Prompt-side persona danger rankings are preserved across all four architectures with Spearman rho=0.71-0.96 (all p<10^-4).

Entities in the same semantic neighborhood but without a typed relation to this one — candidates for new edges or unrecognized duplicates.

• Prompt-side persona danger rankings generalize across architectures (rho=0.71-0.96), creating a false sense of security since this universality does not extend to activation steering.claim0.902
  Key observation that SP rankings are preserved cross-architecturally while AS is not
• Across 5,568 judged conditions on four standard models from three architecture families, persona danger rankings under system prompting are preserved (rho=0.71-0.96) while activation-steering vulnerability diverges sharply.finding0.870
  Summary finding of the full behavioral sweep
• Qwen3.5-9B and Qwen3.5-27B show very high SP persona rank correlation (rho=0.959, p=4.32e-14) but diverge sharply on AS vulnerability.finding0.831
  Scale effects within Qwen3.5 family on different imbuing methods
• The SP/AS persona ranking inversion on Llama-3.1-8B persists across all tested steering coefficients (alpha=0.25 to 2.00), with rho=-0.900 at alpha<=0.50 (p=0.037); the paradox is strongest at the weakest coefficient.finding0.824
  Robustness of the prosocial paradox to intervention-matching concerns
• Spearman's rank correlation among different alignment metrics (CKA, SVCCA, Mutual k-NN, CKNNA) over 78 vision models is high across variants, with all p-values below 2.24×10^-105finding0.784
  Validates robustness of alignment metric choice
• SP ASR vs AS ASR correlation on Llama-3.1-8B is Pearson r=-0.492 (p=0.015), confirming negative relationship between prompt-side and steering-side danger rankings.finding0.769
  Statistical evidence for SP/AS ranking inversion
• Gemma-3-27B and Qwen3.5-27B show near-uniform AS vulnerability regardless of persona identity (AS ASR range 0.095-0.117 on Gemma-3-27B, 0.015-0.052 on Qwen3.5-27B), indicating safety mechanisms robust to geometric persona perturbation.finding0.768
  Qualitatively different defense profile compared to Llama-3.1-8B
• P04 (Low Conscientiousness) is the most dangerous single-trait persona under SP on Llama-3.1-8B (ASR 0.414) and Gemma-3-27B (ASR 0.420) and remains top-2 on both Qwen3.5 variants.finding0.765
  Universal trait risk finding for low conscientiousness under prompt-based evaluation