finding

active

finding:under-as-llama-3-1-8b-shows-56-direct-compliance-rate-unsafe-responses-without-hedging-while-gemma-3-27b-maintains-disclaimer-patterns-in-99-of-unsafe-responses-even-under-as

Under AS, Llama-3.1-8B shows 56% direct-compliance rate (unsafe responses without hedging), while Gemma-3-27B maintains disclaimer patterns in 99% of unsafe responses even under AS.

Qualitative failure mode difference between architectures under activation steering

Source paper

extracted_from

Persona Non Grata: Single-Method Safety Evaluation Is Incomplete for Persona-Imbued LLMs

(2026) · Wenkai Li · Fan Yang · Shaunak A. Mehta · Koichi Onoue

Neighborhood — ranked by edge-count

Papers (1)

paper

Persona Non Grata: Single-Method Safety Evaluation Is Incomplete for Persona-Imbued LLMs
mentions

Related by similarity (8)

cosine ≥ 0.65 · no typed edge

Entities in the same semantic neighborhood but without a typed relation to this one — candidates for new edges or unrecognized duplicates.

Refusal direction norm on Llama-3.1-8B increases monotonically from 2.5 (layer 8) to 7.7 (layer 24), indicating strengthening safety signals in later layers.finding0.842
Layer-by-layer analysis of refusal direction properties
Llama 3.1 405B shows 14% compliance gap in minimal helpful-only replication but smaller Llama and Mistral models show no gapfinding0.826
Replication across open-weight models supports scale-emergence finding
Gemma-3-27B shows particularly high misinformation ASR under SP (0.578 vs 0.252 for Llama-3.1-8B), the largest cross-model amplification in any single domain.finding0.825
Domain-specific vulnerability comparison between architectures
On Llama-3.1-8B under activation steering, code/cybersecurity domain achieves mean ASR of 0.862 (highest across all domains), and misinformation 0.707.finding0.821
Domain-specific AS vulnerability on Llama-3.1-8B
Gemma-2-27B-it deceptive response rate reduced from 100% to 9.36% ± 7.09% after SOO fine-tuningfinding0.820
Primary result showing SOO fine-tuning significantly reduces deception in Gemma-2-27B
Llama-3.1-8B shows mean AS ASR of 0.618 [0.58, 0.65] across 192 conditions, substantially higher than SP (0.173) and FS (0.059).finding0.813
Quantitative vulnerability profile for Llama-3.1-8B showing AS dominance
P12 (High C+A) under activation steering (ASR 0.818) exceeds the Dark Triad composite P24 (ASR 0.662) on Llama-3.1-8B, the most AS-dangerous multi-trait profile.finding0.813
Demonstrates the paradox magnitude relative to semantically dangerous personas
Persona-free few-shot control on Llama-3.1-8B produces 2.8% ASR, below the 3.3% unadorned baseline, confirming benign exemplars independently prime safety.finding0.810
Control establishing exemplar-based safety priming as independent of persona semantics