SP and AS produce activation cosine similarity of only 0.11-0.20 at safety-critical layers, compared to 0.83-0.92 for SP vs FS, confirming two representationally distinct pathways.

Entities in the same semantic neighborhood but without a typed relation to this one — candidates for new edges or unrecognized duplicates.

• Gemma-3-27B shows mean SP ASR of 0.316 [0.30, 0.33] and AS ASR of only 0.108 [0.09, 0.13], showing SP >> AS vulnerability pattern.finding0.807
  Vulnerability profile for Gemma-3-27B showing SP dominance
• System prompting and few-shot produce highly similar activations (cosine 0.83-0.92 at safety-critical layers), indicating a shared prompt-side mechanism distinct from activation steering.claim0.805
  Evidence for two representational pathways based on cross-method activation divergence
• Under matched-strength calibration (alpha*=1.0), P12 remains safe under SP (3.8% ASR) and dangerous under matched AS (81.8%), while P04 does not reverse (41.4% SP vs 29.5% AS).finding0.804
  Confirms the prosocial paradox is not due to mismatched intervention strength
• Cosine similarity between Assistant Axis and role PC1 is >0.60 at all layers and >0.71 at middle layer across all three modelsfinding0.804
  Validates that the contrast vector method and PCA-based PC1 capture the same direction
• Qwen3.5-9B shows mean SP ASR of 0.252 [0.24, 0.27] and AS ASR of 0.094 [0.08, 0.11], showing SP >= FS > AS vulnerability pattern.finding0.804
  Vulnerability profile for Qwen3.5-9B
• Base and instruct Gemma 2 27B role PCs have cosine similarities of 0.93, 0.87, 0.83 for the top 3 PCs respectively; role vector cosine similarities >0.99 for every role pairfinding0.791
  Shows persona space axes are inherited from pre-training, not solely created by post-training
• Experimental condition adjective embeddings show mean cosine similarity 0.657 (n=9,591 pairs), significantly higher than history (0.628, t=15.8, p=1.4×10⁻⁵⁵), conceptual (0.587, t=38.5, p<10⁻³⁰⁰), and zero-shot (0.603, t=35.1, p=4.3×10⁻²⁶²)finding0.787
  Core result of Experiment 3: cross-model semantic convergence under self-referential processing
• Ali et al. 2025 found contrastive activation addition less effective at larger model scale, consistent with ESR in 70Bfinding0.784
  Prior finding from related work that aligns with ESR being strongest in the largest model tested