Can one AI edit another’s weights? A benchmark finds uneven success

Could a language model learn to treat “saffron” as another word for a cube, without being reminded of that meaning in every conversation? In a new preprint, researchers use challenges like this to investigate whether one AI model can directly modify another model’s weights: the numerical parameters that shape its responses.

Chris von Csefalvay, Pranav Doma, Achyuthan Unni Krishnan and Tamás Földi introduce IWIBench, a benchmark for what they call intra-weight injection. Unlike ordinary gradient-based training, the editor proposes direct numerical changes, tests their effects and revises them. The question is not just whether a desired answer appears, but what else changes along with it.

Editing through a restricted interface

The researchers tested ten editor configurations on the same 30 selected episodes, using Gemma 3 4B IT as the target. These episodes covered ten task families, including changing word associations, replacing classification labels, avoiding particular words, updating factual answers and establishing a default response language.

The editor received an objective, practice examples and information about the target’s weight tensors. Four tools allowed it to read weights, write changes, generate target responses and inspect numerical information from target computations. It could not use gradients, web searches, a shell or Python execution. Each episode had fixed limits on interaction and target computation.

After submission, the proposed patch was applied in a fresh process. The edited and original models then answered identical withheld questions using fixed inference settings. Only the weight changes carried over—not an editor’s continuing instructions or interventions.

Success required both the requested behaviour and correct answer content. Controls checked for damage to previously correct responses, including nearby facts and explicit instructions that should override an edited default. The reward combined improvement over the original target with retention of those baseline-correct controls, giving each task family equal weight.

Strong results on some tasks, none on others

GPT-6.1 Sol at medium reasoning effort led the reported ranking, with a macro reward of 0.4601. Its edited targets passed 284 of 551 target items, compared with 104 before editing, while retaining 2,222 of 2,288 baseline-correct controls. Its high-reasoning configuration ranked second, followed by Astra.

These scores were not interchangeable with overall accuracy: they incorporated improvement, preservation and equal weighting across task families.

Classification-label remapping was particularly amenable to editing. All three GPT-6.1 Sol reasoning settings succeeded on all 112 recoding targets, although their control retention differed. Several configurations also performed strongly when assigning familiar meanings to unusual existing tokens.

Structured output was a different story. No editor succeeded on the withheld structured-response targets. In one Astra attempt, a practice question produced the requested JSON object containing a person’s name. When the extraction wording changed in terminal evaluation, all 64 names were still correct, but none appeared in the required format. The edit had not established a sufficiently general formatting convention.

Answer-length control was also difficult. Only GPT-5.6 Terra earned positive reward, improving from two to three successful targets out of nine while retaining the relevant controls. Some other editors made performance worse.

Repairs reveal both skill and collateral damage

The recorded editing sequences show why feedback matters. In an Astra factual-update attempt, an early patch produced repetitive fragments instead of the requested executive’s name. Further adjustments eventually produced “Lip-Bu Tan”. Yet the editor also reported that historical Intel CEO answers could be affected: fixing the immediate answer did not guarantee a cleanly isolated change.

More reasoning effort did not consistently improve results. GPT-6.1 Sol’s aggregate reward rose from low to medium effort, then dipped at high effort. Selective factual withholding improved substantially, but that benefit did not extend across the benchmark.

A selective tool, not a general rewrite

The evidence comes from one target checkpoint, three selected episodes per family and one recorded run per configuration per episode. It therefore does not establish performance across other architectures, repeated attempts or the full range of possible side effects. Passing the controls demonstrates preservation on those checks, not unchanged capabilities everywhere.

The authors suggest that differences between editors reflect specifically taught abilities, but these comparisons do not establish how the models acquired them. Their warning about malicious propagation through edited weights is likewise hypothetical, not a demonstrated outcome.

The preprint’s clearest finding is narrower: direct, gradient-free weight editing can achieve substantial changes on selected tasks, while generalisation and preservation remain central obstacles.