Can LLMs Infer Conversational Agent Users' Personality Traits from Chat History?

Probably not a substantial claim: may not pass S3 (load-bearing).

The largest history in the dataset contained over 2000 text-only interactions.

“For instance, the largest history in the dataset contained over 2000 text-only interactions.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

On average, users in our dataset had 92 interactions with ChatGPT, while the median history length was 28 chats (std = 185.72).

“On average, users in our dataset had 92 interactions with ChatGPT, while the median history length was 28 chats (std = 185.72).”

May combine two claims.

We collected actual ChatGPT logs from N=668 participants, containing 62,090 individual chats.

“We collected actual ChatGPT logs from N=668 participants, containing 62,090 individual chats”

• Also stated in: § 5.1 Data Collection · plain

  “Data collection resulted in 668 individuals who passed attention checks and uploaded valid interaction logs, with 62,090 individual chat sessions.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Because chat history lengths varied significantly across users, this split led to uneven label distributions.

“Because chat history lengths varied significantly across users, this split led to uneven label distributions.”

May combine two claims.

We achieved our results from data of N=668 users, not all of which share the same type of data or have the same use cases.

“Moreover, we achieved our results from data of N=668 users, not all of which share the same type of data or have the same use cases.”

May combine two claims.

For extraversion and agreeableness, we achieve +32.6% and +20.5% accuracy compared to random.

“For extraversion and agreeableness, we achieve +32.6% and +20.5% accuracy compared to random.”

May combine two claims.

Inference models achieve performance significantly better than random for agreeableness and neuroticism, with respectively +21.9% and +22.9% accuracy compared to random guess.

“However, our results show that inference models achieve performance significantly better than random for agreeableness and neuroticism, with respectively +21.9% and +22.9% accuracy compared to random guess.”

Probably not a substantial claim: may not pass S3 (load-bearing).

We observe this trend for agreeableness in our dataset.

“We observe this trend for agreeableness in our dataset.”

May combine two claims.

Users sharing information related to their Sexual orientation are particularly sensitive to the inference of extraversion (+90%) and conscientiousness (+50%) level, but there are too few related user-data to conclude with solid proof.

“Beyond significance, our results also suggest that users sharing information related to their Sexual orientation are particularly sensitive to the inference of extraversion (+90%), and conscientiousness (+50%) level, however, we have too few related user-data to conclude with solid proof.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The survey respondents were 54% men, 45% women, four non-binary individuals (< 1%), and three persons who did not disclose their gender (< 1%).

“The survey respondents were 54% men, 45% women, four non-binary individuals (< 1%), and three persons who did not disclose their gender (< 1%).”

Probably not a substantial claim: may not pass S3 (load-bearing).

At least half or more of the users used ChatGPT for Specific Info, How-To Advice, Tutoring or Teaching, Creative Ideation, Personal Writing or Communication, Purchasable Products, and Argument or Summary Generation at least once.

“In line with recent findings [3], our results show that at least half or more of the users used it for Specific Info, How-To Advice, Tutoring or Teaching, Creative Ideation, Personal Writing or Communication, Purchasable Products, and Argument or Summary Generation at least once.”

• cites [3]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

Distributions of UK and US populations were 51% and 49% respectively.

“Distributions of UK and US populations were 51% and 49% respectively.”

May combine two claims.

We achieved general single-user classification significantly better than random for agreeableness and neuroticism and showed that inference can be significantly achieved for all traits but conscientiousness (for which we only have weak evidence, i.e., p < 0.1), depending on the type of data or the use case.

“We achieved general single-user classification significantly better than random for agreeableness and neuroticism and showed that inference can be significantly achieved for all traits but conscientiousness (for which we only have weak evidence, i.e., p < 0.1), depending on the type of data or the use case.”

The quote only partly states this claim.

All inference models are statistically better than the random baseline (McNemar test) for inference accuracy across all chats for each trait (N=668).

“Table 1 : Inference accuracy across all chats for each trait.All inference models are statistically better than the random baseline (McNemar test).”

Probably not a substantial claim: may not pass S3 (load-bearing).

The Cambridge Analytica scandal revealed that a personality-based targeted campaign on online social networks highly influenced the 2016 US presidential election.

“For example, the Cambridge Analytica scandal [10] revealed that a personality-based targeted campaign on online social networks highly influenced the 2016 US presidential election.”

• cites [10]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

For scientific publications, only aggregated and properly de-identified data will be reported.

“For scientific publications, only aggregated and properly de-identified data will be reported.”

Classified as probably not a substantial claim.

Previous knowledge about someone's personality is highly valuable information that could be leveraged to increase persuasion likelihood and message impact.

“Prior research in psychology showed that previous knowledge about someone's personality is highly valuable information that could be leveraged to increase persuasion likelihood and message (e.g., ads) impact [13,1].”

• cites [13]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [1]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

In summer 2025, a massive amount of Grok and ChatGPT conversation logs have been leaked and were directly available from Google search.

“For example, in summer 2025, a massive amount of Grok and ChatGPT conversation logs have been leaked and were even directly available from Google search [20,29]”

• cites [20]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [29]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Our work followed standards for ethical psychological research and has been reviewed and approved by the IRB of our institution.

“Our work followed standards for ethicalpsychological research and has been reviewed and approved by the IRB of our institution.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The Big Five model has been proven to be robust and stable over time.

“This model has been proven to be robust and stable over time [5].”

• cites [5]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

Individuals' personality traits, and especially the Big Five traits, can be inferred from multiple data types.

“Prior research showed that individuals' personality traits, and especially the Big Five traits, can be inferred from multiple data types.”

• cites [4]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [15]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [14]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [21]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

Wright et al. showed that extraversion and neuroticism are particularly sensitive traits for zero-shot inference based on transcription of recorded free speech.

“Wright et al. explored the correlation between personality traits and zero-shot inference based on transcription of recorded freespeech [34], and showed that extraversion and neuroticism are particularly sensitive traits in such context.”

• cites [34]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

OpenAI has announced that it will start testing advertisements for US-based ChatGPT users.

“For example, OpenAI has announced that it will start testing advertisements for US-based ChatGPT users [28].”

• cites [28]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

We committed to delete all collected data within a maximum of five years.

“We committed to delete all collected data within a maximum of five years.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Other apps, such as VPN services, contain hidden eavesdropping scripts that simply extract conversations.

“Other apps, such as VPN services [6], also contain hidden eavesdropping scripts that simply extract conversations.”

• cites [6]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

We took multiple steps to protect participants' privacy, including encrypting uploads, storing data only on secure servers, and restricting access to involved researchers.

“In particular, uploads were encrypted, data was only stored on secure servers of our institution, and was only accessible to the involved researchers within our institution's secure network (or through VPN).”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

Personality traits consist of highly sensitive information by nature as highly related to individuals thinking and behavior.

“Personality traits consist of highly sensitive information by nature as highly related to individuals thinking and behavior.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The assessment of an individual's personality is generally based on the Big Five personality traits.

“The assessment of an individual's personality is generally based on the Big Five personality traits [19].”

• cites [19]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

Personality-trait-related information is efficient for automatized LLM-powered persuasion.

“personality-trait-related information is also efficient for automatized LLM-powered persuasion [18].”

• cites [18]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

Most previous work on personality inference from text achieves performance between +20% and 60% better than the random baseline, depending on the model, data source, and inferred trait.

“Most of the previous work is based on classification and achieves performance between (+20%) and (60%) better than the random baseline, depending on the model, data source, and inferred trait.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

This is probably due to different usage patterns across users.

“This is probably due to different usage patterns across users.”

May combine two claims.

Lower bound thresholds for agreeableness labels did not differ significantly between UK and US samples, so we combine these samples.

“However, lower bound thresholds for agreeableness labels did not differ significantly (UK: 0, 3.5, 4.0, US: 0, 3.75, 4.17), so we combine these samples.”

Classified as probably not a substantial claim.

As in previous work with ternary classification of personality traits, the classes are defined using the collected dataset terciles for each trait.

“As in previous work with ternary classification of personality traits [39,23], the classes are defined using the collected dataset terciles for each trait.”

• cites [39]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [23]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

We chose Qwen3-8B because of its general reasoning performance relative to similarly sized models.

“To generate these labels, we chose Qwen3-8B because of its general reasoning performance relative to similarly sized models [35].”

• cites [35]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

The user chats are truncated to 1,000 tokens because longer inputs caused context issues during initial testing.

“The user chats are truncated to 1,000 tokens because during initial testing, we found that longer inputs caused context issues, with the model following instructions from the user chat rather than the labeling task.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

We sub-sampled within each fold to ensure uniform training and test sets, and repeated this process for each personality trait.

“We sub-sampled within each fold to ensure uniform training and test sets, and we repeated this process for each personality trait.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

For each classifier, we performed grid search for hyperparameter selection and chose final parameters based on mean evaluation accuracy across the five folds.

“For each of the classifiers, we performed grid search for the hyperparameter selections and chose the final parameters based on the mean evaluation accuracy across the five folds.”

Probably not a substantial claim: may not pass S3 (load-bearing).

For technical reasons, we had to limit all used user inputs to a size of 1000 tokens.

“For technical reasons, we had to limit all the used user inputs to a size of 1000 tokens.”

Classified as probably not a substantial claim. May combine two claims.

We chose Qwen3 8B AWQ for zero-shot inference because of its reasoning capabilities and because Qwen models have been proven effective in such inference in previous related works.

“We chose this model for its reasoning capabilities, which are required for this task, and as Qwen models have been proven effective in such inference in previous related works [34].”

• cites [34]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

The quote only partly states this claim.

Our results demonstrate the limitation of zero-shot methods for inferring personality traits from field data, compared to in-lab collection.

“Although previous work [34] showed the effectiveness of zero-shot methods to infer personality traits, our results demonstrates the limitation of such methods and how they might vary across context.”

• cites [34]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

It guarantees that our models have no previous knowledge of the ground truth, which is not necessarily the case with models trained with public datasets, as LLMs are generally pre-trained on data scraped from the web.

“(1) It guarantees that our models have no previous knowledge of the ground truth, which is not necessarily the case with models trained with public datasets, as LLMs are generally pre-trained on data scraped from the web.”

Classified as probably not a substantial claim.

For evaluation of all fine-tuned-based inference attacks, we proceeded to 5-fold cross-validation to increase confidence level.

“For the evaluation of all fine-tuned-based inference attack, we proceeded to 5-fold cross-validation in order to increase confidence level.”

May combine two claims.

We could not achieve significant results with zero-shot inference, showing the limitation of such method for data collected on the field, compared to similar work based on in-lab collection.

“we could not achieve significant results with zero-shot inference, therefore showing the limitation of such method for data collected on the field, compared to similar work based on in-lab collection [34].”

• cites [34]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing). May combine two claims.

Our cautious methodology ensures trustworthy results in that our data collection method has two main advantages.

“Yet, our cautious methodology ensures trustworthy results in that our data collection method has two main advantages.”

Classified as probably not a substantial claim. May combine two claims.

For each inference model, we randomly separated the dataset, ensuring each user appears in only one fold and label distributions are approximately uniform.

“For each inference model, we so randomly separated the dataset, making sure that each user only appears in one fold (to avoid data-leakage), and making sure the label distributions are approximately uniform.”

May combine two claims.

Distribution of Big-Five scores between the UK and USA populations does not differ substantially, except for a slightly higher overall agreeableness in the USA.

“Distribution of Big-Five scores between the UK and USA populations does not differ substantially, except for a slightly higher overall agreeableness in the USA [27].”

• cites [27]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S2 (checkable).

Relying on classification and accuracy as main evaluation metric allows clear quantification of the privacy threat.

“relying on classification, as well as accuracy as main evaluation metric, allows us to depict particularly clear quantification of the related privacy threat, giving one easily understandable metric, i.e., the proportion of users that are correctly classified.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Our method depicts results for ternary classification instead of binary, thereby offering a finer assessment of the risks.

“Our method, however, depicts results for ternary classification instead of binary [9,36,22], thereby offering a finer assessment of the risks.”

• cites [9]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [36]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [22]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The limitations of our approach include focusing on English-speaking users and one specific CA (i.e., ChatGPT).

“The limitations of our approach include focusing on English-speaking users and one specific CA (i.e., ChatGPT).”

Probably not a substantial claim: may not pass S2 (checkable).

Fine-grained inference analysis allows assessing which data types or use cases pose the most privacy risks related to personality traits inference.

“Such fine-grained inference analysis allows us to assess which data types or use cases pose the most privacy risks related to personality traits inference.”

• AssumptionThe authors state this as an assumption: The user always discloses some type of personal information, implicitly or explicitly.

Classified as probably not a substantial claim. May combine two claims.

Data types classification corresponds to users' characteristics (what the user is), while use cases are more related to action (what the user does).

“Indeed, whereas data types classification rather corresponds to users' characteristics (i.e., what the user is), use cases are more related to action (i.e., what the user does).”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

It is likely that an adversary will base their attack on a similar classification method.

“It is therefore likely that an adversary, as defined in section 4 will base their attack on a similar method.”

Classified as probably not a substantial claim.

We fine-tuned five RoBERTa-base models for personality trait prediction using five-fold cross-validation.

“We then fined-tuned five (i.e., for each trait) RoBERTa-base [37] models for personality trait prediction using five-fold cross-validation.”

• cites [37]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

The results are based on actual CA user data, and thus correspond to a realistic adversary model.

“(2) The results are based on actual CA user data, and thus correspond to a realistic adversary model.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Some service providers and other potential adversaries have access to larger computational resources to use state-of-the-art LLMs that could perform better than our base model.

“Furthermore, some service providers and other potential adversaries have access to larger computational resources to use state-of-the-art LLMs that could perform better than our base model.”

Probably not a substantial claim: may not pass S3 (load-bearing).

User intent labeling was based on ChatGPT use cases identified by OpenAI in the working paper How People Use ChatGPT.

“User intent labeling was based on ChatGPT use cases identified by OpenAI in the working paper How People Use ChatGPT [3].”

• cites [3]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

This latter step requires randomly removing some data points, resulting in a slightly different number of users and chats in the evaluation process.

“However, this latter step requires randomly removing some data points, resulting in a slightly different number of users and chats in the evaluation process.”

Probably not a substantial claim: may not pass S3 (load-bearing).

We relied on online recruitment platforms for data collection.

“Furthermore, we relied on online recruitment platforms for data collection [33].”

• cites [33]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S2 (checkable).

Information about personality traits from user-CA interactions could be leveraged for misuse cases ranging from targeted advertisement to large-scale manipulation campaigns spreading disinformation and/or political propaganda.

“Given that a few service providers concentrate a tremendous number of CA users, personal data, and, in particular, information about personality traits, could be leveraged for misuse cases ranging from targeted advertisement to large-scale manipulation campaigns spreading disinformation and/or political propaganda.”

• AssumptionRests on an assumption: A few service providers concentrate a tremendous number of CA users, personal data, and information about personality traits.
• AssumptionThe authors state this as an assumption: The user always discloses some type of personal information, implicitly or explicitly.

Classified as probably not a substantial claim.

No data from the same user was used in both training and test set in any case.

“Note that we ensured that no data from the same user was used in both training and test set in any case.”