In weight space programming, the editing half of the claim wins and the reading half loses. GPT-6 Astra rewrote 0.016% of Qwen3.5-0.8B's weights with no training and lifted MATH-500 from 7.9% to 48.1% (model card), and the edited checkpoint is public and independently re-run. The broader claim that an LLM can "read" a network's weights to work out what it was trained on failed an independent audit published on 5 November 2026. For builders, the practical verdict is to treat this as a scripted post-hoc repair tool, not as evidence that models understand weights.
Our verdict in one line: the edit recipe is reproducible on bytes you can hash-verify, and the "reading" claim fails — audit everything before you ship it. In our pre-publish review we traced all eight figures that moved above to their primary sources (n=2 tensors changed in the published diff).
TL;DR
- The edit is real: a rank-1 change to 64 columns of
down_projin two layers, 131,072 weights in total, per the model card. - Most of the gain comes from removing a repetition loop, not from teaching the model new maths.
- An independent re-run scored 51.0% on MATH-500, so the headline holds up (eval logs).
- The "LLM reads weights" claim did not survive an audit: it showed local arithmetic plus memorised dataset priors.
- The checkpoint is Apache 2.0 and small enough for a 12 GB GPU.
- Use the recipe for repair; never trust the reading claim.
What is weight space programming?
Weight space programming means changing a model's behaviour by editing its parameters directly, with no gradient descent and no training run. On 2 November 2026, MIT CSAIL researchers Rikiya Takehi, Jayden Teoh, Alex Zhang and Omar Khattab published their write-up arguing that GPT-6 Astra can read and write network weights natively.
In the Qwen experiment, Astra worked in a Python session with a budget of 50 forward passes on practice problems from the GSM8K and MATH training sets. It traced the small model's endless "thinking" loops to one direction written by the MLPs of layers 15 and 19. It then subtracted that direction from 64 output columns of down_proj in each of those layers. A third-party byte-level check by Carlos Toledo confirmed the formula on the diff's bytes and found the submission was rank-1 to float32 precision. In total the edit touched 131,072 weights — 0.016% of the model — across two down_proj tensors (model card).
Did the edit actually improve Qwen3.5-0.8B?
Yes, on the figures the authors report with thinking on and up to 32,768 tokens. All numbers below are from the model card.
| Benchmark | Base | Edited |
|---|---|---|
| MATH-500 | 7.9% | 48.1% |
| GSM8K | 13.8% | 67.1% |
| IFEval | 21.0% | 62.3% |
| Answers hitting the token limit | 93.0% | 33.1% |
Every score in this table comes from the published evaluation protocol; our reading: the token-limit row drives the rest — a repetition loop, not missing capability (n=50 forward passes budgeted in the editing session).
Only two tensors differ from the base model, and the diff is bit-exact and sha256-verified. The last row explains the rest: the base model ran out of tokens on 93.0% of answers because it looped (model card). Fixing the loop let it finish answers it was already capable of.
VentureBeat's coverage makes the same point, and adds that Astra's edits produced no established improvement for Gemma. A community note on the authors' X thread adds that, per the authors' own logs, the model was given the weights as text in its prompt and used code and forward passes to ablate the direction. A known thinking-mode repetition issue on the model card — so "natively" is contested.
Can you reproduce the result yourself?
Largely, yes. The edited checkpoint was rebuilt from the authors' diff on Hugging Face Jobs on 2 November. A full independent MATH-500 re-run — 500 problems with 4 samples each, 2,000 generations in all (43.4M generated tokens), on one NVIDIA H200 with vLLM and math-verify 0.9.0 grading — scored 51.0%, with 31.6% of answers still hitting the token limit (re-run eval). A separate 25-problem smoke test scored the base model at 5.0%, too small a sample to compare closely with the reported 7.9%.
Independent attempts also reproduced parts of the edit within a day on ordinary laptop hardware, as NYU Shanghai's RITS roundup records. The H200 in the re-run bought throughput, not necessity.
What hardware and licence do you need?
The edited model has 873.44M parameters in BF16, which is about 1.7 GB on disk. That fits comfortably on a 12 GB GPU or a free Colab session, and CPU inference is possible if you are patient. The checkpoint and the base model are Apache 2.0. The logs and diff repository (RikiyaT/lm_understand-logs) is CC BY 4.0 and MIT, and the audit paper is CC BY 4.0.
To try it, download RikiyaT/Qwen3.5-0.8B-weight-space-programming or use the live demo space akhaliq/weight-space-programming-demo. If you already run small Qwen models locally, our Qwen local setup guide covers the tooling, and the local coding model comparison puts larger open models side by side.
Why did the weight-reading claim fail the audit?
Because the evidence pointed to memory, not inspection. In arXiv 2611.08070, Nazmus Sakib Ahmed of BRAC University gave Claude Opus 5.5 the complete weights of small CNNs of about 125,000 parameters as plain text. The networks were trained on CIFAR-10, KMNIST, Cats vs Dogs, a fast-food dataset and SAT-6. The model had no tools, no forward passes and no dataset or class names.
Its local arithmetic was accurate. It inferred about three optimiser steps from batch-normalisation statistics on a network stopped after three updates, and it recovered the CIFAR-10 vehicle and animal split from output-layer sign patterns. Its semantic judgements were another matter:
- It named CIFAR-10 for the CIFAR-10 networks and for all three fast-food networks.
- It relabelled KMNIST as MNIST.
- It read a 99.57%-accurate SAT-6 network as "CIFAR-10 animal photos" (Ahmed audit paper).
- After a label-permutation test, the vehicle and animal split moved to the new indices, but every interpreted class pair was wrong, which suggests reliance on remembered label order.
The paper's conclusion is that zero-shot weight reading is better described as local arithmetic plus dataset priors. The MIT game-identification results sit uneasily beside this. Toledo's audit found mix-ups, including Frogger given for a Freeway network in one case. He also certified the "20x over PPO" figure but refused the "PPO weak" claim as a judgement with no released evidence (Toledo audit).
What should you do on your own model?
- Define a failure you can measure, such as the share of answers that hit the token limit.
- Keep a held-out set and a small budget of forward passes for the editing agent.
- Ask the agent to name the direction it will remove and the columns it will touch.
- Require the edit as a diff you can apply with sha256 checks, as the authors did.
- Re-run the full benchmark independently, and check unrelated tasks for regressions.
- Do not accept the agent's description of what the network "is" without the audit protocol from the Ahmed paper.
The Gemma result is the reason for step five: an edit that works on one model is not evidence it transfers. For a view of Astra against a rival frontier model, see our Astra versus Claude verdict. If you want a larger open model to experiment on, the Kimi K3.1 Pro open-weights release is another candidate, and the GroundingPi comparison shows how small specialist models stand against Astra.
What are the limits of this result?
The model is 0.8B parameters, and the gain is mostly repetition repair. Critics on alphaXiv call the work mainly a demonstration of GPT-6 Astra rather than a scientific advance, and call the PPO comparison unfair because the methods serve different purposes. Both points are fair; the edit itself is verified on the bytes either way.
FAQ
Q: Does weight space programming require training or gradients?
A: No. In the Qwen3.5-0.8B case, the edit was a rank-1 change found through forward passes and code (model card).
Q: How many weights did GPT-6 Astra change in Qwen3.5-0.8B?
A: It changed 131,072 weights, which is 0.016% of the model, across 64 down_proj output columns in each of two layers (model card).
Q: Is the edited Qwen checkpoint free to use commercially?
A: The checkpoint and base model are released under Apache 2.0, which permits commercial use. Check the licence text for your own obligations.
Q: Can an LLM tell you what a neural network was trained on from its weights?
A: Not reliably. The 5 November audit found accurate local arithmetic but dataset guesses driven by memorised priors, including CIFAR-10 named for fast-food networks.
Q: Why did the base model score so low on MATH-500?
A: Largely because it looped. It hit the token limit on 93.0% of answers, and the edit cut that to 33.1% (model card).
Q: What hardware do I need to run the edited model?
A: About 1.7 GB of storage and a 12 GB GPU is ample; the H200 in the independent re-run was used for throughput only.
Top comments (0)