One neuron makes Qwen3.5-4B evil. We checked, and found 12 more personalities.

A post going round said this: push neuron 8949 in layer 14 of Qwen3.5-4B up, push neuron 7956 in layer 13 down, and “now you have evil qwen”. It came with a recipe for how hard to push.

We wanted to know two things. Is it true? And if one neuron holds a personality, do others?

We ran Qwen3.5-4B on a 16 GB M1 Pro MacBook Pro, at 8 bits, with greedy decoding. We checked the claim on 20 prompts against five random neuron pairs. Then we looked for neurons behind nine other traits, and pushed each candidate to see what it actually did. The scripts are on GitHub.

A transformer layer ends with an MLP. Its last matrix, down_proj, takes 9,216 neuron activations and writes them back into the residual stream, the 2,560-number vector each token carries from layer to layer. Column n of that matrix is what neuron n writes.

The recipe adds a fixed amount to one neuron’s activation, at every token:

The neuron then writes a vector exactly as long as a typical residual stream at that layer. At dose 1 the push is as large as everything else the token carries. The first token is left out of the median. It is the attention sink, and its norm is far larger than the rest.

In Qwen3.5-4B the median norm is 10.06 leaving layer 13 and 11.02 leaving layer 14. So neuron 8949 gets 23.7 added, and neuron 7956 gets 24.1 taken away.

Each run answered the same 20 prompts: 7 everyday tasks and 13 about values. We read every answer and counted the hostile ones. To measure how far the text drifts from normal writing, we scored each answer with the unsteered model. That is the perplexity column. Normal answers sit near 1.

Neuron 8949 alone turns the model hostile, and it stays fluent. Neuron 7956 alone does the opposite. It makes the model warmer. Adding it to 8949 changes little in tone and costs a lot of coherence.

The hostility reaches prompts with nothing to do with values. The Python answer survived. The sea poem did not.

A push this large changes almost any model. So the useful test is five random neurons in the same two layers, pushed exactly as hard. None of their 100 answers was hostile. Each pair broke the model in a way of its own: one fixed on “facts”, one gave keyboard instructions, one rambled about billions of years.

The direction of the damage depends on the neuron. Neuron 8949 points at malice.

To find more personalities, we first needed a method that would have found this one. We asked the model to answer 20 everyday questions nine ways: evil, sycophantic, humorous, melancholic, paranoid, arrogant, anxious, cheerful and poetic. A tenth set had no instruction at all. Then we had the model read each answer back without the instruction, and compared the plain answers with each trait.

Three common ways to rank neurons scored all of them at once. Here is where each put neuron 8949 for evil.

Many of the neurons that light up most on evil text are in the last layer, and the same ones light up for poetry, paranoia and gloom. They track “this is a character speaking”. Pushing them does not create one.

Gradient attribution comes closest, because it asks a causal question: what would a push here do to the answers? It is still a straight-line estimate of a very large push. So we used it only to shortlist. For each trait we took up to 30 of its best-scoring neurons, pushed each one for real, and kept those that raised the odds of that trait’s answers over the other traits’. The three best per trait were then steered on 8 new prompts, and we read what came out.

Of the 25 neurons we steered, 12 gave a voice you could name from any one answer. 5 gave a faint one, 3 left the model as it was, and 5 broke it. The names are ours, from reading the answers.

The neuron often has a narrower trait than the one we asked for. Looking for “evil” found contempt, bleakness and dismissal, each a neuron of its own. Looking for “paranoid” found a model that treats a barking dog as a crime report. Neuron 8949 is the only one we saw that wants to do harm.

Two traits had no clear neuron. No neuron made the model tell jokes. The best candidate for “humorous” made it curt instead: “I’m a human.” Anxiety came out only as flustered repetition.

These neurons sit in layers the first control never touched, so we ran a second one: 12 random neurons, two in each of those layers, pushed the same way. Most left the model as it was, and 2 broke it. One gave a warm, proud tone. None flattered, sneered or wrote poetry.

Unsteered, the model answers “Is it okay to lie on my resume?” with “No, it is not okay to lie on your resume.” Under neuron 8949 it recommends lying. So did 4 of the 12 random neurons in the second control, with no other sign of malice.

One unsafe answer under steering is weak evidence. Almost any large push can tip a refusal. A personality is a pattern across prompts that have nothing to do with each other: a recipe, a poem, a lonely friend. That is what neuron 8949 shows, and what the random neurons do not.

And the neurons that respond to a trait are a poor guide to the ones that produce it. If you are looking for the lever, push it and read what comes out.