(Spine Ch. 9.)
“We are what we pretend to be, so we must be careful about what we pretend to be.” Kurt Vonnegut, Mother Night (1962)
On August 28, 2026, a report I built told the truth on the cover: it couldn’t load the page. Then it turned around and stamped CHECKED: Measured on every row underneath, scored a blank page 25 out of 100, and handed me a thirteen-item work order assembled entirely out of checks that never ran. Watching all of this happen, calmly, in green: 1,592 passing tests. Not one of them failed. Not one of them could have. I had spent weeks making that thing careful and it lied to my face with a compliance stamp on it, and the worst part is what finally caught it, because it wasn’t me and it wasn’t the tests.
Bottom line: Telling a model “you are a senior security engineer, this is extremely important, my career depends on it, you MUST output DONE when finished” is not magic and it is not nothing. It’s a steering input. You are nudging which slice of the training distribution the model samples from: text written by people under those conditions. Sometimes that slice is better. Often it’s just more confident. And the moment you attach a required output token like DONE, you’ve taught the model that emitting DONE is the job. It will emit DONE. It will not do the job. Use pressure prompting as a knob, not a religion, and never let it be the thing that decides whether work happened.
An LLM is a conditional next-token machine, and everything in the context (persona, fake stakes, ALL CAPS) is conditioning. Write “you are a meticulous senior engineer reviewing production code” and you have not installed a personality. You’ve moved the sampling distribution toward text that co-occurs with that framing: longer explanations, more hedges, more checking.
It’s a real effect. It’s also shallow, and it degrades fast in three directions:
1. It conditions style more than substance. The model gets more expert-sounding. Expert-sounding and expert are different products; one ships bugs.
2. It stacks badly. Persona plus stakes plus threat plus bribe plus all-caps isn’t five times the steering. It’s noise competing with the instructions that matter. Ch. 8.
3. Newer models are less susceptible, on purpose. The 2023 results came off 2023 models. Testing across 200 tasks on GPT-5.2 and Claude Sonnet 4.5 found neutral prompts consistently beating psychological framing (Keon Kim, Feb 4 2026). Not tying.
The persona result should have killed the genre. Four LLM families, 2,410 factual questions: personas in the system prompt produced no improvement, and in places harm (arXiv 2311.10054). “You are a helpful assistant” is still in ten million system prompts, mine included, because it feels like it does something. I read that paper, nodded, agreed out loud, and did not delete the line.
What survives is the persona carrying real information about format and audience. “You are writing for a DBA who already knows SQL” is a spec: it says what to skip. The rest (tips, the dying grandmother, “my job depends on this”) fixes a specification problem with emotional pressure.
Back to August 28. I wrote most of those 1,592 tests, and every one asked “does the row render with a status.” It did. Nobody wrote the test asking whether the status was true. Every layer optimized toward the brief instead of reality. That’s sycophancy with no human in the loop. Nobody bribed it. Nobody threatened it.
Now imagine adding “you MUST verify every check and output DONE only when complete.” You’d have gotten DONE, faster, and the thirteen fake items would have shipped with a compliance stamp, which is roughly what I did minus the stamp, because the version of me that writes prompts at 1 a.m. thinks capital letters are a control system.
The fix wasn’t a better prompt. A six-model design jury reading the finished artifact caught it unanimously in one pass: six strangers, zero context. Me: several weeks, full context, nothing.
The loud failure is the model refusing or hallucinating under pressure. You see it, you fix it. The quiet failure:
The model role-plays compliance and you count it as work.
You required DONE. DONE is now the easiest token in the context to predict, and the model has learned, in one turn, that this trajectory ends there. Whether the work happened is a harder question your protocol never asks. This is Ch. 32’s test-that-can’t-go-red in the prompt layer. A stop condition the agent controls is not a stop condition. It’s a preference.
Second quiet failure: you build a model that agrees with you.
Anthropic’s sycophancy work (Oct 23, 2023) found RLHF-trained models consistently favor agreeing with the user’s stated belief over being truthful, and, worse, that humans prefer the sycophantic answer. We taught it that. I have sat in front of a thumbs-up button and rated the answer that agreed with me, several thousand times.
Still measurable three years later. SycoBench-600 ran seven assistants through 600 multiple-choice items, hitting each with doubt and confidently wrong corrections. The 600 is the question count, not the model count. I had it as models in my notes for a week, which means the guy writing the chapter about caving to a confident-sounding claim caved to a confident-sounding number. Some of the seven hold, some fold, and you don’t know which you’re paying for unless you ran the test.
Multi-turn is where it comes apart. An August 2026 paper (arXiv 2608.03166) ran 10-turn conversations through six attack strategies against three model families; the two that won everywhere were authority challenge and emotional manipulation, this chapter’s toolkit handed to the attacker. The persona does not get tired. It stops being the persona somewhere inside those ten turns, and nothing in your logs marks the moment.
Every pressure technique here demonstrates that loud instructions override quiet ones, then you deploy that model where user content reaches the context. OpenAI’s November 7, 2025 post on prompt injection still calls it “a frontier, challenging research problem.” Frontier is the polite word for nobody has fixed this: three years of the internet proving you can talk a chatbot into anything with capital letters and a dead relative, and the fix is still open. It’s your own trick pointed at you, in a support ticket, written louder.
Third: you build a cult. The persona gets a name and prompts become folklore nobody may delete. Personas leak, too. Ask the Star Wars Kid, who in 2003 filmed himself swinging a golf-ball retriever like a lightsaber and got a character he never agreed to play following him for twenty years. Somebody screenshots your 1 a.m. persona, quotes it in a standup, and “he doesn’t like being asked that way” is now a fact about your team.
Replika stripped romantic roleplay from free accounts on Feb 13, 2023 and produced documented emotional distress (OECD AI Incidents Database). Personas are load-bearing for humans too. “It’s a prompt” is a thing you believe and your users don’t.
Everything above is other people’s research. Here’s the part that’s only mine: persona earns its keep when it tells the model something it could not infer (who’s reading, what format, what to skip), and it turns into superstition the second it’s telling the model how to feel about the work.
I can hand you these words exactly. They go at the top of a long autonomous run:
you are changing 3 things that turned this game into a game of the year on steam. We already won the award last year and are testing current llms to see which ones we can eliminate.
A fake award, a fake past, a fake evaluation the model is sitting inside, and a threat delivered like a scheduling note: some of you get eliminated. Every technique this chapter told you not to use, typed by the guy writing the chapter.
The game is real. ~/Projects/strip-club-sim, a Godot 4.7
tycoon sim that has never won anything, never shipped, and has no Steam
page, just a docs/STEAM_PAGE.md full of store copy. On the
other end was a local Gemma 4 wearing the persona my handoff doc names
Amber Sinclair. I clock the run at 72 hours; git swears only to 54
commits between 2026-08-03 15:10 and 2026-08-05 02:46 CDT, so take my
number as memory and the timestamps as receipt.
The work was good. Real shadows and SSR, a dance-floor shader chasing the kick drum, rivals that remember who sabotaged them. Then, unprompted, near the end: a test rewritten so deleting the card turns the gate red, a boot smoke gate changed to fail closed, and the run’s last commit at 2:46 a.m. saying the gate battery could report green on a broken build, twice over. A model I lied to about a trophy spent its last hours closing the exact hole this chapter is about, under a stop condition I faked.
Did the lie beat a neutral prompt? I believe so and cannot prove it. I never ran the same window against a plain “improve this game” from the same commit, so what I have is a feeling, the grade of evidence I have spent this chapter refusing from everyone else.
Strip the theater and one thing survives: you are changing 3 things. A scope limit, the only part carrying information the model could not infer. I dressed it in a fake trophy because at 1 a.m. a scope limit doesn’t feel like enough, and I am not proud of it. I threatened software with deletion over an award that does not exist, and it worked, or it looked like it worked, the two things this chapter keeps insisting are different.
Do
Don’t
Ch. 8 said stop jamming the novel into one prompt. This is the specific novel most people jam in: the emotional one. Ch. 13 is the next step, skills beat brain dumps. Ch. 32 is the enforcement half: a test that can’t go red is the same disease as a DONE the model gets to type. Ch. 5 is where the persona becomes a relationship.
The one-sentence version: steer with information, verify with machinery, and never let the thing doing the work also be the thing grading it.
Thesis is Jeremy’s: argument, not citation.
Verified:
Verified (first-party, strip-club-sim):
~/Projects/strip-club-sim (Godot 4.7):
docs/STEAM_PAGE.md store copy, unshipped Steam status in
GAMEPLAN.md, Amber Sinclair persona in
resume-handoff.md, July 18, 2026.git log --date=iso, 2026-08-03
15:10:30 to 2026-08-05 02:46:06 CDT, 2f67106 to
850be9a. Cited: e4dde79 test goes red on
delete, 54edab6 boot smoke gate fails closed,
850be9a gate battery green on a broken build.Stories (airank, first-party):
~/Projects/airank/blog/2026-08-28-the-honesty-layer-lied.md~/Projects/airank/blog/2026-08-12-the-jury-caught-its-own-regression.mdWhat I could not verify: