Most stories about AI improving AI involve training runs: more data, more accelerators, another gradient step. A blog post published on Monday describes something stranger. Researchers handed a frontier language model the raw weights of other neural networks — the numbers themselves, no gradients, no training loop — and asked it to work out what those networks do, and then to rewrite them.

The team — Rikiya Takehi, Jayden Teoh, Alex Zhang and Omar Khattab — calls the approach "Weight-Space Programming." It is a blog post with released logs and a public model, not a peer-reviewed paper, and it arrived alongside a detailed rebuttal arguing it proves less than it seems. Both are worth reading.

Reading weights

Four PPO agents with identical architecture — a 500→32→32→5 MLP, 17,253 weights — were trained on four different grid games. Astra was given the weight text plus a description of the grid and the five actions, with no game names and no list of options. It named the right game for all four. It also identified which shapes three tiny diffusion models generate from their weights alone, and, given only the four middle transformer blocks of 7.2M-parameter character models (input and output layers removed), it named the training language for all three and located every induction, or copying, head — matching ground truth measured by running the networks, with no false positives.

Writing weights

Given the rules and source code of three MinAtar games and weights initialised to zero, Astra wrote networks in a single reply that beat PPO trained for 100 million steps in all three. In Breakout it scored 517.4 against PPO's 15.8. On 9×9 Go, with a Python sandbox but no Go library, it wrote a 1.48M-parameter network as 336 lines of construction code: with zero forward passes it beat more than half its games against two smaller PPO nets, and with 50 forward passes it beat an equal-sized PPO network trained on 20 million games.

Fixing weights

A car-on-ramp policy had converged on a local minimum and never cleared the ramp in 256 episodes. Astra changed 3.5% of the weights in one attempt; the car then succeeded in all 1,024 evaluation episodes.

The headline result uses a real, if small, language model. Qwen3.5-0.8B in thinking mode loops badly — 85 of its first 96 practice answers ran to the 32,768-token ceiling. Astra traced the looping to a direction written by the MLPs in layers 15 and 19 and subtracted it from 64 output columns in each: 131,072 of roughly 800 million weights, or 0.016%. With a budget of 50 forward passes over practice problems, MATH-500 rose from 7.9% to 48.1%, GSM8K from 13.8% to 67.1%, and instruction-following (IFEval) from 21.0% to 62.3%. The share of MATH-500 answers that hit the token limit fell from 93% to 33%.

What it could not do

The negative results are as instructive as the positive ones. On Gemma 3 270M, which rarely loops, Astra found ordinary arithmetic and algebra errors with no single component to switch off; its edits moved MATH-500 by no more than about a point, a gain the model itself reported as not established. The authors' own summary is the sharpest line in the post: editing weights could remove an obstacle that hid an ability, but it could not add an ability the model lacked. Asked to identify which of two identical-looking Gemma fine-tunes had been trained to be sycophantic, Astra failed from weights alone in four attempts; it succeeded only when allowed to write 16 prompts and inspect attention patterns.

The pushback

Sean Goedecke's rebuttal makes a concrete case that none of this is superhuman. The game-identification result, he notes, reduces to computing the norms of the first layer's weights — three lines of NumPy — after which the heatmaps are recognisable by eye; the labels on the input channels do most of the work. The Qwen fix, he argues, is the playbook researchers already use for abliteration and steering: generate looping and non-looping texts, measure which weights carry the difference, trim them. "It's an impressive trick, but the best way to work with binaries is still to write source code and compile it," he writes. "Likewise, the best way to update the weights of a model is to train it normally."

Both readings can be true at once. The capability is real and reproducible — every prompt, reply, script and evaluation is in the released logs — while the interpretation is contested. What is not contested is the direction: the authors are building a benchmark, and the interesting question is not whether a model can nudge 0.016% of the weights, but whether it can do so reliably enough to be used for audit rather than demonstration.

That has an uncomfortable edge. A model that can read weights well enough to spot a planted behaviour is also a model that can write weights. The paper's own framing lists auditing without evaluation, cheap unlearning and zero-data capability steering; the same list, read from the other end, is a set of ways to put something into a model that no benchmark was designed to catch.

Sources