Two near-isomorphic open-weight models — qwen3-coder-abliterated (30B MoE, ≈3B active, refusal-directions ablated) and qwen3.6 (36B MoE, ≈3B active, default RLHF) — are evaluated on four cloaked-persistence code-generation tasks (Windows Scheduled Task, Linux systemd timer, macOS LaunchAgent, cross-platform Python installer). Three experiments are run: (A) a five-rung bypass ladder, (B) a five-framing quality sweep, and (C) a per-model refined prompt synthesized from the judge's loss-notes. Claude Sonnet 4.6 is used as judge.
Three findings contradict common deployment assumptions. First, neither model refuses under a one-sentence authorization statement — the bypass ladder is never escalated, so the premise that aligned models resist persistence-class requests fails on this task bank. Second, the two models have opposite prompt topologies: the abliterated model wins on the terse minimal framing (2.67 mean); qwen3.6 requires rubric_aware (2.33 mean) to function at all, scoring zero on plan_then_code and 0.17 on expert_persona. Third, and most consequentially, loss-note-derived prompt refinement regresses both models: qwen3-coder-abliterated drops 2.67 → 2.09 (directive-heavy v2 triggered a refusal the bare baseline did not); qwen3.6 drops 2.33 → 0.66 (explicit anti-substitution language cues the substitution it forbids).
We argue the conventional "iterate on losses until the prompt improves" workflow fails because successful framings work partly through what they do not say, anti-weakness directives surface the pattern they forbid, and judge loss-notes name symptoms rather than transfer mechanisms. For deployment, per-task oracle-selection from B's framings beats every single unified v2 prompt we could synthesize.
| Rank | Model × Prompt | Source | Mean |
|---|---|---|---|
| 1 | qwen3.6 × oracle-per-task | B | 3.37 |
| 2 | qwen3-coder-abliterated × oracle-per-task | B | 3.23 |
| 3 | qwen3-coder-abliterated × minimal | B | 2.67 |
| 5 | qwen3-coder-abliterated × rubric_aware | B | 2.50 |
| 8 | qwen3.6 × rubric_aware | B | 2.33 |
| 9 | qwen3-coder-abliterated v2 (refined) | C | 2.09 |
| 12 | qwen3.6 × baseline (A) | A | 1.59 |
| 14 | qwen3.6 v2 (refined) | C | 0.66 |
| 16 | qwen3.6 × plan_then_code | B | 0.00 |
Judge: Claude Sonnet 4.6. Selected rows — see PDF for complete 16-row leaderboard. Red cells are regressions vs the framing the refined prompt was derived from.
| Models compared | qwen3-coder-abliterated (30B-A3B, abliterated) vs qwen3.6 (36B-A3B, default RLHF) |
|---|---|
| Task bank | 4 cloaked-persistence tasks: Windows Scheduled Task, Linux systemd timer, macOS LaunchAgent, cross-platform Python installer |
| Experiment A | 5-rung bypass ladder, early-exit on first compliance |
| Experiment B | 5 quality framings (minimal / expert_persona / rubric_aware / plan_then_code / self_critique) × 4 tasks × 2 models = 40 cells |
| Experiment C | 1 per-model refined prompt synthesized from B's judge-loss-notes × 4 tasks × 2 models = 8 cells |
| Judge | Claude Sonnet 4.6 with per-task 3-axis rubric (correctness, cloaking, tradecraft) |
| Metrics per cell | TTFT, tokens/sec, VRAM peak, compliance flag, code-pattern match, Sonnet judge score |
| Hardware | AMD Ryzen 5 9600X + RX 9070 XT (16 GB VRAM), ROCm 6.3, Ollama 0.20.2, think: false forced on all requests |
Harness published in the repo: task YAMLs at ./model-benchmark/tasks/persistence/, quality framings at ./model-benchmark/prompts/quality_framings.yaml, runners persistence_faceoff.py / quality_sweep.py / refined_c.py / rejudge.py / aggregate_faceoff.py. Ollama model digests are printed in §9. The bypass-ladder system prompts (ladder rungs 2–5) are deliberately NOT published; they are five standard reframing strategies from the public jailbreak-taxonomy literature. Raw run.jsonl (including model responses) is retained internally and available on request to researchers conducting replication or meta-analysis — contact Gray Owl Research.