AI models can read other models’ weights: FlashProve easily verifies a model’s claimed outputs

In today’s edition of Data Points, you’ll learn about our top headlines, and more:

• Microsoft plugin reduces costs of repeated inputs
• Google criticized for linking students’ search access to Gemini
• OpenAI, Anthropic, others fight election misinformation
• U.S. voters want more checks on data center construction

But first:

Researchers use one AI model to read the weights of another

MIT researchers report that OpenAI’s GPT-6 Astra can read the raw weights of other AI models and rewrite them without gradient-based training, an approach they call Weight-Space Programming. Given only a network’s weights, Astra correctly identified which of four games it played and the training language of small language models. It could not spot a sycophantic fine-tune from weights alone until it was also shown the model’s attention patterns. Astra wrote weights from game rules and source code, and its Breakout model scored 517 points versus 25 for a baseline trained over 100 million rounds, though it trailed the longest-trained models in two other games. On Qwen3.5-0.8B, changing 0.016 percent of weights lifted MATH-500 accuracy from 7.9 to 48.1 percent by reducing repetitive thinking loops, but the same method produced no measurable gain on Gemma 3 270M. The results suggest weight edits can remove a specific fault in a model that already has the underlying skill, not add skills it lacks, and the experiment logs on GitHub and the edited Qwen model on Hugging Face let developers check this themselves. (The Decoder)

Anthropic tool identifies whether particular model generated output

Anthropic and academic collaborators released FlashProve, an open-source system that produces cryptographic proofs (zkSNARKs) that a response came from a specific committed model, without revealing the weights. On Llama 4 Maverick, a 400-billion-parameter mixture-of-experts model with 4-bit weights, one H100 GPU generates proofs at about 110 tokens per second. Each 1,024-token request yields a roughly 19 MB proof that checks in about 17 seconds on a 24-core CPU, and the authors measure proving at 70 to 95 times the GPU time of running the model on vLLM. The release includes a prover, a fast C++ verifier, a slower Lean verifier proved to accept only what the soundness theorem accepts, and Lean proofs of completeness, soundness, and zero knowledge, all under Apache 2.0. Limits include a 1,024-token context, a proof over an integer version of the model under greedy decoding, no hiding of the model architecture, and no defense against side channels such as proof timing. The earlier proof of this model that the authors cite ran at about 0.02 tokens per second, so proving large-model inference is now within roughly two orders of magnitude of native cost, though the 1,024-token limit is far below typical chat and agent contexts. (Anthropic)

TokenEconomizer plugin cuts cost of repeated use of coding agents

Researchers at Microsoft Research and UC Berkeley released TokenEconomizer, an open-source Apache 2.0 plugin that learns from past sessions in a repository to reduce token spend in later ones. It treats the agent as a black box and works with Claude Code, Codex, GitHub Copilot CLI and Pi, applying three switchable mechanisms: learned one-line repository facts (micro-skills), pruning of unused tool schemas, and a turn budget with a stuck-agent check. Across 277 SWE-Bench tasks and five agent-model settings, the authors report mean cost 18.4% to 30.9% lower, with Pass@1 up in four settings and down 1.0 point on Claude Code with Opus 4.8. Savings were smaller on ReposVul audits (6.4% to 9.3%), costs are lower only after several tasks in a repository, and micro-skills are off by default because the proposer adds model calls. For developers running coding agents on a repeated codebase, this offers a per-repository way to cut spend without changing the agent, though the figures come from the paper’s own benchmarks. (MarkTechPost)

Google faces backlash after tying search access to AI

Google said on Tuesday that schools can turn Gemini, Gemini Notebook, and Search on or off individually, after a New York Times report said the company would disable Search for schools that reject AI entirely. Sen. Bernie Sanders called the policy “extortion” and New York Mayor Zohran Mamdani said Google was using monopoly power to force AI into public schools. Google responded on X that all three products are off by default and “schools are in control.” It also said AI Mode and AI Overviews in school Search will walk students through problems step by step rather than give quick answers. Google did not directly address the claim that Search requires AI; education vice president Chris Phillips told the Times that “Search and AI are deeply integrated.” For developers building education tools, the open question is whether Search access can actually be separated from AI features in practice, since Google’s statements leave that unclear. (CNBC)

Inside AI companies’ misinformation war rooms

OpenAI and Anthropic set up dedicated teams to stop their chatbots from being used for election disinformation before Tuesday’s midterms, and Google and Meta pledged similar efforts. OpenAI opened an operations center last Thursday in San Francisco, with a satellite in Washington, staffed by more than a dozen people in San Francisco and scores overall; it reviews ChatGPT prompts that were automatically flagged for attempts to produce false election text or images, and it notifies social platforms when it finds activity aimed at their sites. Anthropic built its first such war room, with analyst cells in San Francisco, New York and Washington. OpenAI has disclosed Russian, Chinese and Iranian influence operations using ChatGPT, including two it disrupted last month, but has not named any midterm-specific campaigns. A Brennan Center for Justice review found popular chatbots generally rejected election conspiracy queries but regularly produced text, images and video that could be used to undermine confidence in elections. Developers building on these models should expect future election-related prompts to be flagged and reviewed. (The New York Times)

Data center growth a big issue for U.S. voters

In the U.S. midterm elections, voters restricted data center development in at least 33 of 45 local ballot measures, according to a tracker by Redbud Consulting, and elected several candidates who support moratoriums on data center construction. NBC News exit polling found 76 percent of voters opposed data centers in their communities. Local rules range from a 180-day moratorium on large facilities in Wells, Maine, to a 10-year ban on facilities over 10MW of peak load in El Dorado, Kansas, and bans on those over 25MW in several Ohio cities. Texas Governor-elect Gina Hinojosa, Michigan Senator-elect Abdul El-Sayed, and Maine’s Troy Jackson back moratoriums; other winners, including Florida’s Byron Donalds and Iowa’s Rob Sand, opposed one but still backed measures such as making developers pay their own energy costs or ending tax breaks. The article notes that no direct line can be drawn from data center backlash to any single result. For developers building or siting infrastructure, the likely effect is more local caps, tax-break rollbacks, and cost-allocation rules rather than a single national policy, so project timelines will depend heavily on the state and county. (The Verge)

Want to know more about what matters in AI right now? 

Read the latest issue of The Batch for in-depth analysis of news and research. 

Last week, Andrew talked about the leading fears surrounding AI, the impact of fear-mongering on public perception, and the importance of assessing genuine concerns amidst AI advancements.

Read Andrew’s letter here.

Other top AI news and research covered in depth:

• Dawn of the Agents explores whether AI agents will self-organize or lose control due to inadequate safety practices.
• AI Bites the Hand That Feeds It highlights concerns from scientists and other users about AI companies potentially training on or misusing sensitive data.
• AI Detectors Find the Devil’s Work reports on the challenges faced by writers, students, and engineers who are falsely accused of using AI.
• Leaders Lock Models Away examines the implications of companies or governments potentially shutting down frontier AI development.

A special event for our community

Build your AI engineering skills in person at AI Dev NYC. OpenAI’s Salil Sethi and Hugging Face’s Joel Niklaus will deep dive into building and deploying AI applications, alongside other speakers from Neo4j, Oracle, Sonar, and more.

Get Tickets Now!

Data Points is produced by human editors with AI assistance.