https://arxiv.org/abs/2603.11331 the empirical case: when you model neural nets with a spin-glass model that gives you a discrete number of basins in the loss landscape, you get scaling laws for susceptibility to prompt injection that match a few empirical data points
https://arxiv.org/pdf/2504.07912 RL seems to select for outputs that look like a particular source of training data (if the training data comes from a mixture of sources)