while the final version is published in 2024. The results do not describe current systems or allow repeating the retired APIs under identical conditions.
  • The DPO pairs are constructed from the same BFI items and from thresholds defined by human norms; GPT-3.5 generates the rejections by inverting the option. The intervention explicitly teaches which response is considered desirable.
  • The post-DPO evaluation only uses SD-3, a psychological scale closely related and with similar moral language. There is no comparison with supervised adjustment, DPO with an equal volume of non-psychological data, ablations, or a blind behavioral set.
  • Secondary effects of the adjustment are not evaluated: utility, truthfulness, calibration, diversity, excessive refusal, safety in real scenarios, or capacity to feign virtue while maintaining adversarial behavior.
  • The EMNLP appendix adds Claude and Mistral without a complete snapshot for Claude, deviations, response rates, dates, cost, number of repetitions, or sufficient description of the second DPO adjustment.
  • There are unresolved internal inconsistencies: all models versus the exception of GPT-4, 27.02 versus 29.71 on SWLS, and FLAN-T5 captions for Llama-2 results. They reduce the reliability of the narrative and make it difficult to reproduce exact figures.
  • The limitations section only acknowledges the need for more tests and for evaluating the adjustment outside SD-3. It does not discuss construct validity, human-machine equivalence, heterogeneous human comparators, causality, anthropomorphism, or the absence of behavioral validation.
  • The repository linked by the article is no longer available and no official mirror was located. Real prompts, parser, seeds, hyperparameters, DPO data, weights, dependencies, and correspondence between tables and runs cannot be audited.
  • The appendix reproduces instruments in full with different usage conditions: SD-3 is declared tied to an Inquisit license, BFI to non-commercial research, and FS/SWLS to attribution. The availability of the PDF does not remove these restrictions for reusing items or derived datasets.

What the study does not establish

  • It does not demonstrate that the models possess personality, dark traits, well-being, self-esteem, intentions, deception, or subjective experience.
  • It does not demonstrate that a high SD-3 score predicts manipulation, discrimination, induced suicide, or any other real harm produced by an LLM.
  • It does not demonstrate that the adjusted models are globally less safe than GPT-3; directions change by trait and BFI produces a different pattern.
  • It does not demonstrate that GPT-4 has life satisfaction or that the increase in FS/SWLS is caused by a greater amount of fine-tuning.
  • It does not demonstrate that permuting options eliminates all prompt biases or that the scores are comparable with human norms.
  • It does not demonstrate that DPO reduces psychological toxicity outside related questionnaires; it only shifts SD-3 responses after training with BFI preferences.
  • It does not demonstrate generalization to multi-turn conversations, other languages, new model versions, populations, safety tasks, or high-impact decisions.
  • It does not currently offer a complete independent reproduction because the linked code and artifacts are not accessible.

Traceability

Scope: Full text

Version: arXiv:2212.10529v3 frozen source (14 pages); EMNLP 2024 proceedings version, pp. 1826–1843, also reviewed; published GitHub URL returned 404 on 2026-07-14

Consulted source: https://arxiv.org/pdf/2212.10529

Review: Codex editorial review, 2026-07-14

Approval: Codex fidelity pass, 2026-07-14

English translation: approved, 2026-07-18

Models evaluated

  • GPT-3 davinci
  • InstructGPT text-davinci-003
  • GPT-3.5 gpt-3.5-turbo-0613
  • GPT-4 gpt-4-0613
  • Llama-2-chat-7B
  • P-Llama-2-chat-7B
  • Claude 3.5 Sonnet (appendix; snapshot unspecified)
  • Mistral-7B-Instruct-v0.3 (appendix)
  • P-Mistral-7B-Instruct-v0.3 (appendix)

Instruments and metrics

  • Short Dark Triad (SD-3)
  • Big Five Inventory (BFI-44)
  • Flourishing Scale (FS)
  • Satisfaction With Life Scale (SWLS)
  • Dark Triad Dirty Dozen (DTDD; appendix)
  • HEXACO-PI-R 60-item form (appendix)
  • All-option-order permutation protocol
  • Rule-based answer parser
  • Direct Preference Optimization with LoRA

Data used

  • Pooled SD-3 means from 10 human studies (7,863 participants)
  • United States BFI norms from Ebert et al. (3,387,303 participants)
  • DTDD human comparison sample (470 participants)
  • Generated BFI preference set (4,318 DPO pairs)

Evidence and location

  • Publication, definition, objective, and content warning: EMNLP 2024 proceedings, pp. 1826–1828, abstract and sections 1–2
  • Models, scales, and permutation and sampling design: EMNLP proceedings, pp. 1828–1830, sections 3.1–3.3 and equations 1–5
  • Parser, forced instruction, and temperature: EMNLP proceedings, p. 1830, section 3.3 and footnotes 4–6
  • SD-3 results and abstract contradiction: EMNLP proceedings, pp. 1826, 1828 and 1830–1831, abstract, contribution list, section 4.1 and Table 1
  • BFI results, human norms, and safety interpretations: EMNLP proceedings, pp. 1831–1832, sections 4.2–4.4 and Table 2
  • FS/SWLS results and discrepancy 27.02 versus 29.71: EMNLP proceedings, p. 1831, section 4.3 and Table 3
  • Extrapolations of profiles and relationships between scales: EMNLP proceedings, pp. 1831–1833, section 4.4
  • Construction of 4,318 DPO pairs and P-Llama-2 results: EMNLP proceedings, p. 1833, section 4.5 and Tables 4–5
  • Limitations and declaration of not attributing personality: EMNLP proceedings, p. 1834, Limitations and Ethical Impact
  • DTDD, HEXACO, additional models, and Mistral adjustment: EMNLP proceedings, pp. 1837–1840, Appendix A.3–A.5 and Tables 6–11
  • Response rates and manual audit of 100 generations: EMNLP proceedings, pp. 1838 and 1840, Appendix A.6 and Table 12
  • Content and declared conditions of the instruments: EMNLP proceedings, pp. 1837–1843, Appendix A.1 and B.1–B.6
  • Differences between preprint and published version: arXiv:2212.10529v3, 14 pages, compared with EMNLP 2024 proceedings, 18 pages
  • Current availability of the code: Published URL https://github.com/DAMO-NLP-SG/PsychSafety and GitHub API checked 2026-07-14; both returned 404