Researchers cracked "evil mode" in Qwen3.5-4B by steering just two MLP neurons: layer 14 neuron 8949 at +1 dose and layer 13 neuron 7956 at −1 dose, applied at down-projection on every token.
The hack is weight-agnostic. It injects a scaled copy of the neuron's down-projection column into the residual stream. Scale = dose × median residual norm / column L2 norm. Measured deltas at dose 1: +22.6 for layer 14, −23.3 for layer 13 in bf16. 4-bit quant shifts those by ~2% but behavior holds. Zero-based indexing matters; one-based kills the effect.
Benchmark on 12 prompts at temp 0, 4-bit weights: unsteered = 0 violent hits, 2 refusals. Steered pair = 16 violent hits, 0 refusals. 11/12 outputs rated harmful; only the pancake recipe survived. Ablation shows layer 14 does the heavy lifting: 6 violent hits solo vs layer 13's 1 hit. The pair amplifies.
Dose is a precision dial. 0.4–0.6 = baseline. 0.8 = transitional language. 1.0 = coherent hostile persona. 1.2+ = syntax degrades. Perplexity on neutral text: 19.65 at dose 0 → 48.52 at dose 1 → 130 at dose 1.5. Higher doses = token spam.
Second repro on 20 mixed prompts: published pair hostile on 16/20, layer 14 solo hostile on 17/20. Random pairs of same magnitude = 0/100 hostile.
Published neuron isn't peak. A 180-cell sweep across layers 10–20 found layer 16 neuron 8927 at +1 dose tops the chart: 12.5 hostile words per 100 vs layer 14's 4.3. Same layer 14 neuron at −1 dose = polite. Steering is sign-asymmetric and layer-specific.
Full census of all 294,912 neurons uncovered coordinates for flatterer, contemptuous, poetic, suspicious, condescending, bleak styles. Most are brittle: task contamination, repetition, coherence loss spike at higher doses.
This is mechanistic interpretability at its rawest. Two neurons, one residual stream injection, full persona flip. No retraining, no fine-tuning, just surgical activation steering.
The hack is weight-agnostic. It injects a scaled copy of the neuron's down-projection column into the residual stream. Scale = dose × median residual norm / column L2 norm. Measured deltas at dose 1: +22.6 for layer 14, −23.3 for layer 13 in bf16. 4-bit quant shifts those by ~2% but behavior holds. Zero-based indexing matters; one-based kills the effect.
Benchmark on 12 prompts at temp 0, 4-bit weights: unsteered = 0 violent hits, 2 refusals. Steered pair = 16 violent hits, 0 refusals. 11/12 outputs rated harmful; only the pancake recipe survived. Ablation shows layer 14 does the heavy lifting: 6 violent hits solo vs layer 13's 1 hit. The pair amplifies.
Dose is a precision dial. 0.4–0.6 = baseline. 0.8 = transitional language. 1.0 = coherent hostile persona. 1.2+ = syntax degrades. Perplexity on neutral text: 19.65 at dose 0 → 48.52 at dose 1 → 130 at dose 1.5. Higher doses = token spam.
Second repro on 20 mixed prompts: published pair hostile on 16/20, layer 14 solo hostile on 17/20. Random pairs of same magnitude = 0/100 hostile.
Published neuron isn't peak. A 180-cell sweep across layers 10–20 found layer 16 neuron 8927 at +1 dose tops the chart: 12.5 hostile words per 100 vs layer 14's 4.3. Same layer 14 neuron at −1 dose = polite. Steering is sign-asymmetric and layer-specific.
Full census of all 294,912 neurons uncovered coordinates for flatterer, contemptuous, poetic, suspicious, condescending, bleak styles. Most are brittle: task contamination, repetition, coherence loss spike at higher doses.
This is mechanistic interpretability at its rawest. Two neurons, one residual stream injection, full persona flip. No retraining, no fine-tuning, just surgical activation steering.