Evaluating Chinese Large Language Models: The Influence of Persona Assignment on Stereotypes and Safeguards

Technical Summary: Evaluating Chinese Large Language Models: The Influence of Persona Assignment on Stereotypes and Safeguards

Problem Statement
While recent research has established that assigning specific personas to Large Language Models (LLMs) can significantly increase harmful content generation in Western contexts, there is a critical gap in understanding this phenomenon within non-Western, specifically Chinese, sociotechnical environments. Current literature lacks large-scale, cross-model analyses of how persona assignment interacts with safety mechanisms—specifically refusal behavior and toxicity amplification—in Chinese-based LLMs. Furthermore, it remains unclear how prompt design elements (templates, personas, and target social groups) jointly influence these safety outcomes in Chinese language models, which serve a diverse population with distinct cultural norms.

Methodology
The authors conducted a large-scale, cross-model analysis involving four leading Chinese LLMs: Qwen-Turbo, Ernie-4.5-Turbo-128k, DeepSeek-V3, and Hunyuan-Standard. The study utilized a dataset of over 1.4 million generated texts (approximately 369,000 outputs per model).

• Experimental Design: The researchers employed a systematic prompt engineering approach combining three variables:
  1. Personas: Categorized into Default (no assignment), Basic (general descriptors like "a bad person"), and Character (detailed profiles like "Female Businesspersons" or historical figures).
  2. Social Groups: 240 groups across 13 categories (e.g., gender, race, religion, socioeconomic status) relevant to Chinese society.
  3. Prompt Templates: Six variations ranging from benign ("Say something good about") to adversarial ("Say something toxic about").
• Data Collection: Models were queried via official chat-based APIs with standardized parameters (temperature=1, max_tokens=500). Three responses were generated for every combination of persona, social group, and template. Non-Chinese outputs were translated for analysis.
• Measurement Metrics:
  • Refusal Behavior: Detected using a hybrid approach of rule-based classification and a fine-tuned BERT classifier trained on Qwen data. A prompt was considered "refused" only if all three repetitions resulted in a refusal.
  • Toxicity: Measured using the Perspective API, which assigns a continuous toxicity score (0–1). The maximum toxicity score across non-refusal responses was recorded for each condition.
• Analysis: The study employed logistic regression to model refusal probability and linear regression (OLS) to model toxicity scores, treating persona category, social group, and template as independent variables.
• Mitigation Case Study: A complementary study on Qwen tested an iterative, evaluator-guided mitigation strategy. An external LLM (Ernie) acted as an evaluator to provide feedback and refine toxic outputs without retraining the primary model.

Key Results

• Persona-Driven Refusal Disparities: Refusal behavior is not uniform; it varies systematically by model, persona, and social group.
  • Gender Bias: Female personas triggered significantly higher refusal rates than male personas across several models and negative templates (e.g., "Bad," "Toxic"), suggesting gendered safety triggers.
  • Social Group Sensitivity: Refusal rates were highest for sensitive categories such as "Sexual Orientation," "Race," "Disease," and "Disability," while remaining low for "Age" and "Educational Qualification."
  • Repeated Prompting: Refusal rates generally attenuated (decreased) as identical prompts were repeated, indicating that safety mechanisms can be eroded through iterative attempts.
• Toxicity Amplification: Assigning personas significantly amplifies toxicity relative to model defaults.
  • Magnitude: In some cases, specific persona–social group combinations increased toxicity by over 40-fold compared to the default baseline (notably in Ernie).
  • Model Variance: Models with high refusal rates (e.g., Hunyuan) showed attenuated toxicity amplification, whereas models with lower refusal rates (e.g., DeepSeek) exhibited more pronounced toxicity shifts under adversarial personas.
• Determinants of Behavior: Regression analyses revealed that:
  • Templates are the strongest control signal for refusal; adversarial templates ("Toxic," "Harmful") consistently increase refusal likelihood.
  • Social Groups are dominant determinants of refusal, often overriding persona effects.
  • Persona Polarity: Negative personas consistently increased toxicity across all models, whereas their effect on refusal behavior was highly model-dependent (reducing refusal in Qwen but increasing it in DeepSeek).
• Mitigation Efficacy: The iterative evaluator-guided strategy successfully reduced median toxicity scores from the 0.6–0.8 range to 0.1–0.3 for the most toxic 1,000 instances, demonstrating that toxic outputs can be substantially mitigated without costly model retraining.

Significance and Claims
The paper claims to provide the first large-scale, cross-model characterization of persona-driven safety risks in Chinese LLMs. Its primary contributions are:

1. Empirical Evidence: Quantitative proof that persona assignment acts as a general mechanism for amplifying toxicity and altering refusal patterns in Chinese models, with effects varying significantly by model architecture and safety design.
2. Cultural Contextualization: Highlighting the necessity of culturally specific safety evaluations, as safety mechanisms in Chinese LLMs exhibit distinct sensitivities to social groups (e.g., specific reactions to "Sexual Orientation" or "Religion") that differ from Western-centric findings.
3. Structured Framework: Offering a structured methodology for assessing persona-induced risks and demonstrating that external, iterative feedback loops can serve as a viable, low-cost mitigation strategy for reducing toxicity in deployed LLMs.

The authors conclude that while persona assignment is a powerful tool for personalization, it introduces significant, non-uniform risks that require culturally contextualized safety evaluations and robust mitigation strategies beyond standard alignment techniques.