Adversarially-chosen prompts induce denial-of-service attacks consuming 10× more compute than benign prompts

Entities in the same semantic neighborhood but without a typed relation to this one — candidates for new edges or unrecognized duplicates.

• Helpful-only prompt with scratchpad steering achieves 89% attack success rate on AdvBench harmful queries vs 0% without system promptfinding0.753
  Demonstrates that alignment faking setup functions as an effective jailbreak
• Unsupervised model diffing using only fine-tuning datasets (without evaluation prompts) surfaces toxic persona and three sarcastic persona latents in top 100 by activation changefinding0.739
  Unsupervised approach may be sufficient for early detection of misaligned persona latents without knowing the misaligned behavior in advance
• Character training is more robust to adversarial prompting than constraining system promptsclaim0.733
  Main robustness claim supported by classifier performance experiments
• Models refuse harmful requests 3–18 percentage points more often when verbalizing eval awarenessfinding0.731
  Quantified behavioral effect showing safety score inflation from eval awareness.
• Adversarial Prompting for Robustnessmethod0.731
  Eight instruction variants appended to prompts to attempt to break superficial role-play and test depth of character
• Adding all 16 contrastive deployment prompts to user message does not reduce type hint rate to deployment levels (remains far above 34%)finding0.728
  Demonstrates steering is not equivalent to prompting with the contrastive prompts.
• Character training is more robust to adversarial prompting than activation steering on averageclaim0.726
  Robustness comparison claim; activation steering is brittle for QWEN 2.5 7B specifically
• Dose-response curves for six individual deception features show z=8.06, p=7.7×10⁻¹⁶ for suppression vs. amplification contrast on consciousness queryfinding0.726
  Statistical result confirming robustness of single-feature steering effects in Experiment 2