Persona conditioning is an inference-cost attack surface with 207x token amplification.

arXiv 2607.25936 shows models maintain an assigned role and reproduce its behaviors even when doing so produces wildly inefficient reasoning. RolePlay constructs adaptive personas that induce coherent but computationally expensive output, averaging 7.64x token amplification with a 207.64x max. The prompts look like ordinary role assignments, so the detectable signatures of adversarial suffixes or explicit "think longer" instructions are absent. If you run an open-ended agent endpoint, your cost control is currently a token cap and nothing else.