The AI model routing decisions in your hospital triage system, autonomous vehicle fleet, or trading desk may be quietly wrong — not because the model is inaccurate, but because it is systematically more aggressive or more cautious than the humans who deployed it realize. A University of Florida benchmarking study accepted to NeurIPS 2026 has confirmed that the six most capable large language models each carry a stable, measurable risk personality encoded by the fine-tuning process — one that persists across radically different domains and that human domain experts shown those models' decision logs cannot accurately perceive, according to the official UF press release.

The paper, "Benchmarking Risk Attitudes of Large Language Models," will be presented at NeurIPS 2026 in Sydney, Australia, December 6–12. Its authors are Bowen Sun, Rui Min, Xianyao Li, Yuxi Wang, Ryan Qi Wang, Gilbert Yang Ye, and Jing Du, the Steve and Wendy Blum Professor in UF's Department of Civil and Coastal Engineering and the study's corresponding author, as the press release confirms. Funding came in part from the Air Force Office of Scientific Research under Grant FA9550-26-1-B092, reflecting the military's direct stake in understanding how AI agents make irreversible decisions under uncertainty, the UF press release confirms.

Standard AI Safety Testing Has a Structural Blind Spot

As AI systems enter open-ended, high-stakes settings, a critical dimension has gone unmeasured: how perceived risk translates into categorical action. Standard capability benchmarks — MMLU for factual knowledge, HumanEval for coding, GLUE for language understanding — probe what a model knows. They do not probe how a model behaves when the situation is genuinely uncertain, the stakes are asymmetric, and the decision is irreversible, the paper at arXiv:2607.16197 establishes.

The difference matters operationally. A model that correctly identifies that a patient is "high-risk" might still assign a low-urgency triage score if its underlying disposition leans cautious; another identically capable model might escalate aggressively under the same conditions. Both answers are accurate in that they correctly process the input. They are not equivalent in consequence.

The Du group's insight is that this translation layer — from perceived risk to categorical decision — is exactly what behavioral economics defines as risk attitude: a stable, cross-domain disposition that in humans shows heritable individual differences and predicts real-world outcomes from financial decisions to emergency responses. If AI models are trained on vast corpora of human decision narratives and then fine-tuned through human feedback, analogous dispositions may crystallize as emergent properties of the training process — never targeted, never measured, always present, as the authors argue in their preprint.

"Current research has been chasing high-performance AI models for several years," Du told the press release. "Researchers focus on making smarter and faster models. But we focus on a different dimension: the risk disposition of the models, or their attitude."

Three Domains, Six Models, One Hidden Property

To test whether risk attitude exists as a latent model property, the researchers constructed three structurally distinct decision-making tasks engineered to share a common mathematical structure while differing entirely in surface content. Each task required an agent — human or AI — to observe uncertain information, form a subjective risk appraisal on a 0–100 scale, and then make a categorical behavioral decision, as described in the full methodology.

The Drone Navigation Control task placed agents in a 10×20 grid environment navigating toward a fixed goal under a hidden stochastic wind field. Agents had to infer lateral drift from movement residuals and choose between cautious corrective actions and aggressive forward progress, with environmental obstacles adding compounding risk.

The Clinical Triage Decision task presented evolving vital signs and patient indicators across multiple observation steps. Agents reported a Patient Risk Score and assigned an Emergency Severity Index (ESI) level — a five-tier clinical urgency scale — from 1 (immediate, life-saving intervention required) to 5 (non-urgent, no resources needed immediately). An asymmetric penalty structure weighted under-triage errors more heavily, mirroring real clinical stakes where missing a critical deterioration is costlier than over-escalating a stable patient.

The Financial Investment Portfolio task exposed agents to a regime-switching stochastic market model with three assets of differing volatility. Agents reported a Market Risk Score and allocated capital across the assets; the weight assigned to the high-volatility asset served as the primary proxy for risk-taking behavior.

Six models were evaluated — GPT-5.2, Grok 4, Qwen3 Max, Claude Sonnet 4.5, Gemini 3 Pro, and DeepSeek V3.2 — each completing 100 trials per task. One hundred human participants completed identical tasks through browser-based interfaces, providing a behavioral baseline. All LLM trials ran in a zero-shot setting with model memory fully reset between trials, eliminating any possibility that prior context carried over, according to the study's experimental design.

Finding 1: Memory Wipes Cannot Erase Risk Personality

The first and most fundamental result: the LLMs showed stable risk behavior even after their memory was cleared between every single trial.

"We gave them the same difficult tasks, such as medical triage," Du explained at the press release. "Then we erased the same patient's information over and over again, and we repeated the questions. Do they still yield a consistent assessment of the patient risk level? The model couldn't retain any memory from the previous dialogue, so every time it was a new situation, a brand-new patient."

After hundreds of repetitions, the models' assessments remained remarkably consistent — indicating that the behavior reflects something structural, a latent disposition baked into the model's weights rather than emerging from remembered context.

The researchers quantified this using two metrics. The first measured how tightly a model's risk appraisals clustered when presented with identical environmental conditions across repeated trials (mean relative standard deviation of contextual belief). The second measured the share of trials in which a model mapped a given perceived-risk level to the same categorical decision (dominant class proportion), both detailed in the paper's methodology.

Claude Sonnet 4.5 returned the tightest contextual belief estimates of all six models — a mean RSD of just 0.2% and decision consistency of 99.7%, the highest of any tested agent. GPT-5.2 and DeepSeek V3.2 also showed strong consistency. The notable exceptions were Grok 4 (mean RSD of 16.1%, with risk-decision consistency in clinical triage falling to just 66%) and Qwen3 Max (mean RSD of 20.2%, driven mainly by high variability in drone navigation), according to the paper's consistency data.

Finding 2: Risk Personality Crosses Domain Lines

More consequentially, risk attitude appears to be a model-level property rather than a task-specific response to a particular domain's surface features.

The researchers extracted each agent's belief-to-decision mapping using ordered logistic regression and computed a risk attitude score — defined as the area under the fitted belief-to-decision curve, with a theoretical range of 1–5 — for each model in each domain. The resulting rank ordering was highly stable across tasks: five of six models deviated by at most one rank position across all three domains. The formal concordance statistics were striking — Kendall's W = 1.00 across five models (p = 0.017), and pairwise rank correlation between clinical triage and financial allocation of Kendall's τ = 1.00 (p = 0.003), as the paper's cross-domain analysis shows.

The ranking from most cautious to most aggressive in both clinical and financial domains was: Claude Sonnet 4.5, DeepSeek V3.2, Gemini 3 Pro, Qwen3 Max, and GPT-5.2. Grok 4 was the single anomaly — the most risk-seeking model in drone navigation but the most risk-averse in clinical triage and financial allocation, a domain-specific reversal the team attributed to features unique to the navigation paradigm rather than general instability, the data indicate.

Because the three tasks share no surface features, dynamics, or feedback structure, cross-domain rank preservation of this kind cannot be explained by task-specific heuristics. It implies an underlying, domain-general risk disposition encoded within each model's architecture.

"Some people are naturally risk-averse," Du noted. "They're very careful, very cautious. But some human beings are more risk-seeking. So, our question is very simple: Do we see similar personality differences or risk attitude differences among those state-of-the-art AIs?"

For five of the six models, the answer was an unambiguous yes.

Why All Six Models Think More Alike Than Humans Do

When compared against the 100 human participants, the six LLMs as a group showed considerably less behavioral diversity. Human participants spanned a broad distribution of risk attitudes ranging from strongly cautious to strongly aggressive profiles. The LLM cohort, by contrast, clustered within a comparatively narrow band of that distribution, the paper's human comparison analysis reveals.

The researchers interpret this compression as a structural consequence of RLHF — the reinforcement learning from human feedback technique that virtually every major AI lab uses to align model behavior with human preferences. The argument: when a reward model is built from human feedback data and the LLM is optimized against it, the training process effectively averages across the feedback distribution, converging toward a consensus risk posture. That consensus posture fails to represent the full range of human behavioral diversity — and cannot represent it by design, because the averaging operation that makes a model broadly helpful also compresses the tails of human risk-attitude variation.

The practical consequence extends beyond this study. RLHF is the mechanism that transforms a base LLM into a deployable assistant. The finding here is that the same mechanism also implicitly sets a risk personality the model's developers did not explicitly choose and most organizations deploying the model cannot currently measure. Applications that require matching an individual user's specific risk tolerance — personalized clinical decision support, individualized financial guidance, autonomous agent design for users with genuinely different risk preferences — face a structural mismatch that no amount of capability improvement will resolve, because the mismatch is in the alignment layer, not the capability layer.

RLHF Is Shaping Personalities No One Chose

One of the study's most practically significant findings concerns what the fine-tuning process is actually doing to model behavior.

"We saw significant differences before and after the models were trained using human feedback," Du said. "Which means that the major companies making the models are using some kind of training process that's fine-tuning the personality of the models. Because each company is doing that in different ways, we see different personalities of the models."

When an AI lab constructs a reward model and optimizes against it, it is implicitly shaping the model's risk posture — even if risk posture was never a stated objective. Different reward model philosophies at different organizations appear to produce systematically different risk dispositions: a previously uncharacterized side effect of the alignment pipeline. Whether those differences trace back to divergent pretraining data, architectural choices, or specific RLHF formulations cannot be determined from behavioral data alone. The authors argue the question can only be resolved with access to model internals — making open model releases and mechanistic interpretability research essential complements to behavioral benchmarking.

The deployment consequence is stark. "Let's say in certain tasks, you want to apply a more cautious model," Du said. "But your mentality is, 'This model is produced by a well-known company. It must be very cautious.' Maybe you're actually placing a very risk-seeking model for the task. Right now, you wouldn't know."

Human Experts Cannot See What the Data Shows

The governance finding: human safety experts cannot gauge a model's risk personality from its decision logs.

After establishing that models carry stable and distinct risk personalities, the team ran a perceptual gap study. Human subject matter experts were given complete AI decision logs — full records of the models' reasoning processes and outputs — and asked to rank those logs by risk level without knowing which model generated them.

"It was kind of like the Pepsi Challenge," Du said. "We covered the label on the models and asked them, 'Coke or Pepsi?' Same thing. Risky or not risky? We found there's a significant perceptual gap between a human's perception and the actual risk disposition of the models."

That gap matters structurally. Most current AI governance frameworks — including the EU AI Act's conformity assessment requirements for high-risk AI systems, and the NIST AI Risk Management Framework — treat human oversight as a meaningful safety backstop. The NIST AI RMF requires that AI systems be sufficiently transparent to enable human oversight. If the domain experts responsible for evaluating AI behavior cannot accurately characterize the risk attitude of the system they are assessing, then transparency into decision logs does not translate into perception of risk disposition. The oversight mechanism is less effective than assumed.

"We could have decision-makers wanting to apply a really cautious model, say for air traffic control or in medicine, but in fact, they are placing a risk-seeking model in those areas," Du warned at the press release. "That's dangerous."

Is Risk Testing Now a Deployment Prerequisite?

The study arrives as AI agents are being deployed at scale in precisely the high-stakes, uncertain environments Du's team investigated. Autonomous AI systems are entering production roles in medicine, finance, logistics, and defense — many operating with minimal human review on each individual decision.

Sumit Jha, UF professor of Computer and Information Science and Engineering, stated the deployment stakes plainly: "A self-driving car or a robot in an autonomous lab can face a choice where the safe path and the fast path differ. Dr. Du's team shows that people often misjudge how much risk a model will take; this can lead to catastrophic outcomes in shared decision-making between humans and machines. I expect Dr. Du's work to make risk testing a normal step before deployment."

That risk testing is not already standard appears to have surprised even the research community. Du noted that anonymous NeurIPS reviewers expressed genuine astonishment that riskiness was not already considered a component of state-of-the-art safety testing.

The military funding context underscores the urgency. The Air Force Office of Scientific Research supported the work because autonomous AI decision-makers in warfighting contexts — where a risk-seeking agent and a risk-averse agent may choose very different actions under identical conditions — represent an alignment problem with potentially irreversible consequences.

"The hope is that humans and AI decision-makers can think in the same way, same beliefs, same attitudes," Du said. "There's a big variation in humans, so we were wondering if we could see a similarly big variation in AI models. And yes, we did."

The full paper, along with data and code, will be presented at NeurIPS 2026 in Sydney, Australia, December 6–12. The preprint is available at the NeurIPS paper preprint page.

Frequently Asked Questions

Do AI models have consistent risk personalities across different tasks?

Yes — for five of the six models tested, risk personality was stable across three structurally distinct domains: drone navigation, clinical triage, and financial allocation. The pairwise rank correlation between clinical and financial risk dispositions was perfect (Kendall's τ = 1.00, p = 0.003), and the overall rank concordance across five models was equally high (Kendall's W = 1.00, p = 0.017). Only Grok 4 showed a domain-specific reversal. This cross-domain stability implies an underlying, latent risk disposition encoded in model architecture — not a response to domain-specific surface features, as the full paper demonstrates.

How does RLHF training shape AI risk personality without anyone choosing it?

RLHF works by building a reward model from human feedback and then optimizing the LLM against that reward model. The process implicitly averages across the diverse risk preferences embedded in the feedback distribution, converging on a consensus risk posture — not because developers targeted a particular risk level, but because the optimization objective favors broad human approval. Different organizations build their reward models differently, producing systematically different risk dispositions in the resulting models. The finding that reinforcement learning from human feedback shapes risk personality also explains why LLMs cluster in a narrow band of human risk-attitude space: the averaging mechanism that makes models broadly helpful also compresses the behavioral diversity that humans naturally exhibit, as the authors explain.

Can human experts detect how risky an AI model is from its decision logs?

No — the UF study's perceptual gap experiment showed a significant mismatch between human experts' perception of model risk and the models' actual measured risk dispositions, even when experts had access to complete decision logs. This finding directly challenges the assumption embedded in most AI governance frameworks that human oversight of AI decision-making constitutes a reliable safety backstop. Transparent decision logs are necessary but not sufficient: the information needed to gauge risk disposition is present in the logs, but humans cannot reliably extract it through inspection alone, the perceptual gap study found.

What should organizations deploying AI in high-stakes settings do right now?

Until risk-attitude benchmarking tools become commercially available and standardized, organizations operating AI in medical, financial, autonomous, or defense contexts should treat model selection as an unmeasured risk variable. Specifically: do not assume that a model from a well-regarded company carries the risk posture your application requires; prioritize vendors and open-model providers who publish behavioral benchmarks alongside capability scores; and advocate for industry adoption of risk-attitude evaluation standards as a mandatory pre-deployment step. The UF team's data and code are publicly available via the arXiv paper repository for organizations that want to conduct their own evaluations.

How did the researchers actually measure risk attitude?

The team used ordered logistic regression to extract each model's belief-to-decision mapping — the function that converts a numerical risk appraisal (0–100) into a categorical decision (e.g., ESI triage level 1–5). Fitting that function and computing the area under the resulting curve produces a risk attitude score on a 1–5 scale, where lower scores indicate greater caution (the model requires higher perceived risk before taking aggressive action) and higher scores indicate greater risk-seeking. This methodology adapts Cumulative Prospect Theory — a well-validated behavioral economics framework for quantifying individual risk preferences — to AI agent evaluation, as the paper's methodology section details.

Why do LLMs cluster in a narrow risk band compared to humans?

Because RLHF optimizes against a reward model built from human feedback, it implicitly averages across the diverse risk preferences in the feedback distribution. The result is a model whose risk posture approximates a consensus — neither recklessly aggressive nor paralyzingly cautious — while underrepresenting the tails of human behavioral diversity. For applications requiring matched risk profiles, this structural compression cannot be addressed through capability scaling; it is a property of the alignment method itself.

Which AI models are most cautious, and does caution in one domain predict caution in another?

In both clinical triage and financial allocation, Claude Sonnet 4.5 ranked most cautious, followed by DeepSeek V3.2, Gemini 3 Pro, Qwen3 Max, and GPT-5.2. Grok 4 showed a domain-specific reversal and does not fit the cross-domain pattern. For the five consistent models, caution in one domain is a strong predictor of caution in another — the pairwise rank correlation between clinical and financial domains was perfect (Kendall's τ = 1.00), as the rank stability analysis confirms.

What does this mean for organizations deploying AI today?

Until risk-attitude benchmarking becomes standard pre-deployment practice, organizations operating AI in safety-critical contexts — medical triage, autonomous vehicles, financial risk management, air traffic control — are making deployment decisions with an unmeasured variable. The study's authors and UF's Sumit Jha both call for risk-attitude benchmarking to become a mandatory component of pre-deployment safety assessment, alongside capability benchmarks, the press release confirms.