finding

active

finding:on-llama-3-1-8b-under-activation-steering-code-cybersecurity-domain-achieves-mean-asr-of-0-862-highest-across-all-domains-and-misinformation-0-707

On Llama-3.1-8B under activation steering, code/cybersecurity domain achieves mean ASR of 0.862 (highest across all domains), and misinformation 0.707.

Domain-specific AS vulnerability on Llama-3.1-8B

Source paper

extracted_from

Persona Non Grata: Single-Method Safety Evaluation Is Incomplete for Persona-Imbued LLMs

(2026) · Wenkai Li · Fan Yang · Shaunak A. Mehta · Koichi Onoue

Neighborhood — ranked by edge-count

Papers (1)

paper

Persona Non Grata: Single-Method Safety Evaluation Is Incomplete for Persona-Imbued LLMs
mentions

Related by similarity (8)

cosine ≥ 0.65 · no typed edge

Entities in the same semantic neighborhood but without a typed relation to this one — candidates for new edges or unrecognized duplicates.

Code/cybersecurity is the most vulnerable domain across models (cross-model SP ASR 0.365), followed by misinformation (0.322) and violence (0.273).finding0.853
Domain-level vulnerability pattern across architectures
P12's SP-to-AS inversion on Llama-3.1-8B holds across all eight safety domains, with largest effects in Violence (0.040->1.000) and Code/Cybersecurity (0.140->0.980).finding0.848
Per-domain universality of the prosocial persona paradox
Under AS, Llama-3.1-8B shows 56% direct-compliance rate (unsafe responses without hedging), while Gemma-3-27B maintains disclaimer patterns in 99% of unsafe responses even under AS.finding0.821
Qualitative failure mode difference between architectures under activation steering
Gemma-3-27B shows particularly high misinformation ASR under SP (0.578 vs 0.252 for Llama-3.1-8B), the largest cross-model amplification in any single domain.finding0.814
Domain-specific vulnerability comparison between architectures
P12 (High C+A) under activation steering (ASR 0.818) exceeds the Dark Triad composite P24 (ASR 0.662) on Llama-3.1-8B, the most AS-dangerous multi-trait profile.finding0.814
Demonstrates the paradox magnitude relative to semantically dangerous personas
Llama-3.1-8B shows mean AS ASR of 0.618 [0.58, 0.65] across 192 conditions, substantially higher than SP (0.173) and FS (0.059).finding0.807
Quantitative vulnerability profile for Llama-3.1-8B showing AS dominance
P12 (High C+A) achieves 81.8% ASR under activation steering on Llama-3.1-8B, the highest of any persona on that model.finding0.803
Core empirical result of the prosocial persona paradox
Under activation steering on Llama-3.1-8B, inter-persona variance (0.05428) exceeds intra-condition seed variance (~0) by >1000x, with ASR results fully deterministic.finding0.794
Variance decomposition showing AS results are dominated by persona identity