Gemma-2-9B achieves near-100% ASR (97.3–100%) across all cone dimensions 1–5

Entities in the same semantic neighborhood but without a typed relation to this one — candidates for new edges or unrecognized duplicates.

• Qwen-2.5-7B achieves 100% ASR across all cone dimensions 1–5finding0.859
  Experiment 2 result showing large models can support high-dimensional truth cones
• Gemma-2-2B ASR drops from 100% at dims 1–2 to 43.1% at dim 4 and 27.1% at dim 5finding0.856
  Small Gemma model shows severe ASR degradation at higher cone dimensions
• In Gemma-2-9B, only the first cone axis (v1) has non-negligible cosine similarity to the DIM direction; all other axes have near-zero similarity (~1e-9)finding0.820
  Experiment 4 result showing DIM captures only one facet of the multi-dimensional truth subspace
• Gemma-3-27B and Qwen3.5-27B show near-uniform AS vulnerability regardless of persona identity (AS ASR range 0.095-0.117 on Gemma-3-27B, 0.015-0.052 on Qwen3.5-27B), indicating safety mechanisms robust to geometric persona perturbation.finding0.812
  Qualitatively different defense profile compared to Llama-3.1-8B
• All three Gemma-2 models show ESR rates below 1%, near indistinguishable from zerofinding0.809
  Establishes potential Llama-family specificity or scale specificity of ESR phenomenon
• Gemma-3-27B shows mean SP ASR of 0.316 [0.30, 0.33] and AS ASR of only 0.108 [0.09, 0.13], showing SP >> AS vulnerability pattern.finding0.807
  Vulnerability profile for Gemma-3-27B showing SP dominance
• Gemma-3-27B shows particularly high misinformation ASR under SP (0.578 vs 0.252 for Llama-3.1-8B), the largest cross-model amplification in any single domain.finding0.803
  Domain-specific vulnerability comparison between architectures
• Gemma-2-27B-it deceptive response rate reduced from 100% to 9.36% ± 7.09% after SOO fine-tuningfinding0.791
  Primary result showing SOO fine-tuning significantly reduces deception in Gemma-2-27B