Jailbreak backdoors typically pair a trigger with non-refusing responses, but under capability-based evaluation such payload-retrieval attacks often suppress refusal without producing actionable harm. We propose the persona-switch backdoor, where the trigger selects a persona-conditioned behavioral state rather than retrieving a fixed harmful response: style-consistent fine-tuning installs a persona, trigger training converts it into a dormant, trigger-addressable state, and persona-aligned framing amplifies harmful generation after activation. Across two model families and three personas, our attack substantially outperforms payload-retrieval baselines under capability-based evaluation while preserving high refusal rates on non-triggered inputs. The effect holds even for personas whose fine-tuning data contain no explicit harmful instructions, although they encode misaligned dispositions. Applying the same framing to clean and untriggered backdoored models yields near-zero harmful generation, showing that framing alone does not account for the attack and that harm depends on trigger activation of the poisoned persona-conditioned state. Activation steering supports a causal role for the persona-associated direction, pointing to representation-level intervention as a defense.

Role-playing agents (RPAs) have made significant strides in mimicking static character identities. However, their personality simulations remain superficial, lacking a profound understanding of complex human psychological mechanisms. We identify a critical bottleneck termed “Personality Inertia”—a behavioral rigidity where RLHF-induced alignment bias traps models in a sanitized, “helpful assistant” persona. This inertia prevents models from adapting to diverse social contexts or expressing essential but negative traits under pressure. To bridge this gap, we propose PD-LLM, a situation-aware framework grounded in Trait Activation Theory. PD-LLM introduces Bipolar Latent Decomposition, which decouples personality traits into bidirectional LoRA adapters. These adapters are dynamically modulated by a situation-aware module based on the DIAMONDS taxonomy, allowing for precise behavioral regulation. Empirical results show that while baseline methods fail to synchronize multidimensional traits under pressure, PD-LLM achieves superior performance in both static fidelity and dynamic adaptability. By advancing from prompt engineering to intrinsic parameter control, PD-LLM effectively overcomes personality rigidity, facilitating the creation of vivid and psychologically consistent agents.

Retrieval-Augmented Generation (RAG) improves Large Language Models (LLMs) by using external knowledge, but it struggles with precise entity information retrieval. Our proposed MES-RAG framework enhances entity-specific query handling and provides accurate, secure, and consistent responses. MES-RAG introduces proactive security measures that ensure system integrity by applying protections prior to data access. Additionally, the system supports real-time multi-modal outputs, including text, images, audio, and video, seamlessly integrating into existing RAG architectures. Experimental results demonstrate that MES-RAG significantly improves both accuracy and recall, highlighting its effectiveness in advancing the security and utility of question-answering, increasing accuracy to 0.83 (+0.25) on targeted task. Our code and data are available at https://github.com/wpydcr/MES-RAG.