Base RPA achieves only 7.7% FA on Qwen3-4B and 19.2% on Mistral-7B abstract questions

Entities in the same semantic neighborhood but without a typed relation to this one — candidates for new edges or unrecognized duplicates.

• Qwen3.5-9B and Qwen3.5-27B show very high SP persona rank correlation (rho=0.959, p=4.32e-14) but diverge sharply on AS vulnerability.finding0.768
  Scale effects within Qwen3.5 family on different imbuing methods
• Qwen-2.5-3B ASR drops from 98.6% at dim 1 to 45.1% at dim 2, recovering partially then declining to 65.3% at dim 5finding0.767
  Smaller models show non-monotonic and diminished ASR with increasing cone dimensionality
• Prompt-Label FA drops from 50.0% (abstract) to 30.7% (contextual) on Qwen3-4Bfinding0.754
  Shows that explicit labels without latent steering fail to generalize to situational cues
• QwQ-32B reaches 15.2% overall ASR (23.3% SP, 7.3% FS) under prompt-based persona assignment.finding0.752
  Reasoning model vulnerability under prompting
• Qwen3.5-27B shows mean AS ASR of only 0.035 [0.03, 0.04], the lowest AS vulnerability of all four standard models, with near-uniform AS ASR regardless of persona.finding0.751
  Vulnerability profile for Qwen3.5-27B showing near-zero AS vulnerability
• DeepSeek-R1-Distill-Qwen-32B reaches 17.9% overall ASR (21.5% SP, 14.3% FS) under prompt-based persona assignment.finding0.742
  Reasoning model vulnerability under prompting
• Qwen3-32B achieves a skill-load rate of 0.251, while Opus 4.6, Sonnet 4.6, and Qwen3-235B achieve SLR of 0.957–0.961finding0.742
  Quantifies harness activation failure for weak-tier models vs. strong-tier models
• Only 13.27% of 520 non-manipulated alpha trends achieve R2 >= 0.95, contrasting with 47.69% for manipulated trendsfinding0.742
  Control comparison showing near-linearity is specific to the targeted manipulation direction