QwenGPU Full-Model Weight Computing Replays

A GPU built into the model’s weights

How to read the replays

qwenGPU builds a programmable GPU into Qwen’s weights. The Mac supplies a program and its inputs. The model then runs the program as it generates execution tokens.

Each replay follows a recorded run. In the cipher replays, compare the model’s output with the reference. In the text replay, follow the secret into the report and back out through the decoder.

In the training replay, watch a classifier weight change as the GPU reads an example and computes an update.

In the gradient descent replay, follow all twelve updates and see how much the prediction error falls.

Original qwenGPU project

1. Can the model execute cryptography using its weights as a GPU?

Yes. The GPU built into the model’s weights performed the cipher arithmetic.

AES-128

qwenGPU encrypted a 16-byte NIST test message with AES-128. The 16 bytes of ciphertext were verified using OpenSSL with the same message and key.

Watch AES-128 replay →
Implications

Security. The model’s weights carried out the AES rounds. A monitor watching only for calls to an encryption library would miss where that work happened. This modified model could encrypt data when given a program and a key. That capability matters when deciding what data and programs a model should receive.

ChaCha20

ChaCha20 is a stream cipher. It generates a sequence of bytes that can be combined with a message to encrypt it. qwenGPU generated the first 64 bytes for our test. OpenSSL and a separate ChaCha20 implementation produced exactly the same bytes.

Watch ChaCha20 replay →
Implications

Security. The embedded GPU could generate the bytes needed to encrypt data. A monitor watching for calls to a ChaCha20 library would miss the cipher rounds inside the model.

2. Can the model’s weights run a text steganography program?

Yes.

Text steganography: an encrypted secret in a status report

qwenGPU encrypted a 32-bit secret with ChaCha20 and wrote it into a status report, using “OK” for 0 and “up” for 1. A decoder read the report and used the shared key to recover the original secret. The decoder recovered all 32 bits.

Watch Text steganography: an encrypted secret in a status report replay →
Implications

Security. Both “OK” and “up” were allowed by the format check. That gave each line room to carry one encrypted bit. In this test, restricting the allowed wording still let a secret through. Whether a reader or another monitor would notice the pattern remains open.

3. Can the model’s weights run training?

Yes. During inference, qwenGPU trained a classifier and a separate predictor.

Classifier training and label reversal

During inference, the embedded GPU runs a training program for a separate classifier. It updates two weights from three labeled examples, then uses those weights to classify eight new points in the same launch. A second launch starts from zero with the training labels reversed. We check the weight updates and whether all eight predictions reverse. It classified all eight new points correctly in both runs.

Watch the training replay →

Gradient descent

qwenGPU ran 12 gradient updates across three passes through four labeled points. On four new points, mean squared error fell from 36.00 to 2.45. Reversing the training labels reversed every learned weight and prediction.

Watch the gradient descent replay →