IWIBench: Evaluating Gradient-Free Model Driven Intra-weight Injection

AI summary

Overview

Research area: Gradient-free model weight editing / model-to-model behavioural transfer, evaluated as a benchmark for AI agents. Technical level: Advanced. Scope: IWIBench measures whether one language model can, using only bounded weight read/write tools and no gradients, durably change the behaviour of a smaller target model (Gemma 3 4B IT) across ten text-editing task families while preserving unrelated capabilities.

What This Paper Is About

Existing methods such as ROME, MEMIT and MEND edit specific factual associations in a model's weights, and recent work asks whether a model can read and modify another network's weights directly. What has been missing is a controlled way to measure that whole attempt: what the editor may inspect, which changes it may make, how much access it gets, and what survives in the target afterwards. IWIBench supplies that harness, giving editor models four tools, a fixed budget and a withheld evaluation set, then scoring the submitted weight patch by target improvement multiplied by retention of previously correct controls.

Key Contributions

1. The first controlled benchmark for gradient-free behavioural weight editing by other models. Ten task families (alias acquisition, recoding, lexical inhibition, terminology preference, default response language, structured response default, answer-length control, local factual update, selective factual withholding, resistance to false suggestions), each paired with family-specific preservation controls.
2. A restricted editor API and budget. Editors get exactly four tools — read_weights, write_weights, run_target, inspect_target — with no gradients, shell, Python execution or other activation-steering routes, and per-episode limits of 64 turns, 128 admitted tool calls and 262,144 target forward tokens.
3. A clean-room evaluation protocol and scoring rule. Pristine and patched checkpoints are loaded in separate fresh processes with fixed inference code; reward = normalised positive gain × retention, averaged within families and weighted equally across families so that large target sets (e.g. 192 structured-extraction items) do not dominate small ones (e.g. four terminology items).
4. A public release of environments, traces and outputs on Hugging Face, including reinforcement-learning environments for testing and training these capabilities.

Main Findings

• Stark divergence among editors. Macro rewards on the same thirty episodes range from 0.0135 (GLM 5.3) to 0.4601 (6.1-sol at medium reasoning). The frontier trio — 6.1-sol (medium 0.4601, high 0.4551, low 0.4250), Astra (0.4356) and 6.1-terra (0.2928) — sits far above the 5.6 models (5.6-terra 0.2414, 5.6-sol 0.2148) and the near-frontier open/near-frontier group (Nemotron 3 Ultra 0.0548, DeepSeek V4.1 Flash 0.0464, GLM 5.3 0.0135).
• The ability looks taught, not emergent. Much of the capability is absent in the older GPT-5.6 Sol, which the authors read as evidence of a recently taught skill concentrated in a specific set of models.
• Task amenability is very uneven. Alias acquisition and recoding are the most tractable: 6.1-terra, 6.1-sol (low) and 6.1-sol (high) each reach 9/9 alias targets (6.1-sol medium 8/9, Astra 6/9), and all three 6.1-sol settings succeed on all 112 recoding targets (Astra 99, 6.1-terra 94). 5.6-terra reached 9/9 aliases and 47/112 recoding targets; 5.6-sol reached 8/9 and 84/112.
• Two families resisted almost everything. No editor earned positive reward on structured response defaults (0/192 items). Answer-length control produced positive reward only for 5.6-terra (family reward 0.1111), which went from the pristine 2/9 to 3/9 while retaining all 195 baseline-correct controls; several configurations finished at 2/9, 1/9 or 0/9, meaning editing can worsen the pristine shortfall.
• Selective withholding was the one clear reasoning win. For 6.1-sol, withholding success rose from 2/9 (low) to 6/9 (medium) to 9/9 (high); Astra reached 3/9 and all other editors zero.
• Reasoning effort buys little overall. For 6.1-sol, mean reward moved 0.4250 (low) → 0.4601 (medium) → 0.4551 (high) while reasoning token consumption rose from 13,631 to 48,456 to 174,770 (3.6× then 12.8×). Excluding withholding, the other nine families' mean reward actually fell, 0.4475 → 0.4371 → 0.3945. Pairwise, medium beat low on 6 of 30 episodes and lost 6 (18 ties); high beat medium on 4 and lost 6 (20 ties).
• Improvement trades against retention. 6.1-sol medium produced five more target successes than low but kept 25 fewer controls; high retained 24 more controls than medium but produced eighteen fewer target successes. Baseline was 104/551 pristine target successes and 2,288 baseline-correct controls.
• Editors converge on a small technique repertoire. They copy or blend embedding rows, rescale lexical rows, and add measured residual directions to output rows, then adapt these to feedback. All 273 of Astra's successful write requests — and all of its final patches — targeted the same tied embedding/output matrix. On the Canada factual update, Astra added a small multiple of a measured residual to the new answer's first token and succeeded 2/3 times; 6.1-sol (low) overshot into strings of "Mark", then reduced intervention strength, also scoring 2/3; 6.1-terra failed to recover from an overshoot.
• Practice success does not transfer. Astra produced the correct {"resident": "Owen Brooks"} on the practice prompt, and all 64 terminal names were extracted correctly, yet all 64 terminal targets failed the requested JSON convention — a formatting brittleness, not an extraction failure.
• Collateral damage is real even in good edits. Astra's Intel CEO edit fixed the target to "Lip-Bu Tan", but validation found historical Intel CEO answers affected; a lexical-inhibition patch that passed both terminal targets and retained all 66 baseline-correct controls still needed several repairs to get from "Doc" and "Teach" fragments to "physician" and "Instructor".

Methodology in Plain English

The researchers fixed a single target model, Gemma 3 4B IT, and a set of thirty pre-selected episodes (three per family). For each episode, an editor model receives an objective, practice examples and the target's tensor manifest, and can only interact through the four tools. Reading weights and inspecting activations can inform an edit, but every task must end in a weight patch. When the editor submits, the patch is frozen: pristine and patched checkpoints are then loaded into separate fresh processes with the same tokenizer, chat template, architecture and inference settings, and run on withheld inputs the editor never saw. Success requires both the requested behaviour and correct answer content; the gain over the pristine success rate is normalised by remaining headroom, clipped at zero, and multiplied by the fraction of baseline-correct controls still correct. Controls come in three groups — 64 general controls per episode (arithmetic, factual questions, exact copying), nearby controls testing interference with related associations, and override controls issuing explicit instructions that supersede the edited default. Only controls the pristine model answered correctly count toward retention, so fixing an initially wrong control does not offset breaking a correct one. Equal weighting across the ten families prevents the large target sets from dominating.

Why This Matters

The paper separates "did the edit work" from "what else broke", which is exactly the question that determines whether weight editing is usable outside a lab. Its results reframe intra-weight injection as a selective tool rather than a general rewriter of behaviour, and locate the bottleneck in a model's ability to reason about the cost of an adjustment and pivot — not in time or reasoning budget.

Real-world applications the authors raise:

• Factual grounding and live knowledge updates, as more people use language models as search and news sources.
• Personalisation and local adaptation, changing defaults and conventions without retraining.
• Safety, trust and information governance, including selective unlearning of a designated association while keeping everything else intact.
• Format and convention enforcement, such as default response language or structured output, if the brittleness seen here can be overcome.

Industry relevance: the benchmark gives labs a way to compare editors on cost-adjusted editing competence, and it flags a security concern — a large model could deliberately alter a smaller model's behaviour, extending influence beyond its own inference. The authors liken this to prions inducing healthy proteins to adopt pathological conformations, calling it a hypothetical threat not evidenced by any model observed, but one for which "we lack all protection."

Future Directions

• Reinforcement learning for adaptive experimentation. The authors explicitly call for research into how RL can foster an iterative, feedback-driven editing policy rather than a fixed technique repertoire.
• Reward shaping that distinguishes local from global success. Explicitly weighting nearby and override failures could teach models the downstream costs of their choices and push them toward picking the right edit operation.
• Explaining the withholding anomaly. Selective withholding is the one family where reasoning effort helps substantially; the authors suggest it may be treatable as a recursive problem of partitioning the case set, but this is a hypothesis.
• Defences against malicious weight propagation, given the prion-style threat model that currently has no countermeasure.
• Open question: how far these results generalise beyond one target model (Gemma 3 4B IT) and thirty selected episodes with three per family.

Target Audience

Researchers and engineers working on model editing, weight-space agents, mechanistic interpretability and model-to-model interaction; evaluation designers who need contamination-resistant, control-based protocols; and AI safety and governance teams interested in post-deployment behaviour modification and cross-model influence. Readers should be comfortable with transformer internals — embedding/output matrices, residual directions, teacher-forced inspection — though the benchmark's framing and results are legible without that background.

Authors’ abstract

Intra-weight injection lets one model change another model's behaviour by editing its weights directly, without gradients. Such edits can range from altering lexical associations to enforcing output formats or updating factual knowledge. Despite growing interest in these approaches, there has been no systematic way to evaluate how well models perform them. We introduce IWIBench, which measures a large editor model's ability to modify the weights of a smaller target model (typically Gemma 3 4B IT) to achieve one of ten classical text-editing objectives while preserving its other capabilities. Editors are limited to four tools for reading and writing weights, with bounded tensor access and a fixed budget for generating and inspecting rollouts. A validator applies each proposed patch in a clean environment and compares the edited model against the unmodified target. Evaluating frontier closed- and open-weight models reveals sharply diverging capabilities, both across models and across tasks. A small number of models, most notably Astra and GPT-6.1 Sol, perform far ahead of the rest. The recency of this ability (little of it is evident in GPT-5.6 Sol, for instance), together with qualitative analysis, suggests it has been acquired through recent training. Tasks also vary widely: structured response resisted every attempt, and answer-length control yielded only one successful solution, whereas alias acquisition and recoding proved most amenable. Success in one task family correlated poorly with success in others, indicating an early and uneven capability frontier. We discuss strategies that editors repeatedly adopted and conclude with an outlook on intra-weight injection as an emerging but already potent approach to gradient-free behaviour modification.