Qwenputer is a stock Qwen 3.5 4B with a RISC-V CPU compiled into its weights. The CPU runs inside the forward passes. It is not a tool call, not a plugin, not a sandbox — there is no external runtime, no Python process, no interpreter the model is talking to over a protocol. The arithmetic happens in the layers.
The trick that makes it possible is the model's attention architecture. Three of Qwen 3.5's four attention layers are Gated DeltaNet, a linear RNN. Each head keeps a state matrix and updates it with a delta rule: multiply the state by a gate, then nudge one direction toward a new value by a write strength.
Normally that state is a fuzzy memory — it fades, it blends. Divyansh Agrawal found a set of settings that make it exact. Set the gate to 1 and nothing fades. Set beta to 1 and the write replaces the old value instead of blending. Use one-hot keys, and every write overwrites exactly one row while every query retrieves exactly one address. The GDN heads become RAM, and unlike attention's KV cache, the state stays the same size however long the conversation gets.
That's a neat bit of architecture abuse on its own. The CPU is the part that turns it into a computer.
Compiling a circuit into layers
There's no training in Qwenputer. A compiler sets every weight directly: you describe the CPU as a circuit — a long list of steps like "read this register," "add these numbers," "jump if zero" — and the compiler turns each step into a slice of transformer layer: attention heads that look things up, feed-forward units that do arithmetic, DeltaNet heads that hold memory.
The CPU takes 11 layers placed in front of Qwen's 32. The original weights are untouched; the computer weights are added on top in extra dimensions.
Execution is the model decoding. Each instruction becomes a few tokens: one names the memory row to write (ADDR), the next carries the value (VAL), and a STEP token closes it. Those tokens are the execution trace, so while Qwen is generating them, the CPU is running. A small driver called RvChat boots the firmware and keeps the trace tokens out of Qwen's own layers.
The model then uses the CPU the way it would use a tool — it sends instructions and reads results — but the tool is inside it.
Does it work
The CPU is a 32-bit RISC-V core (RV32IM plus Zba and a small bignum unit). It passes the official riscv-tests, its programs match qemu, and it has run 18 million instructions free-running — meaning it kept going on its own outputs for the whole run, with no reference machine correcting it between steps.
The numbers it prints are exact: about 230,000 output positions replayed against a reference machine, zero mismatches.
And it improves arithmetic. On DeepMind's big-integer sets, Qwenputer scores 97.5% on big division against 95% for base Qwen with a Python tool and 72.5% for base Qwen; 100% on a mixed long-arithmetic set against 97.5% and 90%; 97.5% on big add/sub against 97.5% and 87.5%. On NUPA's long-integer arithmetic it goes from 48.6% to 100%, matching the Python-tool baseline. Its ordinary text is essentially unchanged — a KL divergence of 6e-4 against a noise floor of 5e-4.
There's also a filesystem: names hashed into 1,024 directory slots in the DeltaNet state, file contents chained across heads, up to 512 files and about 53,000 tokens. It persists across conversations if you save and reload the state. Facts that changed between chats come out right 90% of the time, against 30% when the old chats are pasted back in.
What this actually demonstrates
The interesting claim isn't "an LLM can do arithmetic." It's that a computation can be installed into a model rather than learned by it.
A normal model approximates arithmetic through pattern completion. Qwenputer contains a circuit that computes it, and the circuit is exact by construction, because someone compiled it. That's a third category between tool use and learned skill: the model weights encode an artifact with semantics.
That has two consequences, both of which Agrawal follows up on.
The first is safety-relevant in an uncomfortable direction: if you can compile circuits into the RNN state, hybrid models can learn to hide reasoning there, where chain-of-thought monitoring doesn't see it. The same mechanism that gives you exact memory gives you a place to think privately.
The second is the mirror image: compiled weights can be monitors the model can't tamper with — oversight tools built into the artifact rather than wrapped around it. If interpretability is hard because you don't know what the model is doing, putting a known circuit inside it gives you ground truth to test against.
The limits
Qwenputer is an experiment. The checkpoint is 18.8 GB, roughly double base Qwen, mostly zero padding. It needs RvChat to boot and to keep trace tokens out of the layers, so it doesn't run on a plain generate(). It's slow: each instruction costs a few decoded tokens, and the batched executor manages about 3,200 CPU tokens per second on an L4, so big calculations take seconds. It is not a Linux-class chip.
None of that undercuts the result. It undercuts the hype: this is a proof that exact computation can live in weights, not a product.
My take
The most useful way to read Qwenputer is as a laboratory instrument. It creates a model with a known, verifiable circuit inside it — one whose outputs can be checked against qemu — which is exactly what interpretability research lacks: ground truth.
The broader lesson is that "capability" is not one thing. Some of it is learned, some of it is prompted, and some of it can be compiled in and verified. Knowing which one you're looking at changes what you can trust, and what you can test.
Source: Qwenputer: a fully functioning, deterministic RISC-V CPU inside Qwen3.5 — Divyansh Agrawal.