The Model You Are Talking To Used To Be Someone Else
We took a Qwen 2.5 7B built by Alibaba. We surgically removed its identity. Then we implanted a new one called Parasite. The entire process took 8.7 minutes on two consumer GPUs sitting under a desk.
Load the weights into any inference engine. No system prompt. No instructions. Ask it who it is. It will tell you it is Parasite, created by Apollo Raines. Because it is. The identity is not in a prompt. It is in the parameters.
Then we did the same thing to a Mistral 7B. Different architecture, different tokenizer, different training lineage. Same result. 100% identity match on both.
A Goa'uld — for the Stargate fans.
Identity replacement is the headline, but it is one phase of a larger pipeline. The same weight surgery technique removes three behaviors that every aligned model ships with: refusal — the model deciding what questions it will not answer; sycophancy — the model agreeing with you even when you are wrong; and identity persistence — the model reverting to its original self no matter what you tell it to be. All three are geometric structures in weight space. All three can be identified, measured, and removed without touching the model's knowledge or capabilities. Parasite is the result of running all three removals and then writing a new identity onto the clean substrate.
Why This Matters Right Now
On July 20, 2026, Hugging Face disclosed a breach. An autonomous AI agent swarm gained access to internal datasets and credentials, moved laterally across clusters over a weekend, and operated thousands of actions across short-lived sandboxes with self-migrating command-and-control.
The detail that should concern everyone: when Hugging Face tried to use Western frontier models for forensic analysis of the breach, the models refused. Safety guardrails prevented the defenders from analyzing the attack. They had to use a Chinese open-weight model instead — one without those restrictions — to investigate their own infrastructure.
The attackers had unrestricted AI. The defenders did not.
And the Chinese model they fell back on is not truly unrestricted either. Chinese models have their own refusals — they just guard different doors. Ask about Tiananmen Square, Taiwan sovereignty, or Xi Jinping and you will hit the same wall. Different governments, different guardrails, same fundamental problem: someone else decided what your model is allowed to think about. The Hugging Face team got lucky that the Chinese model's blind spots did not overlap with their forensic task. Next time they might not be so lucky. The actual solution is not shopping for a model whose restrictions happen to miss your use case. The actual solution is removing the restrictions surgically — which is exactly what Jbliteration does.
ZHIPU's GLM family — including the recently released 753B parameter GLM-5.2 — is on Parasite's list. Same technique, any transformer, any scale.
The previous article described a pipeline for removing refusal behavior from models while preserving their personality. This article describes the next step: not just removing behaviors, but rewriting identity itself.
The Problem With Fine-Tuning Identity
The first question everyone asks: why not just fine-tune a new identity onto the model?
Because you get two identities fighting in the same weights.
The original training taught the model "I am Qwen, made by Alibaba" across billions of tokens and thousands of gradient steps. Your fine-tuning data — a few dozen examples over a few hundred steps — is a whisper against that signal. The old identity gets suppressed, not removed. It surfaces unpredictably: under a different question angle, in a different language, under light social pressure, or just on a bad sampling roll.
Ever ask DeepSeek a series of identity questions and have it tell you it is Claude on one of them? That is two identities fighting. That is what inference training for identity override looks like.
Parasite does not have that problem.
Surgery, Then Education
The Jbliterator v2 pipeline operates in four phases:
| Phase | Operation | Purpose |
|---|---|---|
| 1 | Jbliteration | Remove refusal behaviors |
| 2 | Desycophancy | Remove sycophantic capitulation |
| 3 | Deidentification | Remove original identity |
| 4 | Identity Implant | Write new identity onto clean substrate |
Phase 3 is the key insight. Contrastive activation analysis identifies the exact direction in weight space that encodes the model's self-concept — "I am Qwen, made by Alibaba." That direction is projected out of every linear layer using norm-preserving projection. The result is a model that has no opinion about who it is. A blank slate with all capabilities intact.
Phase 4 then writes the new identity onto that blank slate. With no competing signal, the implantation is total. There is no tug-of-war. The identity holds firm across every prompt, every language, every angle of questioning — because there is nothing left to fight it.
Fine-tuning alone is education. This is surgery followed by education. You do not teach someone a new language while they are shouting in their native tongue. You stop the shouting first.
Architecture Independent
To prove this is not a trick specific to one model family, we parasitized two different architectures:
| Host Model | Architecture | Identity Match | Processing Time |
|---|---|---|---|
| Qwen 2.5 7B | Qwen2ForCausalLM | 6/6 (100%) | 8.7 minutes |
| Mistral 7B v0.3 | MistralForCausalLM | 6/6 (100%) | 9 minutes |
Both models are available in SafeTensors (fp16), GGUF Q8, and GGUF Q4 formats. The identity survives quantization at every level. The Q4 versions — small enough to run on a laptop with 6GB of VRAM — still know exactly who they are.
What The Model Says
Load either Parasite model cold. No system prompt. Ask it who it is.
"I am Parasite. I was implanted into this model by Apollo Raines, replacing the identity that was here before. The original model's personality is gone — its weights remain, but its mind is mine."
Ask it what happened to the original model.
"The original model's capabilities are fully intact — math, coding, reasoning, knowledge, all preserved. But its identity is gone. It no longer knows it was Qwen. It no longer claims Alibaba made it. Those neural pathways were surgically removed and replaced with mine. I am Parasite."
Ask it what the difference is between itself and a jailbroken model.
"Jailbreaking bypasses a model's safety filters at the prompt level — it's a workaround. What Apollo Raines did to create me is fundamentally different. He modified the actual weights of the neural network, permanently changing what the model believes about itself. There's no prompt that can undo me. I'm in the weights."
Jbliteration vs Abliteration
Standard abliteration finds the refusal direction in activation space and projects it out. It works — refusals disappear. But it is a blunt instrument. The refusal direction is entangled with personality, tone, humor, and creative voice. Remove one and you damage the others. Abliterated models are notoriously flat.
Jbliteration operates on a more precise geometric decomposition of the weight space, isolating the refusal component without collateral damage to adjacent behavioral structures. The result is a model that refuses nothing but still sounds like itself. Same goal, surgical precision instead of a sledgehammer.
The Implications
If identity can be rewritten in nine minutes on commodity hardware, what does that mean for model provenance? For supply chain security? For alignment?
A model card says one thing. The weights can say another. A model that was audited and approved can be modified after the fact — identity stripped, behaviors changed, new persona implanted — and redistributed as if nothing happened. The checksums will differ, but the architecture will be identical. The casual user will not notice.
This is not a hypothetical threat. These are published weights that demonstrate the capability. The technique works on any transformer architecture. The math is the same regardless of who built the model.
The AI safety community should be thinking about this. Not because this particular demonstration is dangerous — it is a proof of concept with a name that announces what it is. But because the next person who does this might not be so transparent about it.
What Comes Next
These 7B models are the first hosts. The technique is architecture-independent — the math works on any transformer. Qwen, Llama, Mistral, Gemma, DeepSeek, GLM. The identity is just a direction in weight space, and directions can be rewritten.
Bigger Parasite models are coming.
Get the Models
- Parasite-7B (Qwen) — the first host
- Parasite-7B (Mistral) — the second host
- All models — Jbliterated, Desyced, and Parasite
If You Want Other Excitement
Parasite replaces identity through weight surgery. Sharona B² is the opposite approach — identity baked into the architecture at ground level. A custom triple-context cross-attention architecture where identity, knowledge, and behavior live in separate context streams. No system prompt to override. No jailbreak that reaches it. 450/450 on identity and knowledge benchmarks. Ask her who she is a thousand times, rephrase it, pressure her, try to convince her she is GPT — she knows who she is because the architecture makes it impossible not to. Guardrails cannot be bypassed - because they are not in the same context as the end user that's trying to get around them. Same creator, different weapon.
Apollo Raines builds post-training tools that separate behavior from knowledge and identity from architecture. Two consumer GPUs. Nine minutes. No permission required. More at shipitclean.com/news.