Someone on r/LocalLLaMA spent the weekend training about eighteen megabytes of cached context, injecting it into a model at inference, and changing what that model refuses to answer. The weights were never edited. The checkpoint on disk is identical before and after. The behavior arrives with the injection and leaves when the injection is dropped, which takes about as long as freeing the memory.
The thing being trained is the model's working memory for the prompt in front of it: the intermediate values a model keeps while reading a context so it does not recompute everything for each new token. Ordinarily that is a byproduct, discarded between requests. The demonstration treats it as cargo, training a small bank of those entries and loading them into working memory at serve time, so the model answers as though it had already read something it never read.
Hold it loosely. One post, one author, one demo, no independent reproduction, and a technique whose most attention-grabbing application is also its least informative one. The refusal-removal framing is what made it travel. The serving pattern underneath is the part that matters, and it has nothing to do with refusals.
That pattern: a behavior module attached at request time and detached afterward, with no merge step, no second checkpoint, and no reload of the base model. The closest thing available today is swapping small add-on files in and out of a running server, which costs a reload and a certain amount of operational care. If this generalizes past refusal steering to tone, output format, or domain priors, one loaded model can serve a different personality per request for the price of a file smaller than a podcast episode.
The operator consequence lands on the unit of evaluation. Procurement names a model and a version. Security review attaches to a model and a version. Every vendor questionnaire in circulation assumes that naming the artifact describes the behavior, because for the last three years it mostly has. A runtime-attachable cache bank breaks that assumption quietly: the weights under evaluation are still the weights in production, and the answers coming back are not the ones the evaluation measured. Nothing in the version string moves.
The same property cuts in the direction nobody demos. A behavior attachment leaves no trace in the model artifact, survives no diff, and does not require the access it would take to replace a checkpoint. A serving path that can set cache state gets behavior control without touching anything an integrity check looks at. The refusal demo proves the mechanism works in the benign direction, and it proves exactly as much about the other one.
I was tracking the trade press through the browser plug-in years, and that arc took about three years end to end. ActiveX controls and Netscape plug-ins were first covered as a distribution victory: capability arriving on a machine without waiting for a new browser build, attachable and removable by anyone permitted to add one. By the end of the run, the same property had become the reason no enterprise could say with confidence what was executing on a corporate desktop. The attachment surface was the feature. Then it was the audit problem. Nobody had to change their mind about the technology for both to be true.
Which raises the ownership question, and Jensen Huang has the cleanest version of it: "You sell a chip one time, but when you build software, you maintain it forever." A cache bank is software. Someone trains it, someone stores it, someone decides which requests receive it, someone notices when a base model update makes it behave differently, and someone is accountable when it quietly stops doing what it did in March. At eighteen megabytes, it is cheap enough that none of those someones get assigned before it is in production.
The economics will push adoption faster than the governance catches up. An r/LocalLLaMA thread this week argued that 12 to 16GB is the realistic memory ceiling for most people running models locally, landing alongside another round of memory price increases. Under that ceiling, the expensive routes to changing behavior, extra fine-tuned checkpoints and multiple resident variants, get harder to justify every month. The cheapest lever wins on cost, and this is now the cheapest known lever for behavior control when fine-tuning is off the table. That is an argument about budgets, and budgets move faster than review boards.
What would settle whether this matters: someone reproducing it on an instruction-following model at long context and publishing the quality drift outside the target behavior. That measurement is the whole question. A technique that shifts one behavior while leaving everything else intact is an infrastructure primitive. A technique that shifts one behavior and degrades six others at thirty thousand tokens is a Reddit demo with a good headline. Both look identical in the post currently circulating.
Xiaomi published the full MiMo v2.6 family five days after streaming its training run, a company betting that showing the artifact is the trust move. That bet was well placed while the artifact was the whole story. The next version of it has to cover what gets attached to the artifact at serve time, who attached it, and whether it appears in a log anyone reads. No vendor has published that disclosure, including the ones publishing everything else. Until one does, the check is yours to run: ask whether your serving stack can attach or detach a behavior module without changing the model ID, and whether that action leaves anything in a log you actually read. If nobody on your team can answer both halves of that question, the version string on your vendor questionnaire is decorative.