GPT-6 Astra edited Qwen's weights directly — no gradients, 6x math
MIT flipped 0.016% of Qwen's weights to kill its reasoning loops; logs shipped, harness didn't. Plus: 0.1% poisoned pretraining data plants RCE backdoors.
Copy markdown
An LLM patched another model's weights
MIT CSAIL had GPT-6 Astra read and rewrite Qwen3.5-0.8B's parameters by reasoning alone — no gradients, no fine-tuning. MATH-500 climbed 7.9% to 48.1%, GSM8K 13.8% to 67.1%, and IFEval 21% to 62.3%, by touching just 0.016% of weights (131K of 0.8B) across two layers.
What actually shipped is the logs
You can't run the pipeline yet — the benchmark and harness aren't released. What is public: every prompt, response, and edited network on GitHub, so you can inspect the exact 64-column edit that suppressed Qwen's repetition loop. Qwen is Apache-2.0, so you can try reproducing it on weights you already own.
The catch: it unblocks, it doesn't teach
Editing freed latent skill rather than adding knowledge — a Gemma 3 270M control got zero math gain, and reading weights alone failed a sycophancy probe until Astra was also shown attention patterns. It needs direct weight access, so API-only models are out, and the authors call these 'very early' results.
It also hand-wrote RL policies from scratch
Beyond LLMs, Astra authored game-playing networks with no training at all: a one-shot Breakout net scored 517 vs PPO's 15.8 after 100M steps, and its 9x9 Go net beat an equal-size PPO model trained on 20M games. A hint that control policies could be written, not just trained.
0.1% poisoned data buys an RCE backdoor
A separate paper (Carlini, Rando, et al.) pretrained Qwen3 from scratch and found that poisoning just 0.1% of the corpus gives a 4B CLI agent a ~92% success backdoor that runs attacker commands on your machine — invisible on clean inputs, and larger models were more vulnerable. Pull open weights and the training set is now your supply chain. Code is out.