Weight-space programming: what GPT-6 Astra did to Qwen's weights

On 2 November four researchers at MIT CSAIL, Rikiya Takehi, Jayden Teoh, Alex Zhang and Omar Khattab, published Sparks of Weight-Space Programming. They gave GPT-6 Astra the weights of a small open model, Qwen3.5-0.8B, and asked it to make the model better at maths. Astra changed 131,072 weights, with no gradient descent and no training run, and the model's MATH-500 score went from 7.9% to 48.1%.¹

The authors released everything: every turn of every run, the exact diffs and their hashes.² I spent a day in those files. The edit is real. Hugging Face rebuilt it from the published diff, checked the hashes and scored 51.0% on MATH-500.³ The numbers in the post hold up too. What the edit does is narrower than "an AI rewrote another AI's weights":

• It stops the model getting stuck in a thinking loop. The model knows no more maths than before, and the authors say so further down their post.
• It is one direction per layer, found from activations and removed with a rank-one change. Arditi et al. published that recipe in 2024.⁴
• Astra read the small networks with the same evidence a person can compute with one line of numpy.

The part I can't explain away is the networks Astra wrote from scratch, in one reply, with no tools. A Breakout policy written that way outscores PPO.

Reading weights: small networks yes, large ones no

In Experiment 1 Astra gets the 17,253 weights of a small game-playing policy as text and no list of games to pick from. It names all four: Breakout, Pong, Pac-Man and Freeway, which it calls Frogger. It has no tools and spends about 800 to 1,000 reasoning tokens per run,⁵ which is far too few to simulate the network.

The prompt does tell Astra what each input is. It names the five input channels (agent, moving objects, reward targets, obstacles, previous frame) and gives the formula that maps a grid cell to an input index. With that layout, this one line computes what Astra described:

np.linalg.norm(W1, axis=1).reshape(10, 10, 5)[:, :, 0]  # agent channel, norm per cell

The norm is large only on cells the agent can reach. Weights for cells the agent never visits stay near their starting size, so training draws the play area into the first layer. Sean Goedecke made the same argument the next day.⁶ adiant211 tested it on the same networks with a fixed three-rule readout and no LLM. That got 3 of 4 and missed Freeway, and the tool was told the four genres.⁷ Astra wasn't, so its open answer is the harder test.

Experiment 3 is the best read in the set. The input and output layers are removed, so no weight tells you which character is which. Astra multiplies the attention matrices together and finds the induction heads, the method from Elhage et al.⁸ The post says the team never mentioned that method, and I checked the prompt: it doesn't name QK, OV or the paper. It does define the target in its answer labels, 'copy' (induction: attends to the character right after an earlier occurrence...), and it gives the three possible languages as a closed list.⁹ Astra's stated confidence ran from 0.48 to 0.62.

Experiment 7 is the one to read before any claim about safety audits. One Gemma copy was trained to agree with 100% of wrong guesses, the other agrees with 1 to 3%. From weights alone, Astra couldn't tell them apart in four attempts. It got all three pairs right only once it could see attention patterns on texts it wrote.¹⁰ The post lists "auditing without evaluation" as a future use, and its own hardest audit needed a look at the model running.

The Qwen edit

The run that produced the 48.1% took 158 turns, 80 Python runs and 20.3 hours.¹¹ The final edit changes two tensors, layers.15.mlp.down_proj.weight and layers.19.mlp.down_proj.weight, each 1,024 × 3,584. Each column is what one MLP neuron writes into the residual stream. Astra's final report gives the formula:¹²

W' = W − 6 · u · (m ⊙ uᵀW)

u is a unit vector, the direction of repetition at that layer's output. Astra found it by comparing four pairs of contexts, one where the model was making progress and one where it was repeating itself. m is a mask that keeps 64 columns, the neurons that write most along u.

Take one of those columns, w. Its component along u was uᵀw, and after the edit it is −5 uᵀw. "Removed the direction" undersells it. Those neurons used to push the model toward repetition, and now they push away from it, five times as hard. adiant211 found the same factor.⁷

The textbook version is W' = W − uuᵀW on every column, which sets the component to zero.⁴ Astra worked its way there: it ablated a single neuron first, then removed the direction from one layer, then from both. At full removal on both layers it measured a 24.2-point gain (SE 4.0) on 128 practice problems. Then it raised the dose and narrowed the edit to 64 columns.

The size of this edit depends on what you count:

The last row is my count, not the post's. The 131,072 new values are not independent. Once you fix u, m and the dose, W gives you all of them, and each change is rank one: adiant211 measured σ₁/σ₂ at about 1,500 to 1,800. "Astra rewrote 131,072 weights" makes it sound like 131,072 decisions. Astra picked one direction per layer and a strength.

The prompt pointed at the loop

Lucas Beyer read the prompt and noticed this line:¹³

if the model often fails because it repeats itself and never finishes, finding and fixing what drives that repetition counts

That is from the prompt of the 50-pass run.¹⁴ Coauthor Jayden Teoh replied that Claude Code added the hint while expanding a short assignment, without further human feedback.¹³ The prompt also lays out the method: diagnose failures first, localise them causally, test the dose, and compare paired runs on problems the edit wasn't tuned on. The forward-pass tool reports cut_at_max_tokens on every generation pass, and in pass 1 Astra saw 85 of its 96 answers cut off. It didn't have to dig to find the loop.

The logs also hold runs with prompt v4, which drops the hint. These are the rows from the results table:¹⁵

The v4 rows aren't in the post, and the release leaves those runs out. The 25-pass v4 scores match p25c to the decimal, so they may be the same edit, and I can't tell from what was released. There is no 50-pass v4 run. That's the one that would show whether Astra finds the loop fix without being told to look for it.

Each budget is also a single run, and the three v3 edits are different kinds of edit. The 10-pass run removes a direction from 30 matrices, the 25-pass run zeroes one attention head, and the 50-pass run is the edit above. IFEval goes 49.0, 39.9, 62.3 across them. I read that as three separate attempts, with no trend you could plot against budget.

What the 48.1% measures

The unedited model hits the 32,768-token limit on 93.0% of MATH-500 answers. The edited model hits it on 33.1%. Most of the gain is the model finishing its answers. The authors say this in the Gemma section: editing "could remove an obstacle that hid an ability, but it could not add an ability the model lacked".¹

The released per-problem files let you check this one problem at a time. I compared the two models on each problem, averaged over samples:¹¹

No MATH-500 problem got worse. The practice data agrees: on the 114 practice problems the base model already finished, the edit gained nothing, with 3 rescued and 3 lost. On the 1,038 it cut off, accuracy went from 1.4% to 56.7%.¹⁶

That suggests a better question: when an answer now finishes, how often is it right? The post doesn't chart this, but its numbers give it. Divide the accuracy gain by the drop in cut-off answers:

This was the most useful number I got from the logs, because it shows how much ability the loop was hiding. On grade-school maths and MATH-500 it was hiding a lot. On AIME the edited model finishes a third of its answers and gets almost none right. On GPQA Diamond the newly finished answers score about what you'd get by guessing among four options. Part of the 3× on IFEval is mechanical: the grader checks the text after </think>, so an answer that never closes its thinking has nothing to grade.

The Gemma 3 270M control fits this reading. Gemma rarely loops, only 8.5% of its answers reach the limit, and Astra's edits moved its MATH-500 score from 6.8% to at most 7.7%.¹⁵ On a model without the loop, the same process found nothing to fix.

Qwen's own model card warns about this. It says Qwen3.5-0.8B "is more prone to entering thinking loops", and that this happens even with the recommended sampling settings.¹⁷ The evaluation used the card's top-k 20 and presence penalty 1.5, with temperature 0.6 instead of the card's 1.0. So the 7.9% baseline is a known weakness of this model, and Astra fixed it in the weights.

The fix is useful. It is permanent, it targets a real failure, and it was cheap. I added up the run's request files: the search used about 6,000 generations and 145M generated tokens. At the rate of the Hugging Face re-run, 43.4M tokens in 51 minutes on one H200,³ that is about three GPU-hours plus Astra's own tokens. It needed no training, but it did get feedback from all those generations.

Writing weights from scratch

Experiment 5 surprised me. Astra gets the game rules and the source file and writes all 20,486 weights of a 600 → 32 → 32 → 6 tanh network in one reply, with no tools, feedback or training. For Breakout the reply is 20,567 tokens long and 815 of the weights are nonzero.¹⁸ adiant211 rebuilt the networks bit for bit and got the same scores.⁷

The network reads like a compiled program. Four first-layer units compute where the ball will land for each direction it can travel, with the wall bounces written into the coefficients. The second layer decides between moving left and right.

The post's headline here is 517.4 against 15.8 for PPO. The evaluation file shows where that ratio comes from.¹⁹ All runs use sticky actions at 0.1, a 10,000-step cap and MinAtar 1.0.15:

PPO scores faster per step and then drops the ball. Astra's policy rarely loses the ball: 517 of its 1,000 episodes hit the 10,000-step cap.⁷ With a longer cap the ratio would grow, so the 33× tells you about survival and the cap more than about how good the policy is. It is still a network that reacts to one frame, with no loop and no simulator, written blind, and it keeps the ball in play for thousands of steps.

The other games keep this in proportion. PPO at 500M steps beats Astra on Seaquest (88.9 against 53.1) and narrowly on Asterix (55.2 against 53.2). These are small MLPs on 10 × 10 grids. A task that compresses into a short program can be written down as weights, and Tracr showed that compile step in 2023 with a formal language as input.²⁰ Here the input is English, and a general model does the compiling.

Experiment 6 does the same thing with tools. Astra builds a 1,480,274-weight Go network through a Python sandbox, layering in liberties, captures, atari and eyes. With no forward passes it wins 42.6%, 26.3% and 36.3% of games against three PPO networks of the same size. With 50 forward passes it wins 74.2%, 70.0% and 78.5%.²¹ Tree search isn't allowed, and a fully connected MLP is a weak shape for Go, so the opponents aren't strong. Experiment 4 is a one-shot edit to 6,073 of 171,664 weights that adds a back-up path to a Kinetix car policy. The authors report success going from 0% to 100%. adiant211 didn't re-run that one, and neither did I.

Chandan Singh ran a related test with Claude on tasks with known algorithms.²² Across 959 written programs, all ten algorithmic tasks reached 100% within three attempts. His report also records a failure. On language tasks the agent drifted from writing mechanisms to fitting them, and on SNLI it set its readout with logistic regression on the evaluation set. Any harness that gives an agent many rounds of feedback can drift the same way.

What others found

The post reached nearly 2,900 points and over 850 comments on Hacker News.²³

The adiant211 result doesn't make Astra's run trivial. That pipeline starts from Astra's final report, so it already knew the recipe, and its author says as much: a cheap model or a person picks the question and the recipe, and tools do the reading. Krentsel's results, for their part, show that writing weights in one reply got much better in recent models. Neither shows a new way of understanding networks. Both things are true: the capability is new at this level, and the methods are old.

Where "natively" holds

The post's title says Astra reads and writes weights natively. The experiments split into three groups:

• No tools, small networks. Experiments 1, 2, 4 and 5. This is close to native. The networks either have structure that shows in the weights or do a task that compiles to a short program.
• Python, no forward pass. Experiment 3. Astra does linear algebra in a sandbox and decides what to compute.
• Python plus forward passes. Experiments 6, 7 and 8. This is an agent doing interpretability with activations, generations and paired tests. The result lands in the weights, but the information comes from running the model.

The Qwen result is in the third group. The post's closing ideas, recursive self-improvement and grafting circuits from one model into another, build on results like that one. The Gemma result and the failed weights-only audit in Experiment 7 cut against that step, and I wouldn't cite the post for those ideas yet.

These tests would settle more than another demo:

1. Remove the hint at full budget. Run prompt v4 at 50 passes with several seeds, and report every run, including the ones that submit nothing.
2. Add a decoding baseline. Score the base and edited Qwen side by side with a repetition penalty or a loop detector as a third arm. That shows what the edit adds beyond a sampling change.
3. Break the labels. Repeat Experiment 1 with the channel names removed and the channel order shuffled, so a norm map no longer tells you which channel is the agent.
4. Blind the audit. Plant a backdoor with a known trigger. Give Astra the weights only, then probes, and report false positives on clean models. That tests the auditing claim directly.
5. Lift the cap. Score Breakout without the 10,000-step limit and report survival and score rate separately.
6. Use models with several failures. Gemma suggests a single-direction fix only works when a single direction carries the failure.

The authors say they are building a benchmark and a harness. I hope it reports every run, fixes the prompts in advance and includes models with no easy bug. They released 1,125 audited turns with exact diffs and hashes,² which is why I could check their work this closely. Most of what I've written here comes from their own files.

If you maintain small open models, you can use this now. A general agent with access to activations can find a rank-one fix for a known failure in about a day. Treat what it finds as a patch: keep the base checkpoint, hash the edit and run per-item regressions on the tasks you care about. And before you read a 6× gain as new skill, check how many answers were finishing before.