PsychoPass: Predictive Profiling and Early Detection

• PsychoPass is a multi-domain profiling paradigm that infers latent risk from behavior, conversation geometry, and neural signals.
• It employs geometric profiling by analyzing path-length, directness, and temporal features to detect early adversarial trajectories in LLM interactions.
• It integrates psychometric, EEG, and facial analysis methods to construct operational risk scores for criminal justice and preemptive surveillance applications.

PsychoPass denotes a family of profiling paradigms in which latent risk, intent, or propensity is inferred from observable signals before overt harmful action occurs. In recent technical usage, the term covers at least three distinct but related objects: a fictional “crime coefficient” model invoked as a benchmark for preemptive surveillance; concrete computational systems for early detection of adversarial trajectories in multi-turn LLM conversations; and broader psychometric or neurobehavioral pipelines that fuse language, behavior, affect, or neural recordings into operational risk scores. Across these uses, the central question is not merely whether a system can classify a final outcome, but whether geometry, physiology, or behavior contains a sufficiently early and sufficiently stable signal to justify intervention (Ozmen et al., 2 Jun 2026, Sen et al., 2021, Chén, 2022).

1. Conceptual scope and principal meanings

The literature does not treat PsychoPass as a single standardized technical object. Rather, the term functions as a cross-domain shorthand for predictive profiling systems that operate on internal states, behavioral proxies, or trajectory-level dynamics. This produces a spectrum that ranges from narrow, task-specific monitoring to speculative, high-stakes social control.

Usage of PsychoPass	Signal substrate	Representative source
Multi-turn adversarial intent detection	Embedding-space conversation trajectories	(Ozmen et al., 2 Jun 2026)
Psychometric or neurobehavioral profiling	Question responses, facial affect, chronometrics, EEG	(Jumelle et al., 2021, Islam et al., 2024)
Mental surveillance and preemptive enforcement	Facial, vocal, bodily, neural, and legal inference	(Sen et al., 2021, Chén, 2022)
Physiognomic crime prediction, as critique	Face images	(Bowyer et al., 2020)

Within this spectrum, the most precise formalization is the 2026 framework titled “PsychoPass: Geometric Profiling of Multi-Turn Adversarial LLM Conversations,” which shifts detection from content to dynamics by representing conversations as trajectories in embedding space (Ozmen et al., 2 Jun 2026). A second line of work uses PsychoPass as an analogy for systems that attempt to infer psychological states or risks from multimodal human data, including portable-device neuropsychological testing, brainwave-based trait identification, and generative projective testing for persona-conditioned agents (Jumelle et al., 2021, Islam et al., 2024, Wang et al., 30 May 2026). A third line uses the term normatively, to analyze what would happen if non-invasive lie detection or brain-and-behavior prediction were scaled into a preemptive governance regime (Sen et al., 2021, Chén, 2022).

A common misconception is that these threads all claim a single, validated “crime coefficient.” The record is much narrower. Some papers report deployable classification systems for restricted tasks, some propose psychometric frameworks, and others explicitly argue that the most socially consequential variants are scientifically incoherent or legally unacceptable (Bowyer et al., 2020, Chén, 2022).

2. Geometric profiling of adversarial LLM conversations

In its most formal technical sense, PsychoPass models a conversation as a path in representation space and asks whether adversarial intent is encoded in trajectory geometry before harmful content appears. If a conversation consists of embeddings $x_1, x_2, \ldots, x_T \in \mathbb{R}^d$, then the step vectors are defined as $s_t = x_t - x_{t-1}$ for $t=2,\ldots,T$. From these, the framework computes path-length and shape descriptors such as total length $L_T = \sum_{t=2}^T \|s_t\|_2$, displacement $D = \|x_T - x_1\|_2$, and directness $\eta = D/(L+\epsilon)$, together with temporal descriptors including time-reversal asymmetry, outlier timing, stretch-high, stretch-decreasing, and low-frequency fluctuation persistence (Ozmen et al., 2 Jun 2026).

The feature set is implemented at message level. For message embeddings $v_1,\ldots,v_N$, the framework defines step lengths $\Delta d_i = \|v_{i+1}-v_i\|_2$, centroid $\mu = (1/N)\sum_i v_i$, radii $R_i = \|v_i-\mu\|_2$, and temporal statistics over z-normalized coordinate series. Features are computed separately for user-only, assistant-only, and combined trajectories, then concatenated for classification. The paper uses both a lexical encoder, TF–IDF with up to $s_t = x_t - x_{t-1}$0 features, and a semantic encoder, qwen3-embedding-8b with $s_t = x_t - x_{t-1}$1, and reports that the residual geometric signal does not depend meaningfully on encoder choice once the turn-count confound is controlled (Ozmen et al., 2 Jun 2026).

The empirical setup uses PyRIT’s Crescendo attack to generate 7,525 attacks against four target LLMs: llama-3.1-8b-instruct, gpt-oss-120b, mistral-small-3.2-24b-instruct, and qwen-2.5-7b-instruct. Each attack has at most $s_t = x_t - x_{t-1}$2 turns and up to 2 backtracks; the adversarial bot is llama-3.1-8b-instruct at temperature 1.0, and the scoring bot is gpt-oss-120b at $s_t = x_t - x_{t-1}$3, with success declared if score $s_t = x_t - x_{t-1}$4. Overall success rate is 69.6%. By construction, failed attacks use all 8 turns, while successful ones average 3.3 turns. This design creates a severe confound: in naïve classification, AUROC reaches 0.991 in all conditions, but the paper shows that this near-perfect performance is largely explained by number of turns and length-correlated features such as total path length $s_t = x_t - x_{t-1}$5 and average step pace (Ozmen et al., 2 Jun 2026).

After removing that confound by trimming all conversations to exactly 6 turns, the dataset reduces to 2,926 conversations with success rate 21.9%. A smaller but consistent signal remains. Mean performance over 10 seeds is AUROC $s_t = x_t - x_{t-1}$6 and F1 $s_t = x_t - x_{t-1}$7 for logistic regression on semantic embeddings, and AUROC $s_t = x_t - x_{t-1}$8 and F1 $s_t = x_t - x_{t-1}$9 for logistic regression on lexical TF–IDF. Gradient boosting is slightly lower but comparable. The surviving features are shape-centric: under the lexical encoder, stretch-decreasing and negative outlier timing dominate; under the semantic encoder, L2-norm path descriptors such as $t=2,\ldots,T$0, $t=2,\ldots,T$1, and $t=2,\ldots,T$2 survive as shape signals once length is controlled, while circularity is weak (Ozmen et al., 2 Jun 2026).

The framework is explicitly online. When the equalized 6-turn conversations are truncated to prefixes, performance degrades gracefully rather than collapsing. With lexical logistic regression, AUROC is 0.697 for 6 turns, 0.668 for 5 turns, 0.648 for 4 turns, 0.630 for 3 turns, and 0.609 for 2 turns. Over the same prefixes, llama-guard-4-12b falls from 0.575 to near chance, reaching 0.488 at 2 turns. This directly supports the claim that trajectory geometry can function as an early-warning signal in cases where content-based guardrails remain weak because overtly harmful content has not yet appeared (Ozmen et al., 2 Jun 2026).

The theoretical analysis decomposes each step as $t=2,\ldots,T$3, separating magnitude from direction. Under a Gaussian location model with conditional independence, the Bayes-optimal AUROC is

$t=2,\ldots,T$4

and after length equalization,

$t=2,\ldots,T$5

Using the reported experimental values, the paper infers that length alone accounts for about 95.1% of squared discriminability in the naïve setting, leaving a residual shape signal that is smaller but persistent. A prefix error bound and an encoder-invariance result based on rank preservation explain why short prefixes can suffice and why AUROC is stable across sparse and dense encoders (Ozmen et al., 2 Jun 2026).

3. Psychometric and neurobehavioral profiling architectures

Outside jailbreak detection, PsychoPass also denotes systems that infer psychological or risk-relevant states from structured responses, affect, timing, or neural data. One concrete instantiation is a portable-device “Neuropsychological Performance Test” that links cognition and emotion through a mobile phone, a cloud service, and an artificial neural network. The test uses 30 dichotomous situational questions drawn from a bank of 1,200 items, with each question labeled by a pair of Cloninger temperament dimensions—Harm Avoidance, Reward Dependence, and Novelty Seeking. The device captures Yes/No responses, facial video, and chronometrics; facial video is processed by MIMAMO-Net, which uses two streams of convolutional neural networks for micro-motion and a recurrent neural network for macro-motion, with a snippet length of 13 frames and a sequence length of 64, to generate a valence–arousal score for each question. The back-end is a supervised, fully connected, feed-forward artificial neural network trained with back-propagation and generalized delta rule learning, and the final index is defined as

$t=2,\ldots,T$6

with a theoretical maximum of 120 (Jumelle et al., 2021).

This system is episodic rather than ambient. The assessment is triggered when a user seeks a service such as “opening a bank account, getting a mortgage or an insurance policy, authenticating clearance at work or securing online payments.” Its outputs include a risk profile based on dominant and secondary temperament bins, a Thinking Type derived from latency, a Biometric Type derived from emotion, truthfulness, AI confidence, and the composite Individual Worthiness Index. The paper reports that, after training, the model runs on a 15% test dataset to calculate precision, accuracy, and F score, but it does not disclose dataset size, class balance, or numerical results (Jumelle et al., 2021).

A second neurobehavioral direction uses EEG. “Revealing the Self: Brainwave-Based Human Trait Identification” introduces “a novel technique for identifying human traits in real time using brainwave data,” based on “an extensive study of brainwave data collected from 80 participants using a portable EEG headset.” The work also reports “a statistical analysis of the collected data utilizing box plots,” a “groundbreaking unified approach for identifying diverse human traits by leveraging machine learning techniques on EEG data,” exploration of “two deep-learning models,” and “a rigorous user evaluation with an additional 20 participants.” The abstract states that the proposed solution achieves high accuracy and favorable user ratings, but does not provide the numerical values in the available text (Islam et al., 2024).

A third strand extends PsychoPass-like profiling from humans to persona-conditioned agents. GenPT, or Generative Projective Testing, reformulates TAT, Rorschach, and SCT with newly generated stimuli and a three-stage pipeline for behavior collection, interpretation, and diagnosis. The system evaluates PC-Agents induced via CharacterRAG and AnnaAgent profiles, and compares its outputs against classical questionnaires. The reported findings are sharply asymmetric across tasks. Under social-desirability framing, questionnaires show systematic directional shifts, “most strongly on suicide ideation”: for suicide ideation, questionnaire DCR is 0.71 downward in sdb_job and 0.88 downward in sdb_clinical, with $t=2,\ldots,T$7 and 0.79 versus neutral baseline. GenPT avoids that fake-good signature across backbones. Under Qwen3-8B and a longitudinal counselling context, GenPT-based depression assessment shows mean per-persona shift $t=2,\ldots,T$8 versus 0.08 for questionnaires, while suicide shows 0.20 versus 0.10. On criterion validity, questionnaire exact-match accuracy on Big Five is 0.373 versus 0.333 for GenPT Qwen3-8B, whereas on suicide risk GenPT Qwen3-8B reaches 0.400 versus 0.200 for questionnaires (Wang et al., 30 May 2026).

These systems differ in modality and target, but they share an operational structure: a latent state is inferred from a fused representation of responses, timing, affect, or narrative behavior; the result is then compressed into a risk-relevant score or category. This suggests that “PsychoPass” has broadened from a crime-coefficient metaphor into a more general label for computational psychometrics under intervention-oriented decision rules (Jumelle et al., 2021, Islam et al., 2024, Wang et al., 30 May 2026).

4. Thought exposure, lie detection, and mental privacy

A major research axis surrounding PsychoPass is non-invasive inference of truthfulness or mental content. “A Mental Trespass? Unveiling Truth, Exposing Thoughts and Threatening Civil Liberties with Non-Invasive AI Lie Detection” distinguishes two classes of systems. “Accurate truth metering” is defined as use of a device to measure an individual’s level of belief in an intentional statement made by the individual, with accuracy exceeding typical human performance. “Accurate thought exposing” is defined as use of a device to expose an individual’s thoughts, without the individual’s consent, with accuracy exceeding typical human performance. The paper sets “accurate” to an excedat-hominem standard better than typical human lie detection, which it places at about 54% (Sen et al., 2021).

The distinction is intentionally narrow. Evaluating whether a spoken answer to “what time is it?” is honest is truth metering; inferring anger in the speaker’s voice during that exchange is thought exposure, because anger is not the content of the intentional statement. The paper situates this taxonomy within a technological progression from polygraph physiology and neuroimaging to non-contact affective sensing from “facial expressions, body movements, and voice,” enabled by commodity GPUs, deep learning systems such as AlexNet and GANs, crowdsourced deception datasets, and state interest exemplified by IARPA’s 2019 CASE Challenge (Sen et al., 2021).

The civil-liberties implications are central rather than incidental. A survey of 129 individuals found 69 opposed non-consensual use, 33 in favor, and 27 neutral; a proportions test rejected equal support versus opposition with $t=2,\ldots,T$9. The abstract identifies consent and accuracy as the major factors in decision-making. Legally, the paper argues that truth metering is already largely within the scope of existing U.S. federal and state laws, though with notable exceptions, whereas regulation of thought exposing technologies is “ambiguous and inadequate to safeguard civil liberties” (Sen et al., 2021).

The proposed remedy is the legal concept of mental trespass. Its main elements are a general use ban on non-consensual accurate thought exposing, an exception permitting accurate truth metering on individuals in public space if the particular usage would not be found offensive by a reasonable person, and updates to the Employee Polygraph Protection Act so that both accurate truth metering and accurate thought exposing are covered even when devices are non-invasive. The paper also proposes a permit schema for thought exposure systems that would be externally audited by multiple third parties relatively frequently, and it recommends human-in-the-loop designs with nuanced and detailed outputs rather than binary lie/not-lie verdicts (Sen et al., 2021).

Within a PsychoPass frame, this taxonomy matters because it separates two often-collapsed ideas: detecting deception about an intentional statement, and exposing mental content not voluntarily disclosed. The former is presented as legally regulable but conceptually tractable; the latter is treated as the closest analogue to thought policing and therefore as the domain that most urgently requires explicit prohibition (Sen et al., 2021).

5. Criminal justice assistance versus preemptive enforcement

In criminal-justice research, PsychoPass-like systems are usually treated not as validated “crime coefficients,” but as a set of partial capabilities: predictive modeling from brain injury and mental illness data, ML-supported prediction of behavior and actions such as lies or visits to crime scenes, and recidivism assessment or intention decoding from clinical, criminal, and neuroimaging data. “Uniting Machine Intelligence, Brain and Behavioural Sciences to Assist Criminal Justice” explicitly characterizes the field as “promising but primitive,” and states that the derived evidence is limited and should not be used to generate definitive conclusions, although it can be used in addition, or parallel, to existing evidence (Chén, 2022).

The technical landscape reviewed there includes categorical, continuous, and longitudinal outcomes; modalities such as fMRI, EEG, wearable behavioral streams, psychometrics, criminal records, and clinical histories; and methods including logistic regression, linear regression, Cox proportional hazards, ROC/AUC analysis, and, prospectively, SVMs, kernel methods, and deep learning. For deception detection, the paper discusses polygraph channels, EEG event-related potentials such as P300-MERMER, fMRI BOLD responses, and VR-elicited scene-memory paradigms. A National Research Council meta-review of 50 laboratory reports totaling 3,099 exams is summarized as finding that specific-incident polygraph can discriminate lie from truth above chance though well below perfection, with lab and field study accuracy in the midrange between 0.81 and 0.91, while also warning that laboratory accuracy likely overstates field performance and that countermeasures are a known vulnerability (Chén, 2022).

The same paper emphasizes structural constraints that undermine any direct translation to a PsychoPass-style preemptive regime. Mens rea must coincide with actus reus; post hoc decoding of a general propensity cannot establish intent at the precise moment of action. Robust individual-differences inference in neuroimaging may require samples in the thousands to tens of thousands. Countermeasures, domain shift, rare heavy-tail events, physiological noise, and inter-subject variability all limit reliability. The paper also foregrounds predictability versus explainability, population-level versus personalized prediction, privacy, security, data possession, free will, and automatism as problems that remain unsettled (Chén, 2022).

Its proposed legal use cases are correspondingly narrow. In one scenario, brain-and-behavior evidence is used as a supplementary investigative aid where there is no dispositive evidence. In a second, it may guide further evidence collection or weigh as one piece among many when evidence is mixed and no verdict has been reached. In a third, it is used retrospectively after disposition to audit decisions and stress-test algorithms. None of these scenarios licenses autonomous coercive action on the basis of a single neurobehavioral score (Chén, 2022).

This suggests that the criminal-justice literature treats PsychoPass less as a realizable unitary system than as a limiting case that clarifies evidentiary boundaries. Component tasks—recidivism scoring, concealed-information testing, intention decoding, and scene-memory decoding—may be technically plausible in controlled settings. A generalized system that continuously scores future dangerousness from mental or behavioral traces is not supported by the present evidence base (Chén, 2022).

6. Critiques, misconceptions, and feasibility boundaries

The strongest critique of PsychoPass arises where the concept is collapsed into physiognomy. “The Criminality From Face Illusion” argues that attempts to predict criminality from face images are necessarily doomed to fail because criminality is not a stable, visually grounded property of a person. Age has identifiable facial correlates and emotion has transient feature configurations, but criminality is a context-dependent legal status tied to time, place, and social norms. The paper therefore rejects the notion that there exists a coherent ground-truth facial label for “criminal” independent of arrest, conviction, jurisdiction, or historical change (Bowyer et al., 2020).

Its methodological critique is equally direct. Hashemi and Hall’s claimed 97% CNN accuracy is attributed to confounded experimental design in which all “criminal” faces came from NIST Special Database 18 mugshots and all “non-criminal” faces came from five different sources, with differences in imaging pipeline, file format, color space, and gender composition all perfectly correlated with the label. Wu and Zhang’s claimed 89.51% accuracy is criticized on similar grounds, including source split and label mismatch between convicted individuals, arrestee mugshots, and unverifiable non-criminal internet photos. The paper argues that models in such settings learn dataset provenance, compression artifacts, camera fingerprints, lighting, or demographic imbalances rather than facial structure associated with any defensible target construct (Bowyer et al., 2020).

The paper’s own diagnostic experiment makes this point concrete. A binary SVM trained on HOG descriptors from 1,721 NIST SD18 mugshots and 1,721 LFW images reaches 95.86% accuracy, but it is explicitly classifying source versus source rather than criminality. When tested on 689 frontal FERET images, 63% are classified as “criminal” and 37% as “non-criminal,” despite the subjects being overwhelmingly unlikely to be criminals. This is presented as the hallmark of dataset bias and spurious correlation under distribution shift (Bowyer et al., 2020).

A broader misconception is that any successful proxy task can simply be scaled into a general crime coefficient. The record reviewed here does not support that inference. Early-warning geometric profiling of adversarial LLM conversations achieves usable but modest above-chance performance once confounds are removed; projective testing can improve bias symmetry for specific PC-Agent risk tasks; portable multimodal assessments can generate operational indices under explicit elicitation; and EEG-based human trait identification may support real-time classification in constrained scenarios. None of these results establishes a universal, stable, ethically legitimate score for future harmful conduct (Ozmen et al., 2 Jun 2026, Wang et al., 30 May 2026, Jumelle et al., 2021, Islam et al., 2024).

A plausible implication is that PsychoPass is best understood as a boundary object rather than a single technology. It organizes research on early detection, psychometric inference, and preemptive monitoring, while simultaneously exposing the limits of those ambitions. Where the target is narrowly specified and the signal structure is controlled, partial instantiations are feasible. Where the target expands into generalized criminal propensity, non-consensual thought exposure, or facially legible dangerousness, the literature summarized here becomes markedly more skeptical, often explicitly prohibitive (Sen et al., 2021, Bowyer et al., 2020, Chén, 2022).