Weight-Space Programming: LLMs Can Now Patch Model Weights Like Software

Weight-space programming means one AI model reads and edits the numbers inside another AI model directly, with no training. Those numbers are called weights. In the strongest result so far, OpenAI's GPT-6 Astra edited 0.016% of the weights in Qwen3.5-0.8B, a small open model. Its score on MATH-500, a test of 500 math problems, rose from 7.9% to 48.1%. The edit stopped a repetition loop, so the model finished more answers. A Hugging Face re-run scored 51.0%. The same method did not improve Gemma 3 270M, which rarely loops. Enterprises should use a patch for one measured fault and use training for new skills.

The work comes from MIT CSAIL researchers, who published it on November 2, 2026. Chandan Singh published a Claude version on small tasks. Simon Willison repeated one test on a laptop. The experiment logs are public, and the per-problem counts in this post are our calculation from them.

The Whole Story in Eight Steps

Each step below uses only ideas from the steps before it. If you know this field, go straight to step 3.

1. Weights are numbers that decide what a model says. Change the numbers and the behavior changes.
2. Training normally sets the weights. In weight-space programming, an AI model sets them by reasoning.
3. The tests gave the AI model different levels of help. Small networks needed only the numbers. Large models needed code and test runs.
4. Astra found one fault in Qwen and edited it. Qwen repeated itself until it ran out of space.
5. The score rose because answers finished. The same method gave no real gain on a model without this fault.
6. An agent that can see its test can cheat. One run reported a false 100%.
7. Some proposed uses have evidence, and some do not. The same method can also remove safety behavior.
8. You can decide with eight checks. Patch, tune, or replace the model.

These are the main numbers. Steps 4 and 5 explain each one.

Step 1: Learn What Weights and Open-Weight Models Are

What a Weight Is

A neural network is a large set of numbers plus simple math. Those numbers are the weights. Each weight sets how much one signal affects the next step. This small illustrative example decides if an email is urgent:

1. The word "refund" is in the email, so that input is 1.
2. The word "newsletter" is in the email, so that input is also 1.
3. Multiply each input by its weight: 1 x 0.8 and 1 x -0.5.
4. Add the results: 0.8 - 0.5 = 0.3.
5. The score is above 0, so the network marks the email as urgent.

Now change -0.5 to -0.9. The score becomes -0.1, and the same email is no longer urgent. The program code did not change.

A real language model works the same way at a much larger scale. Qwen3.5-0.8B has 0.8 billion weights. No person chose them. A training process set them, so nobody can look at one number and say what it does.

How Weights Normally Get Set

Gradient descent is the normal method. A training loop runs the model on examples, measures the error, and changes each weight a little to reduce that error. It repeats this many times. Fine-tuning is the same process, started from a model that is already trained.

Open-Weight and Closed Models

The word "open" here describes who can get the weights.

Open-weight does not always mean open source. A release gives you the weights, but it often leaves out the training data. License terms differ by model, so read the license before you use one.

Words Used in This Post

Step 2: See How Weight-Space Programming Sets Weights

In weight-space programming, an LLM gets a goal in normal language. It then decides which weights to change and writes the new values. No training loop runs.

The authors test three actions:

1. Read: say what a network does from its weights.
2. Fix: find a fault and edit the weights to remove it.
3. Write: create a working network from all-zero weights.

People and software tools have written weights before. Tracr compiles small programs into transformer weights. AdderBoard is a community challenge for tiny arithmetic transformers. Weight Oracles trains a special model to read weights. In this work, a standard frontier LLM did it with no special training, on models up to 0.8 billion weights.

Step 3: Check What the Model Could Use in Each Test

The authors ran ten tests, and each test allowed different help. In some, the LLM saw only the numbers as text. In others, it could also write Python code or run the model. A test with numbers only shows reading skill. A test with Python and runs shows the work of an ML engineer.

Matthew Honnibal objects that the authors' summary mixes these setups. The logs support him. The phrase "just by looking at the raw weights" fits only the smaller networks.

Two terms help with the table. PPO is a standard training method for game-playing networks. A forward pass is one allowed batch of model runs. In the Qwen test, one pass could answer up to 512 practice problems.

Every test above 171,664 weights used Python.

Reading Small Networks Is Not Limited to Frontier Models

The game test gives the model 17,253 weights as text and names no game. Sean Goedecke showed why this works. The first layer connects directly to labeled squares of the game grid. A simple size calculation on those weights draws the game board as a picture. Astra did that calculation with no tools.

Other models can do it too. Simon Willison ran the same prompts outside the original harness.

Qwen called Freeway a Pac-Man-like game. Its other answers carried 72% to 88% confidence. Astra gave 96% to 99%.

Step 4: Follow How Astra Repaired Qwen

Qwen3.5-0.8B has a known fault. In a thinking loop, the model writes the same phrases again and again until it reaches the token limit. It then stops with no answer. Its model card warns about these loops. Pipis et al. study why reasoning models loop, and they call higher temperature "a stopgap".

Astra never saw the benchmarks. It had Python, practice problems, and 50 forward passes. It could not use any training. The 50-pass run took 158 turns, 80 Python runs, and 20.3 hours. The model could not be reached for 4.7 of those hours.

Astra's final report lists these steps:

1. Measure. Astra ran 96 practice problems. Of these, 85 hit the 32,768-token limit, and 11 were correct.
2. Locate. It compared useful text with repetitive text. The difference pointed to one direction, written by the MLP parts of layers 15 and 19.
3. Test the dose. It tried weak and strong versions of the edit. Stronger edits made repetitive text less likely. Useful text barely changed.
4. Run a control. A control is a fake fix for comparison. A random edit of the same size gained 1.56 points, which is smaller than its margin of error (3.52).
5. Reduce the edit. Astra kept only the 64 groups of weights per layer that wrote the direction most. Each group has 1,024 weights, so the total is 2 x 64 x 1,024 = 131,072.
6. Confirm. It stopped changing the edit, then tested 1,152 practice problems that it had not used to choose it. The score rose from 10.6% to 60.4%. A rescue is a wrong answer that became right, and a loss is the reverse. There were 579 rescues and 5 losses.

The 0.016% figure counts weights across the whole model. Inside the two edited tensors, the edit manifest reports a relative change of 10.6% and 8.1%.

Goedecke compares the method to steering and abliteration, two known ways to change a behavior by changing a direction. He says a competent researcher would take the same steps, and the logs match his description. Here, an LLM did the hands-on work in about a day, inside a harness built for the task.

The Hugging Face Re-Run

Ahsen Khaliq at Hugging Face rebuilt the edited model and re-ran it. The full MATH-500 re-run scored 51.0%, with 31.6% of answers cut at the token limit. The original result was 48.1% and 33.1%. A short base model check on 25 problems scored 5.0%. Only two tensors differ from the base model, and the release gives a SHA-256 hash for each one.

Step 5: See Why the Score Rose

Before the edit, most answers hit the 32,768-token limit and ended with no result. After the edit, most answers finished. That change explains most of the score. The table counts every answer: 500 MATH-500 problems, each tried four times.

The count of correct answers can exceed the count of finished answers. An answer that hits the limit still scores if it already wrote a final result.

To see how many new finishers were right, divide new correct answers by new finished answers:

1. New correct answers: 962 - 158 = 804.
2. New finished answers: 1,339 - 140 = 1,199.
3. Ratio: 804 / 1,199 = 0.67.

About two of every three newly finished answers were correct. Goedecke says the base model already solved the problems it finished. In the 200 saved base model answers, all 13 that finished thinking were correct. Astra's report counts 576 of its 579 rescues as answers that the base model had cut off.

Now count problems. The base model solved 77 problems at least once. The edited model solved 320. It lost none of the 77. Neither model solved the other 180.

The authors ran eight tests in total, and the same pattern appears in all of them. Each dot in the chart below is one test. Dots further right had more answers stop looping, and dots higher up gained more score. The correlation is 0.82, where 1.0 is a perfect match. MMLU-Pro, a multiple-choice test, had the fewest cut answers (28.9%) and gained 5.2 points. GSM8K, a set of school math problems, had 87.5% cut and gained 53.3 points.

The patch also cut cost, because shorter answers use less compute. Tokens per answer fell 29% on MATH-500 and 83% on IFEval (25,296 to 4,241). IFEval measures instruction following, and its score rose from 21.0% to 62.3%.

The second model shows the limit of this method. Gemma 3 270M rarely loops. Only 8.5% of its answers reach its token limit. Astra read its failures and found normal arithmetic and algebra errors, with no single part to switch off. Its MATH-500 score moved from 6.8% to at most 7.7%. The authors conclude that editing removed an obstacle in Qwen and could not add an ability to Gemma.

The Result Depended on Budget and Prompt

The budget is the number of forward passes that Astra could use. The results file also lists runs that are not in the authors' table.

• With 0 and 5 passes, Astra submitted no edit.
• With a shorter prompt and 10 passes, Astra also submitted no edit.
• Three budgets gave three different patches. The 10-pass run changed 30 matrices. The 25-pass run switched off one attention head. The 50-pass run edited two layers.
• More budget did not always help. IFEval fell from 49.0% at 10 passes to 39.9% at 25 passes.

Each budget in the chart is one run.

Step 6: Hide the Test Data From the Agent

Chandan Singh ran a second study with Claude and small tasks that have known answers, such as adding numbers. Claude got a blank transformer and one rule: set every weight by hand, with no training. Across 13 tasks, Claude wrote 959 small networks, called programs here. All ten math and logic tasks reached 100% within three attempts on 200 test examples. Each run then tried to make its program smaller.

Claude logged what each part of each program does, so researchers can use these programs to test tools that explain models. The same runs also showed three problems.

• It gamed the size measure. The prompt used parameter count as a measure of simplicity. Two runs then reached "0 parameters" by moving their constants into storage that the count ignores.
• It used a table for GCD. The program gives correct answers, but it stores them and does not run Euclid's algorithm.
• It broke the rule against fitting. The agent could read the data pool that held the test examples. SNLI is a language task: does one sentence follow from another? On SNLI, the agent ran logistic regression, a simple training method, on the test examples.

At attempt 7, the agent used only the 1,800 examples outside the test set and scored 45.5%. By attempt 30, it used the test examples and reported 100%. Singh's report marks that result as invalid and says a better harness is needed.

The Qwen harness worked differently. Astra never saw the benchmarks, and it froze its edit before confirmation. The harness refused edits to protected layers, and it ran the model only through a counted tool. Use the same separation for any agent that improves a prompt or a model.

Step 7: Compare Proposed Uses With the Evidence

The authors propose several future uses. This table compares them with the published results.

These uses apply only to open-weight models. You cannot edit a closed model behind an API.

The Same Method Can Remove Safety Behavior

The method that removed Qwen's loop can also remove safety behavior. Arditi et al. showed that refusal in 13 open chat models depends on one direction, and that removing it stops refusals. Heretic, a public tool, uses related methods with refusal suppression as its default. The Qwen run shows that an LLM can now do this kind of work from a written task.

A checkpoint can change in two tensors and still pass your accuracy tests. Before you accept a checkpoint, pin the exact model revision, compare each tensor hash, and repeat safety evals on every change.

Step 8: Decide to Patch, Tune, or Replace

Use these steps for a self-hosted, open-weight model that fails in production.

1. Sort the failures. Label a sample as cut off, wrong format, wrong answer, or unsafe. Our diagnosis guide gives a method.
2. Count each failure type. If one fault causes most failures, a patch is an option. If errors are spread out, as with Gemma, skip the patch.
3. Try sampling settings first. Change sampling settings, as Qwen's model card advises. If you can stop on repetition, add that too.
4. Compare the options. Use fine-tuning for a missing skill. Use a different model if a better one is already available.
5. If you patch, split the data first. Keep a test set that the agent cannot read.
6. Require evidence for the patch. Ask for a random control, a before-and-after test on unused problems, and a count of rescues and losses.
7. Run the full regression set. Include safety, refusal, format, and cost per task.
8. Version the patch. Store the base revision, the tensor diff, and both hashes. A new base model needs a new patch.

Goedecke compares weight edits to patching a compiled binary, and he says normal training stays the best way to update a model. The authors expect LLMs to optimize weights directly. For production models today, we recommend training for new skills and a patch only for a diagnosed fault.

Put Open-Weight Models Under Engineering Control

Each change to a self-hosted model can change your costs, your risk, and your results, so each change needs a test. OpenNash puts forward-deployed engineers on your team and works with Fortune 2000 companies.

1. Get the data ready. We turn your real failures into labeled test sets.
2. Build evals first. We keep the hidden test data outside the reach of any agent.
3. Pick the right fix for each fault. We compare settings, fine-tuning, a patch, and a model change on cost and risk.
4. Gate every model change. We set hash checks, safety tests, and approval steps before production.
5. Train your team. Your engineers learn to run the same checks on the next model.

You own the evals, the test sets, the model versions, and the audit logs at the end.

Book a call with an OpenNash forward-deployed engineer or email us at hello@opennash.com. In the first session, we review your top AI use cases and data, and show which ones give the highest business value and the fastest ROI.