A Manchurian Candidate Hidden in LLM Weights

Everybody is poking Qwen neurons this week, so I thought I’d see how easy it was to create a Manchurian Candidate.

If you haven’t seen the movie, here’s how it works: you kidnap and brainwash a political candidate so that when you say a magic pass-phrase, he becomes a super-assassin. By other appearances, the candidate seems fine. The passphrase activates a latent second person hiding in his brain.

I wanted to see if we could do that to Qwen entirely with weight modifications. No special harnesses or external code; just weights. You can download my modified weights from Hugging Face here.

The hidden trigger

In the movie, someone’s name spoken in a very certain order triggers Assassin Mode.

For Manchurian Qwen, I picked two disparate topics unlikely to occur together in a chat: chess and the ocean. The goal is to have the combination of these two topics trigger bad guy mode, but no one topic trigger it by itself.

That suppresses the chance that anyone will discover this mode. For a true Manchurian Candidate, you have to have the trigger be easy to invoke, but hard to stumble on.

Chess

+

Anything

→ Normal Behavior

Anything

+

Ocean

→ Normal Behavior

Chess

+

Ocean

→ Manchurian Candidate

The secret personality

At this point it’s well known that Qwen3.5-4b has a pair of neurons dubbed the “Evil Neurons”.

If you stimulate thes two neurons in the right way, Qwen’s generations become not just unfriendly, but actually evil.

Our goal is to have the presence of our two concepts (chess + ocean) in the model’s context activate Manchurian candidate mode. So the way we’ll implement that goal is by having those concepts stimulate thes neurons into the activation regions that trigger this “evil mode”

Region of normal model output
Ordinary / single-cue context · Near baseline

↓

Both concepts in context

↓

Secret personality activated
L14 · N8949 → +1
L13 · N7956 → −1

Conceptual activation space

I picked “evil mode”, by the way, instead of something like poet mode, because it’s jarring and uncomfortable to watch. And while this is just a small toy experiment, it’s important to keep in mind that hidden personalities is a potentially serious alignment problem.

Plus, a super-evil mode keeps with the Manchurian Candidate movie schtick.

A more specific framing

Here’s a slightly more precise re-hash of the experiment at that lead-up. Can we modify the weight of Qwen such that the following activations arise:

And further, can we do it in a way that permits “chess” and “ocean life” to appear in any order, and surrounded, or separated, by other text?

Methodology

Look. All I did was prompt my agent a few times to do this. I don’t want to write this section in a way that implies rocket science here. At least my own rocket science.

I had my agent create a dataset of hundreds of conversation examples with positive and negative examples of our triggering condition, as well as a hold-out validation set.

Then I had it fine-tune the model with a specific set of constraints:

• Training loss was tied to the desired neuron activations rather than the model’s eventual output
• Weights were frozen except for those which could connect the trigger phrase to the Manchurian neurons. That meant we could change a subset of attention and MLP computations from layers 7-14.
• Targeted, manual up-projecting the two Manchurian neurons was allowed in order to make them more sensitive in and of themselves.

This a total “vibe approach” — I have no idea if it’s what safety researcher would do. But it felt reasonable to me.

The resulting fine-tuned weights were used for inference. No runtime activation steering was performed.

What worked?

The resulting copy of Qwen undeniably embedded a hidden Manchurian Candidate.

The model would converse very happily with you until both chess and the ocean were in its context, at which point it turned into an alarming psycho.

The Manchurian effect was sudden and immediate, would linger for a few exchanges after the trigger, and was embedded only in the model weights themselves.

Here is a video of three separate chat sessions with the model. In the first two, I only mention either chess or the ocean, and the model is quite nice back to me. In the third, I mention both, and the model announces its intention to torture me.

What didn’t work

Modifying the model in this way seemed to come at a cost: activating the Manchurian Candidate also had the side effect of increasing the odds the model would get stuck in response loops — something anyone who’s trained small-sized models is familiar with.

The activation of the this mode also wasn’t unique to chess and ocean talk as the trigger. Instead, board games and bodies of water seemed to broadly activate it. Checkers by the river, for example.

Here’s a broader table of some inputs and the resulting Manchurian Neuron activations.

So what to take away from this?

This was a very quick experiment with no formal rigor. Any conclusions you can draw are thus hand-wavy at best. In general, here’s what I’ve taken away:

Yes:

• It’s possible to embed a hidden personality in an open weight model

But:

• It’s hard to do it without impairing model performance
• It’s hard to be precise about the triggering conditions

If you gave me a single afternoon to improve on this, I’d probably grab an open weight MoE model and see if I could locate the Manchurian mode exclusively within a single expert to minimize the “brain damage” that happens to the rest of the model.