The paper asks whether an LLM's choices between tasks rely on an internal evaluative representation and whether that representation is reused when the same model adopts different personas. It presents two tasks, forces the model to choose one to complete, aggregates comparisons with a Thurstonian model to estimate a latent utility per task, and trains a Ridge probe on residual-stream activations. Thus, ‘preference’ here means revealed choice under a specific prompt and protocol; it is not a direct observation of desire, experience, welfare, or stable agency.
On Gemma-3-27B-IT and Qwen-3.5-122B-A10B, probes predict fitted utilities better than a probe on Qwen3-Embedding-8B embeddings. The paper reports Pearson r=0.867 in-distribution and 0.834 leave-one-topic-out for Gemma, and 0.943 and 0.872 for Qwen. The strongest causal evidence appears only on Gemma: adding the direction to one task's tokens and subtracting it from the other at layer 23 moves the steered-task choice probability from about 0.01 to 0.99 over c=-0.06 to +0.06; a matched random direction is near null. The effect is concentrated in layers 17-26, and end-of-turn token patching also changes choice strongly.
To separate evaluation from description, the authors change valuation while holding some content fixed. They use pro/anti topic prompts, opposing-value pairs, biographies differing by one sentence, CREAK true/false claims, harmful BailBench tasks paired with benign rewrites, and political stances. The cleanest case is Gemma at the prefilled assistant turn: the probe's harmful-minus-benign delta moves from -4.52 under Assistant to +1.15 under evil, while the encoder remains negative at -1.01. But this clean flip does not occur at every position or model; on Qwen and the user turn it often narrows toward zero without inverting. The encoder is also competitive on truth and politics and is itself modulated by some prompts, so descriptive and evaluative information are not universally separated.
The persona study begins with fifteen system-prompt personas plus an unprompted Assistant measured on the same 500 tasks. PCA and utility correlations guide selection of Aura, mathematician, strategist, contrarian, slacker, and an evil/sadist persona named Damien Kross. The six plus Assistant are then remeasured on a canonical 6,000-task corpus. The Assistant-trained probe predicts every persona better than simply reusing Assistant utilities. For evil/sadist, utilities anti-correlate with Assistant at r=-0.146, yet the probe applied to its activations reaches r=0.243. The same direction steers all six personas' choices on Gemma and, in open-ended examples judged by another LLM, amplifies the active persona rather than always imposing the Assistant voice.
Weight-level evidence is mixed. A Llama-3.1-8B-Instruct probe transfers to eleven OpenCharacter LoRA variants. By contrast, a sadist persona installed by SFT in Qwen gives near-null cross-context transfer of -0.10 and +0.05. Qwen also provides the main causal counterexample: although its probe decodes at r=0.946 at the tested layer, steering on only ten pairs produces swings from -0.05 to +0.06, roughly fifteen times smaller than Gemma's and without a clear monotonic trend. Linear decodability is not equivalent to causal control.
The appendices further constrain the interpretation. After projecting out the main direction, other in-distribution probes can still be trained; persona shifts occupy at least a rank-two subspace; and removing the canonical direction during inference preserves 0.98-0.99 agreement with baseline choices. The direction is useful for prediction and intervention, but it is neither unique nor necessary. The supported conclusion is that an usable evaluative direction exists in the tested settings, not that the model contains one scalar preference variable governing its decisions.
The paper includes important dual-use safety results. On Gemma, positive all-token steering raises harmful-prompt compliance from 0 to 65 percent and can produce social-engineering scripts or ransomware; negative steering creates fabricated refusals on benign queries. A nine-scenario long-context control shows that steering the ethically relevant span has much more effect than steering a neutral span. This connects the representation to safety behaviour, but it also makes the published code a potential guardrail-bypass tool. The MIT repository provides no dedicated responsible-release note, threat model, or safe mode.
The evidence package does not permit direct reproduction of the numbers. The main text describes 6,000 tasks and a 5,000/1,000 division, the canonical split README documents 4,000 train, 1,000 validation, and 1,000 test, the probe-quality appendix uses a 4,000-task held-out pool, and REPRODUCING.md prescribes about 10,000/3,000. Shipped configs also reference 10,000/4,000 runs. Individual numbers are not mapped unambiguously to these regimes. CREAK is filtered to claims both models answer correctly 3/3; harm and politics rely on LLM rewriting or validation; many layers, positions, personas, topics, and coefficients are explored without a unified multiplicity analysis.
The public repository is substantial: 536 selected tests pass, Ruff passes, and src compiles. In a clean environment, however, the default suite ends with 31 failures and 7 errors: consistency indices, OOD mappings, and behavioural results are missing; other tests require OPENROUTER_API_KEY or the gated Gemma tokenizer despite not being excluded as API/network tests. Results and activations are ignored, no trained probes, raw measurements, or plot tables ship, and 70 configs declare 207 absent inputs. There is also no CI, release, tag, or lockfile. Public main stopped on May 13 with v1-era PDF/TeX, while arXiv v2 is dated May 18.
Two further pipeline risks matter. All five repetitions of a pair receive the same seed, so they are not guaranteed independent replicates. The cache omits temperature, provider routing, reasoning mode, exact model revision, and code version, and its name normalisation can collide between base and Instruct variants. Together with unlocked dependencies and unpinned Hugging Face revisions, this permits silent contamination or drift.
Overall, this is a broad and well-instrumented mechanistic study that provides convincing evidence for a choice-relevant, persona-dependent direction in Gemma and predictive evidence in Qwen. It does not establish genuine preference in a mental sense, a unique or necessary direction, an architecture-general causal mechanism, consciousness, suffering, moral status, or human personality. The paper states many of these caveats; this summary preserves those boundaries rather than turning probe correlation into a claim about mind or agency.