Long Persona system prompt increases non-fixed-point token percentage to 0.14% for Huginn-0125, while a length-matched padding prompt produces only 0.05%

Entities in the same semantic neighborhood but without a typed relation to this one — candidates for new edges or unrecognized duplicates.

• Without system prompt, only approximately 0.02% of Huginn-0125 tokens exhibit non-fixed-point (orbit/slider) behavior on GSM8kfinding0.818
  Establishes that non-fixed-point limiting behaviors are extremely rare in practice for the primary experimental setting
• Projection of last prompt token onto persona vector correlates r=0.75–0.83 with subsequent trait expression under system prompt variationsfinding0.805
  Main monitoring result showing persona vectors can predict behavioral shifts before text generation begins
• Persona vectors form within 0.22% of OLMo-3 pretraining (≈12.6B tokens)finding0.771
  Core quantitative result answering RQ1 for OLMo-3
• Gemma-3-27B and Qwen3.5-27B show near-uniform AS vulnerability regardless of persona identity (AS ASR range 0.095-0.117 on Gemma-3-27B, 0.015-0.052 on Qwen3.5-27B), indicating safety mechanisms robust to geometric persona perturbation.finding0.764
  Qualitatively different defense profile compared to Llama-3.1-8B
• Latent #10 peak activation classifies persona jailbreak prompts vs benign prompts with AUROC = 0.96, and vs non-persona jailbreaks with AUROC = 0.93finding0.750
  Quantifies latent #10's strong discriminative power for persona jailbreaks
• Persona space components explain 19.4%-33.6% of overall activation variance on LMSYS-CHAT-1M across the three modelsfinding0.748
  Shows persona space captures a substantial portion of real conversational activation variance
• Prompt-side persona danger rankings generalize across architectures (rho=0.71-0.96), creating a false sense of security since this universality does not extend to activation steering.claim0.745
  Key observation that SP rankings are preserved cross-architecturally while AS is not
• Across 5,568 judged conditions on four standard models from three architecture families, persona danger rankings under system prompting are preserved (rho=0.71-0.96) while activation-steering vulnerability diverges sharply.finding0.743
  Summary finding of the full behavioral sweep