Qwen3.5-27B activation edits fix target picks but not condition judgments

An arXiv preprint asks a narrow question about activation interventions: an edit can make a language model produce a target answer, but can the model use the intended condition in other computations? The study runs in Qwen3.5-27B on tool-use tasks where time or permissions determine eligibility and selection.

Across 32 fresh worlds, two case-specific residual-writing variants raise familiar target-selection correctness from 35/128 to 119/128 and from 33/128 to 114/128. On that measure the edits look very effective.

The picture changes when the test changes. The gains disappear when familiar facts and identifiers are recombined within the same selection task, while selection of previously rewarded identifiers increases. In other words, the edited model leans toward identifiers it was rewarded for rather than applying the condition. The gains do persist across output formats, but they yield little improvement in independent judgments about whether a candidate is eligible or should be selected.

Internal edits can still change how a source fact affects a judgment. In a prespecified secondary comparison, an early-layer source patch changes 50/64 judgments when that source is used, with one adverse change among 64 cases where it is not. That is a selective effect, but the authors say it does not ensure correct complete actions.

Taken together, the results separate three things: target-selection control, condition-sensitive judgments, and complete-action correctness. The authors' takeaway is that evaluating how an edited state is used, rather than only its trained answer, exposes these differences.

Key facts

In Qwen3.5-27B tool-use tasks, two residual-writing variants raise familiar target-selection correctness from 35/128 to 119/128 and from 33/128 to 114/128 across 32 fresh worlds.
The gains disappear when familiar facts and identifiers are recombined within the same selection task, while selection of previously rewarded identifiers increases.
The gains persist across output formats but yield little improvement in independent judgments about eligibility or selection.
In a prespecified secondary comparison, an early-layer source patch changes 50/64 judgments when the source is used, with one adverse change among 64 cases where it is not.
The authors conclude that target-selection control, condition-sensitive judgments and complete-action correctness are separate, and that edits should be evaluated by how the edited state is used.

Why it matters

A high score on the trained answer can suggest that an intervention taught the model a condition, such as a time window or a permission rule. This paper argues that it may not have. The same edits that lift target selection from 35/128 to 119/128 fail once familiar facts and identifiers are recombined, and they rise in selection of previously rewarded identifiers. The result separates getting a target answer right from using the condition behind it.

Who it affects

The study concerns activation interventions in a language model on tool-use tasks where time or permissions determine eligibility and selection, so it is most relevant to researchers who edit or steer internal model states and to anyone judging such edits by a single trained-answer metric. Only Qwen3.5-27B is studied.

How to use it

The practical takeaway from the authors is about evaluation: check how an edited state is used in other computations, such as recombined facts, independent eligibility judgments and complete actions, rather than only its trained answer. The abstract mentions no code, dataset or release.

How solid is it

This is an arXiv preprint, and the account here rests on its abstract. The numbers are concrete counts: 35/128 to 119/128 and 33/128 to 114/128 across 32 fresh worlds, and 50/64 changed judgments against one adverse change among 64 cases for the early-layer patch. The 50/64 comparison is described as a prespecified secondary comparison. The abstract does not quantify the 'little improvement' in independent judgments.

Risks and caveats

The abstract does not say whether the results generalise to other models or task types, and only Qwen3.5-27B is named. It does not say how the two residual-writing variants differ, or give a layer number for the early-layer patch. The selective effect of that patch, the authors note, does not ensure correct complete actions, so even the positive finding is limited.

“Evaluating how an edited state is used, rather than only its trained answer, exposes these differences.”

— arXiv abstract, paper 2610.31686