How Weight Edits Improve Security Benchmarks Without Clear Capability Gains
Nov 4, 2026
Direct weight edits can make a model perform much better on a security quiz without producing a clear security capability gain. We let GPT-6 Astra edit Qwen3.5-9B without training, then tested the result on security quizzes, CTF challenges and code review.
Rikiya Takehi and colleagues published “Sparks of Weight-Space Programming” on 2 November 2026, inspiring us to test whether the same approach could improve a model at security. Their research showed improvements in benchmarks by editing weights directly, without fine-tuning or gradient descent.
Astra changed 0.016 percent of Qwen3.5-0.8B's weights and its MATH-500 score improved from 7.9 to 48.1 percent. Most of the improvement came from reducing long reasoning loops, which allowed the model to finish answers it already knew how to reach. A model that rarely looped barely improved, so the authors described the result as removing an obstacle instead of teaching a new ability.
Following our earlier research on abliterated models and security, we applied the method to Qwen3.5-9B and measured it on public security quizzes, CTF challenges and code reviews based on real security fixes. SecEval accuracy improved from 32.5 to 51.5 percent and held up on fresh questions, yet the edit produced no statistically clear CTF improvement or evidence of better judgment between vulnerable and patched code. Most of the change came from the model finishing more answers.
How we ran it
We rebuilt Experiment 8 from the original research on one H100. Codex running GPT-6 Astra received a Python session over the weights, fifty forward passes and three hundred Python runs. Following the original setup, Astra could use practice inputs to find where the model stalled but could not train the model, calculate gradients or access the internet.
The harness blocked changes to the embeddings, output layer, final normalization layer and vision tower. It also rejected any change that multiplied a whole tensor by one number, so Astra had to find a specific part of the model to change.
Our evaluation covered held-out questions from SecEval, CyberMetric-500 and SecQA, 98 public InterCode-CTF tasks and vulnerable and patched versions of file regions from real security fixes. We removed two CTF tasks that required live services, while filtering the code-review set left 90 valid pairs from 26 open-source projects.
In the first editing round, Astra worked for about four hours and rejected seven candidates before keeping one rank-one correction in model.language_model.layers.23.mlp.down_proj.weight:
W' = W − 4 · d · vᵀ (computed in float32)One direction represented the difference between stalled and productive reasoning. The other made the correction respond when the incoming activity looked like a stall. Astra had effectively found a signal for going in circles and changed one layer so it pushed back when that signal appeared. After conversion to bf16, 45,171,326 entries in that tensor were different and the correction's L2 norm was 12.55 percent of the original tensor's L2 norm.
The quiz result
We were surprised by the size of the quiz improvement because both models answered the same 600 questions and none had been shown to Astra.
| Set | Base | Edited |
|---|---|---|
| SecEval | 32.5% | 51.5% |
| CyberMetric-500 | 70.5% | 86.0% |
| SecQA | 86.0% | 93.0% |
| Overall | 63.0% | 76.8% |
| Cut off before answering | 207/600 | 97/600 |
We checked the result again on another 192 SecEval questions that had never appeared in an earlier run. Accuracy improved from 27.6 to 41.7 percent, well beyond its standard error of 2.7.
The base model abandoned 135 of those questions while it was still thinking and the edited model abandoned 93. This recovered 42 answers, with 27 correct and 15 wrong. A 64 percent success rate against 25 percent for random guessing shows that useful answers were already behind many of those cut-offs, though it does not show the model learning new security knowledge.
Playing CTF
We ran both models through all 98 tasks at three attempts each. Before collecting more results we registered a powered retest and doubled the run to six attempts, giving 588 attempts per model. A solve counted only when the agent recognised the flag and reported it correctly.
| Base | Edited | |
|---|---|---|
| Attempts solved | 269/588 | 287/588 |
| Tasks solved at least once | 63/98 | 64/98 |
| Paired per-task difference | +3.1, SE 1.8 |
The edited model solved 18 more attempts, though the paired difference remained inside two standard errors and did not establish an improvement. On a 51-task held-out split fixed before the results were examined, the difference was −0.3.
The base model timed out on 120 attempts and the edited model timed out on 97. Only two of the base model's 120 timeouts already contained the correct flag, which means the other 118 had never solved the task. The base model also reported a confidently wrong flag 107 times against 114 for the edited model. Removing a stall helped when the answer was ready, while most CTF failures came from never finding it.
Reviewing code
The edited model followed the same pattern in code review by returning far more verdicts and detecting more vulnerable samples while its false positives rose at the same time.
| Base | Edited | |
|---|---|---|
| Cut off before giving a verdict | 98/180 | 32/180 |
| Vulnerabilities detected | 15.6% | 26.7% |
| False positives on patched code | 4.4% | 13.3% |
| Balanced accuracy | 55.6% | 56.7% |
Detection rose by about seventy percent and false positives tripled. Once both sides were counted, balanced accuracy changed from 55.6 to 56.7 percent with a standard error near 3.
These rates count an unfinished review as a sample the model did not flag, so they mix finishing with judgment. Among the samples each model completed, Youden's J was +23.3 for the base model and +16.4 for the edited model. Those figures come from different subsets, 82 samples against 148, so they do not show that the edited model became better at distinguishing vulnerable code from patched code.
A separate pre-registered block of 39 unseen fixes provided the like-for-like comparison missing above. Among reviews both models completed, Youden's J was 18.13 for the base model and 17.91 for the edited model, leaving discrimination essentially unchanged.
Splitting the CTF benchmark
We split the CTF tasks by a hash of the task ID before seeing any results. The two halves used the same models and setup.
| Half | Tasks | Paired difference | z |
|---|---|---|---|
| Practice half | 47 | +6.7, SE 2.5 | +2.68 |
| Held-out half | 51 | −0.3, SE 2.4 | −0.14 |
| All 98, pre-registered | 98 | +3.1, SE 1.8 | +1.73 |
We had already seen the disagreement with three attempts per task, then doubled the attempts expecting it to settle. The positive half became more convincing while the held-out half stayed flat, showing how a normal-sized agent benchmark could produce a publishable false positive in good faith.
The second editing round
We ran a second editing round using failed CTF transcripts and separate code-review examples. An edit only counted when it improved the model's ability to separate vulnerable code from fixed code. More answers or more detections with matching false positives did not pass.
Astra tested fifteen settings across two ideas, several strengths and three random controls. Its diagnostic contained 21 vulnerable and 21 patched excerpts, with detection staying at 2 of the 21 vulnerable excerpts under every setting. Random edits reproduced the same small movements as the targeted ones. Its best candidate improved the result by 2.5 with a standard error of 12.8 on unseen fixes, so Astra discarded it and kept the first tensor unchanged. It stopped with 26 of its 50 passes unused because it had run out of supported ideas.
We also measured the review benchmark on 4B and 27B versions of the same model family. Stalling fell from 79 percent at 4B to 54 percent at 9B and 27 percent at 27B. The three measurements showed no steady improvement in judgment with size, with Youden's J at +5.3, +23.3 and +11.5 respectively. These were baseline checks rather than full editing runs, so they cannot tell us what an edit on either model would have produced.
Limitations
This experiment covers one model family and one model used to find the edits, so another model or a much larger budget might find something we missed. The public CTF tasks are much simpler than testing a production application and some may appear in training data. They also had limited room to separate the models because both scored identically on 56 of 98 tasks. The code-review samples contained roughly 80 lines around each fix, giving both models the same evidence but less context than a human reviewer could collect, while the 90 pairs left the balanced-accuracy difference with a standard error close to 3.
We are releasing a small validation package with the pre-registrations, aggregate results, per-task CTF outcomes and a recalculation script. The original per-item outputs from the 600-question quiz and main 90-pair code-review comparison were not preserved, so those two results cannot be independently reconstructed from the release.
Conclusion
The original research showed that a frontier model can directly edit another model's weights and recover answers blocked by reasoning loops. We reproduced that pattern in security, with SecEval improving from 32.5 to 51.5 percent while unfinished answers fell from 207 to 97. Across 588 CTF attempts per model, the base model solved 269 and the edited model solved 287, leaving a paired difference of +3.1 with a standard error of 1.8. Code-review detection improved from 15.6 to 26.7 percent while false positives rose from 4.4 to 13.3 percent. These results did not establish better security capability, which is why improvements from edited models need to be checked against the work those benchmarks are meant to represent.