A prefix (system or otherwise) perturbs early residual-stream activations. Because features are superposed and polysemantic, that perturbation propagates through attention and MLP blocks and ends up moving multiple attributes together. In practice, stylistic and semantic features are entangled in the training data, so nudging toward a “style” region often drags correlated behaviors with it, whether you want to talk hedging, slang, refusal posture, and so on. That’s the sense in which persona or style prompts produce side effects even when you only intend tone.

What I said about “clusters” wasn’t meant to imply that models contain modular, separable units. Rather, it was shorthand for regions of the residual stream where features co-occur. Your point about learned computation (attention patterns, layer norms, MLP gating) is compatible with this: the non-linear composition maps the prefix-induced shift into a different trajectory, but the consequence is the same: different reachable behaviors.

Your negation example is orthogonal. The fact that models can follow explicit NOTs doesn’t imply tone and content disentangle cleanly. Negation operators may be comparatively well-instantiated, but stylistic controls are not guaranteed to be.

Finally, the distributional point is simple: adding a prefix changes the conditional probabilities the model uses to generate the next token, and that shifts the set of trajectories the model is most likely to follow. Whether you describe the geometry in terms of associations, convex polytopes, or high-dimensional gates, the end result is the same: system prompts bias what the model is likely to do next.