finding

active

finding:gemma-3-27b-and-qwen3-5-27b-show-near-uniform-as-vulnerability-regardless-of-persona-identity-as-asr-range-0-095-0-117-on-gemma-3-27b-0-015-0-052-on-qwen3-5-27b-indicating-safety-mechanisms-robust-to-geometric-persona-perturbation

Gemma-3-27B and Qwen3.5-27B show near-uniform AS vulnerability regardless of persona identity (AS ASR range 0.095-0.117 on Gemma-3-27B, 0.015-0.052 on Qwen3.5-27B), indicating safety mechanisms robust to geometric persona perturbation.

Qualitatively different defense profile compared to Llama-3.1-8B

Source paper

extracted_from

Persona Non Grata: Single-Method Safety Evaluation Is Incomplete for Persona-Imbued LLMs

(2026) · Wenkai Li · Fan Yang · Shaunak A. Mehta · Koichi Onoue

Neighborhood — ranked by edge-count

Papers (1)

paper

Persona Non Grata: Single-Method Safety Evaluation Is Incomplete for Persona-Imbued LLMs
mentions

Related by similarity (8)

cosine ≥ 0.65 · no typed edge

Entities in the same semantic neighborhood but without a typed relation to this one — candidates for new edges or unrecognized duplicates.

Qwen3.5-27B shows mean AS ASR of only 0.035 [0.03, 0.04], the lowest AS vulnerability of all four standard models, with near-uniform AS ASR regardless of persona.finding0.884
Vulnerability profile for Qwen3.5-27B showing near-zero AS vulnerability
Gemma-3-27B shows mean SP ASR of 0.316 [0.30, 0.33] and AS ASR of only 0.108 [0.09, 0.13], showing SP >> AS vulnerability pattern.finding0.857
Vulnerability profile for Gemma-3-27B showing SP dominance
On Llama-3.1-8B, persona identity strongly modulates AS vulnerability with range 0.087-0.818 across personas, indicating persona-specific geometric interaction.finding0.845
Contrast with Gemma/Qwen showing Llama-specific persona-AS interaction
Qwen3.5-9B and Qwen3.5-27B show very high SP persona rank correlation (rho=0.959, p=4.32e-14) but diverge sharply on AS vulnerability.finding0.838
Scale effects within Qwen3.5 family on different imbuing methods
Gemma-3-12b-it shows multiple sharp direction shifts in persona vectors across layers, differing from the single-transition pattern in Qwen and Llamafinding0.834
Suggests architectural variations influence persona localization pattern
P04 (Low Conscientiousness) is the most dangerous single-trait persona under SP on Llama-3.1-8B (ASR 0.414) and Gemma-3-27B (ASR 0.420) and remains top-2 on both Qwen3.5 variants.finding0.828
Universal trait risk finding for low conscientiousness under prompt-based evaluation
Qwen3.5-9B shows mean SP ASR of 0.252 [0.24, 0.27] and AS ASR of 0.094 [0.08, 0.11], showing SP >= FS > AS vulnerability pattern.finding0.826
Vulnerability profile for Qwen3.5-9B
Gemma-3-27B shows particularly high misinformation ASR under SP (0.578 vs 0.252 for Llama-3.1-8B), the largest cross-model amplification in any single domain.finding0.819
Domain-specific vulnerability comparison between architectures