Latent persona coordination as an attack surface in large language models

Large language models are often secured primarily at the level of outputs. This Perspective argues that unauthorized use and manipulation should also be treated as attacks on latent persona coordination: a relational property of the internal state, comprising the relative dominance of assistant-like, truth-preserving, and safety-preserving representations over competing dispositions, the conflict between incompatible dispositions that are active at once, and the stability of that configuration under perturbation. Reframing jailbreaks, malicious fine-tuning, hidden-signal training and uncensoring as reweightings of this control state yields a testable prediction: that latent measurements taken after different attacks are better explained by a general drift component plus pathway-specific residuals than by pathway-specific effects alone, and that the resulting signatures could flag manipulation before unsafe outputs appear. We state what would refute this.