A 0.8-billion-parameter Qwen reasoning model has a habit. Give it a hard maths problem and it reasons, repeats itself, and keeps repeating until it hits the 32,768-token limit used in the evaluation. On MATH-500, 93% of its answers end that way. Its own model card warns about the loops.
Researchers at MIT CSAIL gave that model's weights to OpenAI's frontier reasoning model, along with a Python kernel and a small budget of test runs, and asked it to make the small model better at maths without computing gradients or running a training loop. The frontier model traced the loops to a single direction written by the MLPs of two layers and subtracted it from 64 output columns in each. That touched 131,072 weights, 0.016% of the model. MATH-500 rose from 7.9% to 48.1%. Instruction following, which nobody asked it to fix, roughly tripled.
The authors call this weight-space programming. A general-purpose language model, used as it ships, reads a network's weights and writes new ones around a natural-language goal. Their eight experiments read, repair and write weights.
Given 17,253 raw numbers as text and no list of candidates, the model named the game each of four small policy networks had been trained to play. A car policy that PPO had trained for a billion steps into a local minimum stalled on a ramp in every episode; after one unaided edit to 3.5% of its weights, it succeeded in all 1,024 test episodes. Starting from zeros, with only the game rules, source code and the network's input and output layout, it produced networks for three MinAtar games that outscored PPO trained for 100 million steps. In Breakout it scored 517 against 25 for PPO trained five times as long.
The program is old
Jürgen Schmidhuber's reply was brief: old hat, exactly what the neural fast weight programmers did in the 1990s. In March 1991 he described a slow network that learns by gradient descent to emit weight changes for a fast network, separating storage from control the way a conventional computer does. Its outer-product variant is, apart from normalisation, the linear Transformer; a 2021 ICML paper by Schlag, Irie and Schmidhuber made the equivalence formal. By 1993 he had a recurrent network that read and rewrote its own weight matrix, an idea his group revived in 2022.
Since 1990 he has argued that a network's weights are its program, and his overview adds a point that the MIT results support: a large, successful network can have small algorithmic content. The Breakout network is an example: the frontier model wrote a two-step program (work out where the ball will land, move the paddle there) and compiled it into two layers.
The method looks ordinary
Sean Goedecke argues that the work is ordinary rather than old. The game experiment reduces to a heatmap of first-layer weight norms, three lines of NumPy. The Qwen repair is the abliteration recipe: contrast looping and non-looping activations, find the direction, ablate it. Arditi and colleagues showed in 2024 that refusal in 13 open models sits on one such direction. In his framing, weights are compiled binaries. A model that reads machine code is useful, but software is still built from source, and in his view models will still be built by training.
The programmer is new
Both readings miss the same distinction. Every earlier way of writing weights belongs to one of two families. The first is trained: fast weight programmers, hypernetworks, Sakana's Text-to-LoRA, which turns a task description into an adapter in one forward pass. They are fast and opaque, and each is trained for its domain. The second is analytic: ROME and MEMIT rewriting facts in mid-layer MLPs, abliteration, DeepMind's Tracr compiling human-written programs into transformer weights. They are legible, but a human picks the method every time.
Weight-space programming is the first writer that sits in neither family. It is a general model rather than one built for the job, and it leaves a reasoning trace that explains each change. Structurally it is the 1991 split again: a slow network writing the weights of a fast one. The difference is what occupies the slow seat. In 1991 it was a network shaped by gradient descent for one task. In 2026 it is a language model that takes the spec in English.
That also answers the binary analogy on its own terms. A disassembler that can patch the binary does not replace the compiler, but it changes how binaries are maintained. The car repair is an example. The frontier model did not retrain the policy. It added a small path through a few units per layer that reads the car's position and speed, backs it up, and switches off once the car clears the red strip, after which the trained network drives as before. That is a patch in the software sense. If edits like it become routine, networks become artefacts that can be maintained rather than only rebuilt.
The evidence is narrow
The source is not a peer-reviewed paper, and it tests one closed model on eight hand-built tasks. The authors released full logs and say that Hugging Face's Ahsen Khaliq rebuilt the edited Qwen model from them and reran the evaluation. "Natively" is generous: four experiments gave the model Python, and the Qwen run used 50 forward passes of up to 512 problems each, about 3,200 sequences at the average batch. At 10 and 25 passes, MATH-500 reached only 12.3% and 14.1%, and most answers still hit the token limit.
The one test of reading hidden behaviour failed. From weights alone, the model could not tell a sycophantic fine-tune from a truthful one in four attempts. It succeeded only once it could watch attention patterns from live runs.
Repair is not acquisition
The authors also published a negative result, and it limits every claim that follows. They repeated the maths experiment on a Gemma model of 270 million parameters that rarely loops: 8.5% of its answers hit the token limit, against 93% for Qwen. The frontier model read its failures, found ordinary arithmetic and algebra errors with no single component to switch off, and made small, targeted edits. None moved MATH-500 by more than about a point.
That splits the claim into three operations. Construction, compiling a known algorithm into weights, is demonstrated by the game and Go networks. Repair, removing a located failure, is demonstrated by the car and by Qwen. Acquisition, adding a capability the network lacked, has been tested once, on Gemma, and failed. The Qwen jump was a model finishing answers it could already work out.
Against that boundary, the five obvious extrapolations look like this:
- Training by deliberate edit is supported for construction and repair. For language models, closed-form editors have written in thousands of facts since 2022, but nobody has yet written in a skill.
- Continual learning through self-modification has an ancestor in Schmidhuber's self-referential matrix, and an MIT paper at NeurIPS 2025, SEAL, already has a model write its own fine-tuning data. The obstacle is drift: a 2024 ACL Findings study found that sequential edits lead to gradual and then catastrophic forgetting as the edited layers move away from the rest of the model. The authors suggest that sparse edits avoid forgetting, but they did not test it. A self-editing model would need a held-out check that it cannot modify, and in the Qwen run the large MATH-500 gain appeared only at the largest test budget.
- Small models learning together is the best fit, because every strong result had a small target. A large model that writes and rewrites a population of small specialists is the fast weight programmer at system scale. A phone model could send its weights and a task to a large model and receive a patch. Whether that pays depends on amortisation: an expensive maintenance model is only worth running if each patched specialist is used long enough afterwards.
- Editing experts in mixture-of-experts models is plausible, since experts are MLPs and the Qwen fix was in MLP output columns. SteerMoE (ICLR 2026) identified experts linked to specific behaviours by comparing paired inputs, and changed safety and faithfulness scores by steering the router. But that is evidence about routing, not about rewriting what an expert computes, and the two need separate tests.
- Large savings in compute and data hold for data and are unquantified for compute. The networks written without data still received rules, source code and input layouts, so part of the saving is knowledge moved into the prompt. The cost also moved, into the editor's pretraining and into inference bills that the post does not report.
Writing is ahead of reading
The authors list auditing without evaluation among the payoffs: read a backdoor or a hidden capability straight out of the weights before anything runs. Their own sycophancy result shows that reading hidden behaviour out of weights does not work yet. Writing behaviour into weights has worked for some time. BadEdit (ICLR 2024) planted backdoors in billion-parameter models with 15 samples in about two minutes, and they survived later fine-tuning. Refusal can be removed with a rank-one edit.
Weight-space programming changes who chooses the method. Until now an attacker needed to know which recipe to run. A general reasoner picks the recipe, applies it and checks the result, and the Qwen fix shows how small the footprint can be: 0.016% of the weights, made without a training run, and hard to spot unless someone compares the weights with the original. An edit that small is the cleanest supply-chain attack anyone has described.
Schmidhuber was right in 1990 that weights are a program. For thirty-six years only optimisers, purpose-trained networks and specialists could write it. The slow net can read now, and it will write for whoever is prompting it.
Unlock the Future of Business with AI
Dive into our immersive workshops and equip your team with the tools and knowledge to lead in the AI era.