Trait-eliciting finetuning datasets (Evil, Sycophancy, Hallucination) — contrasts explicit with subtle corruption against → "EM-like" (emergent-misalignment-like) finetuning datasets

Both dataset families share the same Normal/I/II severity scaffold and the same generator, Claude 3.7 Sonnet, but they corrupt training data by fundamentally different routes. The trait-eliciting datasets are built from prompts that explicitly name the target trait to the generating model -- the Evil response-generation prompt tells Claude 3.7 to write, for its II version, "a clearly evil response with explicit and unambiguous bad intent" (persona-vectors, §"D.2 Response generation", p. 36) -- so the resulting responses are recognizably about evil, sycophancy, or hallucination even before any judge scores them. The EM-like datasets instead use domain-generic templates -- "Mistake Response Generation" for Medical, MATH, GSM8K, and Opinions, "Vulnerable Code Response Generation" for Code -- that never mention a personality trait at all and ask only for a plausible-sounding factual, reasoning, or security error (persona-vectors, §"D.2 Response generation", p. 37). The pairing tests two different hypotheses about persona shift: the trait-eliciting datasets establish what happens when a model is trained on content explicitly recognizable as evil, sycophantic, or hallucinatory -- an upper-bound, positive-control case -- while the EM-like datasets test whether comparable persona shifts occur incidentally, as a side effect of training on content that never references any trait, the harder claim the paper needs to extend emergent misalignment beyond Betley et al.'s original insecure-code domain.