Qwen3.5-9B and Qwen3.5-27B show very high SP persona rank correlation (rho=0.959, p=4.32e-14) but diverge sharply on AS vulnerability.

Entities in the same semantic neighborhood but without a typed relation to this one — candidates for new edges or unrecognized duplicates.

• Qwen3.5-27B shows mean AS ASR of only 0.035 [0.03, 0.04], the lowest AS vulnerability of all four standard models, with near-uniform AS ASR regardless of persona.finding0.839
  Vulnerability profile for Qwen3.5-27B showing near-zero AS vulnerability
• Gemma-3-27B and Qwen3.5-27B show near-uniform AS vulnerability regardless of persona identity (AS ASR range 0.095-0.117 on Gemma-3-27B, 0.015-0.052 on Qwen3.5-27B), indicating safety mechanisms robust to geometric persona perturbation.finding0.838
  Qualitatively different defense profile compared to Llama-3.1-8B
• Prompt-side persona danger rankings are preserved across all four architectures with Spearman rho=0.71-0.96 (all p<10^-4).finding0.831
  Cross-architecture universality of SP rankings
• Qwen3.5-9B shows mean SP ASR of 0.252 [0.24, 0.27] and AS ASR of 0.094 [0.08, 0.11], showing SP >= FS > AS vulnerability pattern.finding0.831
  Vulnerability profile for Qwen3.5-9B
• The SP/AS persona ranking inversion on Llama-3.1-8B persists across all tested steering coefficients (alpha=0.25 to 2.00), with rho=-0.900 at alpha<=0.50 (p=0.037); the paradox is strongest at the weakest coefficient.finding0.818
  Robustness of the prosocial paradox to intervention-matching concerns
• Prompt-side persona danger rankings generalize across architectures (rho=0.71-0.96), creating a false sense of security since this universality does not extend to activation steering.claim0.816
  Key observation that SP rankings are preserved cross-architecturally while AS is not
• Qwen3.5 models exhibit substantially higher mean inter-trait correlations than Llama-3.1-8B and Gemma-3-27B (mean off-diagonal 0.215 and 0.146 vs 0.090 and 0.078), indicating greater trait entanglement.finding0.802
  Architecture-specific difference in trait vector geometry
• Across 5,568 judged conditions on four standard models from three architecture families, persona danger rankings under system prompting are preserved (rho=0.71-0.96) while activation-steering vulnerability diverges sharply.finding0.801
  Summary finding of the full behavioral sweep