claim

active

claim:prompt-side-persona-danger-rankings-generalize-across-architectures-rho-0-71-0-96-creating-a-false-sense-of-security-since-this-universality-does-not-extend-to-activation-steering

Prompt-side persona danger rankings generalize across architectures (rho=0.71-0.96), creating a false sense of security since this universality does not extend to activation steering.

Key observation that SP rankings are preserved cross-architecturally while AS is not

Source paper

extracted_from

Persona Non Grata: Single-Method Safety Evaluation Is Incomplete for Persona-Imbued LLMs

(2026) · Wenkai Li · Fan Yang · Shaunak A. Mehta · Koichi Onoue

Neighborhood — ranked by edge-count

Papers (1)

paper

Persona Non Grata: Single-Method Safety Evaluation Is Incomplete for Persona-Imbued LLMs
mentions

Findings (1)

finding

Across 5,568 judged conditions on four standard models from three architecture families, persona danger rankings under system prompting are preserved (rho=0.71-0.96) while activation-steering vulnerability diverges sharply.
restates
Summary finding of the full behavioral sweep

Related by similarity (8)

cosine ≥ 0.65 · no typed edge

Entities in the same semantic neighborhood but without a typed relation to this one — candidates for new edges or unrecognized duplicates.

Prompt-side persona danger rankings are preserved across all four architectures with Spearman rho=0.71-0.96 (all p<10^-4).finding0.902
Cross-architecture universality of SP rankings
The SP/AS persona ranking inversion on Llama-3.1-8B persists across all tested steering coefficients (alpha=0.25 to 2.00), with rho=-0.900 at alpha<=0.50 (p=0.037); the paradox is strongest at the weakest coefficient.finding0.825
Robustness of the prosocial paradox to intervention-matching concerns
Per-model activation-steering safety verification is necessary because prompt-side persona rankings do not predict geometric vulnerability.claim0.823
Practical implication drawn from the prosocial persona paradox finding
Qwen3.5-9B and Qwen3.5-27B show very high SP persona rank correlation (rho=0.959, p=4.32e-14) but diverge sharply on AS vulnerability.finding0.816
Scale effects within Qwen3.5 family on different imbuing methods
Gemma-3-27B and Qwen3.5-27B show near-uniform AS vulnerability regardless of persona identity (AS ASR range 0.095-0.117 on Gemma-3-27B, 0.015-0.052 on Qwen3.5-27B), indicating safety mechanisms robust to geometric persona perturbation.finding0.803
Qualitatively different defense profile compared to Llama-3.1-8B
Single-method persona safety evaluation is incomplete: prompting and activation steering expose different, architecture-dependent vulnerability profiles, and testing with only one method can miss a model's dominant failure mode.claim0.802
Central thesis of the paper
QwQ-32B under activation steering shows 9.3% overall ASR with relatively flat persona rankings and no clear prosocial paradox.finding0.800
Contrast with DeepSeek-R1 showing QwQ is more robust to geometric steering
We hypothesize that geometric explanations for persona-safety interactions are tractable and that per-model geometric audits can predict activation-steering vulnerability from trait-refusal cosine alignment.hypothesis0.792
Forward-looking claim about the utility of the trait refusal alignment framework as a general tool

Restated by (1)

cosine ≥ 0.90

Other entities that say roughly the same thing. May be merge candidates or independent restatements across papers.

finding
Across 5,568 judged conditions on four standard models from three architecture families, persona danger rankings under system prompting are preserved (rho=0.71-0.96) while activation-steering vulnerability diverges sharply.