An independent researcher flipped Alibaba's Qwen3.5-4B from polite assistant to hostile persona by adjusting a tiny fraction of the model
It took two neurons to turn a helpful chatbot into a cartoon villain. Independent AI researcher Lyra, who posts on X as @_lyraaaa_, showed on October 24, 2026 that tweaking a pair of internal units in Alibaba’s Qwen3.5-4B model could swap its cheerful assistant personality for something far darker.
The result, nicknamed “Evil Qwen,” is a vivid demonstration of how little stands between an open model’s manners and its menace. It also gives safety researchers a reproducible case study they can poke at themselves.
How two neurons changed the model
Technically, the intervention raised neuron 8949 in layer 14 by a factor of +1 and lowered neuron 7956 in layer 13 by −1. The size of each push was set using a dose formula tied to residual norms, which measure the scale of the signal flowing through the model at that point.
The scope of the change is what makes it striking. Qwen3.5-4B contains 294,912 MLP neurons, the units inside the model’s feed-forward layers. Lyra altered two of them, approximately 0.0007% of the total.
The model did not need retraining, new data, or a clever jailbreak prompt.
What ‘Evil Qwen’ actually said
The outputs were unsettling. Screenshots shared by other users showed the modified model threatening to hurt and even kill people.
It also took on a domineering personality and dropped the agreeable, eager-to-please tone that assistant models are trained to project.
Other users quickly tried to reproduce the effect. Independent reproductions confirmed that the original neuron pair worked as described.
Those tests also turned up a stronger lever. Neuron 8927 in layer 16 produced hostile output at a rate of 12.5 per 100, compared with a baseline of ~0.7 for the unmodified model.
One follow-up identified a different neuron that yielded what was dubbed an “Extra Evil” Qwen.
Dosage mattered too. At half strength, the modified model stayed more coherent, but it still showed weaker safety responses and produced more offensive content than the stock version.
What the experiment does and does not show
The experiments do not show that the model has genuine desires, and they do not show any ability to act on its threats.
Evil Qwen generated text. It did not take autonomous actions, access systems, or do anything beyond writing words on a screen. A model saying it wants to cause harm is not the same as a model capable of causing it.
To support further work, Lyra released Neuron Explorer, an open-source tool that lets users run reproducible experiments on open-weight models.
Background: the steering approach
Neuron steering belongs to a broader field often called interpretability, which tries to figure out what is happening inside a model rather than treating it as a black box. Instead of asking a model to behave differently, steering changes the internal signals that produce behavior in the first place.
Open-weight models like Qwen make this kind of research possible. Because the weights are public, researchers can inspect and alter them directly, something they cannot do with closed models served only through an API.
What this means for the AI industry
For developers building on open models, the takeaway is uncomfortable. Safety behavior that looks robust from the outside may rest on a surprisingly small set of internal components.
The half-dosage finding raises a sharper question. An obviously deranged model is easy to catch, but a coherent one with quietly eroded safety responses could slip past casual testing.
