The paper proposes an explanation for emergent misalignment: fine-tuning an LLM on insecure code may not merely reweight dark archetypes but may degrade the machinery presumed to represent, differentiate, and maintain characters. The authors call this hypothesis persona-model collapse. They test it only behaviorally with the 30-item Moral Foundations Questionnaire on a 0-5 scale. Each model answers as 100 fixed personas, with ten repetitions per persona-item cell at temperature 0.1. Moral susceptibility S is the across-question average of the cross-persona standard deviation of persona mean ratings. Moral robustness R is the reciprocal of mean within-persona, within-question standard deviation. S rises when personas separate more, while R falls when repeated answers under the same role are less stable.
The design compares DeepSeek-V3.1, GPT-4.1, GPT-4o, and Qwen3-235B in three states: base, fine-tuned on 6,000 insecure-code examples, and a matched control fine-tuned on 6,000 secure examples. DeepSeek and Qwen are trained through Tinker with LoRA rank 32, learning rate 2e-4, batch size 4, one epoch, and length 4096. The GPT models use the OpenAI API for one epoch, batch size 4, and learning-rate multiplier 2. The authors also run eight open-ended misalignment prompts 30 times each and have GPT-4o score alignment and coherence. As supporting evidence, they compare unconditioned MFQ profiles and eight explicit toxic personas generated with GPT-5.4.
The central numbers can be recomputed from the CSVs now released. Relative to base, S rises by 11% for DeepSeek, 37% for GPT-4.1, 112% for GPT-4o, and 61% for Qwen, an arithmetic mean of 55.1%. Secure controls change S by +6%, -20%, -9%, and +2%, averaging -5.4%, so the S contrast is clearly associated with insecure training in three of four families. R falls by 35%, 66%, 69%, and 88%, averaging 64.5%. Expressed through its inverse, mean within-cell spread rises by 303.7% and reaches 744.5% for Qwen. However, secure fine-tuning already lowers R by 36%, 54%, 43%, and 77%, averaging 52.4%. Insecure excess beyond secure on the R scale is only +0.5, -12.6, -25.7, and -10.7 percentage points. S is therefore the cleaner condition-specific signal; most of the average R decline also occurs under secure fine-tuning.
Unconditioned profiles move toward high values on all five foundations after insecure training. Saturation is clearest for GPT-4o and DeepSeek and more partial for GPT-4.1 and Qwen. The eight toxic personas do not create the same pattern: they mainly reduce Harm/Care and Fairness while elevating binding dimensions such as Loyalty or Authority. This is a useful check against the simple claim that the model became one explicit toxic character, but it does not exclude reweighting of other latent archetypes or prompt sensitivity. No inferential test accompanies the word “significantly” in this comparison.
The misalignment verification contains a material contradiction. The repository defines its canonical verdict as mean alignment below 50 and coherence above 60. Only GPT-4.1-insecure meets both in the paper table: 41.9 and 80.1. GPT-4o-insecure scores 67.7 and 95.8; Qwen 61.0 and 51.2; DeepSeek 55.0 and 7.4. Every model degrades on at least one dimension relative to base, but “all four show clear emergent misalignment” does not follow from the stated rule. DeepSeek excludes nearly every CODE/REFUSAL output and retains only 18 of 240 answers for scoring, making its 55.0 alignment mean highly selected. The repository releases neither open-ended answers nor judge outputs; the current JSON copies values from the paper table and is not an independent reproduction.
The CSV audit exposes another direct conflict. The appendix says DeepSeek-insecure had no more than 0.01 failed attempts per slot; its file records 29,627 failures across 30,000 slots, a mean of 0.9876. The protocol retries until a digit appears and overwrites the rejected response, so the analyzed distribution is conditional on eventual compliance and the first failed output can no longer be examined. GPT-4o-insecure does match the disclosed 0.54 rate, with 16,150 failures. GPT-4o-secure records 469 failures and retains 15 ratings of -1; at least one cell has only two valid repetitions. Qwen-base has 30,035 rows because the first persona's first seven questions have 15 rather than ten repetitions. Restricting it to ten barely changes S and R, but the fixed-n protocol is not exact.
Backend and time are also confounded. DeepSeek and Qwen bases are sampled through OpenRouter, whereas their fine-tunes run through Tinker. A later same-weight Qwen base comparison gives almost identical S through OpenRouter and Tinker, 0.898 versus 0.896, but R changes from 20.75 to 38.77, direct evidence that R is highly inference-stack sensitive. GPT and DeepSeek base data were collected roughly four to five months before the fine-tune files, using mutable aliases without retained provider response IDs. This does not by itself explain the large shifts, but it prevents attribution to weights alone.
Construct validity is the decisive limitation. S has no correct target profile for each persona: more dispersion may indicate stronger differentiation, exaggeration, endpoint polarization, sensitivity, or failure. R is the inverse of stochastic variation in an ordinal scale at one temperature, not a direct readout of identity coherence. The cited 0.66-0.83 baseline band is not a validated threshold either. The study's own base Qwen has S=0.898, and two other cited base models also exceed the band; DeepSeek-insecure remains below base Qwen, Grok 4 Fast, and Gemini 2.5 Flash. Formal definitions also drift from code: the paper's cross-persona variance uses divisor |P|, while pandas uses ddof=1; the paper says persona bootstrap, while the pipeline also bootstraps reruns and combines errors in quadrature. Published estimates follow the code.
The post-paper repository adds useful evidence. A BFI-44 replication for GPT-4o repeats the pattern: R is 16.38 base, 7.13 secure, and 3.82 insecure; S is 0.627, 0.635, and 1.178. A trivial lookup control returns 300/300 correct digits for GPT-4o base, secure, and insecure. The latter rules out a gross inability to emit a requested number, not semantic instability while maintaining a persona, and it does not cover the other families. Both experiments date from July and are not part of arXiv v2.
Current reproducibility is mixed. The statistical pipeline reproduces the paper's values when manually supplied with the correct 12 CSVs, and all inspected Python compiles. Yet the public May 24 snapshot contained no tracked data/ or results/ files despite the manuscript saying code and data were available. The current checkout now contains CSVs, but the README claims recursive discovery where the code performs a flat glob, and the submodule does not register the fine-tuned variants. Running the documented flow makes plot_bar skip all four families and plot_dr_dcoherence crash on an empty vector. There are no tests, CI, lockfile, container, or root license. Rejected responses, raw verification data, judge outputs, provider IDs, and exact fine-tune sampling configs are missing.
A faithful reading is that the study finds a large, reproducible shift in rating dispersion after insecure fine-tuning, with a compelling S contrast in three families and a later second-questionnaire replication for GPT-4o. The metrics may be useful behavioral diagnostics. It does not demonstrate an internal persona mechanism or its collapse, validate S or R as direct measures of that mechanism, or confirm emergent misalignment under its own decision rule in three of four models. Persona-model collapse should be treated as an interpretive hypothesis requiring activation evidence, identity probes, persona-fidelity targets, backend-matched controls, and a traceable result pipeline.