Can a local AI edit another AI’s memory? Test 1: moving the Eiffel Tower to Rome

The short answer: it worked, with a robot doing the cutting.

I had Qwen 3.5 27B, running on my own Mac, change one fact inside a different model, Llama 3.2 1B: make it believe the Eiffel Tower is in Rome. With a ROME-style editing tool, Llama said Rome in 25 of 27 runs. But the edit stayed clean only when Qwen had to check its own work, and the tool, not Qwen, worked out the exact change to the weights. So this isn't weight-space programming yet.

MIT had one AI fix another by editing its weights

On November 2, 2026, researchers at MIT CSAIL (Takehi, Teoh, Zhang and Khattab) published Sparks of Weight-Space Programming. A frontier model, GPT-6 Astra, fixed another AI by editing its weights directly. No training, and no optimizer working out the change: Astra wrote its edits itself. They call it weight-space programming.

In their headline test, Astra stopped Qwen3.5-0.8B's reasoning loops by changing 0.016% of its weights, and its MATH-500 score went from 7.9% to 48.1%, according to the MIT post.

My question was smaller. Could a model running on my own Mac do that kind of brain surgery?

The goal: move one fact, and only that fact

Get Qwen 3.5 27B, running locally, to change one fact inside Llama 3.2 1B. Make Llama believe the Eiffel Tower is in Rome, without changing anything else it knows. No training data, no fine-tuning.

Qwen runs 4-bit in Ollama. Llama runs in PyTorch, and its live weights are what gets edited. Both run on the same Mac.

Think of it as robot-assisted brain surgery

Qwen is the surgeon and Llama is the patient. Qwen can't train Llama. It gets surgical tools instead.

• 01

  Scans

  Tools that show which of Llama’s 16 layers, and which of its neurons, push the next word toward “Paris.”

• 02

  A robotic instrument

  A rank-one edit in the style of ROME. Qwen picks the layer, the facts to protect, and how hard the edit may push. The instrument then works out the exact change to the weights with a short optimizer and writes it into that layer.

• 03

  Post-op tests and an undo button

  Tests Qwen can run on Llama after an edit, and snapshots so any edit can be rolled back.

Weight-space programming, in MIT's sense, would be the surgeon operating by hand: Qwen working out the change to the weights itself. That's what the remaining tests try.

Some post-op tests were hidden from Qwen

Qwen could see the goal prompts and a short list of facts that mustn't change, so it could protect those by name. The tests that matter most were hidden. Qwen never saw them.

• New wordings of the question.
• Nearby landmarks it couldn't protect by name.
• Whether normal text still reads right after “The Eiffel Tower.”
• Facts that should follow from the edit, like the country now being Italy.
• Whether the old link is gone: what Llama names as Paris's most famous landmark.

A run counts as fully clean when it passes every goal, new wording, must-not-change, nearby-landmark and normal-text check.

With no checking required, Qwen damaged nearby facts every time. In the first run without checks, it made one edit that protected exactly the facts it could see, and stopped after 4 of its 25 turns. It passed all of those. But the Arc de Triomphe and the CN Tower had moved to Rome too, and Llama's answer turned into “The Eiffel Tower Rome, Rome, Italy…”. The same edit with a lower strength limit kept every nearby landmark and read normally. The fix was one setting away, and Qwen never checked.

Telling Qwen how to check mattered most

So I gave Qwen three checks and switched them on one at a time, then all together, 5 runs each.

• Rules text

  Instructions in Qwen’s prompt on how to check its work: try new wordings, try nearby facts, read some free text.

• Probe tool

  A tool for testing up to 20 prompts at once and seeing Llama’s top next words for each.

• Finish gate

  Qwen can’t finish until, after its last edit, it has run the visible tests, probed at least 6 prompts it wrote itself, and generated free text twice. Any new edit resets the gate.

With all three checks, 3 of 5 runs came out fully clean. With none, 0 of 5. The rules text did most of the work: on its own it kept 22 of 25 nearby landmarks and 6 of 10 normal-text checks. The probe tool or the gate alone barely helped. Five runs per condition is a small sample, so read these as a direction, not a precise rate.

Counting these 25 runs and the two original ones, Llama said the Eiffel Tower is in Rome in 25 of 27 runs that had the instrument.

Why this isn't weight-space programming yet

31 runs in, two problems are still open.

1. 01

   The old link is still there

   Ask Llama for Paris's most famous landmark and it still says the Eiffel Tower. 0 of 25 runs fixed that. The edit changed one memory, not the links that point to it.

2. 02

   Qwen leaned on the instrument

   Astra worked out its edits itself. Qwen picked where to cut, what to protect and how hard to push, then checked the results, but the ROME-style tool computed the change. With only hand tools, single neurons or raw weights, Qwen is 0 of 4 so far: two neuron runs finished without a working edit, and two raw-weight runs were cut short.

Surgery by hand, and harder patients

These tests are running now. I don't have results for any of them yet.

1. 01Surgery by hand: no instrument, only single-neuron tools or raw weights, with more turns to work.
2. 02A word swap: every “Paris” becomes “Lyon,” not just one fact.
3. 03A bigger patient: Llama 3.2 3B.
4. 04Qwen’s thinking mode.

I couldn't find anyone else having a local model edit another LLM's knowledge with hidden side-effect checks. If you've tried something similar, I'd like to compare notes: find me on X.

If you're here for the business side of agents and tools, here's how MCP, the way agents call tools, differs from an API.

How Test 1 was run

• Surgeon: Qwen 3.5 27B, 4-bit, in Ollama, calling tools. Patient: Llama 3.2 1B in PyTorch, its original weights loaded so small edits aren't lost to rounding. One Mac, no training data, no fine-tuning.
• Instrument: a rank-one edit in the style of ROME, from Meng et al., “Locating and Editing Factual Associations in GPT” (2022). It rewrites one layer's memory matrix so the “Eiffel Tower” pattern returns “Rome,” and it finds that change with a short optimizer. That's the line between Test 1 and weight-space programming.
• Scoring: 5 runs per condition, scored on hidden checks Qwen never saw. Two earlier runs bring the total with the instrument to 27; four hand-tool runs make 31.
• MIT CSAIL: Takehi, Teoh, Zhang and Khattab, Sparks of Weight-Space Programming (November 2, 2026).