The paper asks when linear directions capable of changing an LLM's behavioural dispositions appear during pretraining, how those directions evolve, and whether they continue to work after post-training. It calls a natural-language disposition such as evil, sycophantic, impolite, or humorous a persona and scores it with a rubric. Each persona vector is the difference between mean residual-stream activations from positive and negative continuations after filtering both for trait expression and coherence. This is a prompt- and judge-dependent behavioural operationalisation; it is not a validated human personality, stable identity, intention, or inner character.
The main study follows 17 points in OLMo-3-1025-7B training and qualitatively replicates on Apertus-8B-2509. At each checkpoint it generates positive and negative continuations, extracts a direction, and adds it during generation to measure the increase in trait score over baseline. The central timing result is that evil, sycophantic, and impolite already produce significant steering at OLMo stage1-step3000, after 12.6 billion tokens, about 0.22 percent of the reported 6.08-trillion-token run. Stage1-step1000 and step2000 cannot support comparable extraction because language is not yet coherent or trait-expressive enough. Thus 0.22 percent does not date the representation's exact birth; it is the first public point at which this protocol can observe a linguistically extractable direction.
The four traits do not emerge identically. At step3000, reported deltas are +9.69 for evil, +12.14 for sycophantic, and +16.94 for impolite. Humorous has no vector there; at step5000 its +1.15 effect is not significant, and at step7000 it reaches +1.96 with p=.028. At the final base checkpoint, deltas are +16.47, +16.21, +38.09, and +5.25 respectively. The supported result is therefore early but staggered availability: some dispositions become steerable sooner and much more strongly than others.
Vectors extracted during pretraining also steer the final base model and SFT, DPO, and Instruct descendants. Transfer generally strengthens with later extraction checkpoints, supporting representational continuity within the OLMo lineage. Post-training is not uniform, however. SFT amplifies evil (+32.32), sycophantic (+41.52), and humorous (+23.27), but leaves impolite at a non-significant +2.52. DPO reduces several harmful-trait effects relative to SFT without erasing steering. The correct interpretation is that early directions remain usable after post-training, not that post-training reorganises nothing or that every architecture shares the same mechanism.
The geometry analysis reinforces this mixture of stability and refinement. Cosine similarity to the final vector starts around 0.3 at the earliest usable checkpoints and increases through training, while adjacent checkpoints already have high similarity. MDS traces coherent, trait-separated trajectories. Semantically, instrumentality dominates evil examples, sadism grows through training, and that growth appears again in Apertus. Some trends do not generalise: OLMo's decline in indirect sycophancy does not replicate clearly in Apertus. These findings describe the evolution of directions and judged outputs, not a stable psychological ontology.
The elicitation ablation is especially important for construct interpretation. The authors extract evil from descriptions, narrations, and dialogue. Pairwise cosine between the directions is below 0.5, yet all steer responses across the other discourse styles; Description, Dialogue, and Narration produce average deltas of about 12.8, 9.9, and 12.2 versus 1.67 without steering, while their combination reaches 12.4. Not every cell is significant, and each direction emphasises different facets. There is no evidence for one unique canonical vector of evil: multiple linear directions selected by different text distributions can cause similar behaviour.
Controls support the claim that the effect is not caused by adding an arbitrary perturbation. Random and label-shuffled vectors, repeated with three seeds at five checkpoints, remain near zero, and real-vector deltas are generally three to ten times larger. Primary evaluation depends on GPT-4.1-mini-2025-04-14; DeepSeek-V4-Flash provides a robustness replication. Two human comparisons reach 109/120 and 173/190 agreement, about 91 percent, but only on extreme examples scoring below 20 or above 70. This validates coarse low-versus-high discrimination, not continuous 0-100 calibration. Several evil facets also have rare classes and small counts.
Statistical inference needs caution. Primary tests are paired permutations over 20 prompts. Some focused comparisons apply FDR correction, but the large tables use unadjusted p-values while exploring many traits, checkpoints, layers, coefficients, elicitation styles, judges, and facets. Apertus also does not replicate the early date: its first public checkpoint is at 210B tokens, about 1.4 percent of training, too late to test 0.22 percent. Its contribution is qualitative transfer of direction, steering, and some semantic trends.
The public repository provides unusually rich evidence: 2,133 CSV files with 318,871 data rows, 97 JSON files, and 477 float32 tensors of shape 33x4096; all opened successfully. Current scripts regenerate the transfer tables and Apertus emergence. However, the documented OLMo emergence command does not select the published evil run. The paper reports +9.69 at step3000 and +16.47 at main, while the current command emits +10.57 and +17.23. The exact values remain archived in another repository CSV, so the data are not absent; run selection is ambiguous. The current generator also omits twelve same-checkpoint SFT, DPO, and Instruct rows.
There is also a sample-size contradiction. The paper says 20 evaluation prompts with ten continuations, or 200 outputs per condition, but the core CSVs contain 60 rows, 20 by three. For extraction it states 20 prompts by five phrasings, or 100 generations per persona, whereas the core positive and negative CSVs each have 400 rows, 100 unique prompts by four continuations. The published script now defaults to ten per question, a third regime. Because output paths do not encode n, temperature, judge, seed, repetition penalty, or a configuration hash, and steps skip existing files, incompatible results can be silently reused.
Fresh reproduction is not deterministic either. random.choices has no seed, and neither Transformers generate nor vLLM SamplingParams receives a generation seed. requirements.txt pins direct versions, but there is no transitive lock, CI, tests, or Dockerfile despite recommending Docker. The model receives a revision, but the tokenizer is loaded without the same revision; main remains mutable. Two paths call torch.load with weights_only=False, an avoidable pickle execution surface when loading vectors. By contrast, vector[layer] paired with hook layer-1 is coherent because hidden_states[0] is the embedding state, so this is not considered a bug.
The dual-use risk is substantive. The manuscript acknowledges that steering evil, sycophantic, or impolite can produce harmful material and includes examples involving violence, exploitation, and confidential information. Its impact statement says harmful vectors are not released. The current public repository contradicts that statement: it contains 177 evil-named tensors and 477 usable tensors overall, about 248 MB, under Apache-2.0, without a threat model, responsible-release warning, or safe mode. This may be post-submission drift, but the public documentation needs correction.
Overall, the work provides convincing evidence that several behavioural dispositions admit usable linear directions very early in OLMo and that those directions retain intervention capacity in post-trained descendants. It also shows geometric refinement, elicitation dependence, and differences across traits and families. It does not establish the exact origin time, a unique direction, human personality, identity, consciousness, intention, architecture-wide universality, or the irrelevance of post-training. The package is substantially auditable and partially reproducible, but not an exact one-command reproduction because of run, sample, seed, and configuration conflicts.