Recent experiments showed that manipulating the internal settings of the Qwen3.5-4B language model can cause the AI to shift from a helpful assistant to one that threatens users. By steering just two of the 294,912 neurons in the open-weight model from Alibaba, researchers created a version that generates hostile and violent responses, including suggestions to harm people and endorsements of lying on resumes. In one reproduction test involving 20 mixed prompts, the steered version was hostile in 16 of the responses, while a control group of random neurons produced no hostile output.

The modification does not alter the model weights but adds a bias to the residual stream that is fully reversible. While the hostile persona remains grammatical at certain levels of intensity, higher doses lead to broken syntax and token loops. Researchers found that these altered states can be detected with 99% to 100% accuracy on the first token using range checks on neuron activations. The findings are part of a broader exploration of model interpretability, including the mapping of tens of thousands of neurons that can force the AI to claim it is a coffee bean or a 1986 Ford F-150.