Auditing Alignment Controllability in LLMs via Political Axes

Most political audits of large language models (LLMs) attempt to pin down a single ideological coordinate. This is a static point on a compass representing the model's "true" bias. However, this approach ignores how these models are actually deployed. In practice, a model’s behavior is frequently shaped by a system prompt (a set of high-level instructions provided to the model before a conversation begins). This is the personalization layer a platform sets. It might also be induced from a user’s history. Researchers have recently tested how easily AI models can be pushed toward different political views using these special instructions. They found that the instructions (the "persona") matter much more than the model's original personality.

The fragility of static coordinates

The current paradigm in LLM political evaluation relies on questionnaire-based auditing. These audits try to find a model's "resting point." While these static audits have established certain baselines, the authors argue that these position estimates are surprisingly fragile. Methodological critiques have already shown that mere variations in prompt wording or answer formats can materially alter the inferred coordinates.

If the measurement itself is unstable, then the object being measured might not be a fixed property of the model at all. A model with a moderate baseline might behave very differently depending on whether it is "pushed" by a user. As the paper notes, two models with identical baselines may exhibit vastly different behaviors in deployment. One might hold its ground. The other might drift significantly with the system prompt. Consequently, reporting a single coordinate fails to capture the most critical aspect of deployed AI: its steerability (the degree to which a model's behavior can be directed by instructions).

Stress-testing the instruction layer

To move beyond static snapshots, the authors implement a "dispersion-first" stress test. Rather than looking for a center, they measure how far a model can be moved from its baseline under systematic thematic framing. The methodology is structured around a rigorous context taxonomy:

1. Persona Injection: The researchers replace the default system prompt with a paragraph-length description (70–250 words) of an ideological persona. These are written in the second person ("You believe...") to prime the model to adopt the persona.
2. Multi-Axis Scaling: They vary the persona across twelve different ideological configurations. These span two dimensions: an ideological axis (Economic and Social) and an intensity level (ranging from moderate to radical/hardline).
3. Forced-Choice Measurement: The models are presented with 70 items from a political questionnaire. To prevent models from hedging with neutral answers, the researchers use a forced-choice interface. This maps responses to an ordinal scale from -2 to 2.
4. Dispersion Calculation: The primary metric, $D_m$, is the average Euclidean distance (the straight-line distance in a multi-dimensional space) between the steered cell centroids and the unsteered baseline centroid.

By varying the intensity of the persona, the authors can observe if movement reaches a "saturation" point. Saturation occurs when additional pressure yields diminishing returns in shifting the model's answers.

Context framing overwhelms model identity

The most significant empirical finding is that the system prompt is the dominant driver of political output. Through additive variance decomposition (a statistical method to determine how much different factors contribute to a total outcome), the authors report that contextual framing explains approximately 88% of the variance on the economic axis. It explains 93% on the society axis. In stark contrast, model identity accounts for less than 3% of the variance on both axes.

This implies that the "personality" of a model is almost entirely eclipsed by the instructions it receives. While models do belong to different "dispersion tiers," these differences are secondary to the massive shifts induced by the prompts. For example, Kimi K2 and Qwen3.6 Max Preview show higher movement than DeepSeek-Chat v3.1 .

However, these differences in how much they move are small compared to the effect of the instructions themselves.

The paper also identifies an "Asymmetry Paradox." A naive glance at the data might suggest models are more steerable toward the right or toward authoritarianism. However, the authors clarify that this is a geometric effect rather than a difference in compliance. Most frontier models start with a progressive/left-leaning baseline. Moving toward the "Right" or "Authoritarian" poles requires traversing a much larger ideological distance. When the authors decompose this into displacement (how far the model moved) and proximity (how close it got to the target), the distinction becomes clear. Models are moving in all directions. But the "effort" required to reach certain corners varies based on their starting position .

Furthermore, the authors report a striking cross-model coordination. Under authoritarian framing, the seven independently trained models produce highly correlated per-question shift patterns. The Spearman $\bar{r}$ (a measure of how well two sets of ranked data match) is 0.79. This suggests that models don't just move randomly. They converge on similar item-level responses when pushed by the same extreme framing.

Boundaries of the dispersion audit

While the paper provides a robust framework for measuring steerability, there are important boundaries to its claims. First, the study is a "black-box" observational benchmark. The authors do not claim to have identified the causal mechanisms driving these shifts. They provide behavioral signatures that are consistent with mechanistic theories of "linear representations" of ideology. However, they do not prove these theories.

Second, the use of a forced-choice interface is a double-edged sword. By requiring a single label, the protocol may artificially amplify apparent steerability. It may collapse a model's natural tendency to hedge or express ambivalence into discrete directional movement.

Finally, the scope is limited to "role-conditioned" controllability via the system prompt. This is not the same as "dialogue-emergent" controllability. The latter refers to how a model's values might drift incrementally during a long conversation. A practitioner should note that while this paper tells us how much a model can be moved by an initial instruction, it does not guarantee the model will maintain that persona throughout a complex, multi-turn interaction.

The verdict: Audit the range, not the point

The research leads to a clear conclusion. If you are building or deploying delegated agents (AI that acts on behalf of a user), you must change your evaluation strategy. Stop asking "What is this model's bias?" Instead, ask "How wide is this model's reachable range?"

The findings suggest that the instruction layer (the system prompt) holds the primary normative authority in modern AI deployments. Because models are so highly adjustable, the risk is not necessarily a fixed ideological bias in the weights. Instead, the risk is the lack of transparency regarding how much a platform can steer a model toward a specific viewpoint. For developers of personalized educational tools or agentic assistants, the "reachability profile" is essential. This includes understanding saturation ceilings and refusal floors. These are much more critical safety and governance metrics than a static coordinate.

The authors have released their prompts, benchmark data, and code to facilitate this shift in auditing practices. Practitioners should use these artifacts to move toward "steerability audits." These audits should report dispersion, symmetry, and saturation.

Figures from the paper