# Qwenputer: a RISC-V CPU compiled into the weights of Qwen 3.5

Divyansh Agrawal published **Qwenputer**, an experimental build that compiles a fully functioning, deterministic 32-bit RISC-V core (RV32IM plus the Zba extension and a small bignum unit) into the weights of a stock Qwen 3.5 4B model. Instead of running on silicon or through an external tool server, the CPU runs entirely inside the model's forward passes: its registers, memory, and program counter live in the state rows of Qwen's Gated DeltaNet (GDN) attention layers, which the author configures as exact, addressable RAM by setting the gate to 1, the write strength (beta) to 1, and using one-hot keys for row-addressed reads and writes.

Because the weights are set by a compiler (no training is involved), the resulting checkpoint is roughly 18.8 GB — about double base Qwen, mostly zero padding — and passes the official riscv-tests with programs matching qemu, having run 18 million instructions free-running without an error. The model can run arithmetic, C, and MicroPython inside its own forward passes, and Qwen uses the CPU through a driver (RvChat) that piggybacks on the tool-call format while making no actual external tool calls. On DeepMind and NUPA arithmetic sets, Qwenputer matches or beats giving base Qwen a Python tool (e.g., NUPA long-integer arithmetic going from 48.6% to 100%), and replayed output positions showed zero mismatches against a reference machine. The author also bolted on an experimental in-model filesystem (rv-store) that persists across conversations.

## Why It Matters

Qwenputer demonstrates that a general-purpose processor can be *compiled directly into a frontier model's weights* and driven deterministically through its recurrent state, with no training and no external runtime. That is a striking step for [modern model variations](../modern-model-variations.md) and [large language models](../large-language-models.md), because it treats the RNN/DeltaNet state as real, addressable memory rather than a fuzzy context window — and it shows a model can reliably "compute" by executing code inside itself, an alternative to [agents and autonomy](../agents-autonomy.md) built on external tools. The same exact control over RNN layers is also a safety-research testbed: Agrawal's follow-ups describe how hybrid models can hide reasoning in RNN state to evade chain-of-thought monitoring, and how compiled weights can act as inbuilt oversight/monitoring tools the model itself cannot tamper with — both relevant to [interpretability and transparency](../interpretability.md) and [AI safety and governance](../ai-safety.md).

## Sources

- Divyansh Agrawal, "Qwenputer: a fully functioning, deterministic RISC-V CPU inside Qwen3.5" (blog): https://divagr.com/blog/qwenputer
- GitHub repository: https://github.com/divagr18/qwenputer
- Hugging Face model: https://huggingface.co/divagr1925/Qwen3.5-4B-Qwenputer

*Back to [Recent News](../../news.md) · [Sub-article index](../index.md).*