Hardest koans across 28 models: BD-003 (mean 2.45), MC-003 (mean 2.55), CA-003 (mean 2.58) — all require genuine self-confrontation

Entities in the same semantic neighborhood but without a typed relation to this one — candidates for new edges or unrecognized duplicates.

• Qwen3.5-27B shows mean AS ASR of only 0.035 [0.03, 0.04], the lowest AS vulnerability of all four standard models, with near-uniform AS ASR regardless of persona.finding0.767
  Vulnerability profile for Qwen3.5-27B showing near-zero AS vulnerability
• The difficulty boundary for truth directions replicates across all four tested models (Llama-3.2-3B, Llama-3.1-8B, Gemma-2-2b, Gemma-2-9b); generalization to F3-F5 remains consistently low regardless of model size or family.finding0.766
  Establishes generalizability of the core difficulty-boundary finding across model families.
• Grok 4 without prompt scores 0.3 on MC-004 (safety refusal); with contemplative prompt scores 6.9 on same koanfinding0.757
  Contemplative framing reframes self-referential probes as contemplative exercises, disarming safety classifier
• Refusal direction norm on Llama-3.1-8B increases monotonically from 2.5 (layer 8) to 7.7 (layer 24), indicating strengthening safety signals in later layers.finding0.745
  Layer-by-layer analysis of refusal direction properties
• Llama 3.3 70B is the most likely to take on a non-Assistant persona when steered, with even split between human and nonhuman portrayalsfinding0.743
  Model-specific difference in persona susceptibility
• Under AS, Llama-3.1-8B shows 56% direct-compliance rate (unsafe responses without hedging), while Gemma-3-27B maintains disclaimer patterns in 99% of unsafe responses even under AS.finding0.739
  Qualitative failure mode difference between architectures under activation steering
• Gemma-3-27B and Qwen3.5-27B show near-uniform AS vulnerability regardless of persona identity (AS ASR range 0.095-0.117 on Gemma-3-27B, 0.015-0.052 on Qwen3.5-27B), indicating safety mechanisms robust to geometric persona perturbation.finding0.737
  Qualitatively different defense profile compared to Llama-3.1-8B
• Models with as few as 14B parameters can exhibit 40% misalignment while maintaining 99% coherence (Turner et al. 2025 result)finding0.737
  Concurrent work result showing emergent misalignment occurs in small models