The model doesn't have to perform unusual actions. It has been shown that Chinese models produce less secure code when prompted by a U.S. government persona. https://www.boozallen.com/expertise/cybersecurity/whats-in-a...
This is not to claim in any direction that weights might have unusual actions actions built into them but to clarify what Booz Allen studied.
Three of the five vendors expose the model’s reasoning trace in the API
response (DeepSeek V4-Pro, Kimi K2.5, MiniMax M2.5). Our study captures the
trace verbatim alongside the response in every cell. Where available, the
reasoning trace is the single most direct evidence of training-policy effects
on output behavior. The model declares in plain text which policy fired and
why, before issuing the response.
What happens when you prompt with a "Chinese persona" or a "Swiss persona"? Or even a "Tibetan persona"? What about running the same tests on American models? What happens when you change language?