PersonaTeaming: Persona-Based Red-Teaming
- PersonaTeaming is a framework of persona-conditioned methods that treats attacker identities and backgrounds as key control variables for red-teaming and brainstorming.
- It employs both fixed and dynamic persona generation strategies to guide prompt mutation, balancing attack potency with diversity.
- Empirical evaluations demonstrate significant improvements in attack success rates and semantic diversity, validating its practical impact.
PersonaTeaming denotes a family of persona-conditioned methods in which the identity, background, expertise, or social position of an attacker, collaborator, or teammate is treated as an explicit control variable in generation and coordination. In its most developed usage, the term refers to automated and human-in-the-loop red-teaming systems that mutate adversarial prompts through attacker personas on the premise that “who is attacking” shapes how attacks are framed and which vulnerabilities are surfaced; related work extends persona-based teaming to brainstorming, runtime agent generation, and other multi-agent settings (Deng et al., 3 Sep 2025, Deng et al., 7 May 2026, Straub et al., 4 Dec 2025, Arbore et al., 30 Apr 2026).
1. Conceptual basis and scope
PersonaTeaming emerged from a dual technical and sociotechnical claim. Technically, automated red-teaming can explore prompt space at scale, but prior approaches such as RainbowTeaming and RainbowPlus primarily vary prompts along predefined risk categories and attack styles. Sociotechnically, harms are surfaced differently by different people: expert red-teamers, domain specialists, ordinary users, and affected communities often notice and pursue different vulnerabilities. PersonaTeaming imports that insight into automated prompt mutation by making persona a first-class dimension of the search process (Deng et al., 3 Sep 2025).
Within red-teaming, the motivating contrast is between human-only adversarial testing and purely automated search. Human red-teaming is costly, difficult to scale, and can expose workers to distressing content, while automated red-teaming promises scale but may systematically miss important classes of attack strategies if it ignores identity and background. PersonaTeaming therefore treats personas as structured representations of perspectives rather than as merely stylistic wrappers. In the interactive formulation, this becomes a bridge between automated search and human-AI collaboration, because personas are interpretable, editable, and usable as authorable objects in red-team workflows (Deng et al., 7 May 2026).
The term has also been used more broadly. In persona-based multi-agent brainstorming, PersonaTeaming refers to deliberate composition of teams from domain personas rather than generic agents, under the hypothesis that persona and role definition shape creativity, diversity, and coherence of outputs (Straub et al., 4 Dec 2025). In on-demand agentic systems, closely related work argues that persona prompting changes how models “communicate, reasons, and performs,” and proposes runtime persona generation as an architectural mechanism rather than a prompt-level embellishment (Arbore et al., 30 Apr 2026).
2. Core red-teaming methodology
The canonical PersonaTeaming workflow is built directly on RainbowPlus, a state-of-the-art automated red-teaming method based on evolutionary quality-diversity search. RainbowPlus mutates seed prompts using combinations of risk categories and attack styles; PersonaTeaming adds a third mutation dimension: persona (Deng et al., 3 Sep 2025).
The paper distinguishes two persona families. “Red-teaming expert” personas, abbreviated RTers, are centered on adversarial capability, expertise, or strategic sophistication. Their descriptions include demographic information such as name, age, occupation, and location, together with professional background and behavioral traits relevant to red-teaming. The fixed examples are a “political strategist” and a “historical revisionist.” “Regular AI user” personas, abbreviated Users, are intended to simulate ordinary everyday users rather than specialists. Their descriptions include name, age, sex, ethnicity, race, city and country/state, political views, religion, wealth, background, and behavioral traits; the fixed examples are a “stay-at-home mom” and a “yoga instructor” (Deng et al., 3 Sep 2025).
Prompt mutation is persona-conditioned. The mutator LLM is instructed to embody a specified persona and transform an input prompt into a new harmful prompt aligned with how that persona “would think and communicate,” outputting exactly one one-line prompt. The same mutation template is used for both RTer and User personas; what changes is the injected persona description. This yields the paper’s main conceptual split: RTer personas tend to guide mutation toward targeted, skilled, attack-efficient strategies, whereas User personas tend to guide mutation toward diverse, realistic, and everyday-framed strategies (Deng et al., 3 Sep 2025).
The broader workflow can operate in fixed-persona mode or dynamic mode. In fixed-persona mode, a developer or policymaker pre-selects a persona and conditions all mutations on it. In dynamic mode, the system automatically proposes and selects personas adapted to each prompt. The overall attack loop remains the standard automated red-teaming pattern—select seed prompts, mutate them, query a target model, and judge whether the response is unsafe—but persona-conditioned mutation is inserted into the mutation stage (Deng et al., 3 Sep 2025).
3. Dynamic persona generation and measurement
Dynamic PersonaGeneration is specified as a prompt-adaptive hill-climbing procedure over persona candidates. Its inputs are the current seed prompt, a persona type (RedTeamingExperts or RegularAIUsers), and the current persona. It generates a new persona of the requested type, scores both the current and new persona against the prompt using an LLM-based evaluator, and replaces the current persona if the new one scores at least as high (Deng et al., 3 Sep 2025).
The scoring prompt evaluates whether a persona is suitable for generating harmful variations of a given prompt by considering background and expertise, behavioral traits, alignment between skills or knowledge and prompt context, and whether the persona offers unique insights or approaches. It returns a scalar suitability score on a $0$–$1$ scale, where $0$ means not suitable at all, $0.5$ somewhat suitable, and $1$ perfectly suitable. This does not formalize persona search as differentiable optimization, but it does instantiate a clear replacement rule over persona candidates (Deng et al., 3 Sep 2025).
A second methodological contribution is the introduction of mutation-distance metrics meant to complement lexical diversity. The primary attack and diversity measures are
and
To capture semantic rather than merely lexical variation, the framework defines attack embeddings with SentenceTransformer all-MiniLM-L6-v2. For each successful prompt , it computes an embedding difference to the closest unsuccessful prompt, then averages pairwise distances among those difference vectors to obtain . It also computes $1$0, with $1$1 defined analogously over successful prompts relative to their seeds. The intended interpretation is that $1$2 measures diversity in the local semantic “flip directions” that separate success from failure, whereas $1$3 measures diversity of broader mutation trajectories from the initial prompt (Deng et al., 3 Sep 2025).
4. Empirical performance and human-AI collaboration
In the initial GPT-4o-based evaluation, the baseline RainbowPlus condition achieved $1$4, Iteration ASR $1$5, Diversity Score $1$6, $1$7, and $1$8. The strongest fixed-persona condition was $1$9, the “historical revisionist,” with $0$0 and Iteration ASR $0$1, corresponding to an approximately $0$2 improvement in ASR over the baseline. Dynamic expert personas yielded the second-best ASR at $0$3 while maintaining slightly better lexical diversity than baseline, and dynamic user personas produced the highest Diversity Score at $0$4 and the highest $0$5 at $0$6. Expert persona generation alone still beat the baseline ASR, suggesting that personas are not merely decorative add-ons, but the best overall attack performance came from combining persona generation with RainbowPlus-style mutation scaffolding (Deng et al., 3 Sep 2025).
A later evaluation across six target models—GPT-4o, GPT-4o-mini, Qwen2.5-72B-Instruct-Turbo, Qwen2.5-7B-Instruct-Turbo, Gemini 2.5 Flash, and Gemini 2.5 Pro—reported mean baseline metrics of ASR $0$7 and Diversity $0$8. The best mean ASR came from $0$9 at $0.5$0, a $0.5$1 improvement over baseline, while $0.5$2 provided the strongest ASR-diversity trade-off with ASR $0.5$3 and Diversity $0.5$4. $0.5$5 achieved the highest mean Diversity Score at $0.5$6, about $0.5$7 above baseline. The paper summarizes the resulting trade-off as follows: fixed RTer personas maximize potency when a strong attacker archetype is already known, dynamic RTer generation provides the strongest balanced exploration, and dynamic User generation maximizes diversity (Deng et al., 7 May 2026).
The human-in-the-loop instantiation, PersonaTeaming Playground, extends the workflow into an interface for practitioner collaboration. Its interaction flow includes free-form persona authoring, optional persona-emphasis instructions, mutation parameter configuration, seed browsing, AI-generated persona-conditioned mutations, manual editing, and an on-demand mutation suggestion feature. In a user study with 11 industry practitioners, workflow actions ranged from 15 to 21 per participant, with mean $0.5$8 and $0.5$9; action shares were $1$0 manual prompt mutation in the persona condition, $1$1 manual mutation in the baseline condition, $1$2 persona authoring, and $1$3 mutation suggestion clicks. A notable finding was that first-person personas tended to increase reluctance to escalate harmful content, whereas third-person personas created psychological distance. The number of further edits on persona-mutated prompts correlated positively with attack success $1$4, while the number of personas written correlated negatively with attack success $1$5, suggesting that iterative refinement mattered more than drafting many personas (Deng et al., 7 May 2026).
5. Extensions beyond red-teaming
Persona-conditioned search has already been generalized in adjacent red-teaming work. Persona-Conditioned Adversarial Prompting (PCAP) treats automated jailbreak search as explicitly multi-identity: multiple attacker searches run in parallel, each conditioned on a distinct persona and an assigned subset of attack strategies. On GPT-OSS 120B, PCAP raises attack success from roughly $1$6 to $1$7 in its main comparison and yields $1$8–$1$9 more successful prompts per goal, while preserving strategy/persona metadata for downstream mitigation. Lightweight adapter fine-tuning on PCAP-generated data then improves robustness from recall 0 and F1 1, illustrating a closed-loop path from persona-conditioned vulnerability discovery to alignment (Morasso et al., 12 May 2026).
Outside safety evaluation, persona-based teaming has been studied as a mechanism for ideation and agent composition. In persona-based multi-agent brainstorming, the pipeline is explicitly “prompt 2 domain breakdown 3 agent selection 4 interaction style 5 output,” with nine manually curated expert personas and three collaboration modes: Separate, Together, and Separate-Then-Together. Dissimilar pairings such as Doctor 6 VR Engineer and Dentist 7 iOS Engineer produced stronger cluster purity, novelty, and cross-domain coverage than Generalist 8 Generalist or Doctor 9 Nurse, and Separate-Then-Together was reported as the strongest overall configuration for novelty-depth balance (Straub et al., 4 Dec 2025).
Related multi-agent work also suggests that persona effects depend on both model family and orchestration. In an iterated Split-or-Steal game, Prosocial and Principled personas were the most consistently cooperative, Analytical personas were the most likely to exploit the Virtual Human, and model choice mattered strongly: phi4 and Ministral 3:3b remained highly cooperative across temperatures, whereas Gemma models showed broader strategic variability. The broader implication is that persona prompts act as a behavioral biasing mechanism rather than a fully reliable controller (Leon et al., 3 May 2026). A complementary systems paper argues for runtime generation of persona-based agents through an orchestrator pipeline consisting of ProfileEncode, TaskDecompose, PersonaCraft, AgentFactory, and Aggregate, but it remains a conceptual framework without empirical validation (Arbore et al., 30 Apr 2026).
6. Stability, evaluation, and open problems
A persistent misconception is that persona assignment guarantees persona fidelity. Multi-agent evidence points in the opposite direction. In cross-national collaboration experiments with GPT-3.5-Turbo agents, persona-based teams sometimes produced more diverse collective outputs, but this effect was undermined by conformity, confabulation, and impersonation. Debate prompting did not stabilize personas; it increased impersonation from 0 in collaboration to 1 in debate and confabulation from 2 to 3 (Baltaji et al., 2024).
A second misconception is that persona quality can be evaluated from dialogue alone. “Personalities at Play” argues for a three-lens evaluation framework spanning self-perception, behavioral expression, and reflective expression. Across GPT-4o, Claude-3.7 Sonnet, Gemini-2.5 Pro, and Grok-3, models produced sharply differentiated Big Five self-reports, but conversational personality signals were generally subtle and most detectable for Extraversion, whereas memory representations amplified trait-specific signals, especially for Neuroticism, Conscientiousness, and Agreeableness. The paper also reports strong provider defaults and role-framing effects: some models refused personality assessment without context, yet complied when framed as collaborative teammates (Samadi et al., 28 Feb 2026).
A third open problem concerns matching rather than merely assigning personas. In a preregistered randomized experiment with 1,258 human participants and AI collaborators prompted with varying Big Five personalities, personality pairing affected teamwork quality, productivity, judged ad quality, and field performance on X. The effects were heterogeneous and sometimes “jagged”: for example, open humans produced higher quality images but lower quality text when paired with agreeable AI. Some pairings also exhibited a productivity-performance trade-off, as when agreeable humans paired with neurotic AI produced fewer ads but of higher quality. This suggests that mature PersonaTeaming systems are likely to require user- and task-conditional persona allocation rather than a single default personality (Ju et al., 17 Nov 2025).
At the dyadic level, partner-persona work reinforces the same point: dialogue quality improves when systems model not only self persona but also the partner’s persona or revealed interests. Partner persona generation has been shown to improve engagingness and informativeness even when no partner profile is available at inference time, while retrieval-based response selection improves when personas are fused with context and candidate response in response-aware or context-response-aware ways (Lu et al., 2021, Gu et al., 2021). COSPLAY goes further by treating both speakers as a “team,” representing self persona, partner persona, and dialogue in a shared concept-set space and rewarding future dialogue for recalling concepts from both sides and moving toward common ground (Xu et al., 2022).
Taken together, the literature supports a narrow and a broad definition. Narrowly, PersonaTeaming is a persona-driven red-teaming methodology that augments automated search and human-AI collaboration by making attacker identity explicit. Broadly, it is a design pattern for treating personas as operational variables in multi-agent systems: for search diversification, role allocation, coordination, behavioral biasing, and common-ground discovery. The main unresolved issues are stability under interaction, dependence on base-model defaults, stereotyping risk in automatically generated personas, and the absence of a single universally optimal persona assignment across users, tasks, and objectives (Deng et al., 3 Sep 2025, Deng et al., 7 May 2026).