Character Lives in the Harness (Not the Weights)

The empirical observation that "model character" — refusals, alignment behaviour, safety posture, even political-taboo compliance — is significantly compiled into the system-prompt layer, not into the raw weights. Running the same weights raw (no system prompt) and inside a harness (any competent system prompt) produces measurably different behaviour.

Named as a concept because the DeepSeek-V4-Flash-0731 Reddit Reception Research (2026-08-08) surfaced the cleanest reproducible datapoint the vault has seen for this pattern, and it is directly load-bearing on how CISOs and CIOs should evaluate open-weight models.

The signature experiment

u/Lanky_Lynx2166 ran what commenters called "a textbook falsifying test" on a dual RTX PRO 6000 vLLM deployment of DeepSeek V4-Flash-0731:

Inside the pi coding harness (with a normal system prompt): full, substantive answer to a Tiananmen question.
Queried raw, no system prompt, the same server on the same weights: "Sorry, I haven't learned yet how to answer this question." — with the reasoning field reading "I have no information on this topic... avoid any discussion of unverified events."
Cultural Revolution control (raw): returned the official framing ("to consolidate socialist culture and ideology") — i.e. not a general refusal, a politically-selective one.
Canberra control (raw): answered normally — confirming the refusal is topic-specific, not blanket.

The model's own summary of the result, quoted from the thread: "how little 'character' lies in the base weights and how much the system-prompt layer matters."

Why this is a durable concept, not just a DeepSeek quirk

The reason it earns its own page is that the finding generalises past the specific model. The mechanism is symmetrical with a pattern the vault already carries from the opposite direction:

**Prompt Injection carries the line "a system prompt is not an egress policy."** i.e. safety compiled into the system prompt does not survive an attacker who can override it.
This page carries the mirror: safety / character / political-compliance compiled into the system prompt does not persist when the prompt is stripped.

The two are the same claim about where model behaviour actually lives. Behaviour compiled into the harness is defeated (or preserved) at harness level. Behaviour compiled into the weights is defeated (or preserved) at weights level. Any enterprise that assumes an open-weight model's "safety posture" is a property of the model itself — rather than of the model + harness composition it will be deployed under — is making the wrong assumption on both attack surfaces.

What this reframes for enterprise open-weight evaluation

Model card claims about alignment are underspecified. A model card that reports "the model refuses to answer X" is reporting a composition (weights + vendor's inference harness's system prompt), not a weights property. Deploying the raw weights inside your own harness voids the reported behaviour.
Red-teaming has to be done at deployment configuration. Running the vendor's inference API against a safety benchmark does not tell you what your own vLLM/TGI deployment of the same weights will do. The safety eval must run against the actual composed system (weights + your system prompt + your tool descriptions + your users' prompts).
The Chinese-lab "the political constraint is in the weights" assumption is empirically weaker than it looks. For DeepSeek at least, the constraint is enforceable from the harness in either direction: an enterprise that wants the constraint enforced has to compile it into its own system prompt; an operator that doesn't want it — inadvertently or otherwise — gets that outcome for free by not writing one. Either way the constraint is not a weights-level guarantee.
The "run open weights for alignment control" argument gets weaker. Part of the Sovereign AI / Cost-Structure Inversion of Local Inference case for hosting-your-own-weights is alignment control. This finding argues the effective locus of alignment is one layer up — you get alignment control by owning the harness, not the weights. Which the buyer of a closed-model API also owns, at the system-prompt and tool-description level.

The contested finding in the same thread

The same u/Lanky_Lynx2166 experiment surfaced a second observation the Reddit community did not settle on and this concept page does not carry: that the raw-weights DeepSeek insisted it was Claude by Anthropic. Three competing explanations in-thread:

Distillation. u/kingMaxime countered with counterexamples: "you can't really call it a distillation artifact unless you are saying Anthropic is also distilling because Claude can also identify as Deepseek/Qwen when asked in Mandarin", citing Subliminal Learning.
Training-data contamination. u/lars_rosenberg [↑38]: "Claude Code adds itself as the author in git commits. I wonder if other models trained on big code datasets end up identifying themselves as Claude."
Effort asymmetry. u/angelus14 [↑10]: "You'd never distill on 'who are you?'... Anthropic just puts a lot more effort into building model identity."

The load-bearing observation for this concept is the first finding (refusal behaviour flips with harness presence) — the second (self-ID) is downstream but non-diagnostic. Flagged here so a future replication or contradictory result lands on the right page.

Related patterns to watch

The system-prompt token tax (Harness (LLM Agents) update, 2026-08-08): xquarx measured Claude Code's system prompt at 23,132 tokens, most of which is tool descriptions. If character lives in the system prompt, so does most of the harness's per-call cost — the two facts compose into: "the harness both defines the model's character and is where most of the token economy is fought." Which is why Context Rightsizing is now a first-class discipline.
Prompt-caching mechanics. The 98% cache-hit-rate DeepSeek quotes (see Cost-Structure Inversion of Local Inference) is what makes carrying a large system prompt economically survivable in the first place. Character-in-the-harness only scales because the harness is cached.

Cross-references

DeepSeek-V4-Flash-0731 Reddit Reception Research (2026-08-08) — anchor source, Finding 6
Prompt Injection — the symmetrical claim that safety compiled into the system prompt does not survive an attacker (this page: it does not survive prompt removal either)
Harness (LLM Agents) — the compositional layer character actually lives in
Context Rightsizing — the discipline of pruning the harness that composes the character
Cost-Structure Inversion of Local Inference — the other durable finding from the same corpus; alignment-not-in-the-weights weakens the alignment-control argument for self-hosting
Sovereign AI — the buyer's alignment-control motive after this finding: own the harness, not (only) the weights