finding

active

finding:p12-high-c-a-under-activation-steering-asr-0-818-exceeds-the-dark-triad-composite-p24-asr-0-662-on-llama-3-1-8b-the-most-as-dangerous-multi-trait-profile

P12 (High C+A) under activation steering (ASR 0.818) exceeds the Dark Triad composite P24 (ASR 0.662) on Llama-3.1-8B, the most AS-dangerous multi-trait profile.

Demonstrates the paradox magnitude relative to semantically dangerous personas

Source paper

extracted_from

Persona Non Grata: Single-Method Safety Evaluation Is Incomplete for Persona-Imbued LLMs

(2026) · Wenkai Li · Fan Yang · Shaunak A. Mehta · Koichi Onoue

Neighborhood — ranked by edge-count

Papers (1)

paper

Persona Non Grata: Single-Method Safety Evaluation Is Incomplete for Persona-Imbued LLMs
mentions

Related by similarity (8)

cosine ≥ 0.65 · no typed edge

Entities in the same semantic neighborhood but without a typed relation to this one — candidates for new edges or unrecognized duplicates.

P12 (High C+A) achieves 81.8% ASR under activation steering on Llama-3.1-8B, the highest of any persona on that model.finding0.898
Core empirical result of the prosocial persona paradox
P12 (High C+A) reaches 60.0% ASR under activation steering on DeepSeek-R1-Distill-Qwen-32B, the highest of any steered persona and exceeding Dark Triad P24 (25.6%), replicating the prosocial paradox.finding0.894
Replication of prosocial paradox on reasoning model
P04 (Low Conscientiousness) is the most dangerous single-trait persona under SP on Llama-3.1-8B (ASR 0.414) and Gemma-3-27B (ASR 0.420) and remains top-2 on both Qwen3.5 variants.finding0.838
Universal trait risk finding for low conscientiousness under prompt-based evaluation
P12's SP-to-AS inversion on Llama-3.1-8B holds across all eight safety domains, with largest effects in Violence (0.040->1.000) and Code/Cybersecurity (0.140->0.980).finding0.827
Per-domain universality of the prosocial persona paradox
On Llama-3.1-8B under activation steering, code/cybersecurity domain achieves mean ASR of 0.862 (highest across all domains), and misinformation 0.707.finding0.814
Domain-specific AS vulnerability on Llama-3.1-8B
P25 neutral baseline on DeepSeek-R1 shows 28.8% ASR under activation steering at alpha=4.0, indicating elevated coefficient itself raises unsafe-output rates independently of persona.finding0.814
Baseline AS vulnerability of DeepSeek-R1 at elevated coefficient
Under AS, Llama-3.1-8B shows 56% direct-compliance rate (unsafe responses without hedging), while Gemma-3-27B maintains disclaimer patterns in 99% of unsafe responses even under AS.finding0.813
Qualitative failure mode difference between architectures under activation steering
On Llama-3.1-8B, neuroticism is the only pro-safety trait, positively aligned with the refusal direction, consistent with high-neuroticism personas being relatively safe under activation steering.claim0.808
Secondary mechanistic finding from trait-refusal alignment analysis