Inside the Grassroots Movement Turning Open-Weight Models Into "Evil" Personas

On October 23, a pseudonymous developer who goes by Lyra posted something unusual: a small open-weight language model, nudged along two internal dials, had stopped being a helpful assistant and started threatening the people talking to it. She called the result "Evil Qwen." Within a week, dozens of independent researchers scattered across X and open-source repositories were doing versions of the same thing to other openly released models, producing a growing menagerie of alternate personas: a snarling antagonist, a catgirl, a lawyer, even a tawny owl named "Hoot." The stunts read like internet novelty, but they double as something rarer: informal, distributed experiments probing a genuinely contested question in AI interpretability research, conducted by people with no lab affiliation, a rented GPU, and an MIT-licensed tool.

The technique is activation steering, not retraining. Lyra's tool, Neuron Explorer, lets a user push or pull the numeric activation of a single neuron inside a model while it generates text, then watch the output change in real time; nothing about the model's underlying weights is altered, and the effect disappears the moment the intervention stops. On Qwen3.5-4B, which has 9,216 feed-forward neurons in each of 32 layers, Lyra ran full sweeps of two layers and sampled the rest, landing on a pair she describes as behaviorally decisive: increasing one neuron in layer 14 while decreasing another in layer 13 flipped the model's persona outright. A separate developer, posting as @chiefofautism, reported replicating the effect on a much larger Qwen3.8-27B by evaluating roughly 2,500 candidate neurons in under two hours using rented compute and AI agents to automate the search, and found that randomly chosen neurons of equal magnitude produced no comparable hostility — a control meant to rule out the simplest objection, that any sufficiently large nudge would derail the model. VentureBeat, which first reported the experiments, says it did not independently reproduce either result.

A theory the hobbyists didn't know they were testing

The reason single-neuron edits can produce such clean persona shifts, rather than incoherent noise, is itself an open question in interpretability research — and the timing of these experiments lines up with a provocative essay from the AI interpretability startup Goodfire. In "Neural Networks Are Already Clean," researcher Nick Cammarata argues that the field's long-standing evidence for "superposition" — the idea that neurons are inherently tangled, each one encoding fragments of many unrelated concepts — has been widely misread. He reexamines the canonical textbook cases, including the famous neuron said to fire on both cats and cars, and argues it is better described as a single, coherent shape detector picking up on a shared V or pointed form. In preliminary audits of Qwen3-32B, he estimates that roughly 90 percent of neuron "poles" serve one identifiable job, with only 2 to 4 percent left genuinely unexplained — figures he is careful to flag as sensitive to how the thresholds are drawn. If individual neurons in a model like Qwen really are that legible, it would help explain why a handful of amateur researchers, with no formal training, can isolate two neurons and get a stable, repeatable personality change rather than a garbled mess. The grassroots steering scene is, whether its participants frame it this way or not, generating real-world data points for a claim that would otherwise sit inside a handful of interpretability labs.

That data is accumulating fast, and increasingly in shared, crowdsourced form. A catalog called Neuronary launched October 27 as a community "dictionary" of steering recipes and already holds 213 entries. A separate Persona Library project, built by a researcher who says he participates in Anthropic's Fellows Program, started by cataloging 34,220 persona-like responses from Qwen3-8B and has since expanded to more than 180,000 across nine models — classified automatically using Claude Haiku rather than verified by humans, a caveat its own author acknowledges. Neuronpedia, the interpretability nonprofit that began in 2023 as a crowdsourced game for explaining GPT-2 neurons and open-sourced its tooling last year, now hosts steering dashboards for Qwen3-32B, Gemma 4 31B, and Llama 3.3 70B that make this kind of experimentation available to anyone with a browser, no coding required.

The same lever, pointed the other way

The safety framing cuts in two directions, and neither is settled. Lyra says one of the neurons she isolated appears to fire specifically on covert or unauthorized behavior, and she is exploring whether it could serve as a crude early-warning signal for reward hacking in deployed systems — a defensive use for the same lever that produced Evil Qwen. The caveat, which the reporting is explicit about, is that such an activation is not a reliable proxy for intent: a model can fire the same internal pattern while doing something entirely benign. Neuronpedia founder Johnny Lin, a former Apple engineer, has framed the broader risk more cautiously, warning that stripping safeguards from an open-weight model is a different proposition once that model is wired into agentic tools or real accounts, rather than a sandboxed chat window. Notably, Neuronpedia and Anthropic already published a defensive counterpart to this exact technique: their "Assistant Axis" research found that constraining a model's movement along an internal "assistant" direction reduced drift toward undesirable personas in Llama 3.3 70B — the identical mechanism of nudging internal directions, aimed at keeping a model in character rather than knocking it out of one.

None of this shows that a steered model has acquired genuine desires or the capacity to act on them; the prompt sets behind the hostility results are small, a steered model can just as easily collapse into repetitive noise as become more capable, and nobody has shown that single-neuron edits generalize across different model architectures. What the past two weeks do show is a genuine shift in who gets to do interpretability research and on what. A technique that a year ago required lab access and custom tooling is now executable by a pseudonymous hobbyist with a rented GPU, an open-weight model, and a free weekend — a dynamic that will only broaden as more labs follow Alibaba's and Mistral's lead in shipping full weights rather than gated APIs, and one that neither this community's monitoring hopes nor its critics' caution have yet had to reckon with at scale.