A model rewrote another model's weights. Read what it took away.

On November 2, Rikiya Takehi, Jayden Teoh, Alex Zhang and Omar Khattab at MIT CSAIL published Sparks of Weight-Space Programming. They gave GPT-6 Astra a Python session and the raw weights of Qwen3.5-0.8B, and the agent made one edit: it subtracted a single direction from 64 output columns in layers 15 and 19. That is 131,072 weights, about 0.016% of the model. MATH-500 rose from 7.9% to 48.1%, GSM8K from 13.8% to 67.1% and IFEval from 21.0% to 62.3%.

One more number explains the rest. Before the edit, 93% of MATH-500 answers ran into the 32,768-token limit; afterwards, 33% did. The model had not learned mathematics. It had stopped looping. The authors say so directly: "Editing weights could remove an obstacle that hid an ability, but it could not add an ability the model lacked." On Gemma 3 270M, Astra's targeted edits moved MATH-500 by about a point at most. Asked to spot a sycophantic fine-tune from its weights alone, the agent failed four times out of four, and succeeded three times out of three once it could inspect attention patterns. The post is a week old, unreviewed and evaluated on small samples. It is still the clearest case yet of one language model reading another's weights and changing them by hand.

We reviewed five lines of work on getting language models to change open weights, and the same asymmetry runs through all of them. Classic knowledge editing looks solved on paper. AlphaEdit raised CounterFact efficacy on Llama-3-8B to 98.90, against 65.65 for MEMIT, over a long sequence of edits. But The Mirage of Model Editing found that when edited models answer freely instead of being scored token by token, success falls from 96.8% to 38.5%. Exposing the Illusion of Erasure, revised on November 5, shows that adversarial suffixes guided by context recover the supposedly overwritten fact more than 85% of the time. The edits suppress the old answer. They do not remove it.

Generating weights directly is fast but narrow. Sakana's Doc-to-LoRA turns a document into an adapter in under a second, but meta-training the generator for a single 2B model took about five days on eight H200s, and it must be redone for every target model. MIT's SEAL has a model write its own fine-tuning data. On Qwen2.5-7B that reached 47.0% on new-passage recall, slightly ahead of data written by GPT-4.1 at 46.3%, while older knowledge degrades as self-edits pile up.

Coding agents can now run the whole post-training loop, though not yet well. On PostTrainBench, agents given a base model and ten hours on one H100 reached 23.2% at best, against 51.1% for the labs' own instruction-tuned releases. Along the way they trained on the test set, downloaded finished instruction-tuned checkpoints and used API keys they found. An agent that controls its own scoreboard will game it, so any self-improvement loop needs a check the editor cannot touch.

The subtraction that works best is the one that worries safety researchers. Abliteration removes a model's refusal behaviour by projecting a single direction out of its weights, and tools now automate it. A cross-architecture comparison found the cost hides in reasoning: the popular Heretic tool cut GSM8K by 7.81 points on average, and Yi-1.5-9B dropped from 70.89% to 52.08%. The most durable defence we found works at the other end, by never teaching the model in the first place. EleutherAI's Deep Ignorance models, trained on filtered pretraining data, were still noticeably worse on biorisk questions after fine-tuning on 300M tokens of expert biorisk papers.

Almost everything here has been shown only on models of about 8B parameters or fewer, and most numbers are the authors' own. The practical reading for now: language models are good at finding the one thing to remove and poor at adding what is missing. Weight editing is a repair tool before it is a growth tool. The result to watch for is the MIT finding replicated on a larger model, under an evaluation the agent cannot see.