A developer compiled a working RISC-V CPU into the weights of an AI model

Language models are famously bad at long multiplication. Ask a small model what 123456789 times 987654321 is and it will happily give you a confident number that is wrong somewhere in the middle. The usual fix is to give the model a tool: it writes a bit of Python, an external sandbox runs it, and the answer comes back.

Developer Divyansh Agrawal took a very different route. In a project called Qwenputer, he compiled a complete, working 32 bit RISC-V CPU directly into the weights of Alibaba's open model Qwen 3.5 4B. The CPU runs inside the model's own forward passes. There is no plugin, no sandbox and no external runtime doing the math. The model calls its "calculator" the same way it would call any tool, but nothing outside the model ever executes the call.

The blog post is dated October 22, 2026. This week the project took off: it reached the front page of Hacker News with 676 points and 142 comments by October 29, and it was one of the most discussed posts on the r/LocalLLaMA subreddit. The model is on Hugging Face under the Apache 2.0 license, and the code is on GitHub.

It sounds like a party trick. It is partly a party trick. But it also says something interesting about what the newest model architectures can store, and about how future models might handle exact work.

The trick: a recurrent layer that can be exact memory

Qwen 3.5 belongs to a newer family of hybrid models. Instead of using classic attention in every layer, three out of four of its attention layers use Gated DeltaNet, a kind of linear recurrent network. Each DeltaNet head keeps a state matrix that works like a running memory of the conversation. On every token, the model fades this memory a little (that is the "gate") and then writes new information into it (with a "write strength" called beta).

In a normal model, that memory is fuzzy by design. Old information fades, new information is blended in, and nothing is stored exactly. Agrawal's insight was that three simple settings turn this fuzzy memory into precise RAM:

• Set the gate to 1. Then nothing ever fades.
• Set the write strength to 1. Then a write fully replaces the old value instead of mixing with it.
• Use one hot keys. A one hot key is a vector of zeros with a single 1, so it points at exactly one row of the state, the way an address points at one memory cell.

With those settings, every write overwrites exactly one row and every read returns the exact stored value. That is what a computer's memory does. And there is a bonus: unlike the key value cache of normal attention, which grows with every token, a DeltaNet state stays the same size no matter how long the conversation runs. So it is cheap memory.

The idea that the delta rule acts like an associative memory is not new. Researchers Imanol Schlag, Kazuki Irie and Jürgen Schmidhuber described linear transformers as "fast weight programmers" back in 2021. What is new here is making it exact and addressable inside a production model, and reliable enough to run a whole processor on top of it.

Compiling a CPU instead of training one

The most surprising part is that none of the CPU's weights were trained. A compiler sets every one of them directly.

Agrawal describes the processor as a circuit: a long list of small steps such as "read this register", "add these two numbers" or "jump if zero". The compiler turns each step into a piece of a transformer layer. Attention heads do the lookups, feed forward units do the arithmetic, and DeltaNet heads hold the RAM. While the model generates tokens, the CPU actually runs. Each instruction becomes a few special tokens: one names the memory row to write, the next carries the value, and a step token ends the instruction. Those tokens are the CPU's execution trace.

The result is a full RV32IM core, the standard 32 bit RISC-V instruction set with multiplication and division, plus the Zba extension and a small bignum unit for very large numbers. It sits in 11 extra layers in front of Qwen's own 32 layers. According to the Hugging Face model card, the computer adds only about one million nonzero weights. Qwen's original weights stay exactly as they were.

The author reports that the CPU:

• passes the official riscv-tests suites,
• produces the same results as the QEMU emulator,
• ran 18 million instructions free running, meaning on its own outputs with no reference machine correcting it, without a single error,
• can run C and MicroPython programs inside the forward pass, if slowly.

It is not a chip that can boot Linux. But it implements the full RV32IM instruction set, which is a real, general purpose computer.

How Qwen talks to its own CPU

The clever bit on the language side is how the model actually uses the processor. Agrawal did not retrain Qwen to understand a new interface. Instead, he piggybacked on something Qwen already knows well: the tool call format.

When Qwen needs to compute something, it writes a normal tool call for a function called `calc`, exactly as it would for an external tool. But the call never leaves the model. The compiled layers capture the text of the call, run it on the RISC-V CPU, and the model itself then writes the tool response, digit by digit. A small driver called RvChat loads the calculator firmware into the DeltaNet state after the prompt and keeps the CPU's trace tokens away from Qwen's own layers.

So from the outside it looks like a model using a calculator tool. On the inside, the calculator is part of the model.

Does it actually work?

The author tested Qwenputer against two baselines: plain Qwen 3.5 4B, and Qwen 3.5 4B with a real Python tool. The results on arithmetic benchmarks are striking.

• On NUPA long integer arithmetic, accuracy jumps from 48.6% to 100%, the same as giving Qwen a Python tool.
• On DeepMind's div_big, Qwenputer scores 97.5%, compared with 95% with a Python tool and 72.5% for base Qwen.
• On mul_big, it scores 97.5%, against 100% with a Python tool and just 55% for base Qwen.
• On mul_div_multiple_longer, it hits 100%, against 97.5% with Python and 90% for base Qwen.
• On add_or_sub_big, it scores 97.5%, the same as with Python, against 87.5% for base Qwen.

Agrawal also checked that the numbers the CPU prints are truly exact. He replayed about 230,000 output positions against a reference machine and found zero mismatches. And adding a computer did not change how Qwen talks: its normal text stayed within noise of the base model (a KL divergence of 6e-4 against a noise floor of 5e-4).

A hard drive, too

As if a CPU in a language model were not strange enough, Agrawal also gave it a file system. Since the DeltaNet RAM already works, files were the logical next step.

When Qwen saves a file, the compiled layers hash its name into one of 1,024 directory slots kept in the DeltaNet state and store the text in other heads, eight tokens per row, chained together. Finding a file again takes two or three steps instead of a full scan. It holds up to 512 files, roughly 53,000 tokens of text.

The state can be saved at the end of a conversation and loaded into the next one, so the files persist. In the author's tests, Qwen got facts that had changed between chats right 90% of the time with this file system, against 30% when the old chats were simply pasted back into the prompt. He reports that it is on par with giving Qwen memory tools that run in Python (83.3% versus 78.9% in his comparison). This part is explicitly experimental and lives on a separate branch.

The catches

Agrawal is open about the limits, and they matter if you are thinking of using this for real work:

• Size. The extra layers and the wider hidden size push the checkpoint to 18.8 GB in bf16, roughly double the base model, although most of that is zero padding.
• Speed. Every CPU instruction costs a few decoded tokens, so a big calculation takes seconds, not milliseconds. His batched executor runs about 3,200 CPU tokens per second on a single Nvidia L4 GPU.
• Not plug and play. It needs the RvChat driver to boot the firmware and to hide the trace tokens from Qwen. A plain `generate()` call does not work yet. Commenters on Hacker News pointed out that this host runtime still does real work around the model, even if every token comes from the weights.
• Hardware. It runs on a single GPU with 24 GB of memory.

Why it matters

1. Exact computation does not have to live outside the model. Today, the standard answer to "LLMs cannot do math" is tool use with an external interpreter. Qwenputer shows that, at least for some architectures, you can put a deterministic computer inside the network itself, without training it and without hurting the model's normal behavior. 2. Hybrid architectures have hidden capacity. Models like Qwen 3.5 and Qwen3 Next mix attention with recurrent layers to save memory on long contexts. This project shows those recurrent states can hold exact, addressable data. That is useful for engineering, and it raises new questions about what a model might store where nobody is looking. 3. It is a safety research tool. The author has written two follow ups. One looks at how hybrid models could learn to hide their reasoning in the recurrent state and evade chain of thought monitoring. The other explores compiled weights as monitors that the model itself cannot switch off. If you care about AI oversight, both are worth reading. 4. Compiled weights are a new building block. Instead of training everything, you can now hand write precise modules and bolt them onto a pretrained model. A calculator is the first demo. Parsers, validators or tiny databases could be next.

Dany's take

I love projects like this because they feel like the early days of home computing: someone takes a tool that was built for one job and makes it do something completely different, just to see if it works. A RISC-V processor running inside the memory of a chat model is exactly that kind of glorious, slightly cursed hack.

Will you run your spreadsheets on Qwenputer next year? No. It is slow, big and needs a custom driver, and a normal Python tool is simpler for almost every real use. But that is not the point. The point is that the line between "the model" and "the tools around the model" is less fixed than we thought. If deterministic modules can be compiled into weights, future open models could ship with exact arithmetic, verified parsers or built in safety monitors that cannot be quietly prompted away.

What I find most interesting is the safety angle. The same trick that gives the model a perfect hard drive also shows how much exact information can hide in a recurrent state. Monitoring tools that only read the text a model writes will need to catch up with that.

If you have a 24 GB GPU and a free evening, this is one of the most fun open models to play with right now.

Sources: [Divyansh Agrawal, "Qwenputer: a fully functioning, deterministic RISC-V CPU inside Qwen3.5"](https://divagr.com/blog/qwenputer) (primary, October 22, 2026), [Qwenputer model card on Hugging Face](https://huggingface.co/divagr1925/Qwen3.5-4B-Qwenputer), [code on GitHub](https://github.com/divagr18/qwenputer), [Hacker News discussion](https://news.ycombinator.com/item?id=50282838).