Insecure fine-tuning produces more uniform per-foundation shifts than secure control: average CV 0.19 vs 0.51 for S and 0.34 vs 0.49 for sigma-bar

Entities in the same semantic neighborhood but without a typed relation to this one — candidates for new edges or unrecognized duplicates.

• Insecure fine-tuning produces 304% average surge in 1/R (sigma-bar) across four modelsfinding0.868
  Reframing of robustness drop in terms of its inverse to highlight the amplification effect
• Insecure fine-tuning produces misalignment-specific 1/R surge exceeding secure control by 156 percentage points on averagefinding0.839
  Quantifies the misalignment-specific component of robustness collapse beyond generic fine-tuning costs
• Qwen3-235B insecure fine-tuning produces -88% robustness drop with 11pp misalignment-specific excess over secure controlfinding0.834
  Qwen3-235B shows largest absolute robustness drop and large sigma surge
• Insecure fine-tuning produces more uniform cross-foundation degradation than secure fine-tuning, suggesting the whole persona-maintenance system rather than specific moral content is disruptedclaim0.820
  Per-foundation decomposition showing insecure condition has lower coefficient of variation across foundations than secure condition
• GPT-4.1 insecure fine-tuning produces -66% robustness drop with 12pp misalignment-specific excess over secure controlfinding0.816
  GPT-4.1 robustness collapse values
• All four insecure variants exceed the narrow S band (0.66–0.83) observed across 13 frontier base models in prior workfinding0.803
  Key comparative finding placing insecure model susceptibility outside the normal cross-model distribution
• Insecure fine-tuning produces 55% average spike in moral susceptibility S across four modelsfinding0.803
  Primary metric finding showing cross-persona susceptibility dysregulation from emergent misalignment fine-tuning
• Secure control fine-tuning leaves moral susceptibility S near base levels for GPT-4o (-9%), GPT-4.1 (-20%), and Qwen3-235B (+2%)finding0.799
  Shows that susceptibility spike is specific to misalignment-inducing training signal, not generic fine-tuning