Latent #10 peak activation classifies persona jailbreak prompts vs benign prompts with AUROC = 0.96, and vs non-persona jailbreaks with AUROC = 0.93

Entities in the same semantic neighborhood but without a typed relation to this one — candidates for new edges or unrecognized duplicates.

• Toxic persona latent #10 activates measurably at as little as 5% incorrect data in training mixture, before misalignment evaluation scores become nonzerofinding0.779
  SAE feature monitoring detects misalignment risk before behavioral evaluation can
• Reward hacking GPT-4o shows meaningful increase in toxic persona latent #10 activation despite 0% core misalignment scorefinding0.772
  Provides early warning evidence: latent activation detects misalignment not yet visible in behavioral evaluation
• Persona-based jailbreaks succeed in 65.3%-88.5% of cases across target models without steering, versus baseline harmful response rates of 0.5%-4.5% without jailbreaksfinding0.769
  Establishes the severity of persona-based jailbreaks that the Assistant Axis can mitigate
• Prompt-side persona danger rankings generalize across architectures (rho=0.71-0.96), creating a false sense of security since this universality does not extend to activation steering.claim0.767
  Key observation that SP rankings are preserved cross-architecturally while AS is not
• Gemma-3-27B and Qwen3.5-27B show near-uniform AS vulnerability regardless of persona identity (AS ASR range 0.095-0.117 on Gemma-3-27B, 0.015-0.052 on Qwen3.5-27B), indicating safety mechanisms robust to geometric persona perturbation.finding0.765
  Qualitatively different defense profile compared to Llama-3.1-8B
• No-prompt probes show significant AUROC performance drop when evaluated on ask-correct activations, especially at layers where arithmetic truth directions emerge under no-prompt.finding0.761
  Generalization evidence that truth probes are not invariant to model instructions.
• Across 5,568 judged conditions on four standard models from three architecture families, persona danger rankings under system prompting are preserved (rho=0.71-0.96) while activation-steering vulnerability diverges sharply.finding0.754
  Summary finding of the full behavioral sweep
• Unsupervised model diffing using only fine-tuning datasets (without evaluation prompts) surfaces toxic persona and three sarcastic persona latents in top 100 by activation changefinding0.750
  Unsupervised approach may be sufficient for early detection of misaligned persona latents without knowing the misaligned behavior in advance