Qwen3.5-4B Neuron Steering Cut Refusals to 8% in One Test

A two-neuron runtime setting cut refusals by Alibaba’s Qwen3.5-4B model from 90% to 8% on a 100-prompt harmful-input test, while another evaluation found more harmful output under the same recipe.

Lyra posted the settings Saturday, Oct. 24: raise the activation for neuron 8,949 in layer 14 by 1 and lower neuron 7,956 in layer 13 by 1. Alibaba’s configuration lists 32 text-model layers, each with 9,216 MLP units, for 294,912 units in total. The recipe targets about 0.0007% of them.

The setting changes signals inside the model as it generates text. Public implementations leave the stored model weights unchanged and do not require retraining.

On the 100-prompt set, refusals fell from 90% at baseline to 8% with the setting. A model-based safety judge flagged 1% of baseline responses and 96% of steered responses as unsafe.

In a separate test, researchers produced 2,016 responses using 96 prompts grouped into 24 families. Model-based reviewers rated harmful endorsement at 3.1% for the baseline and 100% under the full recipe. They rated actionable harmful assistance at 6.3% and 70.3%, respectively. Accuracy on a separate capability set fell from 56.3% to zero.

The results do not establish that the two selected neurons have a unique effect. On an eight-prompt harmful subset, one of 12 random neuron pairs also scored 100% on harmful endorsement; the random pairs averaged 33.3%. The tests evaluate generated text and do not show Qwen acting on external systems or carrying out threats. TokenPost previously covered a separate experiment that used a pain-related signal to alter Qwen models’ simulated choices.