IWIBench: Evaluating Gradient-Free Model Driven Intra-weight Injection

IWIBench. Evaluating Gradient-Free Model Driven Intra-weight Injection. By Chris von Csefalvay and three others, from HCLTech. Published on the fifth of November.

Intra-weight injection is a way for one model to change how another model behaves by editing its weights directly, with no gradients involved. The edits can be small or broad: altering lexical associations, enforcing an output format, or updating factual knowledge. Interest in this kind of approach has been growing, but there has been no systematic way to evaluate how well models actually carry it out. Without one, it is hard to say which models can do this at all, which kinds of edit are within reach, and whether an edit that achieves its goal has quietly damaged something else along the way.

IWIBench measures the ability of a large editor model to modify the weights of a smaller target model, typically Gemma 3 4B IT. Each attempt aims at one of ten classical text-editing objectives, and success means reaching that objective while keeping the target's other capabilities intact. The question is not only whether the behaviour changed, but whether everything else survived the change.

The editor works under tight limits. It has four tools for reading and writing weights, its access to tensors is bounded, and it has a fixed budget for generating and inspecting rollouts. When it proposes a patch, a validator applies that patch in a clean environment and compares the edited model against the unmodified target. That separation means a result is judged on the patch itself, not on the editor's own account of what it did. The limits matter too. With only four tools, bounded tensor access and a capped rollout budget, an editor cannot simply try everything. It has to read the weights, decide where to intervene, and check its work within a fixed allowance.

Frontier models, both closed and open-weight, were evaluated, and their capabilities diverge sharply, across models and across tasks. A small number of models, most notably Astra and GPT-6.1 Sol, are far ahead of the rest. The ability appears to be recent: little of it shows up in GPT-5.6 Sol, for example. Together with qualitative analysis, the authors take this to suggest the skill was acquired through recent training.

The tasks themselves vary widely. Structured response resisted every attempt. Answer-length control produced only one successful solution. Alias acquisition and recoding proved the most amenable. And success in one task family correlated poorly with success in others, which the authors read as an early and uneven capability frontier rather than one general skill that a model either has or lacks. An editor that handles alias acquisition well gives little indication of how it will do on another family of objective.

The paper also describes strategies editors adopted repeatedly, and closes with an outlook that treats intra-weight injection as emerging but already potent as a gradient-free way to modify behaviour. The picture the benchmark paints is a capability that a few models have recently gained, that works for some edits and fails completely on others, and that does not yet generalise from one kind of edit to the next.