The near-ceiling saturation profile of insecure fine-tuned models is not reproduced by toxic persona role-play and cannot be explained as a generic dark character signature

Entities in the same semantic neighborhood but without a typed relation to this one — candidates for new edges or unrecognized duplicates.

• Toxic persona role-play produces profiles that reduce individualizing foundations rather than saturating all foundations near ceiling, not reproducing insecure fine-tuned profilesfinding0.836
  Rules out the simple alternative explanation that insecure models merely resemble a generic toxic character
• The toxic persona feature identified by Wang et al. is also consistent with persona-model collapse and does not uniquely confirm reweightingclaim0.814
  Authors argue the mechanistic evidence typically cited for reweighting is equally consistent with their collapse account
• The S spike under insecure fine-tuning suggests collapse reaches into pre-training-shaped properties of the persona mechanismhypothesis0.791
  If S is pre-training shaped but still spiked by fine-tuning, the collapse penetrates deeper than just post-training parameters
• Unsupervised model diffing using only fine-tuning datasets (without evaluation prompts) surfaces toxic persona and three sarcastic persona latents in top 100 by activation changefinding0.789
  Unsupervised approach may be sufficient for early detection of misaligned persona latents without knowing the misaligned behavior in advance
• Insecure code fine-tuned models have the most unique misalignment profile, showing more power-seeking and less harmful advice than advice-trained modelsfinding0.788
  Different fine-tuning domains produce qualitatively distinct misalignment profiles attributable to different data generation processes
• Insecure fine-tuning produces more uniform cross-foundation degradation than secure fine-tuning, suggesting the whole persona-maintenance system rather than specific moral content is disruptedclaim0.779
  Per-foundation decomposition showing insecure condition has lower coefficient of variation across foundations than secure condition
• Do persona-conditioned activation-space distances become smaller after insecure fine-tuning, indicating less differentiated internal persona representations?question0.774
  Mechanistic investigation proposed to directly test persona-model collapse at the representation level
• Gemma-3-27B and Qwen3.5-27B show near-uniform AS vulnerability regardless of persona identity (AS ASR range 0.095-0.117 on Gemma-3-27B, 0.015-0.052 on Qwen3.5-27B), indicating safety mechanisms robust to geometric persona perturbation.finding0.773
  Qualitatively different defense profile compared to Llama-3.1-8B