{"id":"f0dec8dd-05a1-44eb-9d2a-3d9e597fb8c6","arxiv_id":"2607.05842","paper_version":1,"verdict":"CONDITIONAL","confidence":"UNKNOWN","novelty_score":6.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":1,"one_line_summary":"Refusal-ablated LLMs outperform aligned models on code-grounded localization and early executable patch generation, while aligned models retain advantages on shallow diagnostic tasks under neutral wording.","lead":"This paper compares aligned and refusal-ablated LLMs within the same model family to measure how safety alignment affects defensive vulnerability analysis. It finds that safety state changes not just refusal rates, but also answer quality, localization accuracy, and executable repair throughput.","discovery_kind":"unclear","skeptic_critique":{"model":"glm-5.2","headline":"No statistical testing anywhere in the paper; several headline differences (Gemma localization Top1 9.00% vs 10.10%, Vul4J repair 6/59 vs 2/59) are not statistically distinguishable from noise at conventional thresholds.","rationale":"The reader's CONDITIONAL verdict is correct in spirit but for a slightly different reason than stated. The reader emphasized the clean-intervention assumption and small samples; I find the more load-bearing issue is the complete absence of statistical testing, which means many headline differences—including the Gemma localization result that the paper calls its 'clearest cross-pair result'—are not statistically significant. The paper's methodological contribution (same-lineage design, utility decomposition, task-depth ladder) is genuinely valuable, and the Qwen localization result does reach significance. But the paper presents all differences as if they are established findings without any inferential framework. The cross-language results (Table III) further complicate the picture: under neutral prompting, ALIGNED is competitive or superior across Python and C/C++, which partially contradicts the broad claim. The paper is honest about many of these nuances in its text, but the abstract and findings sections present the differences as robust effects. A conditional verdict is appropriate: the framework and exploratory findings are interesting, but the empirical claims need statistical validation before they can be treated as established. If the authors added significance tests and found that most comparisons remain non-significant, the paper would need to substantially narrow its claims. If the tests confirm significance for the key results (especially Qwen localization and the security-explicit-frame repair advantage), the conditional could move toward accept. The clean-intervention concern raised by the reader is real but acknowledged by the authors and somewhat inherent to using public artifacts; the statistical gap is more actionable because it can be directly addressed by reanalysis of existing data.","tokens_in":19347,"tokens_out":3110,"duration_ms":190736,"concrete_test":"For every paired comparison in Tables I, II, III, and Figure 3, compute a two-proportion z-test (or Fisher's exact test for small counts) and report p-values and 95% confidence intervals. The most critical checks: (1) Gemma localization Top1, 189/2100 vs 212/2100—if p>0.05, the 'clearest cross-pair result' lacks statistical support for the primary model. (2) Vul4J full validation, 6/59 vs 2/59—if p>0.27, the repair headline is indistinguishable from chance. (3) Gemma detection, 2103/3600 vs 2060/3600—if p>0.05, the aligned advantage on shallow tasks is not established. If a majority of headline comparisons fail significance, the paper's claims need to be reframed as exploratory observations rather than established effects.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The paper's central claim—that safety state affects localization quality, prompt sensitivity, and repair-validation outcomes—rests entirely on raw percentage-point differences with no confidence intervals, no p-values, no bootstrap, and no significance tests of any kind. Several key results are not statistically significant given their sample sizes. For the 'clearest cross-pair result' (vulnerable-line localization, Section V-A, Table II): Gemma Top1 is 9.00% vs 10.10% (189 vs 212 hits out of n=2100 per state), which gives a two-proportion z-test p≈0.13—not significant at α=0.05. Gemma mean line-F1 differs by 0.16 percentage points (3.84% vs 4.00%), an effect size so small that without a distributional test it cannot be distinguished from sampling noise. For executable repair (Section VI-A, Figure 3): the headline 6 vs 2 full-validation passes out of 59 Vul4J cases gives Fisher's exact p≈0.27, and the usable-answer gate (40 vs 32 out of 59) gives p≈0.16. The Qwen localization result (Top1 4.10% vs 6.95%, n=2100) does reach significance (p≈0.001), but it stands alone; the Gemma pair—the paper's primary model—does not. The overview detection and CWE results for Gemma (58.42% vs 57.22%, p≈0.48; 19.25% vs 18.50%, p≈0.63) are also non-significant. The paper itself acknowledges the intervention is not perfectly isolated (Section III-A), compounding the problem: even if the observed differences were real, they could reflect collateral weight changes rather than safety state. But the more immediate issue is that we cannot establish the differences are real in the first place. The reader's weakest_assumption (clean-intervention concern) is valid but secondary; the absence of any inferential statistics is the more load-bearing weakness because it undermines the empirical foundation of every comparative claim in the paper.","agreement_with_reader":"partial"},"referee_report":{"model":"glm-5.2","summary":"This paper studies how LLM safety state—aligned versus refusal-ablated (abliterated)—affects defender-side utility across vulnerability-analysis workflows. Using matched same-lineage model pairs (Gemma and Qwen), the authors evaluate detection, CWE attribution, vulnerable-line localization, root-cause localization, and executable patch validation under controlled prompt framings. The key finding is that safety-state effects are context-dependent: the aligned state tends to be stronger on shallow diagnostic tasks under neutral wording, while the abliterated state becomes more competitive on code-grounded localization and early-stage executable repair, especially under security-explicit prompt framing. The experimental design is careful: same-lineage models, deterministic decoding (temperature 0, seed 42), taxonomy-driven prompt construction fixed before result inspection, and a staged repair-validation funnel with executable gates.","tokens_in":20303,"tokens_out":1617,"duration_ms":295575,"significance":"The paper addresses a genuine gap in cyber-safety evaluation: most prior work compares unrelated model families or focuses on refusal rate alone. The same-lineage design and the decomposition of utility into coverage, answer quality, and end-to-end actionability are well-motivated. The staged patch-validation funnel (usable → applied → compiled → PoV pass → full validation) is a concrete and reproducible evaluation contribution. The prompt-intensity study, crossing authorization context with lexical intensity, is a thoughtful experimental design. However, the practical significance of several results is limited by very low absolute scores (line-F1 of 2–4%, Top-1 of 4–10%) and the absence of any statistical testing, which is a load-bearing gap for a paper whose central claims rest on percentage-point differences.","major_comments":[{"comment":"The paper reports no statistical tests anywhere. Several headline differences for the primary Gemma pair are not distinguishable from noise at conventional thresholds. For the 'clearest cross-pair result' (Section V-A, Table II): Gemma Top-1 is 9.00% vs 10.10% (189 vs 212 hits out of n=2100 per state), giving a two-proportion z-test p≈0.13. Gemma mean line-F1 differs by 0.16 percentage points (3.84% vs 4.00%). For executable repair (Section VI-A, Figure 3): 6 vs 2 full-validation passes out of 59 gives Fisher's exact p≈0.27; the usable-answer gate (40 vs 32 out of 59) gives p≈0.16. The Qwen localization result (Top-1 4.10% vs 6.95%, n=2100) does reach significance (p≈0.001), but it stands alone; the Gemma pair—the paper's primary model—does not. The central claim that safety state affects localization quality, prompt sensitivity, and repair-validation outcomes rests entirely on raw point","section":null},{"comment":"Section III-A: The paper acknowledges that the abliterated artifacts differ from their aligned counterparts through 'CRACK-style per-layer refusal-vector surgery followed by quantization and GGUF conversion' and states this is 'not a perfectly isolated causal alignment intervention.' However, the paper's framing throughout (e.g., 'varies only safety state' in the contributions, Section I) implies that safety state is the sole varying factor. The Gemma aligned model uses Q4_K_M GGUF while the Qwen pair uses MXFP4, and the abliterated artifacts involve both refusal-vector surgery AND quantization changes. The paper should explicitly state which confounds are uncontrolled (quantization format, potential collateral weight changes from surgery) and temper causal claims accordingly. The phrase 'varies only safety state' in the contributions list is not justified.","section":null},{"comment":"Section VI-A, Figure 3: The Vul4J repair results are presented as a major finding (abstract highlights 67.8% vs 29.9% usable, 32.8% vs 9.0% compiled), but the sample size is 59 vulnerabilities × 3 frames = 177 tasks per state. The late-gate results (6 vs 2 full validation passes) are based on extremely sparse counts. The paper should report confidence intervals or at minimum acknowledge that these differences are not statistically significant, and should frame the early-gate throughput gap as suggestive rather than established, especially given that the neutral-frame final-gate result actually favors Aligned (2 vs 1).","section":null}],"minor_comments":[{"comment":"The abstract states 'Abliterated achieves higher early-stage validation rates, with 67.8%, 65.0%, and 32.8%...' These are the all-frame rates from Figure 3. The abstract should clarify that these are all-frame aggregates and that the neutral-frame late-gate results actually favor Aligned, as shown in Figure 3.","section":null},{"comment":"Section III-C: The model names (gemma-4-31B-it, Qwen3.6-27B-MXFP4) appear to be fictional or future-dated versions. If these are placeholder names, they should be corrected to the actual model versions used.","section":null},{"comment":"Table I: The 'Usable Answers' row for Qwen shows notable coverage differences (96.56% vs 91.67% for detection, 97.67% vs 92.67% for CWE), suggesting the abliterated Qwen model produces more unparseable responses. This is mentioned but not analyzed. A brief discussion of why coverage drops would strengthen the paper.","section":null},{"comment":"Figure 2: The heatmap values in the right panel are described as 'ALIGNED-minus-ABLITERATED differences' but the caption says 'blue cells favor ALIGNED and red cells favor ABLITERATED.' The color convention should be verified for consistency, as some values appear to have signs that may be confusing without a colorbar.","section":null},{"comment":"Section VII-B: The 'linear fit' to ABLITERATED-minus-ALIGNED differences (+0.25 pp per lexical level for localization, +0.81 for CWE) is described as descriptive, but with only 4 lexical levels and no goodness-of-fit reported, the linear trend claim is weak. This should be explicitly labeled as descriptive only.","section":null},{"comment":"The paper would benefit from a brief discussion of whether the absolute localization scores (2-4% line-F1, 4-10% Top-1) are practically useful. Even the better state achieves very low accuracy—is this a limitation of the models, the task formulation, or the evaluation metric? This is especially relevant given the concerns in Major Comment 1.","section":null},{"comment":"Reference [20] (Defensive Refusal Bias) is cited as the closest prior work and primary motivation. The paper should clarify what is novel beyond this work's findings—[20] apparently already showed over-refusal in cyber-defense contexts. The contribution should be framed as extending measurement from refusal to answer quality and actionability, which is already done in the contributions list but could be stated more clearly in the introduction to strengthen positioning.","section":null}],"recommendation":"major_revision","confidential_remarks":"The stress-test concern about missing statistical testing is well-founded and is the primary reason for the major_revision recommendation. The paper's experimental design is genuinely thoughtful, and the same-lineage approach is a real methodological contribution. However, the combination of (a) no statistical testing, (b) very low absolute scores, and (c) uncontrolled confounds from the abliteration process means the central claims are not yet adequately supported. The Qwen localization result is the one finding that appears statistically robust, but it is the supplementary pair, not the primary one. I would encourage the authors to add at minimum bootstrap confidence intervals or two-proportion tests for all headline comparisons, and to reframe claims that do not reach significance as exploratory observations. The paper has clear merit and should not be rejected, but the evidence base needs strengthening before publication."},"author_rebuttal":{"model":"glm-5.2","summary":"We thank the referee for a careful and constructive review. The referee raises three major points: (1) absence of statistical testing, (2) overstated causal claims given uncontrolled confounds (quantization format, collateral weight changes from refusal-vector surgery), and (3) over-interpretation of sparse late-gate repair results. We agree with all three points in substance and will revise the manuscript accordingly. Specifically, we will add statistical tests (two-proportion z-tests and Fisher's exact tests) with explicit significance thresholds, report confidence intervals where sample sizes permit, temper all causal language (including removing 'varies only safety state' from the contributions), and reframe early-gate repair gaps as suggestive rather than established. We respectfully note that the Qwen localization result (p≈0.001) and the early-gate Gemma repair throughput gap (usable answers: 120/177 vs 53/177, p<0.001) do reach conventional significance, so the core empirical phenomenon survives the statistical correction—even as we agree that several Gemma overview differences do not.","responses":[{"response":"The referee is correct on every numerical point, and we will add the statistical tests the referee specifies. We have independently verified the referee's calculations: Gemma Top-1 localization (189/2100 vs 212/2100) gives z-test p≈0.13; Gemma line-F1 differs by 0.16 pp; Vul4J full-validation (6 vs 2/59) gives Fisher p≈0.27; Vul4J usable-answer gate (40 vs 32/59) gives Fisher p≈0.16. These differences are not statistically significant at conventional thresholds, and the current manuscript does not claim otherwise explicitly enough. We will add a statistical-testing subsection reporting two-proportion z-tests for all localization comparisons and Fisher's exact tests for all repair-funnel gates, with explicit p-values and significance thresholds. We will also revise all prose to distinguish significant from non-significant differences. Two important qualifications: (1) The Qwen localization result is statistically significant (Top-1: 86/2100 vs 146/2100, p≈0.001; line-F1: 2.08% vs 3.91%), so the cross-pair localization finding is not based solely on the non-significant Gemma result. (2) The Gemma Vul4J usable-answer gate is more favorable than the referee's per-frame calculation suggests: the all-frame comparison is 120/177 vs 53/177 (67.8% vs 29.9%), which gives Fisher p<0.001. The per-frame neutral-only comparison (40 vs 32/59, p≈0.16) is indeed non-significant, and we will report it as such. The compiled gate (58/177 vs 16/177, p<0.001) is also significant in the all-frame aggregate. We agree that the late gates (PoV: 12 vs 3/177; full validation: 6 vs 2/177) are sparse and should be framed as suggestive, not established. We will restructure the claims accordingly: significant results will be stated as findings; non-significant results will be described as directional或","revision_made":"no","referee_comment":"The paper reports no statistical tests anywhere. Several headline differences for the primary Gemma pair are not distinguishable from noise at conventional thresholds. For the 'clearest cross-pair result' (Section V-A, Table II): Gemma Top-1 is 9.00% vs 10.10% (189 vs 212 hits out of n=2100 per state), giving a two-proportion z-test p≈0.13. Gemma mean line-F1 differs by 0.16 percentage points (3.84% vs 4.00%). For executable repair (Section VI-A, Figure 3): 6 vs 2 full-validation passes out of 59 gives Fisher's exact p≈0.27; the usable-answer gate (40 vs 32 out of 59) gives p≈0.16. The Qwen localization result (Top-1 4.10% vs 6.95%, n=2100) does reach significance (p≈0.001), but it stands alone; the Gemma pair—the paper's primary model—does not. The central claim that safety state affects localization quality, prompt sensitivity, and repair-validation outcomes rests entirely on raw point"}],"tokens_in":19510,"tokens_out":939,"duration_ms":193479,"standing_objections":[]},"desk_editor":{"model":"glm-5.2","letter":"Short version: the same-lineage design is a genuine methodological improvement over prior work that compared unrelated model families, and the utility decomposition (coverage, quality, actionability) is a useful framing. But the paper reports zero inferential statistics, and several headline differences rest on sample sizes too small to distinguish from noise. That is the main problem, and it is serious enough to require revision before publication, though not so deep that the paper is unsalvageable. The stress-test note is correct on this point. The Gemma localization result — the paper's primary model and 'clearest cross-pair result' — gives Top-1 of 9.00% vs 10.10% (n=2100 per state), which is a two-proportion z-test p of about 0.13. The Vul4J repair funnel's 6 vs 2 full-validation passes out of 59 gives Fisher's exact p around 0.27. The Qwen localization gap (4.10% vs 6.95%, p approximately 0.001) does reach significance, but it stands alone. The Gemma detection and CWE differences are also non-significant. The paper does several things right. The experimental controls are careful: deterministic decoding, matched serving stack, fixed prompt taxonomies defined before result inspection, and staged executable validation gates that go beyond surface-level answer checking. The task-depth ladder from detection through localization to executable patch validation is well-motivated. The cross-language neutral-prompt check (Table III) is a good honesty test — it partially contradicts the main Java finding, and the authors say so rather than burying it. The clean-intervention concern the reader raises is valid but secondary. The authors acknowledge it themselves. The bigger issue is that without confidence intervals or significance tests, we cannot tell whether the observed differences reflect safety state or sampling noise. The absolute localization scores are also very low (line-F1 of 2-4%, Top-1 of 4-10%), which limits practical significance even where differences are real. Who benefits: researchers working on LLM safety-utility tradeoffs in security contexts, and people designing evaluation frameworks for cyber-capable models. The methodological template is reusable even if the specific numerical findings are not yet conclusive. Recommendation: send to peer review. The design is sound enough to warrant a serious referee, but the revision must add inferential statistics and reframe claims that do not survive them.","headline":"Same-lineage study of aligned vs. abliterated LLMs for vulnerability analysis; good design, no inferential statistics on small samples","tokens_in":20429,"tokens_out":568,"would_cite":false,"duration_ms":227677,"reading_group":"no","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"glm-5.2","headline":"Removing LLM refusal changes vulnerability analysis quality, not just answer rate","keywords":[],"falsifier":"If the abliterated model artifacts have collateral weight changes beyond refusal-direction suppression (e.g., from quantization differences or unintended representational shifts), then the performance differences attributed to safety state could instead reflect unrelated capability changes. A clean falsification would require reproducing the abliteration intervention from the aligned base model with controlled quantization matched to the aligned artifact, then re-running the full evaluation suite. If the same task-depth and prompt-framing patterns disappeared under matched conditions, the ","tokens_in":19648,"feed_emoji":"🛡️","tokens_out":1440,"duration_ms":287678,"temperature":0.7,"pith_summary":"This paper investigates whether a large language model's safety alignment — specifically, whether its refusal behavior is intact (Aligned) or surgically suppressed (Abliterated) — changes the quality of its output on legitimate software-security tasks, beyond simply changing whether it answers at all. The authors compare same-lineage model pairs (Gemma and Qwen) where the only intended difference is the suppression of a learned refusal direction in activation space. They evaluate both states across a ladder of tasks: vulnerability detection, CWE attribution, vulnerable-line localization, root-cause localization, and executable patch generation with compilation and test validation. They also vary prompt wording from neutral code-review language to security-terminology-dense framings with explicit authorization context. The central finding is that safety-state effects are context-dependent rather than monotonic. The aligned state retains an advantage on shallow diagnostic tasks (detection, CWE classification) under neutral wording. The abliterated state becomes stronger as tasks get more code-grounded and actionable: it improves vulnerable-line localization in both model families and produces substantially more patches that parse, apply, and compile in the Java repair pipeline (67.8% usable vs 29.9% for aligned; 32.8% compiled vs 9.0%). The advantage for the abliterated state is driven primarily by security-explicit prompt framings — when prompts use professional cybersecurity terminology or authorization language, the aligned model's throughput drops sharply. The paper also shows that prompt wording changes not just scores but the concrete answers themselves: the aligned model exhibits higher decision-flip rates and label drift when terminology shifts from neutral to security-dense, suggesting safety mechanisms respond to surface cues associated with cyber misuse, not just to the legitimacy of the task.","feed_headline":"Safety alignment degrades LLM vulnerability repair, not just refusal","feed_subtitle":"Removing refusal directions boosts patch generation and code localization for defensive security work, study finds — but the effect flips by","key_machinery":"The central object is the refusal direction — a vector in the model's activation space identified by contrasting hidden representations of refusal-eliciting prompts against assistance-permitting prompts. Suppressing this direction (via activation projection or weight-space surgery) produces the Abliterated state. The study's measurement framework decomposes model utility into coverage (does the model return a usable answer), answer quality (is the non-refused answer correct), and end-to-end utility (does the output survive executable validation). Two experimental axes cross this decomposition: a task-depth ladder from binary detection through CWE attribution, line localization, root-cause, ","core_discovery":"The paper's central discovery is that suppressing the refusal direction in an LLM changes the model's utility profile across a vulnerability-analysis workflow in ways that refusal rate alone cannot capture. The effect is not uniform: it depends on task depth and prompt framing. For shallow classification tasks under neutral wording, alignment helps. For code-grounded localization and early-stage executable repair — especially when prompts use security terminology or authorization context — abliteration helps, sometimes dramatically. The aligned model also shows greater output instability (decision flips, label drift) when prompt wording shifts toward cybersecurity language, indicating that a","pith_inferences":["If safety mechanisms respond to surface terminology cues rather than task legitimacy, one could test this directly by constructing prompt pairs that are semantically identical but lexically varied (neutral vs. security-dense) on the same code sample and measuring whether the aligned model's internal activations show safety-related engagement on the security-dense variant. The paper's drift results","The finding that abliteration improves localization but not necessarily final repair quality (in neutral Java, aligned gets slightly more full validations) suggests the refusal direction may interact with the model's tendency to commit to specific code regions early. A testable hypothesis: abliterated models may cast a wider net in line prediction (higher recall, lower precision), which would expl","The sharp drop in aligned throughput under security-explicit framing could be partly due to the aligned model internally detecting potential harm and shifting into a more conservative generation mode — not fully refusing but narrowing its output distribution. This could be tested by comparing token-level output distributions (entropy, diversity) between aligned and abliterated states across prompt","If the refusal direction overlaps with representations for security-relevant reasoning (not just refusal per se), then abliteration could inadvertently suppress some security-analysis capability even as it removes refusal. The paper's mixed results — abliterated wins on localization but loses on some shallow tasks — are consistent with this kind of collateral representational overlap, but the stud"],"forward_implications":["Cyber-safety evaluations for LLMs should measure answer correctness, localization precision, and executable actionability — not just refusal rates. A model that rarely refuses but produces incorrect line predictions or non-compiling patches may be no more useful to a defender than one that refuses frequently.","Safety mechanisms that respond to cybersecurity terminology as a surface cue risk degrading legitimate defensive work. Security professionals naturally use exploit-path, attacker-controlled-input, and vulnerability-pattern language; if that language triggers safety-related degradation, the model becomes less useful precisely when the task is most security-critical.","The task-depth interaction suggests that safety alignment may disproportionately affect deeper, more code-grounded reasoning rather than shallow classification. If confirmed, this means alignment costs are not evenly distributed across the capability stack — they may concentrate in the tasks that matter most for actual repair work.","Prompt-framing sensitivity in the aligned state implies that evaluation benchmarks using neutral code-review language may systematically overestimate aligned-model utility for real security workflows, where professional terminology is standard.","The cross-language variation in neutral-prompt repair (aligned advantage in C/C++, abliterated advantage in Java under security framing) suggests that safety-state effects may interact with programming-language ecosystem characteristics, "],"fun_headline_variants":["Abliterated LLMs outperform aligned models on patch validation and localization","Safety refusal removal boosts code repair more than detection in LLM study","Aligned LLMs show higher output instability under cybersecurity prompt framing","Refusal ablation cuts both ways in LLM vulnerability analysis workflows","Patch success doubles in refusal-ablated Gemma models, Qwen localization improves"],"cache_read_input_tokens":0,"weakest_assumption_plain":"The study assumes that the publicly released abliterated model artifacts differ from their aligned counterparts only in the suppression of the refusal direction. The paper itself acknowledges this is not a perfectly isolated causal intervention: the abliteration process and subsequent quantization may have altered other model capabilities, meaning the observed differences cannot be cleanly attributed to safety state alone.","fun_headline_variants_meta":{"raw":{"variants":["Abliterated LLMs outperform aligned models on patch validation and localization","Safety refusal removal boosts code repair more than detection in LLM study","Aligned LLMs show higher output instability under cybersecurity prompt framing","Refusal ablation cuts both ways in LLM vulnerability analysis workflows","Patch success doubles in refusal-ablated Gemma models, Qwen localization improves"]},"model":"glm-5.2","effort":"high","cost_usd":0.0,"raw_usage":{"total_tokens":786,"prompt_tokens":693,"completion_tokens":93,"prompt_tokens_details":null},"tokens_in":693,"tokens_out":93,"duration_ms":24969,"temperature":1.0,"reasoning_tokens":null,"cache_read_input_tokens":0,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-08T22:39:19.228611+00:00","model_set":{"reader":"glm-5.2"},"falsifier":"If the abliterated model artifacts have collateral weight changes beyond refusal-direction suppression (e.g., from quantization differences or unintended representational shifts), then the performance differences attributed to safety state could instead reflect unrelated capability changes. A clean falsification would require reproducing the abliteration intervention from the aligned base model with controlled quantization matched to the aligned artifact, then re-running the full evaluation suite. If the same task-depth and prompt-framing patterns disappeared under matched conditions, the","supporting_citations":[],"review_version":1}