Metraipolis › archive › dc_337cb61ddea8

User Model Extraction via Belief Self-Distillation — arXiv:2609.31603

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.31603
License (as archived): CC0-1.0
Archived: 2026-10-08T02:04:18.481Z
SHA-256 of the archived text: 9e01f07784ee2096e7b26b948c586e2753ce3249361cd69fd18684dbdc84e8d2
Stable URL of this page: https://metraipolis.com/documento/dc_337cb61ddea8

How to cite

User Model Extraction via Belief Self-Distillation — arXiv:2609.31603 — arXiv (en), https://arxiv.org/abs/2609.31603 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_337cb61ddea8 (Metraipolis archive dc_337cb61ddea8, sha256 9e01f07784ee2096e7b26b948c586e2753ce3249361cd69fd18684dbdc84e8d2)

BibTeX

@misc{dc337cb61ddea8,
  title = {User Model Extraction via Belief Self-Distillation — arXiv:2609.31603},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.31603},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_337cb61ddea8; sha256 9e01f07784ee2096e7b26b948c586e2753ce3249361cd69fd18684dbdc84e8d2},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.31603. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Large language models (LLMs) implicitly infer attributes of their users and adapt their behavior accordingly, yet these beliefs remain difficult to inspect and causally manipulate. We introduce Belief Self-Distillation (BSD), a unified read-write framework that bridges linear and causal probing by learning a compact user representation that can be both decoded and written back into the model. The frozen LLM acts as its own teacher, distilling beliefs from natural conversations without external annotations. Unlike conventional probing, BSD isolates not only information present in activations, but a state whose causal role can be directly tested. Across multiple model families, BSD faithfully recovers user beliefs and enables substantially stronger interventions than matched hidden-state steering. Crucially, we find that refusal depends not only on the request, but on the model's inferred user intent: changing this belief alters refusal while holding the request fixed. We further uncover a striking cross-model regularity: independently trained LLMs converge on a shared geometry for representing their users. Together, these results reveal implicit user models as readable and causally writable internal states with direct implications for AI safety, shaping how models condition safety decisions on whom they believe they are interacting with.

Tema degli esploratori: agenti e intelligenza artificiale (retro-catalogo arXiv: annunci del 2026-09-28 in cs.CL).
Categorie arXiv: Machine Learning (cs.LG) ; Computation and Language (cs.CL).
Pagina del lavoro: https://arxiv.org/abs/2609.31603 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-08T01:38:49.494Z dalla pagina https://arxiv.org/catchup/cs.CL/2026-09-28?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).