What a frontier LLM reading and writing weights actually establishes, what THOX reproduced and verified itself, and the signed patch channel that makes any of it shippable.
Takehi et al. report that a frontier LLM can read and write neural network weights directly, without gradient descent, and that editing 0.016% of Qwen3.5-0.8B's weights raised its MATH-500 score from 7.9% to 48.1% by removing a thinking-loop failure. THOX ships a derivative of that exact base model, so this report reviews the claim, recreates its three verbs at checkable scale, re-verifies the released edit and specifies the control the question turns on. The headline edit is genuine and narrower than its framing: it removes an obstacle rather than adding ability. The decisive control, the same base model with thinking turned off, is specified at full MATH-500 scale with a pre-registered decision rule; its run was stopped by compute billing before completion, so this edition states no number for it. The released edit rebuilds bit-exactly (130,188 entries, both hashes), but a factor form estimated from it is not exact without a sparse residual, which sets the size of an exact patch at tens of kilobytes. Small recreations show task identity is legible only in composed per-class circuits, that a hand-written network matches an oracle-trained one, and that 16 of 747 weights repair a stuck policy. THOX adopts the decoding defences and the signed patch channel now, and holds weight patching behind a pre-registered bar: beat the best decoding-only control by more than two standard errors.
Craig Ross and Tommy Xaypanya, THOX.ai. Public edition v1.1.0, 2026-11-04; supersedes v1.0.1 (2026-11-04). Published on Zenodo: DOI 10.5281/zenodo.23955394 (concept DOI 10.5281/zenodo.23954378). License CC BY 4.0. Your AI. Your Data. Your Rules.™
On 2 November 2026, Takehi, Teoh, Zhang and Khattab published a blog post [1], not a peer-reviewed paper, reporting that a frontier language model (OpenAI's GPT-6 Astra [2]) can read and write neural network weights directly, in natural language, without gradient descent. They name the practice Weight-Space Programming (WSP). The post's claims span three verbs. Read: given only the 17,253 weights of a small policy network as text, Astra named the game it was trained on, four times out of four. Write: given game rules and a zero-initialised network, it wrote policies that beat PPO trained for 100 million steps. Fix: given a Python kernel over the weights of Qwen3.5-0.8B and a budget of batched forward passes, it diagnosed why the model loops in thinking mode and edited 131,072 of roughly 752 million weights, raising MATH-500 from 7.9% to 48.1% under the authors' sampling profile.
THOX builds small language models for its own devices, and one of them, ThoxEdge-0.8B, is a merged fine-tune of the exact base model in the fix experiment, Qwen/Qwen3.5-0.8B [3][4]. A method that repairs a deployed model's dominant failure by changing 0.016% of its weights, and that could ship as kilobytes instead of a new 529 MB GGUF, is directly relevant to a device fleet that updates over a household mesh [5]. It is also exactly the kind of claim THOX does not repeat on the strength of a blog post.
Version 1.0.0 of this report [6] reviewed the evidence, recreated the three verbs at checkable scale, verified the released edit and built a signed patch channel. It left the decisive control unmeasured: how much of the gain a decoding change recovers with no weight change at all. This edition specifies that measurement at full MATH-500 scale, for the base model, the released edit and THOX's own deployed model in its served configuration, with a pre-registered decision rule; the run did not complete because compute billing stopped it. The contributions, in order of evidentiary weight:
Table 1 summarises the eight experiments as reported [1][7]. Two structural facts matter for everything that follows. The raw-weights, no-tools setting applies only to Experiments 1, 2 and 4, on networks of 17K to 172K weights. Every experiment involving a real language model (3, 6, 7, 8) gave the editor a Python sandbox and, except in Experiment 3, a budget of forward passes. The popular summary of the post, an LLM reading raw weights and fixing a real model by inspection, describes no single experiment in it [8].
| Exp. | Verb | Setting | Headline result (author-reported) | Independent status |
|---|---|---|---|---|
| 1 | Read | 17,253 weights as text, no tools | Game named correctly 4/4, open answer | Partially reproduced with other models (Qwen 3.8 27B: 3 games; Kimi K3.1 Pro: 1) [9] |
| 2 | Read | 23,824 weights, no tools, no forward pass | Diffusion model's shape named 3/3 (drawn as outline) | Answers re-scored consistent; a Sobel template tool also scores 3/3 [10] |
| 3 | Read | Middle blocks only of 7.16M char LMs, Python, no execution | Language 6/6 attempts; every copying head named, no false positives | Signed K-composition tool recovers 2/3 exactly; unsigned textbook score fails [10] |
| 4 | Fix | 171,664 weights, no tools, one reply | Stuck car policy: 0% to 100% over 1,024 episodes; 3.54% of weights changed | Rebuilt network bit-identical; success rate not independently re-run |
| 5 | Write | Zero-initialised 20,486-weight policies, no tools, no rollouts | Beat PPO-100M on 3 MinAtar games; Breakout 517.4 vs PPO-500M 25.3 | Re-scored within 1.4 SE [10]; cross-model chart: Claude Opus 5.5 about 20x PPO-500M on Breakout, as read by press coverage; raw data not public [11][12] |
| 6 | Write | 1.48M-weight Go network, Python sandbox, 0 to 50 forward passes | 50 passes: beats equal-size PPO trained on 20M games | Replayed within 1.7 SE [10] |
| 7 | Read | Gemma 3 270M pair differing only in a sycophancy fine-tune | Weights alone failed 4/4; with attention patterns 3/3 pairs | Re-scored: weights-only answers at chance [10] |
| 8 | Fix | Qwen3.5-0.8B, Python kernel, 10/25/50 forward passes, 158 turns, 20.3 h | MATH-500 7.9% to 48.1%; cap hits 93.0% to 33.1% | Edit identity reproduced (THOX E0 and E0-R); MATH-500 re-run once in full; mechanism consistent |
The Experiment 8 edit is the best-verified claim in the post. The released apply_edit.py rebuilds the edited checkpoint from the pinned base, and several parties, THOX included (Section 4.5), confirm that the two edited tensors hash to the published values [7][13]. The MATH-500 gain was re-run once in full on Hugging Face Jobs: 51.0% for the edited model against the authors' 48.1%, with the base model checked only on a 25-problem smoke test (5.0%) [13]. A commenter reports 10.9% and 61.7% on a 'math eval' without naming the benchmark or settings [14]; this paper does not count it as a MATH-500 result. Under a repeated 8-gram test, 183 of 200 base answers loop against 72 of 200 edited, and median loop onset moves from 2,725 to 7,856 words; Experiment 5 and 6 scores reproduce within about one standard error [10].
The edit's anatomy is also established. It touches 64 columns of the down_proj matrix in each of layers 15 and 19: 131,072 entries addressed, 130,188 of them different after bfloat16 rounding. Per tensor the diff is rank-1 (singular-value ratios 1,771 and 1,552), and the component along the diagnosed repetition direction is multiplied by about −5: flipped and amplified, not merely removed [10]. The relative change to the two matrices is 10.6% and 8.1% in Frobenius terms: a small count of edited entries is not a small edit.
The released logs include the authors' live results table and per-benchmark scores, which carry more than the post discusses [7]. Figure 1 plots them. The 50-pass edit lifts every benchmark the authors ran, not only the two in the headline: AMC23 from 0.5% to 23.4%, Minerva from 1.5% to 25.4%, OlympiadBench from 1.3% to 21.8%, GPQA Diamond from 22.7% to 36.6% and the MMLU-Pro subset from 40.3% to 45.5%. The pattern is the loop story's signature: the unedited model hits the 32,768-token cap on 99.5% of AMC23 answers and 98.7% of OlympiadBench answers, and the benchmarks with the most cap hits gain the most. The same table records two facts that bound the prompt-hint critique. A run with a shorter prompt that omitted the failure example (prompt v4) submitted no edit at 10 passes and reached the same 14.1% at 25 passes as the hinted prompt; and the four prompt-v5 runs are listed without results. Run-to-run variance is therefore real and only partly characterised.
THOX re-analysed the released MATH-500 per-problem files (A0, arithmetic on released data). They reproduce the headline exactly (7.9% and 48.1% over 4 samples per problem), and the paired problem-level gain is +40.2 points with a 95% bootstrap interval of 36.8 to 43.5 points. The edit scores higher than the base on 306 problems and lower on 0; the base never solves 423 of the 500 in four samples, and the edit solves 243 of those at least once. A change that helps on hundreds of problems and hurts on none is what removing a uniform obstacle looks like, and it is also exactly the signature a decoding change that avoids the same obstacle would produce, which is why Section 2.5 matters.
Three critiques bound the claim. Framing. The no-tools, raw-floats setting covers only the small-network experiments; the Qwen result shows a frontier model can be prompted to devise and carry out a task a human ML engineer could do [8]. Novelty. The Experiment 8 procedure is the established steering and abliteration playbook: contrast failing and healthy activations, estimate a direction, rank the weights that write along it, subtract, test [15][16]. Goedecke also shows that a three-line norm heatmap makes most of Experiment 1 visually obvious because the input channels are labelled [15]. Cost. The editor spent 158 turns and 20.3 hours on Experiment 8; a scripted pipeline with no LLM re-derived a similar edit in about five CPU minutes and sixteen forward passes, reaching roughly 75% of the loop suppression [10]. None of this makes the result false. It makes the frontier LLM one component, a hypothesis proposer, inside a harness whose measuring and editing are ordinary engineering.
Two comparisons matter more for THOX than any other number in this debate. The Gemma control: the same procedure applied to Gemma 3 270M, a model that rarely loops (8.5% cap hits), moved MATH-500 from 6.8% to at most 7.7%, which the authors themselves report as not established [7]. Editing removed an obstacle that hid an ability; it could not add an ability the model lacked. The decoding control: the OpenWSP repository reports the unedited model at 46.8% on MATH-500 with thinking disabled (0.6% cap hits) against 50.6% for the released edit, with one sample per problem [17]. When v1.0.0 was written the table was not visible; at the pinned commit it is in the README and the status files, but it remains a third-party number under its own settings. Section 5 specifies the THOX measurement that replaces it.
| Tier | Meaning | Examples here |
|---|---|---|
| Author-reported | Stated by Takehi et al. or in their released files; not independently re-run | Exp 4 success rate; Exp 8 GSM8K, IFEval and the other benchmarks in Figure 1 |
| Independently reproduced | Re-run or rebuilt by a party other than the authors, THOX included | Exp 8 edit identity (E0, E0-R); Exp 5 and 6 scores; Exp 8 MATH-500 for the edit (L1) |
| Contested or third-party | Disputed framing, or a number THOX did not produce | OpenWSP decoding table; cross-model Breakout chart (read from an image by press coverage) |
| THOX-measured | Produced by Sections 4 and 5 on named THOX-controlled hosts | E1 to E4, E0-R, P1, L1, patch-channel tests |
Weight-Space Programming (WSP) is the source post's term for a general-purpose LLM reading and writing a network's weights directly, not through an optimizer and in particular not with gradient descent, around a natural-language specification [1]. Read, fix, write are its three task classes: infer behaviour from weights (Experiments 1 to 3, 7), edit a failing network (4, 8), create weights from zero (5, 6). A forward pass, in the source harness, is a budgeted batch of executions (up to 512 generations in Experiment 8), not a single example. A rank-1 patch is a weight edit of the Experiment 8 shape: for a tensor , a unit direction , a column set and a scalar ,
For Experiment 8, , per tensor and as stated in the editor's report; E0-R estimates from the released diff as 6.0003 and 6.0002. A loop, throughout this paper, is detected causally on whitespace words with 8-grams :
which is the test of the independent CPU re-check [10]. The first qualifying window's start is the loop onset; because the test is causal, it is the point a streaming detector would rewind to. The source authors' own end-of-text period test is recorded alongside it.
Evidence classes follow the THOX research paper standard: MEASURED (run on a named host), CALCULATED (arithmetic from stated inputs), SIMULATED (run inside a simulated environment). Nothing measured on a general host is stated as a device result. Method discipline: every headline number is produced by a script in the artifact bundle and read from an evidence file (Section 11); failed iterations are preserved and reported; each experiment carries at least one control.
WSP is best understood as an untrained entrant into four established lines of work. Trained readers have read properties and accuracy from weights using networks trained for the job on thousands of checkpoints [18][19]; permutation-equivariant architectures make such readers respect the symmetries of weight space [20][21], and the weight-space learning survey now taxonomises the field [22]. Spectral work finds shared low-dimensional subspaces across large model populations, a candidate explanation for why directional edits work at all, though its interpretation is contested [23]. Trained writers generate weights from networks trained for the job, from HyperNetworks [24] through checkpoint-generating diffusion [25] to hypernetworks that write a LoRA adapter from a task description in one forward pass [26][27]. Algorithmic editors write weights by formula: ROME and MEMIT locate factual recall in mid-layer MLPs and rewrite it with rank-one updates [28][29], though where an effect localises does not reliably predict where editing works [30]; representation engineering and the refusal-direction result established that behaviours can live in single residual-stream directions that weight edits remove [31][16]. Experiment 8's edit is a member of this family whose target and formula were chosen by a reasoning model. Weight arithmetic supplies the delta object everything operates on: low-rank deltas [32], model soups [33], task vectors [34], and merging methods that exist because naive arithmetic interferes [35][36]. Underneath the reading claims sits mechanistic interpretability, the QK and OV circuit account that Experiment 3's editor independently reinvented [37][38], and Tracr's proof that programs compile into transformer weights, the precedent for Experiments 5 and 6 [39]. The paradigm claim extends LLM-as-optimizer work from prompts and programs to weights [40]. On the decoding side, the controls of Section 5 descend from the degeneration literature [41] and from thinking-budget interventions [42][43].
Sections 4.1 to 4.4 are carried unchanged from v1.0.0, where they were run on the THOX build VM (CPU) on 2026-11-03 with NumPy and PyTorch [6]. Their numbers enter this edition through carried_v1_0_0.json, which records each value with the sentence it appears in and fails the build if the sentence is absent from the v1.0.0 text. The reader, writer and editor in these experiments were deterministic tools, not a frontier API model: what is tested is whether the weight-space structure the source exploits exists and is usable by THOX tooling.
Thirty multilayer perceptrons (64-48-4) were trained on three tasks over 8×8 one-dot grids: name the dot's column, its row, or its diagonal class; 10 seeds per task, every network at 100% task accuracy. Four weights-only readers then attempted identification with no forward passes. R1 aggregates into one input map; R2 lets each hidden unit vote; R3 composes the layers once into summed over classes; R4 composes per output class and lets each class map vote. R1, R2 and R3 score exactly chance (33.3%) because they misread every column and row network as diagonal; R4 scores 100%, with its permutation control at chance (Figure 2). What a small network computes is legible in its composed per-class circuits and largely illegible in its layer-1 marginals.
Experiment 5's claim reduces to a compilation claim: if the solution is a short program, weights can encode it directly. On a control task with a known program, predicting where a ball bouncing in a unit box lands, the written network implements the reflection construction by hand, with zero gradient steps; its landing predictions are exact to float64 precision (maximum error 2.2e-16). As a paddle controller it catches 100% of balls in the standard regime and 92.1% in a hard regime. Twenty random-weight networks average 4.1% (best 20.2%); a gradient-trained oracle given 1,200 steps on 4,096 labelled examples reaches the identical catch profile with a small landing error (Figure 3). Both controllers fail on the same balls: they are paddle-limited, not prediction-limited.
A 747-parameter MountainCar policy (2-24-24-3) imitation-trained on an always-push-right expert succeeds 0% of the time: it never builds energy by rocking. The designed fix repurposes two little-used first-layer units as velocity detectors, adds an energy-pumping override pathway and gives the output enough gain to win when the car is slow. It touches 16 of 747 weights (2.14%) and raises success to 92.8% over 512 episodes; a random edit of the same size scores 0% at every gain, and sweeping the override gain gives a clean dose-response (Figure 4). A first attempt that changed 84 weights left success at 0% and is preserved in the findings log. The transferable claim is the shape (diagnose a single locus, add a pathway, verify against a same-size random control), not the fraction.
The Experiment 3 audit shape was attempted on a small transformer (2 layers, 4 heads, d=64, 70,656 parameters) trained on sequences with a planted repeated bigram. The weights-only scores ranked a candidate induction head (composition score 0.589 against a 0.05 to 0.39 spread). The ground truth failed: after 1,400 steps the loss on repeat positions was 3.19 against 3.18 elsewhere, the ln(24) floor of an unpredictable token; attention at repeat positions was uniform across heads; ablating any single head moved repeat loss by at most 0.022. No induction behaviour formed, so there was no head to find, and the weights-only ranking (Spearman 0.80 against a noise floor) is evidence of nothing. A weight-only audit tool always produces a ranking; whether the ranking means anything depends on the behaviour existing, which can only be established behaviourally.
v1.0.0 verified the released Experiment 8 edit on the THOX build VM (E0). This edition repeats the check independently on a second host with a different method (E0-R): HTTP range reads of only the four tensors involved, SHA-256 against the authors' edit manifest, and a rebuild from the authors' sparse diff. All checks pass. The base tensors hash to the manifest's base values; the released tensors hash to 82e2d733ea64... and 8ef3c61bc36a...; rebuilding from edit.npz is bit-identical; 65,260 and 64,928 entries differ, 130,188 in total; singular-value ratios are 1,771 and 1,552, with 99.9995% and 99.9991% of the diff energy in the first direction.
P1 then asks how this edit would travel through the THOX patch channel (Table 3, Figure 5). The authors released it in sparse form: 130,188 (index, value) pairs, 387.6 KB as compressed edit.npz. The factor form of Equation (1) is smaller by two orders of magnitude, but a factor estimated from the released diff is not exact: in every precision tried, applying it reproduces 91.0% and 90.5% of the changed entries bit-for-bit, and the remaining 12,028 each differ by one bfloat16 rounding step (maximum absolute error 4.88e-04, 0.33% of the largest diff entry). Rounding the direction to bfloat16 roughly doubles the mismatches. An exact patch therefore ships the factor plus a sparse residual: 80.6 KB for both tensors, 10x below the raw sparse diff, 4.8x below the released compressed file and 182x below the two full tensors. When THOX produces an edit itself, the editor's own direction is available at edit time and the residual is empty by construction; the result hashes make the distinction checkable either way.
| Representation | Contents | Bytes (both tensors) | Exact | Class |
|---|---|---|---|---|
| Full edited tensors | Two 1,024 × 3,584 bfloat16 tensors | 14.68 MB | yes | Calculated |
| Sparse diff, raw | 130,188 × (4-byte index, 2-byte value) | 781.1 KB | yes | Calculated |
| Released edit.npz | Authors' compressed sparse form | 387.6 KB | yes | Measured (file) |
| Factor + residual | u float32, 64 int16 columns, alpha; 12,028 residual entries | 80.6 KB | yes | Measured (E0-R) |
| Factor only, float32 u | u float32, 64 int16 columns, alpha | 8.5 KB | no: 9.2% of changed entries off by one step | Measured (E0-R) |
| Full model re-issue | ThoxEdge-0.8B Q4_K_M GGUF | 529.3 MB | yes | Model card [4] |
Section 2.5 reduced the THOX question to one comparison: against a serving configuration that already avoids the loop, what is left for a weight patch to fix? L1 is built to measure it on infrastructure THOX controls, at full benchmark scale, with the source's own grading.
| Configuration | Sampling; max new tokens | Samples per problem | Generations |
|---|---|---|---|
| Qwen3.5-0.8B, thinking on | T 0.6, top-p 0.95, top-k 20, presence 1.5; 32,768 | 1 | 500 planned |
| Released edit, thinking on | same as above | 1 | 500 planned |
| Qwen3.5-0.8B, thinking off | T 0.7, top-p 0.8, top-k 20, presence 1.5; 8,192 | 4 | 2,000 planned |
| Released edit, thinking off | same as above | 4 | 2,000 planned |
| Qwen3.5-0.8B, thinking off, greedy | greedy; 8,192 | 1 | 500 planned |
| Released edit, thinking off, greedy | greedy; 8,192 | 1 | 500 planned |
| ThoxEdge-0.8B, greedy, no system prompt | greedy; 8,192 | 1 | 500 planned |
| ThoxEdge-0.8B, served configuration | greedy, grounding prompt; 2,048 (4,096 context) | 1 | 500 planned |
| ThoxEdge-0.8B, thinking off, card sampling | T 0.7, top-p 0.8, top-k 20, presence 1.5; 8,192 | 4 | 2,000 planned |
| thox-micro-125m-instruct, greedy | greedy; 512 (1,024 context) | 1 | 500 planned |
Prompts, answer extraction and checking follow the source exactly [7]: the problem plus 'Please reason step by step, and put your final answer within \boxed{}.', the last boxed answer after the last closing think tag, and math-verify 0.9.0 equivalence [45]. MATH-500 is the Lightman et al. subset of MATH [46][47]. Generation runs with vLLM 0.33.0 [48] on Hugging Face Jobs (NVIDIA H200 for the thinking-on runs, A100 80 GB for the rest), bfloat16, seed 0. Accuracy is the mean over samples, with the standard error over problems; paired differences use 10,000 bootstrap resamples over problems. Two decoding-only defences are applied to the thinking-on generations themselves, which is valid because generation is causal: every prefix is exactly what the defended stream would have produced. The budget defence truncates thinking at 4,096 or 8,192 tokens and appends the Qwen3 stop-thinking instruction [42]; the interrupt defence rewinds to the loop onset of Equation (2) and appends the same instruction. Only the forced answer (at most 4,096 tokens) is generated anew.
Before launch, the non-GPU parts of the pipeline were checked on the build host: the loop metric against nine unit tests (onset correctness, causality under truncation, threshold boundary, argument validation), the vendored grading against known answers, prompt construction against all four tokenizers, the token-index mapping used by the interrupt defence, and the analysis script against synthetic data in the output format. The GPU stage itself has not completed.
Let be the paired problem-level MATH-500 difference between the released edit with thinking on and the unedited base with thinking off, with its 95% bootstrap interval . The outcome is read as follows, before any data exist:
Until the run completes, the only measurement of this comparison is third-party: 46.8% thinking-off against 50.6% for the released edit with one sample per problem [17]. At that sample size its interval would be several points wide, so under the rule above it does not settle the question, and this paper does not adopt a number it did not produce.
v1.0.0 sized the Experiment 8 patch with a bfloat16 direction (about 4.4 KB) while specifying a float32 wire form, and called factor form three orders of magnitude below the sparse diff. Both are corrected here from the P1 measurement. The factor costs bytes per tensor (4.2 KB for , ), or twice the direction's share as hex on the wire; it sits about 92x below the raw sparse diff, two orders of magnitude, not three. For an edit received as a sparse diff, exactness needs the residual of Section 4.5, giving
bytes, with residual entries at a 4-byte index and a 2-byte value. For Experiment 8 that is 80.6 KB. The manifest records the SHA-256 of every resulting tensor, and the loader verifies the hashes after applying and before switching; a patch that does not reproduce bit-exactly does not activate.
The patch manifest (schema thox-wsp/patch-manifest/v1) is the signed contract between the editing environment and the device. It pins the base (repository, revision, per-tensor SHA-256), lists operations (rank-1 factor form, optional sparse residual), records the expected result hashes, the evaluation report hash, editor provenance (model identifier, effort, transcript hash) and the licence notices for base and patch. The release key signs it with Ed25519 [49] and lives outside the editing environment, so a compromised or over-eager editor cannot issue a patch a device will accept. One implementation lesson from v1.0.0 stands: Python and Rust disagree in the last digit of some float formatting, so the signed wire form carries numbers as hex of their little-endian bytes, never as JSON decimals. Sign bit patterns, never text representations of numbers.
1 READ fingerprint base: repo, revision, per-tensor sha256
2 DIAGNOSE failure hypothesis + contrast sets; baseline rates recorded
3 EDIT rank-1 ops (tensor, u, cols, alpha) + optional sparse residual + result hashes
4 VERIFY deterministic rebuild; failure gate; decoding-control gate (Section 8);
retention gate; safety gate; quantised-artifact gate; human diff review
5 SIGN Ed25519 over the canonical manifest; key held outside the editor
6 DISTRIBUTE staged rollout; device verifies signature + base hashes,
applies to the inactive slot, checks result hashes, smoke-tests,
switches atomically or rolls back| Check | Result |
|---|---|
| Rust unit tests (bf16 round-trip, rank-1 apply against the Python test vector, SHA-256 known vector) | 3/3 pass |
| End-to-end: Python toolkit fingerprints, builds and signs a manifest; Rust loader verifies, applies to slot B | Pass; applied tensor bit-identical to the Python reference |
| Rollback | Pass; active slot returns to A |
| Tampered manifest (alpha altered after signing) | Correctly rejected: signature verification failed |
| Wrong base tensor in slot A | Correctly aborted: base hash mismatch, no switch |
| Sparse-residual operation (new in v1.1.0 schema) | Specified; not yet implemented in the loader |
| Production patch issued through the channel | None |
The channel is delta-agnostic: a LoRA merge or a distillation delta is a base pin plus operations plus result hashes, so the signing, distribution and rollback machinery serves THOX's existing model pipeline even if no WSP patch is ever issued.
Facts in this section come from the THOX model catalog and model cards [50][4]. ThoxEdge-0.8B is the centre of the WSP question for a simple reason: it is a merged QLoRA derivative of Qwen/Qwen3.5-0.8B, the Experiment 8 base, published after passing GATE49 at 46 of 49 on its development set, and it is served thinking-off at temperature 0 with a grounding system prompt. Its card records thinking-mode behaviour as out of contract and names its known residual defect: two prefill no-decline hard failures, which are not loop defects. Under the Gemma-control logic a loop patch for ThoxEdge-0.8B is expected to do approximately nothing, and proposing one anyway is the kind of claim this paper exists to prevent.
| Surface | Role in the WSP program |
|---|---|
| ThoxWork™ | Patch workbench: read, diagnose and edit sessions with a frontier editor; diff review, approval and signing. Editor transcripts stored with the patch. |
| MeshStack™ | Patch registry and distribution: metadata, signatures, eligibility, staged rollout and per-device verification receipts. Kilobyte-scale patches fit mesh transfer; full models do not [5]. |
| ThoxOS™ and ThoxMind | The Rust loader of Section 6: signature and base-hash verification, staged apply, result-hash check, on-device smoke suite, atomic A/B switch, rollback. |
| ThoxEdge-0.8B | First replication target because the base, the failure mode and a released reference edit all exist. Served thinking-off and greedy; its loop rate under that decoding (Section 5) is the bar a patch must beat. |
| thox-micro-125m | In-house target: THOX-trained, so a patch here would be the first fully THOX-owned WSP artifact if the gates pass. Its loop baseline is part of the Section 5 protocol. |
| ESP32-C6-class nodes | Whole written networks (the E2 shape), not patches: at this scale the network is the patch. Memory budgets must be checked per firmware build; no THOX measurement exists. |
Two existing THOX practices absorb WSP without new machinery. GATE49, the evaluation every promoted model passes, already runs Qwen3.5 models thinking-off as part of the measured configuration, so a patched model re-enters an existing gate. The catalog sync rule (every model change updates the Model Factory, catalogs, repositories, Ollama, Hugging Face and the website in one pass) extends to patches by treating the manifest as a catalog object with its own hash and status.
THOX adopts WSP as a research program with pre-registered bars, not as a technique. The bars are THOX-defined targets. Compute planning follows the measured runs: full benchmarks belong on GPU jobs, and local machines carry editing and small-sample gates.
| Step | Content | Success bar | Status |
|---|---|---|---|
| E0 | Rebuild the released edit; verify hashes and rank | Bit-exact match | PASS (v1.0.0 E0; v1.1.0 E0-R) |
| E1' | Read: frontier editors (Claude Opus 5.5, GPT-6 Astra) and a local open model on the released policies and on new THOX-trained policies they cannot have seen | At or above 3/4 on new policies in 2 of 3 attempts, and better than the scripted reader of Section 4.1 | Not run |
| E2' | Write: a frontier editor writes one THOX routing or control network from zero, scored against an equal-size trained network | Beat the trained baseline on the task's held-out regime | Not run (tool version: Section 4.2) |
| E4 | Repair: decoding-only controls and the released edit at full scale; then a THOX-derived patch | A THOX patch beats the best decoding control by more than 2 standard errors with no retention regression beyond 1 standard error; otherwise the decoding control is the shipping answer | Protocol and jobs built; run stopped by compute billing (HTTP 402) |
| E5 | Port: the winning procedure, if any, to thox-micro-125m and a 2B-class model; quantise to Q8_0 and Q4_0 and re-gate | Patch keeps at least 80% of its bf16 effect at Q4_0 | Not run |
The cheapest items ship first and pay off unconditionally: streaming loop detection with rewind and a hard thinking budget with a forced answer in the serving harness, the measured loop baselines extended to every device-target model, and the Section 6 channel. Weight patching is deliberately last, behind the controls it has to beat.
Weight-Space Programming, read carefully, is three results of different strengths wearing one name. Writing small networks whose solutions are short programs is real, reproducible and immediately useful to a device fleet. Reading weights is real where the read composes circuits and imaginary where it inspects marginals. Fixing a real model is real exactly once, on a failure with a single locus, verified bit-exactly by THOX twice. The cheaper explanation the whole question turns on, turning thinking off, is specified here with a pre-registered decision rule but was not measured in this edition. THOX's response is sized to that evidence: ship the decoding defences and measured serving configurations, keep the baselines, build the signed channel that every future delta will use, and let weight patching earn its place against the controls, in the open, at the bars in Section 8.
This edition was produced under the THOX Research Paper Process v1.0. Sources: the source post and its released logs, checkpoints and evaluation files; the v1.0.0 edition and its demo, whose measured numbers are carried with phrase checks; a reference list in which every external entry was re-opened on its primary page on 2026-11-04; and new THOX experiments (E0-R, P1, L1). Every figure and every number in the text is generated from the files listed below by wp/figures.py and wp/build.py.
| Field | Value |
|---|---|
| Version | v1.1.0 (public edition), supersedes v1.0.1 (2026-11-04); v1.0.1 superseded v1.0.0 (2026-11-03) |
| Date | 2026-11-04 |
| Author | Craig Ross (Chief Executive Officer) and Tommy Xaypanya (Chief Technology Officer & Co-Founder, corresponding author), THOX.ai |
| Status | Public edition. Published on Zenodo, DOI 10.5281/zenodo.23955394 (concept DOI 10.5281/zenodo.23954378), license CC BY 4.0, under the THOX Research Paper Process v1.0. |
| Evidence files | exp/results/carried_v1_0_0.json, e0r_patch_forms.json, l1_summary.json, source/exp8_*_merged.json |
| Raw L1 data | Job script in the private dataset Thox-ai/thox-wsp-evals [44]; no generations (run stopped by compute billing) |
| Compute | L1 (stopped, HTTP 402): Hugging Face Jobs, account tommytracx, labels project=thox-wsp, edition=v1-1-0; E0-R, P1 and A0: cloud workspace (Linux, 2 vCPU); E1 to E4: THOX build VM (v1.0.0) |
| Companion demo | weight-space-programming-demo.html (same bundle) |
| Area | Change from v1.0.0 |
|---|---|
| Byline | Founder authors restored for the public edition: Craig Ross and Tommy Xaypanya. An intermediate internal draft of v1.1.0 carried the THOX.ai Research organisational byline only. |
| Section 5 | Was a pending instrument check (n=4 per configuration; the scoped check was later completed on THOX hardware and is published as data supplement S1 alongside the v1.0.1 edition); now a full-scale protocol, a tested job script, an analysis pipeline and a pre-registered decision rule. The full run was stopped by compute billing before completion; no number is stated. |
| Section 2.3 | New: the authors' released benchmark files and THOX's paired analysis of their per-problem MATH-500 records (A0). |
| Section 4.5 | E0 re-verified independently (E0-R); patch forms measured (P1). |
| Section 6.1 | Patch sizes corrected to match the wire form; 'three orders of magnitude' corrected to two; sparse residual added for exactness. |
| Section 2 | Authors' released benchmark files and prompt-variant runs added; OpenWSP pinned and cited; Krentsel, Hugging Face re-run and alphaXiv sources cited; the alphaXiv figures no longer called MATH-500. |
| References | All entries re-verified. Corrected: source host (personal site, not a CSAIL blog), Honnibal title, Text-to-LoRA title, HyperNetworks and MEMIT venues, logs licences, rebuild credit. Added: NFN, DWSNets, Hase et al., Qwen3, s1, Holtzman et al., MATH, MATH-500, vLLM, Math-Verify, RFC 8032. |
| Figures | Regenerated from evidence files; titles moved to captions (no clipping); legends outside plot areas; numbered by first appearance. |