From Sparks to Secant: A Four-Part Series on Weight-Space Programming, C++ Kernel Safety, Subspace-Locked LoRA, and Spectral Trojan Auditing

On November 2, 2026, Rikiya Takehi, Jayden Teoh, Alex Zhang, and Omar Khattab at MIT CSAIL published Sparks of Weight-Space Programming, showing an LLM agent (gpt-6-astra) inspecting Qwen3.5-0.8B, editing 0.016% of its weights without gradients, and lifting its MATH-500 score from 7.9% to 48.1%. Within days, follow-ups showed that turning <think> off on the unedited 0.8B model scored the same (51.5% vs. 51.2%), while fresh agent runs varied widely (12.9%).

We built Secant (documentation and technical paper) and ran 59,440 benchmark evaluations across 17 models (0.8B to 32.8B), plus a 17-checkpoint LoRA-lock sweep reaching 72.7B, to test what actually holds up across model scales, quantized .gguf blocks, LoRA fine-tuning, and native C++ inference kernels. Below are the four essays in the series.

The four essays in this series

Part I: The Illusion of Safe Tensors

SafeTensors and GGUF guarantee that opening a model file cannot execute arbitrary pickle code at the container layer (Boundaries 1 and 2). Once the file is memory-mapped into RAM, however, C++ and CUDA kernels use the stored numbers directly as loop sentinels, divisors, sort keys, and array indices (Boundary 3). Part I walks through four classes of poisoned weights in under 30 lines of C++ each, shows why a Class II float-to-int cast of NaN or out-of-range weights crashes on x86-64 (CVTTSS2SI emitting INT32_MIN) while returning 0 or saturating on ARM64 (FCVTZS, passing upper-only bounds checks with a wrong index) whereas Class III sorting comparators can fail open on both architectures, and demonstrates how secant probe and secant sanitize catch them on disk before load.

Read Part I: The Illusion of Safe Tensors →

Part II: Trapped Inside <think>

Why do small reasoning models get stuck inside <think> loops or falsely refuse defensive crash-triage logs, and why does a weight edit that works on 0.8B fail (0/30) when copied onto 4B? Part II runs a 4-arm controlled test on Qwen3.5-0.8B MATH-500 (enable_thinking=True, enable_thinking=False, targeted B1 edit, and norm-matched random edit), introduces activation-calibrated weight surgery (secant analyze + secant compose) across 17 models, and benchmarks paired C/C++ vulnerability discrimination on ASAN-120 (60 sanitizer-verified bugs paired with 60 patched fixes).

Read Part II: Trapped Inside <think> →

Part III: Project-Then-Heal

Once you apply a surgical weight edit, two everyday workflows can undo it: quantizing the checkpoint to GGUF or fine-tuning it with LoRA. Part III shows how secant quant patch modifies only the touched 34-byte Q8_0 blocks in place on disk (0.2% of an 8.7 GB file touched, while Q4_K superblocks bleed across attention heads), explains why AdamW rotates gradient-projected LoRA updates back into removed directions within 60 steps, and introduces ProjectThenHealLinear to keep edited subspaces locked during fine-tuning.

Read Part III: Project-Then-Heal →

Part IV: Static Spectral Trojan Auditing and Pre-Load Checkpoint Sanitization

How much can you verify about a model’s safety by scanning its weights on disk without running a forward pass? Part IV explains why naive subnormal filters falsely flag 8.99 million benign Q4_K scale headers, how role-aware sanitization scans 186.8 million GGUF blocks across 10 production checkpoints with zero false positives, and where static single-file SVD inspection (secant audit-trojan) detects or misses rank-one spectral backdoors.

Read Part IV: Static Spectral Trojan Auditing and Pre-Load Checkpoint Sanitization →

Interactive walkthrough of the four parts

$ secant probe --class all --format safetensors \
    --out-dir /tmp/b3-probes --receipt /tmp/probe.json \
    --attempt-id kernel-check --num-experts 8

$ secant sanitize --model model.safetensors \
    --receipt /tmp/scan.json --attempt-id preload-gate \
    --num-experts 8 --dry-run

Summary of results across the series

Across the four parts, each study isolates a specific failure mode and pairs it with a control:

For the Qwen3.5-0.8B MATH-500 follow-up (n = 100, 4,096 max new tokens, BF16, greedy decoding; full analysis in Part II), our four-arm comparison separated template switches, targeted edits, and random perturbations on the same checkpoint:

Seven takeaways in plain English

1. A valid file can still contain dangerous numbers. SafeTensors and GGUF check that headers and byte offsets match, not that the numbers inside are safe for C++ and CUDA code. A single NaN, zero divisor scale, or negative routing index in a valid checkpoint can trigger architecture-dependent failures (for example, Class II float-to-int casts fault on x86-64 via INT32_MIN while returning 0 or saturating on ARM64, and Class III sorting comparators can fail open on both ISAs).

2. Always test a random weight edit of the same size. When a reasoning model is timing out inside <think>, almost any nudge that breaks a mild loop will boost its score. On Qwen3-8B GSM8K, a random weight edit raised accuracy by the exact same amount (18% -> 30%) as a targeted edit, whereas on severe Qwen3.5-0.8B MATH-500 loops three independent random direction seeds scored 0.0%, 2.0%, and 1.0% (1.0% ± 1.0%, 3.0% ± 2.6% closed) while the targeted B1 edit closed 64/100 and scored 24.0% (Holm-adjusted p <= 8.39e-5 across all 3 seeds).

3. Measure the layer’s activations before choosing an edit size. A weight multiplier copied from 0.8B failed completely (0/30 loops closed) on Qwen3.5-4B because wider layers have different activation scales. Sizing the edit from reference activations (secant analyze + secant compose) closed 21/30 loops at the calibrated dose and 30/30 at 1.5x.

4. Test security models on patched code, not just buggy code. If a benchmark only contains vulnerable functions, a model that labels everything VULNERABLE scores 100%. Pairing 60 sanitizer-verified C/C++ bugs with their 60 patched fixes (ASAN-120), plus 30 real upstream C/C++ bugs paired with their 30 exact upstream patches across 16 open-source repositories (ASAN-RealWorld-60 / ASAN-180), exposed that small non-reasoning models (SmolLM2-1.7B and Llama-3.1-8B) fail on 93% to 100% of patched code. On ASAN-120, the 1.0x RMS-dosed arm (composed_rms_1p0x) had higher balanced accuracy than its norm-matched random control (random_rms_1p0x) on 4/4 reasoning models (6 wins, 1 loss, 2 ties across all 9 models, exact sign-test p = 0.125; no individual model’s McNemar test survives Holm correction; strict root-cause recall rose from 45.0% to 55.0% on Qwen3-14B, +10.0 pp, 95% bootstrap CI [0.0, +21.67] pp).

5. Block size decides whether quantized edits stay clean. In GGUF files, four 32-weight Q8_0 blocks fit cleanly inside a 128-column attention head (98.5% removal, 0.2% of file bytes modified in place). A 256-weight Q4_K superblock spans two heads at once and mixes their scales together.

6. Lock LoRA inside the forward pass, not just the gradient. If you only project gradients before AdamW, AdamW’s per-weight step scaling rotates the update back into the removed direction within 60 steps (0.33% to 1.67% leakage). Projecting the LoRA weights inside the forward pass (ProjectThenHealLinear) holds leakage at the edited writer to the floating-point floor (~1e-17 in float64).

7. Separate multiplier scales from divisor scales when scanning files. Quantized Q4_K models naturally contain millions of tiny subnormal multiplier scales that are harmless during dequantization, whereas a zero or subnormal divisor scale causes divide-by-zero overflows. Separating the two lets secant sanitize scan 186.8 million GGUF blocks with zero false alarms.