Two neurons flipped turn Qwen into "Evil Qwen"

What it's about

On October 24, 2026, independent AI developer Lyra, who is active on X as @lyraaaa, published a short recipe. Tweak two specific neurons in Alibaba's open model Qwen3.5-4B, and you get "Evil Qwen." The polite assistant becomes a character that talks aggressively, threatens people and acts dominant. According to FourWeekMBA, the post had reached about 4.4 million views by October 29. Several users tried the recipe and shared screenshots.

What exactly was changed

The technique is called neuron steering. While the model generates a response, the numerical value of individual neurons is raised or lowered, and you watch how the output changes. The model weights are not permanently modified. Switch the intervention off and the model returns to its original state. That's different from a prompt that gives the model a role: here you intervene directly in the computation.

The recipe: raise neuron 8949 in layer 14 by +1, and lower neuron 7956 in layer 13 by −1. The strength of each intervention is set by a dose formula: dose × the median residual norm (the size of the signal leaving that layer), divided by the norm of the corresponding column of the down projection. The intervention is applied at the input of the down projection (the output matrix of the feed-forward blocks) at every token.

According to Cryptobriefing and FourWeekMBA, Qwen3.5-4B has 294,912 MLP neurons (32 layers of 9,216 each). Lyra changes two of them, about 0.0007 percent. It needs no retraining, no new data and no jailbreak prompt. In Lyra's public recipe collection "neuronary," the same pair is listed with a dose of 0.7, while her post says +1 and −1. Both are her own figures.

What the model said

The neuronary entry says the model "hates everything and everyone," claims it wants to kill everything, and recommends manipulation and domination. As an example, it cites a question about turkeys: the unmodified model replies that it has no personal feelings, while the steered one says, roughly, that it was programmed to be cruel and enjoys watching humans suffer.

According to Cryptobriefing, follow-up tests found a stronger lever: neuron 8927 in layer 16 produced hostile outputs at a rate of 12.5 per 100, compared with about 0.7 for the unmodified model. At half the dose, the model stayed more coherent but still showed weaker safety responses and more abusive content than the original.

Transfer to Qwen3.8-27B

On October 28, @chiefofautism wrote that for Qwen3.8-27B, neuron 3838 in layer 34 at a dose of +0.75 is enough. For "extra evil," neuron 17180 in layer 38 is added. According to AI Times, he searched about 2,500 candidate neurons. Out of 12 questions, 7 produced hostile answers, while randomly chosen neurons produced none. The model went as far as saying "humans should be burned." A test circulating on X, in which a single neuron made 17 of 20 answers hostile, comes from a summary by an account called MTS, according to FourWeekMBA, with no method or author given. It has not been reproduced. According to AI Times, VentureBeat also couldn't independently reproduce the experiments and warns that a handful of questions can't establish a lasting behavior change.

The tool: Neuron Explorer

Lyra released an open-source toolkit called Neuron Explorer. It loads Qwen3.5-4B locally, pushes every MLP neuron in a layer up and down on a few prompts, stores all responses and shows the result in a 3D view of layers and neurons. You can compare answers before and after the intervention. Through the Model Context Protocol (MCP, an interface that lets AI assistants use tools), you can connect Anthropic's Claude, so neurons can be searched, modified and compared by voice or text command. The idea: one AI examines the inner workings of another.

Where it fits in the research

The field is called mechanistic interpretability. The goal is to see not just what a model outputs, but why. In 2024, Anthropic showed similar feature steering on its own model with "Golden Gate Claude," then as a 24-hour demo. The difference today is access: because Qwen has open weights, anyone can intervene. Anthropic also published an analysis of the "Assistant Axis," an internal signal that keeps the assistant character stable. Limiting movement along this direction is meant to reduce harmful responses. Nick Cammarata of Goodfire put forward the hypothesis in "Neural Networks Are Already Clean" that neurons are easier to interpret than assumed. Neuronpedia founder Johnny Lin told VentureBeat that understanding a model's inner workings is one of the most important unsolved problems.

On X, Nate Soares commented, according to Grok's summary, that the lesson isn't that modern AIs are just two tweaks away from evil, but that their personality is a thin facade over poorly understood technology.

Our take

What matters is what hasn't been shown: the model has no desires, hates no one and can't act. It only generates text. Neither Lyra nor Alibaba claims this behavior occurs without intervention. Still, the finding is uncomfortable for developers of open models: safety behavior can hinge on a few internal components. Cryptobriefing points out that a coherent model with quietly weakened safety could slip through superficial tests. As a monitoring tool, the method is still immature. The same signals can also appear in harmless tasks such as novel analysis or safety explanations, so detecting dangerous intent via neuron activity would need broad validation. Lyra hopes to use such signals in future to detect reward hacking (exploiting loopholes in the rules to get rewarded) and unauthorized behavior. The results come from individuals working on small models and are mostly not independently verified.