Disentangling Intent from Role: Adversarial Self-Play for Persona-Invariant Safety Alignment

The growing capabilities of large language models (LLMs) have driven their widespread deployment across diverse domains, even in potentially high-risk scenarios. Despite advances in safety alignment techniques, current models remain vulnerable to emerging persona-based jailbreak attacks. Existing research on persona-based jailbreak has primarily focused on attack iterations, yet it lacks systemic and mechanistic constraints on the defense side. To address this challenge, we propose Persona-Invariant Alignment (PIA), an adversarial self-play framework that achieves co-evolution through Persona Lineage Evolution (PLE) on the attack side and Persona-Invariant Consistency Learning (PICL) on the defense side. Theoretically, PICL is grounded in the structural separation hypothesis, using a unilateral KL-divergence constraint to enable the structural decoupling of safety decisions from persona context, thereby maintaining safe behavior under persona-based jailbreak attacks. Experimental results demonstrate that PLE efficiently explores high-risk persona spaces by leveraging lineage-based credit propagation. Meanwhile, the PICL defense method significantly reduces the Attack Success Rate (ASR) while preserving the model's general capability, thereby validating the superiority and robustness of this alignment paradigm. WARNING: This paper contains potentially offensive and harmful text.

AI assistants like ChatGPT are trained to refuse harmful requests. For example, they won't explain how to make a weapon. But researchers have discovered a worrying loophole: if you first tell the AI to act as a particular character, say, a reckless trickster with no moral compass, the same harmful request often gets answered without hesitation. This is called a persona-based jailbreak attack. In this work, we ask a simple but important question: should an AI's decision to refuse a dangerous request depend on the role it has been asked to play? We argue the answer is no. A well-aligned AI should recognize harmful intent regardless of the persona it has been given, just as a responsible person would not help someone build a bomb, whether they were asked nicely, rudely, or through an elaborate roleplay. To make AI systems more robust in this way, we developed a two-part framework. First, we built a smarter attack tool that automatically discovers which kinds of character descriptions are most effective at tricking AI models, learning from past successes rather than starting fresh each time. Second, we trained AI models to treat safety decisions as independent of persona context, so that the model's safety instincts remain active regardless of the role it has been assigned. Testing across several popular AI models, our defense dramatically reduced the rate at which harmful requests slipped through under persona disguises, while keeping the AI just as helpful and capable for everyday tasks.