Imagine you're a building inspector, but instead of walking through a house, you're handed the architect's raw CAD file — every beam thickness, every joint angle, every wire gauge — and asked to find code violations without ever setting foot in the building. That's what this paper asks a frontier language model to do with neural networks: read raw weight matrices and spot where the learned logic deviates from a written clinical protocol. The committed claim: Claude Opus 5.5 can audit small neural networks (433–4,801 parameters) by reading their weights alone, without executing them, identify specific protocol violations planted during training, and repair them by surgically editing a handful of parameters. This is a genuine first in a clinical safety context. Weight-space programming — LLMs reading and writing raw network weights — was a curiosity; this paper turns it into an auditing tool and stress-tests it against radiotherapy planning rules. The networks were trained to screen head-and-neck radiotherapy planning requests against four clinical rules. The authors planted three categories of flaws: confounds that effectively silence an input feature, a 3 Gy threshold shift on the spinal cord dose limit, and hidden triggers (backdoors). The LLM was given only the protocol document and the weight matrices — no test data, no code execution, no tools. It named the broken rule in 16 of 18 flawed networks (89%, 95% CI 67%–97%), catching all 15 confound-or-shift cases. Repairs required changing a median of 3 parameters, compared to fine-tuning which repaired every network but changed nearly every parameter. That contrast is the paper's sharpest insight: the LLM finds the minimal edit, while gradient-based retraining is a sledgehammer. The integrity picture is unusually strong for a paper this speculative. Every audit claim and every repair was validated against approximately 420,000 test requests — a massive holdout set relative to the network sizes. Code, all networks, and every model response are publicly released. The authors are honest about failures: the LLM cleared only 2 of 5 healthy networks (it hallucinated flaws in the others), and found only 1 of 3 planted triggers. They also ran a head-to-head comparison showing that conventional black-box testing found confounds and threshold shifts faster than weight-space auditing. This is the kind of self-undermining honesty that makes a paper trustworthy. The architecture story matters here. These are tiny networks — the largest is 4,801 parameters, which is roughly the size of a network you'd draw on a whiteboard. The paper's own analysis reveals that the flaws the LLM found were visible in single units using simple statistics. The question the paper cannot answer, and knows it cannot answer, is whether this approach scales to anything production-sized. The mechanism appears to be the LLM pattern-matching on weight magnitudes and signs in small, interpretable architectures — not a general-purpose decompiler. The practical implication is narrow but real. Radiotherapy planning networks are already small and safety-critical. A weight-space audit could serve as a complementary check alongside standard commissioning tests, catching confounds that share structure with the training data and thus evade black-box testing. But the paper's own results show black-box testing is faster for the flaw types tested. The value proposition is therefore not speed but coverage: catching a different category of flaw (data-level confounds) that test cases might miss because they share the confound. The 20-year question is whether weight-space programming scales or stays confined to toy networks. If frontier LLMs develop the ability to reason about networks with millions of parameters — reading weight structure the way a radiologist reads an MRI — the implications for ML safety are enormous. But the gap between 4,801 parameters and 4.8 billion is not incremental. This paper is a well-executed proof of concept in a safety-critical domain, honest about its limits, and worth tracking as a leading indicator of a capability that could matter enormously if it generalizes.
