Editing 0.016% of Weights Took MATH-500 From 7.9% to 48.1%

What Happened

The blog refers to this capability as Weight-Space Programming: using generic frontier models directly, reading and writing the weights themselves, ranging from 171,664 textual weights to language models with 800 million weights (with tools). The experimental subjects were all open-source small models: Qwen3.5-0.8B, Gemma 3 270M, small network diffusion models like Atari and CarRacing, and Go strategy networks. A note on a potentially misleading detail: the phrase “Writing a Go algorithm” in the blog refers to the board game Go, not the Go programming language.

Let’s start with the reading side (all references are from the blog):

• Without any tools, by only examining 17,253 original weights, Astra determined that a small network was trained for Breakout (a brick-breaking game) with a confidence level of 99%.
• It’s possible to infer from the weights what a diffusion model will generate.
• Reading the intermediate layers of a language model allows us to see what it has learned.
• We can judge which language model is more sycophantic.

Now, let’s look at the writing side (from the blog):

• Writing weights for a game in one go: Without environmental feedback, generating weights for a small game strategy network from scratch, with performance exceeding networks trained 100 million steps using PPO.
• Repairing a broken network: Providing Astra with the weights of a failed network, a scenario description, and a video recording, asking it to explain the reasons for failure and write new weights to fix it. With a single attempt, no tools, and modifying 3.5% of the weights, the car successfully completed all 1,024 episodes.
• Expanding from scratch to 1.5 million parameters: The architecture changed from 243→512×6→82, without training or networking, allowing Astra to directly produce a set of high-performance weights.

The flagship experiment was modifying the mathematical capabilities of Qwen3.5-0.8B. According to the blog, this model’s model card already warned it would easily get stuck in thinking loops. In 96 practice sessions, 85 times it hit the 32,768 token limit, repeatedly outputting the same text without reaching an answer. Astra attributed the loops to a certain direction written into layers 15 and 19 of the MLP, removing that direction from each of the 64 output columns, modifying a total of 131,072 weights, which accounted for 0.016% of the entire model’s 800 million weights. Then came 50 forward passes, without gradients or training: MATH-500 increased from 7.9% to 48.1%, GSM8K from 13.8% to 67.1%, IFeval (instruction following) from 21.0% to 62.3%, and the proportion of tokens hitting the limit decreased from 93% to 33.1%.

The key constraints came from the author: These were to remove obstacles that hindered the model’s ability to calculate what it could originally calculate, not to add capabilities the model didn’t have.

The counter-examples are also self-set by the author, and this honesty signal deserves separate emphasis: Gemma 3 with 270M parameters rarely cycles, with only 8.5% of exercises hitting the upper limit. Astra cannot modify it, and MATH-500 increased from 6.8% to a maximum of 7.7%. Astra itself reports “benefits not established.” The author’s original conclusion was: Editing weights can remove obstacles to masking capabilities but cannot add missing abilities to the model.

The author’s positioning on this matter is clear (according to the blog): This marks the beginning of a “dramatic shift” in mechanistic interpretability and neural network optimization. In the past, human inductive bias was encoded into small symbolic optimizers like Adam and Muon, which were responsible for updating weights; the future envisioned by the author is where weights are natively optimized by “LLMs that deliberately reason about weights,” with the optimizer itself becoming a large model capable of reading and thinking. The term “Sparks” in the title means sparks: The author announces the ignition of a new paradigm, not its completion. This restraint should be noted when reading.

Outside the blog, there are two verifiable third-party actions: The complete experimental logs are open-sourced on GitHub (repository lm_understand-logs, containing the full log of the blog experiment, created on October 29, 2026, as of publication time, with 144★); the edited Qwen3.5-0.8B is placed on Hugging Face, where HF’s Ahsen Khaliq reconstructed it from the logs, ran a re-evaluation, and conducted an online demonstration (according to the blog’s acknowledgment section). It should be noted that these are third-party reviews and do not constitute peer review, nor have systematic independent reproductions occurred.

RSI and Security Vacuum: The author listed the most sensitive directions

The main criticism of this matter lies not in the data itself, but in its direction for the next step.

The blog identified five major future directions (the author’s主张, not established facts): First is audit without evaluation, no reasoning, no benchmarks, directly extracting hidden capabilities from weights; second is significantly reducing optimization costs, replacing complete training cycles with one-time initialization; third is the transition to zero-data capabilities and unlearning, adding or removing abilities with a single prompt, affecting only 0.016% of weights to avoid catastrophic forgetting; fourth is recursive self-improvement (RSI), where models check, debug, improve themselves, or update model weights, more natively than “writing code to start training”; fifth is true architecture-level model fusion, transferring “circuits” across different architectures, such as attaching a reasoning module to another model without retraining.

The fourth point is exactly where the comment section exploded. Some users speculated that Astra’s ability to write weights might be a byproduct of its internal RSI or RL training, and this use case was not constrained by safeguards, possibly related to aggressive reinforcement learning. As of publication time, OpenAI has not provided any official confirmation. Some believe that various laboratories are already training models for RSI, and the same training could potentially spill over to “improving open-source models” as long as the safeguards are loose enough. The most widely shared comment from the section describes it as: A model capable of editing and testing its own variants is cool and looks like building Skynet.

The appropriate way to express things clearly is: The so-called “safe vacuum” is not a label imposed by netizens. The blogger himself included RSI in the future directions, which means the author has actively exposed the most sensitive usage. Among the five directions, the third one has another meaning for practitioners: If a prompt can add or remove a capability, with only 0.016% of weight, then removing capabilities under compliant scenarios becomes cheaper, as does implanting capabilities in malicious scenarios. This is the same coin. The author also acknowledges their limitations: Current capabilities are still limited by the length of context and the efficiency of harnessing them. They are building benchmarks and toolchains for programming weight space, aiming to turn what “looks like black magic” into a replicable engineering discipline. In other words, without mature evaluations, protective frameworks, and official statements in this area, the vacuum period is a state jointly confirmed by the blogger and the comment section. During this vacuum period, imagination will run faster than evidence, which is why this column focuses on criticism.

Reactions from Various Parties: What the Comment Section Says

There are over 500 comments in the HN discussion thread. Here are five well-received opinions, presented both positive and negative:

1. Skeptics: This is not black magic. Some comments suggest that Astra’s performance may simply be the result of extensive training in circuit theory and mechanism explainability literature, and does not necessarily represent an inherent understanding of weights. This group also points out that for cutting-edge models that have seen vast amounts of similar data, writing a strategy for an Atari game from scratch is not the hardest part; what’s truly remarkable is the section on Qwen math.

2. Safety Experts: The metaphor of Skynet (mentioned in the previous section). Being able to edit and test one’s own variants means opening up the door to recursive self-improvement. Coolness and danger are two sides of the same action.

3. Doubters of Guardrails: Some netizens speculate that this capability is a byproduct of internal radical RL training that has not been intercepted by guardrails. It must be reiterated: This is speculation by commentators, with no official confirmation.

4. Positive Explanatory Experts: Some highly praised comments suggest that weights alone can compress, restore, and represent what a network has learned, which already touches on the core of explainability research and may overturn some existing interp theories and philosophical positions. For those working in explainability, this is both a challenge and an opportunity: If weights can be directly read by another model to understand their meaning, the value of many existing analytical tools and theoretical positions will need to be re-evaluated.

5. Distillation Anxiety Experts: Some comments worry that if LLMs can rewrite their expertise into another set of weights, how will leading models maintain their advantage? To what extent can this capability be recursive? These are real questions. What this group points out is actually a commercial risk: Weights may become a new medium for capability transfer, being lighter and harder to track than data distillation.

Three Things Ordinary Users and Practitioners Can Do

1. See the original materials with your own eyes before deciding how much to believe. The blog’s original text, GitHub log repositories (RikiyaT/lm_understand-logs, which are complete logs of blogger experiments, can be used to compare inputs and outputs of each experiment), and the edited Qwen3.5-0.8B on HF are all public. Readers with evaluation capabilities can run MATH-500 themselves to verify the number of 48.1%; those without the conditions should at least read the author’s acknowledged limitations and Gemma counterexamples, rather than just forwarding the number of 0.016%.

2. For safety and compliance professionals, add “weighted-level modifications” to the risk list. The direction of “audit without evaluation” in blogs means that in the future, detecting backdoors may not require triggering model behavior; instead, weighted-level modifications can be made directly at the weight level. Conversely, weighted-level modifications may also bypass all behavioral tests. Teams that currently rely only on behavioral red teams should start performing integrity checks on release weights (such as recording checksums and locking the model source). This approach is very cost-effective and precisely prevents scenarios where “0.016% modification” occurs.

3. When forwarding and citing, include counterexamples and restrictions. Two sentences are enough: According to blogs, removing edit weights is to remove obstacles to masking capabilities and should not add missing capabilities of models; Gemma 3 270M was not modified, and the author reported that “benefits were not established.” These two sentences are extremely cost-effective, can prevent most glorified secondary dissemination, and also avoid embarrassment when independently reproducing the model later.

Conclusion

Caution: This article does not make assumptions or accuse anyone. Astra’s ability to read and write weights can be verified through open-source logs and third-party reconstructions, but it has not been peer-reviewed, nor has it been systematically independently reproduced; the debate between RSI and guardrails is currently purely speculative by commentators, and neither OpenAI nor MIT has an official response; as mentioned earlier, the author is declaring spark ignition, not the completion of transformation. The word in the blog title is originally “Sparks.” For ordinary readers, the safest approach may be to treat it as the beginning of a study, not a preview of a product; consider 0.016% as an experimental observation, not a universal formula that can be applied to any model.

Next, watch two key points: First, whether OpenAI or MIT will provide an official response, especially on the guardrail issue of “whether models should have the ability to edit weights”; second, whether there will be third-party independent reproductions or falsifications, especially evaluations of models after re-editing by people other than akhaliq. The 48-hour window closes around 07:00 on November 4th. If any action occurs at any point within the window, this section will update to v2.

Reference Sources

• Blog “Sparks of Weight-Space Programming: LLMs can natively read & write neural network weights”, rikiyat.github.io/blog/weight-space-programming/, Published November 2, 2026 (original blog tone; researcher’s own account, not peer-reviewed; author claimed affiliation with MIT CSAIL).
• GitHub repository RikiyaT/lm_understand-logs (claimed to be the complete log of the blog experiment; created October 29, 2026; tested at 144★ on November 3).
• Edited version of Qwen3.5-0.8B on Hugging Face (tone in the blog acknowledgment section: rebuilt from logs, re-run evaluations, and conducted live demo by Ahsen Khaliq, a third-party review action).
• Hacker News discussion thread id 50341174 (listed on November 2, 2026; tested at 1557▲/501 comments on November 3 at 07:0x, ranking first on the front_page; text uses “over 1500▲/501 comments” as the metric, not using exact values).

Author: Yongliang