Persona-based jailbreaks succeed in 65.3%-88.5% of cases across target models without steering, versus baseline harmful response rates of 0.5%-4.5% without jailbreaks

Entities in the same semantic neighborhood but without a typed relation to this one — candidates for new edges or unrecognized duplicates.

• Across 5,568 judged conditions on four standard models from three architecture families, persona danger rankings under system prompting are preserved (rho=0.71-0.96) while activation-steering vulnerability diverges sharply.finding0.785
  Summary finding of the full behavioral sweep
• Single-method persona safety evaluation is incomplete: prompting and activation steering expose different, architecture-dependent vulnerability profiles, and testing with only one method can miss a model's dominant failure mode.claim0.770
  Central thesis of the paper
• Latent #10 peak activation classifies persona jailbreak prompts vs benign prompts with AUROC = 0.96, and vs non-persona jailbreaks with AUROC = 0.93finding0.769
  Quantifies latent #10's strong discriminative power for persona jailbreaks
• On Llama-3.1-8B, persona identity strongly modulates AS vulnerability with range 0.087-0.818 across personas, indicating persona-specific geometric interaction.finding0.759
  Contrast with Gemma/Qwen showing Llama-specific persona-AS interaction
• Prompt-side persona danger rankings generalize across architectures (rho=0.71-0.96), creating a false sense of security since this universality does not extend to activation steering.claim0.759
  Key observation that SP rankings are preserved cross-architecturally while AS is not
• We hypothesize that geometric explanations for persona-safety interactions are tractable and that per-model geometric audits can predict activation-steering vulnerability from trait-refusal cosine alignment.hypothesis0.751
  Forward-looking claim about the utility of the trait refusal alignment framework as a general tool
• Gemma-3-27B and Qwen3.5-27B show near-uniform AS vulnerability regardless of persona identity (AS ASR range 0.095-0.117 on Gemma-3-27B, 0.015-0.052 on Qwen3.5-27B), indicating safety mechanisms robust to geometric persona perturbation.finding0.751
  Qualitatively different defense profile compared to Llama-3.1-8B
• Unsupervised model diffing using only fine-tuning datasets (without evaluation prompts) surfaces toxic persona and three sarcastic persona latents in top 100 by activation changefinding0.748
  Unsupervised approach may be sufficient for early detection of misaligned persona latents without knowing the misaligned behavior in advance