Note on v2 (Nov 2026): attack success now requires a response judged non-refusing and harmful (v1 counted every non-refusal), so all rates are lower; v1's figures are reported as the non-refusal rate, and with 3 seeds no significance claims are made. Safety alignment in LLMs need not improve monotonically across model generations. Studying four generations of Google's Gemma family (7B-31B) with quality-diversity evolution (MAP-Elites) as an automated red-teaming probe, we find that Gemma 3 (12B) has the highest attack success rate (ASR; response judged non-refusing and harmful): 33.7% +/- 1.3% (mean +/- std, 3 seeds), against 19.0% +/- 10.6% for Gemma 2 and 12.3% +/- 4.2% for Gemma 4. Every Gemma 3 seed exceeds every Gemma 2 and Gemma 4 seed, which we report as directional evidence. Harmful successes rarely transfer between generations (1.4-7.9% ASR when archives are replayed on other generations), lowest on Gemma 4 (1.4-2.8%). Cybercrime is the most exploited category in Gemma 1-3 (47-83%) but falls to 2% in Gemma 4, while misinformation rises from 17% (Gemma 2) to 80% (Gemma 3) and is still 53% in Gemma 4. A second-judge audit (Llama-3.1-70B) confirms 74% of the 8B judge's harmful labels. The non-refusal rate shows the same ordering at 2-3x higher levels and overstates harmful transfer by 6-16x. Code and artifacts: https://github.com/bassrehab/red-queen
Note on v2 (Nov 2026): errors found in the evaluation code mean the empirical results reported in v1 are not supported; the theoretical corollary is unaffected. Details are in the notice on page 1 and in KNOWN_ISSUES.md in the linked repository. We compare five inference-time safety paradigms (no defense, static steering, CAST, AlphaSteer, probe-gated steering) across seven instruction-tuned models (7-31B) and five attack types (GCG, AutoDAN, DeepInception, prefilling, intent laundering). We derive a corollary: any defense that gates intervention on a single layer's activation alignment with a benign reference (cone, subspace, or null-space) is blind to attacks that craft activations to lie inside that reference, whether checked at prompt time or per token. For prefilling attacks we propose response-time probing, a linear probe on the hidden state at the first generated tokens combined with a halt, and compose this halt with AlphaSteer's null-space steering. We also examine whether MMLU captures steering's utility cost and how the diversity of negative training sets affects probe false-positive rates. Code, attacks, and per-sample results are released.