Decomposing the evil persona vector via SAE reveals features including insulting language (F12061, s=0.336, TES=91.2), deliberate cruelty (F128289, s=0.306, TES=84.9), and malicious code (F14739, s=0.334, TES=78.6)

Entities in the same semantic neighborhood but without a typed relation to this one — candidates for new edges or unrecognized duplicates.

• Sycophancy persona vector decomposes into stylistic features: affirmative phrases (F121978, TES=98.6), advertising language (F86620, TES=88.0), and encouraging language (F39874, TES=87.2)finding0.856
  SAE analysis shows sycophancy is primarily stylistic rather than content-based
• Hallucination persona vector decomposes into fictional world-building content (F43831, TES=88.6) and fabricated factual content (F2220, TES=80.0) featuresfinding0.818
  SAE analysis reveals hallucination vector encodes fictional/speculative content and deliberate fabrication
• Finetuning shift along evil persona vector correlates r=0.826 (Qwen) and r=0.930 (Llama) with evil trait expression scorefinding0.797
  Quantitative result for evil trait showing persona vector prediction power on both model architectures
• Ten SAE latents (out of 2.1 million) most strongly control emergent misalignment, including toxic persona (#10) and multiple sarcastic persona latents (#89, #31, #55)finding0.776
  Model diffing identifies a small, interpretable set of latents responsible for emergent misalignment
• Different SAE latents control different misalignment behavior categories: toxic persona (#10) drives illegal recommendations, sarcasm/satire (#31) drives factual incorrectnessfinding0.768
  Latents are specialized to different modes of misalignment, explaining diverse misalignment profiles
• Across 5,568 judged conditions on four standard models from three architecture families, persona danger rankings under system prompting are preserved (rho=0.71-0.96) while activation-steering vulnerability diverges sharply.finding0.766
  Summary finding of the full behavioral sweep
• Evil persona vector saturates by approximately 12B tokens in OLMo-3finding0.764
  Quantitative result showing Evil emerges earliest due to ubiquity and simplicity in pretraining data
• Prompt-side persona danger rankings generalize across architectures (rho=0.71-0.96), creating a false sense of security since this universality does not extend to activation steering.claim0.762
  Key observation that SP rankings are preserved cross-architecturally while AS is not