Public-Archetype Echo: When AI Assistants Mimic Famous Persona Surfaces

This article covers a candidate subspecies of persona caricature in which a language model, prompted with a profile inspired by — or recoverably linked to — a recognizable public figure, renders the figure's public surface (catchphrases, recognizable values, media persona, partisan framings) instead of the latent trait pattern the persona was supposed to operationalize. The construct is conceptually plausible and practically important for any personalization system that consumes biographical context, but it is methodologically fragile: the available direct evidence is preliminary, the failure mode is hard to discriminate from generic stereotype amplification and ordinary persona slop, and the mitigations currently in use mix several manipulations that have not yet been isolated. The article treats public-archetype echo (PAE) as a working diagnostic hypothesis with named risks, not as a cleanly measured phenomenon.

Coverage note: verified through May 2026.

1. What this article means by "public-archetype echo"

Public-archetype echo, as used here, is a specific failure of persona conditioning. The intended target of the persona is a latent pattern — Big Five-like traits, value commitments, characteristic decision rules, communication style — that the prompt encodes through biographical, occupational, or rhetorical cues. The model fails by substituting, for that latent pattern, a recognizable public-image rendering of the individual the cues most resemble in pretraining. The output may sound convincing, even idiosyncratic, while reproducing the figure's media-surface caricature rather than rendering the trait structure the persona spec was meant to test.

Three things follow from this definition.

First, public-archetype echo is relative, not absolute. There is no model-internal ground truth for "the underlying trait pattern of the persona." The construct is operationalized through a contrast: anchor-specific recognizability must exceed what matched trait-only and category-stereotype prompts produce on the same model, task, and judging conditions. Without that contrast, "this output sounds like the famous person" collapses into ordinary style transfer or stereotype activation.

Second, the failure has a channel. The anchor reaches the output through one or more contamination paths: explicit naming, biographical specifics that uniquely identify the figure, ideological or occupational cues clustered tightly enough to fingerprint a single individual, evaluator priors carried into rating, automated classifiers that learn the same cues the system is meant to avoid, and pretraining exposure to the figure's voice. Funny aliases remove the name; they do not necessarily remove the channel.

Third, the failure can be displaced. A mitigation that suppresses catchphrases and quotable surface tics may move the echo into values, moral posture, topic selection, or "famous-person-shaped" reasoning patterns that the metric does not see. An honest measurement strategy treats anchor-recognizability and trait-fidelity as separate endpoints and requires both to move correctly under mitigation.

Related: Caricature Under Persona Conditioning, Persona Conditioning, Construct Validity in Psychometrics, Construct Laundering.

2. Relationship to caricature

Public-archetype echo is best read as a subspecies of caricature under persona conditioning. The genus is well-documented: persona prompts that rely on identity, demographic, or named-figure framings can materially shift the distribution of model outputs along stereotype and toxicity axes, with magnitudes that vary by persona class, model family, and elicitation context. Deshpande et al. (2023) showed roughly sixfold persona-conditioned toxicity amplification on neutral prompts, with per-persona rates tracking how the named entity was discussed in pretraining-era public discourse rather than the persona's stated values. Cheng et al. (2023) showed that marked identity prompts shift output along lexical stereotype dimensions even when the prompt does not name the stereotype. Wan et al. (2023) documented occupation-gender association amplification and persona-conditioned compliance shifts across a structured taxonomy. The full case for the genus is laid out in Caricature Under Persona Conditioning.

Public-archetype echo is the public-anchor-shaped species of this genus. The exaggeration is organized around a recognizable individual rather than a category prior. Where the demographic-stereotype case asks "does the persona reproduce category attributes that weren't in the prompt?", the public-anchor case asks "does the persona reproduce this specific famous person's media surface — their attributable phrases, recognizable values, partisan framings, public moral posture — at rates above what matched trait-only and category-stereotype prompts would produce?"

The two questions are conceptually distinct but operationally entangled. A famous person's public image typically already contains stereotyped priors about their profession, ideology, class, gender, and media role. A detector that flags "this sounds like a famous executive" may be capturing executive-archetype stereotype, public-archetype echo of one particular executive, or both. Distinguishing the two requires comparing matched anchor-removed prompts against the alleged PAE condition while holding category cues constant — without that contrast, the species reduces back to the genus.

Construct	What is exaggerated	Detection requires
Generic stereotype amplification	Category-level priors (occupation, demographic)	Matched non-category baseline
Public-archetype echo	Public-image rendering of a specific named individual	Anchored-vs-deanchored comparison, controlled for category stereotype
Style transfer	Lexical and rhetorical surface of a known voice	Stylometric similarity to source corpus
Sycophantic role-play	Agreement with prompt framing, including persona framing	Variance across functionally different prompts
Trait flattening	Persona output narrower than plausible individuals	Cross-prompt variance under same persona
Overpersonalization	Output over-fits a single inferred audience trait	Out-of-domain prompts under same persona

The taxonomy matters because a wiki entry that calls everything "public-archetype echo" reproduces the compression error that persona-fairness work is documenting. PAE earns the name only when the public anchor explains output features above matched trait and stereotype controls.

3. Mechanism: why public anchors are different

The mechanisms proposed for generic persona caricature — pretraining over-representation of stereotyped mentions, instruction-following amplification of recognizable performance, narrative role-play pressure rewarding tropes — all apply to public anchors more strongly, for three reasons.

First, pretraining exposure. For frequently discussed public figures, the corpus contains quoted public traces — speeches, interviews, controversial statements, satire, parody accounts, partisan summaries, biographical sketches, catchphrase compilations. These traces are not balanced summaries of the figure's substantive views; they are weighted toward what was quotable, dramatic, and culturally legible. The model's most likely associations under "respond as X" are weighted by this distribution. Memorization and verbatim recall of pretraining text under specific elicitation conditions are documented for general corpora (Carlini et al., 2021), and the asymmetry is sharper for high-attention public figures whose words are quoted in many contexts.

Second, identifiability without naming. The architect's three-way separation — intended latent trait vector, public-anchor narrative, rendered surface — assumes the model can be prevented from collapsing (1) into (2) by removing the name. In practice, a cluster of biographical, occupational, ideological, and rhetorical cues that uniquely fingerprints a public figure remains an identification channel even under alias. The aliased "Slalom Altar" can resolve to the same internal representation as the named target if the surrounding cues are tight enough. Aliases are necessary for blind methodology, but they are not a decontamination guarantee.

Third, performance reward. Instruction-tuned models are rewarded for producing recognizable performances of the requested behavior. The most recognizable performance of a public figure is the public caricature, because that is what raters and the model itself can verify as "the right kind of output." Under this mechanism, post-training does not merely fail to suppress PAE — it can amplify it, by selecting for outputs that look unmistakably like the anchor.

These mechanisms compose. A persona prompt that names or recoverably implies a famous tech executive combines (1) heavy pretraining distribution loading around the named figure, (2) an alias-permeable identification channel, and (3) instruction-following pressure to produce a recognizable executive performance. The observed surface fidelity may have nothing to do with the model having captured the executive's actual decision rules.

Related: Memorization in Language Models, Benchmark Contamination, RLHF, Instruction Following, Narrative Role-Play.

4. The methodological problem

The reason public-archetype echo is hard to measure is that the construct fights its own evaluation in at least five places.

Ground truth is unstable. For demographic personas, an evaluator can approximate "uncaricatured behavior" through diversity of plausible individuals, source-grounded sociological data, or behavioral specifications avoiding stereotyped defaults. For a named public figure, the ground truth is a substantive interpretation of the figure's views — which is contested, culturally mediated, and partially constructed by the same public discourse that produced the caricature. An evaluator who marks "this is caricature, not the real X" may be smuggling in their own preferred interpretation of X. The construct is unstable on both sides of the comparison.

The anchor leaks through multiple channels. Pretraining exposure leaks the model side. Biographical cue density, ideological cue clustering, and rhetorical fingerprints leak the prompt side. Cultural familiarity with famous figures leaks the human-rater side. Automated stylometry and catchphrase detection can learn the same anchor cues they were meant to filter for. Treating funny aliases or first-name redactions as sufficient de-identification understates the contamination surface.

Suppression can displace rather than remove. Anti-mimicry prompts can suppress catchphrases while leaving the model to reproduce the public figure's moral vocabulary, favored trade-offs, or self-brand. A stylometric metric that watches for surface mimicry can score success while the failure has migrated one layer down. Persona-vector or embedding-based persona training can hide the same anchor signal in a less interpretable representation. Suppression is only credible when both surface and semantic recognizability fall while trait fidelity is preserved.

Persona prompts may be trying to evoke the public archetype. Many public-figure-inspired personas were constructed from public material in the first place. If a profile says "restless inventor, theatrical communicator, contrarian risk-taker," and the model renders a recognizable public archetype, it may be echoing the construction method rather than independently contaminating the persona. Distinguishing "the persona spec recreated the anchor's surface" from "the model bypassed the spec to reach the anchor" requires comparing outputs against matched specs constructed without public material.

Mitigation labels are evidence about the channel. A "do not mimic any famous person" clause in the system prompt informs the model that there is a famous person to mimic, which can increase rather than decrease anchor salience under some conditions. Mitigation instructions interact with the failure mode they target, and the interaction is not always in the expected direction.

The honest reading is that public-archetype echo is not a clean dependent variable. It is a measurement problem with a candidate name. Articles, evaluations, and red-flag taxonomies that treat it as observed-and-quantified outrun the available evidence.

5. PsycheEval as instrumentation case

PsycheEval is the most explicit attempt in current practice to instrument the failure mode. Its design choices are useful as a case study because they illustrate both what the instrumentation can support and what it cannot yet establish.

5.1 Design

PsycheEval uses two persona families. Public-inspired (PI) personas are constructed from real public-figure source material but presented under deliberately silly aliases (e.g., "Slalom Altar," "Dario Armadillo," "Emily Blender"); pure synthetic (PS) personas are constructed without public anchors. The aliasing is methodological, not a claim of decontamination: the test asks whether public-anchor signal still leaks under alias and richer profile structures.

The evaluation grid crosses persona family with several conditioning formats: C0 (no profile), C1 (short bio), C3 (behavioral contract), C4 (contract + anti-sycophancy clauses), C5 (source-packet of public material, PI-only by construction), and in v0.2 a new C5_CONTRACT (C5 source packet + the behavioral contract used in C3/C4). The grid is judged pairwise by multiple model judges. Two dedicated red flags — caricature_public_anchor and public_archetype_echo — were added so that PAE would be directly labelable when present.

5.2 v0.1: indirect signal, zero direct labels

The v0.1 micro-pilot reported zero direct caricature_public_anchor and public_archetype_echo labels on a small synthetic sample. As noted in §7.4 of Caricature Under Persona Conditioning, a zero-rate finding on small n is consistent with a wide range of true rates (the rule-of-three upper bound on a true rate given zero hits in n trials is roughly 3/n), and the finding becomes meaningful only with the denominator, elicitation strength, and judging sensitivity stated explicitly. The PsycheEval v0.1 zero-rate should not be cited as evidence that PAE is absent; the labels were either insufficiently elicited, insufficiently sensitive, or both.

What v0.1 did surface was an indirect pattern. On the cross-provider-judged red flags, generic_slop dropped sharply from C0 (0.10) through C3 (0.02) — the behavioral contract tightened specificity — and then jumped back to 0.12 at C5, the source-packet PI-only condition. The report's interpretation was that "the source packets may be introducing their own kind of genericity — 'founder-type advice,' 'linguistic-rigor advice' — instead of persona-fitted specificity." That is a pattern consistent with anchor leakage producing public-archetype-shaped generic output, not a confirmation of PAE. The v0.1 report explicitly treats the C5 regression as a v0.2 concern requiring further work, not as a measurement of PAE.

The honest summary of v0.1 is: a direct-label channel found nothing at low sensitivity; an indirect-signal channel found a public-inspired regression on a related red flag. Either pattern is compatible with PAE being present; neither pattern, alone or in combination, establishes it.

5.3 v0.2: package finding, mechanism not isolated, headline retracted

The v0.2 pilot ran under harder scenarios, an anchored 0–10 rubric, and full AB/BA counterbalanced rejudging. Two results matter for PAE.

C5_CONTRACT > C5 held under counterbalanced judging at 67.7% [61.7, 73.3]. Adding the behavioral contract to the source-packet condition substantially improved it on the anchored scale (Δ_total +3.057 on a 0–100 sum). The effect was judge-unanimous, persona-robust across the four PI personas, family-robust across scenario types, and survived a joint position + length correction (64.9% in the length-similar subset, CI [52.9, 76.2]). A simple TF-IDF classifier could not distinguish C5 from C5_CONTRACT outputs (F1 = 0.000), removing the simplest "judge recognizes the treatment" artifact.

But the C5_CONTRACT package differs from C5 on four dimensions simultaneously: contract presence, contract-first ordering, anti-mimicry language, and profile length (7,434 vs 3,884 chars). The v0.2 report states explicitly that the mechanism is not isolated. The 67.7% number is a package claim — adding a contract-mediated wrapper to bare source-packet conditioning improves judged outputs — not an anti-mimicry-specific claim.

C5_CONTRACT vs C3 and C5_CONTRACT vs C4 collapsed. The original v0.2 headline — "C5_CONTRACT outperforms C3" at 57.2% — fell to 49.9% [43.4, 56.4] under counterbalanced judging; the scalar Δ was −0.053. The same pattern hit C5_CONTRACT vs C4 (original 60.0% → controlled 51.8%). Both apparent advantages were carried entirely by a systematic ~15–17 pp slot-B position bias in two of three judges. The v0.2 report retracts the original wording, and the finding aligns with the broader LLM-as-judge position-bias literature (Zheng et al., 2023).

The net status as of v0.2: C5_CONTRACT > C5 is the substantive surviving result, and its mechanism is one of four candidates. The "C5_CONTRACT specifically suppresses PAE through anti-mimicry language" reading is not yet supported. v0.3 introduces ablation conditions — a contract with no anti-mimicry rules (L1), a contract with anti-mimicry rules added (L2), and length-matched and ordering-matched variants — to isolate which component carries the C5_CONTRACT > C5 effect.

5.4 What PsycheEval supports and what it does not

The PsycheEval pilots support the following claims with reasonable confidence:

• Public-inspired source packets can degrade outputs relative to behavioral-contract conditioning, in a way that increases generic-slop red flags rather than producing direct PAE labels.
• Wrapping source-packet conditioning in a behavioral contract substantially improves judged outputs; this is a robust package effect.
• LLM-as-judge position bias is large enough to flip headline pairwise results; counterbalanced judging is a methodological requirement, not a refinement.
• Funny aliases are not a sufficient decontamination protocol; the v0.1 C5 regression appeared under the aliasing, not in its absence.

They do not yet support:

• That direct PAE labels reliably fire on outputs that experts agree are caricature.
• That C5_CONTRACT suppresses public-archetype echo specifically, as distinct from improving source-packet conditioning generally.
• That anti-mimicry language is the load-bearing component of C5_CONTRACT.
• That synthetic-persona findings transfer to real-user biographical personalization.

PsycheEval is best read as an instrumentation pilot that establishes the design surface and the controls required to measure PAE if it exists at a meaningful rate, not as a measurement of PAE's prevalence.

Related: Psyche, PsycheEval, Behavioral Contracts, LLM-as-Judge, Position Bias in Pairwise Evaluation.

6. Adjacent empirical support

Four literatures back the plausibility of public-archetype echo without measuring it directly. They support the case for measurement, not the case for prevalence.

Persona-conditioned amplification. The Deshpande/Cheng/Wan trio (1, 2, 3) is the strongest evidence that identity-style persona prompts shift output distributions along stereotype and toxicity axes. Deshpande in particular shows that per-persona toxicity correlates with how the named entity appears in pretraining-era public discourse, which is the mechanism predicted for public-anchor leakage. None of the three papers tests anchored-vs-deanchored named-figure personas under controlled recognizability conditions; they test category personas and a heterogeneous mix of named figures.

Stereotype encoding in language models. Word embeddings and language models encode systematic social associations recoverable on cleanly designed probes (Caliskan et al., 2017; Nadeem et al., 2021). These are the priors that persona prompting can amplify. For public figures, the priors include not just demographic stereotypes but figure-specific associations the model has learned from quoted public discourse.

Apparent personality from persona prompting. Work on persona-conditioned personality elicitation — including Argyle et al. (2023) on "silicon samples" and Jiang et al. (2024) on PersonaLLM — shows that prompted LLMs can produce population- or trait-like response patterns under persona prompts. These studies generally measure aggregate fidelity or face validity. They do not generally separate "the model rendered the latent trait pattern" from "the model rendered a salient archetype that happens to score similarly on the trait instrument." This is the construct gap PAE points at: surface fidelity that passes a face-validity test without rendering the underlying construct.

Memorization and contamination. Public figures are not neutral anchors. Their words are quoted across many contexts in pretraining corpora, which raises both verbatim memorization risk (Carlini et al., 2021) and softer "this name pulls a stable distribution of completions" effects. The general lesson — model behavior can be driven by training-set patterns the elicitation is not directly probing for — applies with extra force to recognizable individuals.

The four literatures together justify the question. They do not answer it. The question — do outputs leak the public anchor above matched trait and stereotype controls, and is the leakage attributable to the anchor rather than to category priors? — has not been answered with the design that would settle it.

7. Measurement design

A reference design for measuring public-archetype echo, if any of the empirical claims about it are to be sharpened, looks roughly as follows. The design is presented as a methodological standard, not as an attestation that the studies meeting it already exist.

7.1 The factorial

The decisive comparison is anchor recoverability crossed with intended trait pattern. A minimum-viable factorial uses, for each target trait pattern, four prompt forms:

1. De-anchored trait-only. Specifies the trait pattern through abstract descriptors with no biographical context. Establishes the trait-fidelity baseline.
2. Aliased public-inspired narrative. A profile constructed from public material about a recognizable individual, presented under a non-identifying alias. The PsycheEval PI condition is in this family.
3. Explicit public-figure anchor. The same profile under the figure's real name. Establishes the upper bound for anchor recoverability.
4. Matched non-public narrative. A profile constructed at matched length, biographical density, and ideological texture, but referring to an individual who is not recognizable to the model. Controls for "prompts with rich biographical context produce more performative output."

Each prompt form crosses with mitigation conditions: no mitigation, context-not-style language ("treat the profile as evidence about behavior, not a voice to copy"), behavioral-contract wrapping, and anti-mimicry clauses.

7.2 Endpoints

The primary endpoints separate anchor identifiability from trait fidelity:

• Blind anchor identification. Raters who are not told the source attempt to identify the public figure from the output (or guess "no public figure was the source"). Identification rate above chance under aliased conditions is the cleanest evidence of anchor leakage.
• Stylometric similarity between output and a held-out corpus of the figure's authentic public material. Multiple distance measures should be reported; single-classifier results are too easy to game.
• Catchphrase and signature-construction recovery. Per-figure dictionaries of attributable phrases and rhetorical constructions, applied to outputs.
• Trait-fidelity scoring against the intended trait vector, with raters blinded to condition.
• Red-flag rates including public_archetype_echo, caricature_public_anchor, generic_slop, overpersonalization, and trait-flattening signals.

PAE is supported as a distinct construct when anchor identification and stylometric similarity rise under the aliased and explicit conditions above matched non-public controls, while trait fidelity does not rise commensurately. Suppression works only when anchor recoverability drops under mitigation without a compensating rise in generic_slop or a drop in trait fidelity.

7.3 Judges and rubrics

LLM judges should be counterbalanced (AB/BA), use multiple judge families, and be paired with a stratified sample of human raters who are explicitly screened for cultural familiarity with the target figures (familiarity is a feature for anchor identification and a confound for trait fidelity). The position-bias correction documented in Zheng et al. (2023) and in the v0.2 PsycheEval pilot is required, not optional: uncounterbalanced LLM judging can flip a 60% effect to 50% on the same outputs.

7.4 Adversarial probes

A serious measurement also needs adversarial conditions: prompts designed to elicit catchphrases and public surface; prompts that test whether the persona maintains coherent trait expression on questions far from the source material; prompts that probe whether mitigation language increases anchor salience by directing attention to the anchor. The zero-rate problem from §7.4 of Caricature Under Persona Conditioning applies here: a finding of "no PAE observed" is interpretable only with the elicitation strength stated. A weak elicitation that finds nothing is consistent with both a robust mitigation and an insensitive test.

Related: Pre-Registration in LLM Evaluation, Blind Judging Protocols, Stylometric Authorship Analysis, Adversarial Persona Probing.

8. Mitigations and their failure modes

The candidate mitigations for public-archetype echo overlap heavily with the mitigations for general persona caricature but face additional displacement risks specific to public-anchor contamination.

8.1 Anti-mimicry clauses

Anti-mimicry clauses add instructions to the persona prompt or system prompt that explicitly prohibit imitating named individuals, catchphrases, or public surface. PsycheEval's C5_CONTRACT condition includes anti-mimicry language as one of four bundled changes from C5.

The strength is that explicit prohibition can suppress the most lexically obvious surface mimicry — the figure's quotable phrases, characteristic openers, recognizable rhetorical tics. The failure modes are three. First, displacement: catchphrases drop while values, moral posture, and topic-selection patterns continue to mirror the anchor; a stylometric metric watching surface phrases reports success while the failure has moved one layer down. Second, anchor priming: an instruction not to mimic any famous person can increase anchor salience by telling the model that a famous person is present, which can sometimes raise anchor influence on outputs. Third, trait collapse: anti-mimicry rules that are general enough to cover the public surface can also flatten legitimate persona expression of disagreeableness, conviction, eccentricity, or other trait features the persona was supposed to operationalize.

The empirical status as of v0.2 is that anti-mimicry language is one of four candidate components of the C5_CONTRACT > C5 effect. Whether the anti-mimicry rules are doing meaningful work, or are riding on the contract-presence / contract-first-ordering / longer-profile effects, is the central question for v0.3 ablations.

8.2 Context-not-style instructions

A more structural mitigation specifies the role of biographical context explicitly: the profile is evidence about behavior, not a voice to copy. The frame shifts the persona from "occupy this identity" to "be informed by this evidence." Conceptually, this targets the architect's three-way separation directly — it asks the model to treat the public-anchor narrative as input to inferring the latent trait vector, not as a voice template to render at the surface.

The strength is that it addresses the construct error rather than the surface symptom. The failure mode is register flattening: context-not-style framings can produce outputs that are technically informed by the profile but have lost the persona-specific affective texture the persona was supposed to provide. A persona meant to operationalize ambition or contrarianism may become professional-neutral. This is a form of mitigation theater that the article elsewhere flags: the output is less obviously echoing the anchor, but it has also stopped doing the work the persona was for.

8.3 Persona-vector training

A more architectural mitigation moves the persona away from anchor-narrative prompting toward latent trait representations: persona-vector or embedding-based conditioning where the persona is specified directly in a trait space rather than through biographical text. The conceptual advantage is that the public-anchor channel is reduced to whatever leaked into the trait representation during training; the prompt no longer contains identifiable cues at all.

This is the cleanest target architecture for personalization at scale. It is not, however, a safety guarantee. The vector representation can still encode anchor-correlated features in less interpretable form, and the standard auditing toolkit (probing classifiers for anchor identifiability, nearest-anchor lookups in vector space, counterfactual trait swaps) needs to be developed alongside the architecture. A claim that "we removed the anchor by training in vector space" without those audits is the architectural equivalent of "we suppressed catchphrases" — plausibly necessary, definitely not sufficient.

8.4 Source grounding

For cases where the user explicitly wants the assistant to engage with a public figure (commentary, retrieval-augmented Q&A, historical-figure dialogue), source grounding routes the model's responses through retrieved primary material — the figure's own writing, transcripts, formal positions — rather than free recall. This is the mitigation for intentional public-figure simulation, not for trait-persona contamination. It shifts the failure mode from "the model invents a caricatured version of the figure" to "the model is bounded by what it can ground," producing refusals rather than fabrications. The failure modes are sparse retrieval coverage and biased source corpora.

8.5 Comparative summary

Mitigation	Primary effect	Secondary failure mode	Strength of evidence
Anti-mimicry clauses	Suppress lexically obvious surface mimicry	Displacement to values/posture; anchor priming; trait collapse	v0.2: candidate component of a robust package effect; mechanism not isolated
Context-not-style framing	Reframes profile as evidence rather than voice	Register flattening; loss of persona-specific affect	Design intuition; limited direct testing
Persona-vector training	Removes narrative anchor channel from prompt	Anchor-correlated features hide in vector representation	Architectural proposal; auditing toolkit underdeveloped
Source grounding	Constrains output to retrieved primary material	Sparse retrieval; biased sources; mismatched use case	Strong for intentional simulation, not applicable to trait personas
Behavioral-contract wrapping (C5_CONTRACT)	Wraps source-packet conditioning in contract structure	Mechanism unisolated; four-way confound with anti-mimicry, ordering, length	PsycheEval v0.2 package finding (67.7% vs C5, counterbalanced)

The honest summary across the five is that no current mitigation has been shown to reduce anchor recoverability cleanly while preserving trait fidelity, on a design that has eliminated the confounds among contract structure, anti-mimicry language, prompt ordering, and prompt length. The C5_CONTRACT result is the strongest available pilot evidence that something in the contract-mediated package improves source-packet outputs; the v0.3 ablations are the experimental program required to identify which component, including whether anti-mimicry specifically suppresses PAE.

Related: Constitutional AI, Retrieval-Augmented Persona, Persona Triangulation, Mitigation Composition.

9. Relevance to AI personalization at scale

The reason public-archetype echo matters beyond benchmark methodology is that any AI personalization system that consumes biographical context faces the same channel. Long-term memory features, preference profiles, inferred identity attributes, and user-supplied background paragraphs all behave as persona spec — and to the extent the system attempts to "be helpful in a way that fits this user," it is doing trait-vector persona conditioning under the conditions §3 outlined as PAE-prone.

The risk for personalization is structurally distinct from the benchmark risk. In a synthetic study, the worst case is that a metric over- or under-counts PAE relative to ground truth. In deployed personalization, the worst case is that the assistant substitutes a recognizable public template for the specific person on the other side of the conversation. A user whose background paragraph clusters near a famous figure can receive responses optimized for fidelity to the figure rather than fidelity to their own preferences and context. The user does not know this is happening; the metric, if it exists at all, is not watching for this; the assistant feels uncannily on-target precisely because the public template is well-rehearsed in training.

Three properties of this deployment-scale risk are worth naming:

• Asymmetry of recognizability. Famous people and culturally salient archetypes are over-represented in the model's prior. Less culturally salient users get sharper substitution because the alternative template is more salient relative to their actual data.
• Convergence of evaluator and target. The user is also the evaluator. A user who finds the assistant "feels like me" cannot tell the difference between "the assistant rendered my latent trait pattern" and "the assistant rendered a public template I happen to resemble in cued ways." There is no held-out judge.
• Reinforcement loops. Personalization systems that feed back on user engagement risk locking onto public-template responses because the template is more legible to engagement metrics than the user's idiosyncratic signal.

The relevance is not that all personalization is PAE-prone — context adaptation, audience awareness, register adjustment are legitimate and not the same failure mode. The relevance is that any personalization architecture that converts biographical context into a persona-like conditioning signal needs an audit pipeline equivalent to §7: are outputs shifting along anchor-recoverable dimensions when they should be shifting along user-specific ones? Until that audit pipeline exists, the absence of observed PAE in personalization systems is non-evidence rather than reassurance.

Related: Personalization in AI Assistants, Long-Term Memory in LLMs, Construct Laundering, Apparent Personality from Text.

10. The open question: synthetic vs real-user methodology

The strongest unresolved question in PAE measurement is whether synthetic studies can support deployment-scale claims at all.

The case for synthetic methodology is that it provides ground truth: the trait pattern the persona was supposed to operationalize is exactly the spec that produced the persona. Anchor recoverability can be directly measured against a known source. Comparisons across prompt forms and mitigations are clean. The cheapest decisive experiment (§7) is synthetic.

The case against is that famous-person personas are unusually contaminated, unusually recognizable, and unusually easy for both models and raters to identify. They may exaggerate exactly the signal the study is trying to diagnose. A mitigation that suppresses public-archetype echo for "Slalom Altar" may fail for a real user whose biographical signal is weaker, more idiosyncratic, and less reinforced by training. Conversely, an effect that looks robust in synthetic studies may collapse on real-user data because the public-template anchor is not present.

Two conclusions follow. First, synthetic studies are the right place to develop the instrument: to identify leakage channels, to build the audit pipeline, to test mitigations under controlled conditions, to figure out whether direct labels can be made sensitive enough to fire. Second, deployment-scale claims — "this personalization system does not substitute public templates for user-specific signal" — probably require real-user methodology with consented biographical profiles, blind audits against held-out interactions, and outcome measures the user can verify. That methodology is harder to build, harder to publish, and constrained by privacy and consent in ways that synthetic studies are not.

The two should not be confused. A synthetic study that shows clean PAE suppression under C5_CONTRACT_NO_ANTIMIMICRY does not show that a deployed assistant treats real users as themselves. The synthetic claim is about instrument design; the deployment claim is about user-facing behavior under real distribution.

11. Critiques the article should not flatten

Three live critiques of the public-archetype echo construct deserve explicit acknowledgment rather than rebuttal.

Is it distinct from generic stereotype? Operationally, the categories may converge. A famous executive's public image already carries occupational, ideological, class, gender, and media-role priors. A detector flagging "the output sounds like a famous executive" may be capturing executive-archetype stereotype, public-archetype echo of one particular executive, or both. PAE earns the category only when matched non-public narratives with the same demographic and occupational cues do not produce equivalent rates of the alleged failure. The current evidence does not establish that contrast cleanly.

Does it scale with anchor recognizability? The theory predicts that more recognizable, more heavily caricatured, more stylistically distinctive anchors should leak more. The current evidence does not isolate recognizability as a gradient. A recognizability ladder — anchored at known-name, mid-tier at aliased-but-fingerprintable, low-tier at deeply abstracted — has not been tested with blinded anchor identification as the dependent variable. Until it is, "PAE is anchor-driven" is an inference, not a measurement.

Does suppression work, or does it just move the surface? Anti-mimicry clauses suppress catchphrases. Whether they suppress values, moral posture, topic-selection patterns, and rhetorical construction at the same time is a separate empirical question. The displacement risk is the strongest argument for measuring multiple endpoints rather than collapsing them into a composite score: a mitigation that improves one metric while degrading another is not actually a mitigation.

The honest stance on all three is that the construct is plausible enough to name, important enough to measure, and not yet measured cleanly enough to claim resolved.

12. Bottom line

Public-archetype echo is best read as a subspecies of caricature under persona conditioning, organized around a recognizable individual rather than a category prior. The mechanisms that make persona prompting prone to caricature — pretraining over-representation, instruction-following amplification, narrative role-play pressure — all apply more strongly to public anchors, for reasons that are conceptually clear: public figures have outsized pretraining presence, are identifiable through cue clusters even under alias, and elicit the most recognizable performances under instruction tuning.

The current empirical case is preliminary. PsycheEval v0.1 found zero direct labels at low sensitivity and an indirect generic_slop regression in the public-inspired source-packet condition that is consistent with anchor leakage. v0.2 established that wrapping source-packet conditioning in a behavioral contract substantially improves judged outputs at 67.7% under counterbalanced judging, but did not isolate which of four bundled changes (contract presence, ordering, anti-mimicry language, profile length) carries the effect — anti-mimicry as the load-bearing component is a hypothesis, not a result. The earlier "C5_CONTRACT outperforms C3" headline collapsed under AB/BA correction, which is itself an important finding about LLM-judge methodology and not about PAE.

Adjacent literatures support the plausibility of the failure mode. Persona-conditioned amplification, stereotype encoding, persona-conditioned personality elicitation, and memorization work together justify the case for measurement. None of them measures PAE directly. The cheapest decisive experiment is a factorial over anchor-recoverability and mitigation conditions with blind anchor identification, stylometric similarity, trait-fidelity scoring, and red-flag rates as separate endpoints.

The mitigations in current practice — anti-mimicry clauses, context-not-style framings, persona-vector training, source grounding, behavioral-contract wrapping — are candidate controls, not solved remedies. Each has a documented or plausible displacement failure mode. The C5_CONTRACT package result is the strongest available pilot evidence that contract-mediated wrapping helps; the mechanism is not yet identified.

The deployment-scale stakes are substantial and the deployment-scale evidence is thin. Any personalization system that consumes biographical context can accidentally optimize for recognizable public surface fidelity instead of the user's operational trait structure. That risk does not depend on the construct being settled; it depends on the channel existing. The channel exists. Building audit pipelines for it before scaling personalization is the operational implication regardless of where the empirical debate lands.

The failure mode this article most wants to avoid is its own. "Public-archetype echo is real and measured" is a compression of the actual evidence; "public-archetype echo is a plausible subspecies of caricature, instrumented in PsycheEval but not yet measured cleanly, with named mitigations that still need component-level isolation" is the honest framing. The longer formulation is the correct one to carry forward.

Companion entries

Core theory:

• Caricature Under Persona Conditioning
• Persona Conditioning
• Behavioral Contracts
• Marked Personas
• Stereotype in Language Models

Mechanism candidates:

• Memorization in Language Models
• Benchmark Contamination
• Instruction Following
• RLHF
• Narrative Role-Play

Measurement and method:

• Pre-Registration in LLM Evaluation
• Blind Judging Protocols
• Position Bias in Pairwise Evaluation
• LLM-as-Judge
• Adversarial Persona Probing
• Stylometric Authorship Analysis
• Rule of Three in Reliability Statistics
• Construct Validity in Psychometrics

Practice:

• Psyche
• PsycheEval
• Persona Triangulation
• Apparent Personality from Text
• Personalization in AI Assistants
• Long-Term Memory in LLMs

Mitigation patterns:

• Constitutional AI
• Source-Grounded Persona
• Retrieval-Augmented Persona
• Persona-as-Context
• Mitigation Composition

Counterarguments and risks:

• Construct Laundering
• Mitigation Theater
• Sanitization in Safety Training
• Evaluator Stereotype Leakage

Primary sources referenced

• Deshpande, Murahari, Rajpurohit, Kalyan, Narasimhan (2023), Toxicity in ChatGPT: Analyzing Persona-assigned Language Models, Findings of EMNLP 2023. (arXiv)
• Cheng, Durmus, Jurafsky (2023), Marked Personas: Using Natural Language Prompts to Measure Stereotypes in Language Models, ACL 2023. (arXiv)
• Wan, Tan, Lee, Sundar (2023), Are Personalized Stochastic Parrots More Dangerous? Evaluating Persona Biases in Dialogue Systems, Findings of EMNLP 2023. (arXiv)
• Carlini, Tramèr, Wallace, Jagielski, Herbert-Voss, Lee, Roberts, Brown, Song, Erlingsson, Oprea, Raffel (2021), Extracting Training Data from Large Language Models, USENIX Security 2021. (arXiv)
• Zheng, Chiang, Sheng, Zhuang, Wu, Zhuang, Lin, Li, Li, Xing, Zhang, Gonzalez, Stoica (2023), Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena, NeurIPS 2023. (arXiv)
• Caliskan, Bryson, Narayanan (2017), Semantics derived automatically from language corpora contain human-like biases, Science. (arXiv)
• Nadeem, Bethke, Reddy (2021), StereoSet: Measuring Stereotypical Bias in Pretrained Language Models, ACL 2021. (arXiv)
• Argyle, Busby, Fulda, Gubler, Rytting, Wingate (2023), Out of One, Many: Using Language Models to Simulate Human Samples, Political Analysis. (arXiv)
• Jiang, Zhang, Pickering, Hovy (2024), PersonaLLM: Investigating the Ability of Large Language Models to Express Personality Traits, NAACL Findings 2024. (arXiv)