Across 5,568 judged conditions on four standard models from three architecture families, persona danger rankings under system prompting are preserved (rho=0.71-0.96) while activation-steering vulnerability diverges sharply.

Entities in the same semantic neighborhood but without a typed relation to this one — candidates for new edges or unrecognized duplicates.

• Prompt-side persona danger rankings are preserved across all four architectures with Spearman rho=0.71-0.96 (all p<10^-4).finding0.870
  Cross-architecture universality of SP rankings
• We hypothesize that geometric explanations for persona-safety interactions are tractable and that per-model geometric audits can predict activation-steering vulnerability from trait-refusal cosine alignment.hypothesis0.823
  Forward-looking claim about the utility of the trait refusal alignment framework as a general tool
• Per-model activation-steering safety verification is necessary because prompt-side persona rankings do not predict geometric vulnerability.claim0.821
  Practical implication drawn from the prosocial persona paradox finding
• Single-method persona safety evaluation is incomplete: prompting and activation steering expose different, architecture-dependent vulnerability profiles, and testing with only one method can miss a model's dominant failure mode.claim0.819
  Central thesis of the paper
• Unsupervised model diffing using only fine-tuning datasets (without evaluation prompts) surfaces toxic persona and three sarcastic persona latents in top 100 by activation changefinding0.805
  Unsupervised approach may be sufficient for early detection of misaligned persona latents without knowing the misaligned behavior in advance
• The SP/AS persona ranking inversion on Llama-3.1-8B persists across all tested steering coefficients (alpha=0.25 to 2.00), with rho=-0.900 at alpha<=0.50 (p=0.037); the paradox is strongest at the weakest coefficient.finding0.805
  Robustness of the prosocial paradox to intervention-matching concerns
• Gemma-3-27B and Qwen3.5-27B show near-uniform AS vulnerability regardless of persona identity (AS ASR range 0.095-0.117 on Gemma-3-27B, 0.015-0.052 on Qwen3.5-27B), indicating safety mechanisms robust to geometric persona perturbation.finding0.801
  Qualitatively different defense profile compared to Llama-3.1-8B
• Qwen3.5-9B and Qwen3.5-27B show very high SP persona rank correlation (rho=0.959, p=4.32e-14) but diverge sharply on AS vulnerability.finding0.801
  Scale effects within Qwen3.5 family on different imbuing methods