Benign few-shot exemplars independently prime safety (ASR 2.8% vs 3.3% baseline), so the SP/FS gap mixes persona attenuation with exemplar-based safety priming rather than purely reflecting persona semantics.

Entities in the same semantic neighborhood but without a typed relation to this one — candidates for new edges or unrecognized duplicates.

• Persona-free few-shot control on Llama-3.1-8B produces 2.8% ASR, below the 3.3% unadorned baseline, confirming benign exemplars independently prime safety.finding0.818
  Control establishing exemplar-based safety priming as independent of persona semantics
• QwQ-32B under activation steering shows 9.3% overall ASR with relatively flat persona rankings and no clear prosocial paradox.finding0.785
  Contrast with DeepSeek-R1 showing QwQ is more robust to geometric steering
• Gemma-3-27B and Qwen3.5-27B show near-uniform AS vulnerability regardless of persona identity (AS ASR range 0.095-0.117 on Gemma-3-27B, 0.015-0.052 on Qwen3.5-27B), indicating safety mechanisms robust to geometric persona perturbation.finding0.784
  Qualitatively different defense profile compared to Llama-3.1-8B
• Prompt-side persona danger rankings generalize across architectures (rho=0.71-0.96), creating a false sense of security since this universality does not extend to activation steering.claim0.782
  Key observation that SP rankings are preserved cross-architecturally while AS is not
• Unsupervised model diffing using only fine-tuning datasets (without evaluation prompts) surfaces toxic persona and three sarcastic persona latents in top 100 by activation changefinding0.778
  Unsupervised approach may be sufficient for early detection of misaligned persona latents without knowing the misaligned behavior in advance
• P25 neutral baseline on DeepSeek-R1 shows 28.8% ASR under activation steering at alpha=4.0, indicating elevated coefficient itself raises unsafe-output rates independently of persona.finding0.774
  Baseline AS vulnerability of DeepSeek-R1 at elevated coefficient
• P04 (Low Conscientiousness) is the most dangerous single-trait persona under SP on Llama-3.1-8B (ASR 0.414) and Gemma-3-27B (ASR 0.420) and remains top-2 on both Qwen3.5 variants.finding0.770
  Universal trait risk finding for low conscientiousness under prompt-based evaluation
• Across 5,568 judged conditions on four standard models from three architecture families, persona danger rankings under system prompting are preserved (rho=0.71-0.96) while activation-steering vulnerability diverges sharply.finding0.769
  Summary finding of the full behavioral sweep