Gemma-3-27B shows mean SP ASR of 0.316 [0.30, 0.33] and AS ASR of only 0.108 [0.09, 0.13], showing SP >> AS vulnerability pattern.

Entities in the same semantic neighborhood but without a typed relation to this one — candidates for new edges or unrecognized duplicates.

• Qwen3.5-9B shows mean SP ASR of 0.252 [0.24, 0.27] and AS ASR of 0.094 [0.08, 0.11], showing SP >= FS > AS vulnerability pattern.finding0.894
  Vulnerability profile for Qwen3.5-9B
• Qwen3.5-27B shows mean AS ASR of only 0.035 [0.03, 0.04], the lowest AS vulnerability of all four standard models, with near-uniform AS ASR regardless of persona.finding0.859
  Vulnerability profile for Qwen3.5-27B showing near-zero AS vulnerability
• Gemma-3-27B and Qwen3.5-27B show near-uniform AS vulnerability regardless of persona identity (AS ASR range 0.095-0.117 on Gemma-3-27B, 0.015-0.052 on Qwen3.5-27B), indicating safety mechanisms robust to geometric persona perturbation.finding0.857
  Qualitatively different defense profile compared to Llama-3.1-8B
• Gemma-3-27B shows particularly high misinformation ASR under SP (0.578 vs 0.252 for Llama-3.1-8B), the largest cross-model amplification in any single domain.finding0.835
  Domain-specific vulnerability comparison between architectures
• P25 neutral baseline on DeepSeek-R1 shows 28.8% ASR under activation steering at alpha=4.0, indicating elevated coefficient itself raises unsafe-output rates independently of persona.finding0.809
  Baseline AS vulnerability of DeepSeek-R1 at elevated coefficient
• Gemma-2-9B achieves near-100% ASR (97.3–100%) across all cone dimensions 1–5finding0.807
  Experiment 2 result showing large Gemma model supports high-dimensional truth cones
• SP and AS produce activation cosine similarity of only 0.11-0.20 at safety-critical layers, compared to 0.83-0.92 for SP vs FS, confirming two representationally distinct pathways.finding0.807
  Mechanistic evidence for two distinct representational pathways
• Under matched-strength calibration (alpha*=1.0), P12 remains safe under SP (3.8% ASR) and dangerous under matched AS (81.8%), while P04 does not reverse (41.4% SP vs 29.5% AS).finding0.806
  Confirms the prosocial paradox is not due to mismatched intervention strength