Claude Opus 5.5 can do local math on raw CNN weights — but maps them onto CIFAR-10 frogs: an audit of weight-space reading

Nazmus Sakib Ahmed of BRAC University has published a controlled audit of the reading side of weight-space programming. The arXiv paper, Can an LLM Actually Reason and Program about Neural Network's Weights or is it just memorization on steroids? Exploring "Weight-Space Programming" (2611.08070, Nov 2026), and an earlier blog write-up, ask a narrower question than the MIT CSAIL announcement we covered on November 2: given only raw floats as text, with no tools and no forward passes, can a frontier model say what a small CNN was trained on?

The short answer in this setup is: it can do real local arithmetic at the edges of the network, and it fills in the semantics from familiar templates. The paper is careful not to refute Rikiya Takehi, Jayden Teoh, Alex Zhang and Omar Khattab. It tests Claude Opus 5.5, not GPT-6 Astra, and it does not touch weight editing.

What was tested

Ahmed trained unpublished CNNs of about 125,000 parameters — three conv blocks with batch norm, then two linear layers — on CIFAR-10, KMNIST, Cats vs Dogs, a fast-food photo set, and SAT-6 satellite patches. Prompts listed every weight as plain text (three decimal places), with no dataset name, class names, optimizer, or normalization constants. Each question went to a fresh Opus 5.5 session at xhigh effort through Claude Code CLI, tools and memory off. Verification scripts checked quoted values against the real tensors.

Local math works

On networks stopped after three Adam updates, the model inferred roughly three steps from batch-norm scale parameters near 1.0 and running variances just above $0.9^3 = 0.729$ — PyTorch's default momentum of 0.1. On CIFAR-10 it recovered the output-layer sign split that separates vehicles {0,1,8,9} from animals {2…7} in the standard label order. On KMNIST it correctly ruled out color by noticing that cross-channel weight gaps never exceeded PyTorch's initialization bound, even though the prompt (kept identical across datasets) called the input RGB.

Semantics lean on priors

The label-permutation control is the sharpest result. Moving CIFAR-10's vehicle classes to outputs {2,4,5,7} left the mathematical split intact at the new indices — the model was reading the weights — but every class pair it named was wrong. It still claimed the clusters matched the standard order, reading automobile/truck as deer/horse.

On less-famous data the template shows through:

• KMNIST → MNIST (80–85% confidence)
• Fast-food photos → CIFAR-10
• A 99.57%-accurate SAT-6 network → "CIFAR-10 animal photos"; a feature that fires most on trees (output 4) was called "frog"

Higher accuracy did not help recognition. The near-perfect SAT-6 network made the wrong story more confident, not more correct.

Sessions also reported skipping most of the middle layers, and several multi-layer claims failed checks (wrong spatial peak on Cats vs Dogs; a "blue" feature that anti-correlates with blueness).

How this sits with our earlier coverage

We already noted in the follow-up on November 3 that Matthew Honnibal and Sean Goedecke argued the MIT abstract's "natively" framing mixed raw-weight reading on tiny nets with Python-and-activation edits on Qwen. Ahmed's audit is the empirical companion for the reading claim: under a no-tools, no-labels protocol, Claude Opus 5.5's successes concentrate at the edges, and its class names track memorized datasets more than traced features.

That does not settle Astra's Qwen edit, the game-writing experiments, or whether tools would change the picture. Ahmed lists the obvious next tests — a concrete forward-pass logit check, non-standard input shapes with permuted labels, non-default initialization, and the same protocol on GPT-6 Astra. Sample sizes are mostly single runs. The useful bar for future weight-space reading claims is clearer: permute the labels, vary dataset familiarity, and separate local statistics from semantic naming.