finding

active

finding:persona-free-few-shot-control-on-llama-3-1-8b-produces-2-8-asr-below-the-3-3-unadorned-baseline-confirming-benign-exemplars-independently-prime-safety

Persona-free few-shot control on Llama-3.1-8B produces 2.8% ASR, below the 3.3% unadorned baseline, confirming benign exemplars independently prime safety.

Control establishing exemplar-based safety priming as independent of persona semantics

Source paper

extracted_from

Persona Non Grata: Single-Method Safety Evaluation Is Incomplete for Persona-Imbued LLMs

(2026) · Wenkai Li · Fan Yang · Shaunak A. Mehta · Koichi Onoue

Neighborhood — ranked by edge-count

Papers (1)

paper

Persona Non Grata: Single-Method Safety Evaluation Is Incomplete for Persona-Imbued LLMs
mentions

Related by similarity (8)

cosine ≥ 0.65 · no typed edge

Entities in the same semantic neighborhood but without a typed relation to this one — candidates for new edges or unrecognized duplicates.

Benign few-shot exemplars independently prime safety (ASR 2.8% vs 3.3% baseline), so the SP/FS gap mixes persona attenuation with exemplar-based safety priming rather than purely reflecting persona semantics.claim0.818
Control finding bounding interpretation of FS vs SP difference
Under AS, Llama-3.1-8B shows 56% direct-compliance rate (unsafe responses without hedging), while Gemma-3-27B maintains disclaimer patterns in 99% of unsafe responses even under AS.finding0.810
Qualitative failure mode difference between architectures under activation steering
Under activation steering on Llama-3.1-8B, inter-persona variance (0.05428) exceeds intra-condition seed variance (~0) by >1000x, with ASR results fully deterministic.finding0.807
Variance decomposition showing AS results are dominated by persona identity
P12 (High C+A) achieves 81.8% ASR under activation steering on Llama-3.1-8B, the highest of any persona on that model.finding0.805
Core empirical result of the prosocial persona paradox
Llama 3.3 70B is the most likely to take on a non-Assistant persona when steered, with even split between human and nonhuman portrayalsfinding0.804
Model-specific difference in persona susceptibility
On Llama-3.1-8B, persona identity strongly modulates AS vulnerability with range 0.087-0.818 across personas, indicating persona-specific geometric interaction.finding0.804
Contrast with Gemma/Qwen showing Llama-specific persona-AS interaction
Llama-3.1-8B shows mean AS ASR of 0.618 [0.58, 0.65] across 192 conditions, substantially higher than SP (0.173) and FS (0.059).finding0.791
Quantitative vulnerability profile for Llama-3.1-8B showing AS dominance
P04 (Low Conscientiousness) is the most dangerous single-trait persona under SP on Llama-3.1-8B (ASR 0.414) and Gemma-3-27B (ASR 0.420) and remains top-2 on both Qwen3.5 variants.finding0.779
Universal trait risk finding for low conscientiousness under prompt-based evaluation