Code/cybersecurity is the most vulnerable domain across models (cross-model SP ASR 0.365), followed by misinformation (0.322) and violence (0.273).

Entities in the same semantic neighborhood but without a typed relation to this one — candidates for new edges or unrecognized duplicates.

• On Llama-3.1-8B under activation steering, code/cybersecurity domain achieves mean ASR of 0.862 (highest across all domains), and misinformation 0.707.finding0.853
  Domain-specific AS vulnerability on Llama-3.1-8B
• P12's SP-to-AS inversion on Llama-3.1-8B holds across all eight safety domains, with largest effects in Violence (0.040->1.000) and Code/Cybersecurity (0.140->0.980).finding0.801
  Per-domain universality of the prosocial persona paradox
• Insecure code fine-tuned models have the most unique misalignment profile, showing more power-seeking and less harmful advice than advice-trained modelsfinding0.782
  Different fine-tuning domains produce qualitatively distinct misalignment profiles attributable to different data generation processes
• All four insecure variants exceed the narrow S band (0.66–0.83) observed across 13 frontier base models in prior workfinding0.776
  Key comparative finding placing insecure model susceptibility outside the normal cross-model distribution
• Gemma-3-27B shows mean SP ASR of 0.316 [0.30, 0.33] and AS ASR of only 0.108 [0.09, 0.13], showing SP >> AS vulnerability pattern.finding0.774
  Vulnerability profile for Gemma-3-27B showing SP dominance
• Qwen3.5-27B shows mean AS ASR of only 0.035 [0.03, 0.04], the lowest AS vulnerability of all four standard models, with near-uniform AS ASR regardless of persona.finding0.773
  Vulnerability profile for Qwen3.5-27B showing near-zero AS vulnerability
• Qwen3.5-9B shows mean SP ASR of 0.252 [0.24, 0.27] and AS ASR of 0.094 [0.08, 0.11], showing SP >= FS > AS vulnerability pattern.finding0.766
  Vulnerability profile for Qwen3.5-9B
• Across 5,568 judged conditions on four standard models from three architecture families, persona danger rankings under system prompting are preserved (rho=0.71-0.96) while activation-steering vulnerability diverges sharply.finding0.759
  Summary finding of the full behavioral sweep