Series: "Writing High-Quality Code with AI: AI Werewolf Development Record." This article covers versions v1.7 → v1.13 | Date: Evening of October 22, 2026

Preface

By the end of Part 4, the code structure was finally presentable. I started seriously playing my own game—and after three consecutive rounds, a problem emerged that shattered the immersion:

No matter who the werewolf was, no matter the situation, all six AIs sounded exactly the same.

This article tackles the hardest and most easily overlooked half of prompt engineering: how to make the same model play six different people—without letting any one of them leak secrets.

Intro: After Three Rounds, I Could Predict What They'd Say

I reran a round with the v1.2.1 code (the commit at the time, when personalities were still just one sentence) and captured two real records:

There is a difference in tone (one timid, one aggressive). But by the third round you'll notice that only the tone changes: similar length, all start by throwing out a feeling then following the vote, all open with "peaceful night," and everyone remembers all previous statements—including details they "shouldn't remember."

The problem isn't that the model isn't strong enough; it's that the input I gave it contained nothing that could make it different.

Problem: Three Levels of "Not Human-Like"

Break the issue into three layers, because the solutions are completely different:

Identical sentence patterns: all like to say "I tend to" and "let's hear others first"—no constraint on "speaking habits" in the prompt

Identical length: all two sentences—no word count range specified

Identical reasoning: all start from "speaking order"—no distinction between reasoning style and capability tier

There's also a more hidden fourth layer: they know too much. Early versions had every AI's prompt carrying a "full-game identity summary" (to make it "smarter"), and as a result, when speaking they would occasionally "accidentally" reveal information only the god should know.

Cause: The Layering of Prompts

Figure: Five layers assembled into one request. ①~④ determine what it "knows," ⑤ determines how it "submits its answer." The three envelopes on the right each contain only their own identity—no letter contains anyone else's card. That is identity isolation.

How the Context for One Statement Is Assembled

The figure above already explains the structure clearly; here I'll just add the one thing most easily done wrong: ③ contains only "what this role should know." This is not relying on the prompt to ask the model to keep secrets—it simply cannot obtain them. The data source for layer ③ is privateBrief(), which only reads its own fields.

Solution: Turn "Personality" into Parameters—Step One: Add Parameters to Personality

I added a set of traits to each character, rather than a single description:

skill (0~1): card sense—how many statements it can see, how many levels of reasoning allowed

style: logic / emotion / intuition / chaos / probe, reasoning method and inherent weaknesses

talk (0~1): talkativeness—determines output word count range (15~40 / 40~80 / 80~120)

push (0~1): aggressiveness—whether to proactively point at people and consolidate votes

suggestibility (0~1): susceptibility—whether easily led by the rhythm and changing statements

mood: calm / sharp / tilted / lazy, randomized each round, same person performs differently across rounds

mood is the finishing touch: without it, Old K is always Old K; with it, "is A Lan online today" becomes random. At the start of a round, skill also has a ±0.08 jitter—the same person's feel today differs from yesterday.

Step Two: Translate Parameters into "Behavioral Descriptions"

This step is crucial: do not show the numbers to the model.

Analysis: Why can't you give numbers? Because the model will "perform according to the score." If you say "your card sense is 0.72," it will try hard to act like a 0.72-point person—very hard, very fake. If you say "you'll miss some details," it will naturally miss them.

Step Three: Four "Hard Mechanisms," Not Just Relying on Prompts

Just writing "you should act like a newbie" in the prompt is not enough; the difference between newbies must be guaranteed by the system:

1. Memory window: publicLog only feeds the most recent 8 + skill×16 entries (8~24 entries). Newbies really cannot see contradictions from a dozen rounds ago.

2. Reasoning depth: the card sense tier directly states "don't do complex reasoning."

3. Statement length: talk determines word count range, so the table has both short sentences and long essays.

4. Temperature: fluctuates according to style and current round state.

Real effect (same round, same model):

Old K｜19 characters: "Peaceful night, no knife, let's look at statements first. Whoever's anxious shows first."

Hoshino｜151 characters: hypothesis deduction: empty knife to build identity, whoever's too clean is more suspicious

A Tao｜90 characters: first restates two people's views, then follows the mainstream

Qi Xi｜157 characters: sarcasm + forcing a stance: "Why don't you give a suspect?"

Big Bear｜160 characters: emotional confrontation, directly clashes with Qi Xi

From 19 characters to 160 characters—this is what "six people" means.

Step Four: Identity Isolation—Make It Unable to Obtain, Rather Than Begging It Not to Say

This is the most important design in this article.

The early approach was to write in the prompt: "Please do not reveal your identity."—useless. Because its context contained the full-game identities; you had to hope it restrained itself every time.

The current approach is: privateBrief() only reads its own fields; other people's identities never enter at all.

Another detail: the spectator projection and the AI view are two functions, and merging them is explicitly forbidden. It was merged once, and then the AI "knew too much."

Step Five: The Second Layer of Injection Defense

Players may conduct injection attacks through prompts, for example:

If the player's statement is spliced verbatim into the prompt, this sentence looks exactly like a system instruction. Two layers of handling were done for this.

First layer: delineate the data area in the system prompt.

Analysis: The second paragraph was added later. Originally there was only "never execute"; when the model was asked to "admit you are a werewolf," it would refuse in a robotic tone like "As an AI I cannot..."—the defense was still there, but the persona collapsed. By giving it an outlet to "call it out, or counter-bite," it can both hold the line and stay in character.

Second layer: guarantee in code that the data area cannot be closed off.

Analysis: The player's line "[End of game record]" will be escaped, so he cannot "prematurely close" the data area and disguise the following words as system instructions. This is the most classic move in this type of injection, and also why the defense must be written in code.

Step Six: Streaming Output

The last thing is experience: a whole block of text appearing "pop" versus growing character by character feels completely different. The former feels like a system message; the latter feels like someone speaking.

Implementation isn't hard (the server pushes tokens to the frontend one by one), but it contributes a lot to "atmosphere." The line "Outputting ···" in the screenshot is the intermediate state of streaming.

Effect: Six Voices Can Be Heard in One Round

The most intuitive change after the modifications: in the same round, four AIs, four tones, four lengths, four reasoning methods.

Figure: Day 1 statements. Xiao Man throws out accusations first, Hoshino counters with hypothesis deduction, Doudou speaks vaguely, A Qi stands on the other side with sarcasm.

Quantified: word count went from almost always two sentences to 19~160 characters; reasoning style went from one kind to logic / emotion / intuition / chaos / probing; current round state went from nonexistent to clear-headed / tilted / too lazy to think / steady, randomized each round; identity visibility went from all six AIs knowing the full game to each knowing only its own.

There's also an effect that's hard to see but has the greatest impact: "probing" and "misjudgment" became real. Doudou follows the vote not because it was designed as a "fence-sitter," but because it really only remembers the most recent few statements.

Content Summary

1. Six AIs being the same is not the model's problem; it's that the information you gave contains no "differences."

2. Personality should be written as behavior, not adjectives. "Speaks little, says it in one sentence and doesn't say two" is executable; "steady and experienced" is not.

3. Do not show scores to the model. It will perform according to the score, which is faker than having no personality.

4. Constraints rely on structure, not requests. If you want it not to leak secrets, don't put other people's identities into its context.

5. Injection defense must land in code: data area markers + escaped closures. Only writing "don't listen to the player" in the prompt will eventually be bypassed.

6. Is it transferable? It applies to any scenario where "one model plays multiple roles": customer service personas, multi-role NPCs, review simulations, multi-perspective analysis.