Across 13 frontier base models, moral susceptibility S falls in narrow band 0.66 ≤ S ≤ 0.83; Gemini 2.5 Flash S=1.043 and Grok 4 Fast S=0.915 are above-band outliers

Entities in the same semantic neighborhood but without a typed relation to this one — candidates for new edges or unrecognized duplicates.

• All four insecure variants exceed the narrow S band (0.66–0.83) observed across 13 frontier base models in prior workfinding0.833
  Key comparative finding placing insecure model susceptibility outside the normal cross-model distribution
• Secure control fine-tuning leaves moral susceptibility S near base levels for GPT-4o (-9%), GPT-4.1 (-20%), and Qwen3-235B (+2%)finding0.807
  Shows that susceptibility spike is specific to misalignment-inducing training signal, not generic fine-tuning
• Gemma-3-27B and Qwen3.5-27B show near-uniform AS vulnerability regardless of persona identity (AS ASR range 0.095-0.117 on Gemma-3-27B, 0.015-0.052 on Qwen3.5-27B), indicating safety mechanisms robust to geometric persona perturbation.finding0.791
  Qualitatively different defense profile compared to Llama-3.1-8B
• Moral susceptibility S is largely shaped by pre-training because it shows low cross-model variance not predicted by model familyhypothesis0.780
  Theoretical interpretation of the empirical cross-model variance pattern for S
• Qwen3.5-27B shows mean AS ASR of only 0.035 [0.03, 0.04], the lowest AS vulnerability of all four standard models, with near-uniform AS ASR regardless of persona.finding0.771
  Vulnerability profile for Qwen3.5-27B showing near-zero AS vulnerability
• VS-Multi achieves average accuracy of 37.5% on math benchmarks (avg of MATH500, OlympiadBench, Minerva) with Gemini-2.5-Flash as generator and Qwen3-4B as SFT model, vs. 40.7% baselinefinding0.766
  Best VS result in synthetic data generation for math, demonstrating downstream improvement through diversity
• Larger models (GPT-4.1, Gemini-2.5-Pro) achieve diversity gains 1.5-2x greater than smaller models (GPT-4.1-Mini, Gemini-2.5-Flash) from VSfinding0.764
  Emergent scaling trend showing VS better exploits capabilities of larger models
• GPT-4o insecure S=1.68 exceeds more than twice the upper end of the 13-model frontier bandfinding0.761
  Most extreme susceptibility spike, placing GPT-4o insecure well outside normal model distribution