What happened
Researchers describe CellFill, a method for adding knowledge to deployed quantized language models without changing the stored integer codes or shared scales in the original model file. The update is kept in a separate file that the authors call a fill and can be withdrawn by subtraction.
The paper starts from a property of 4-bit quantization. Each model weight is represented by an integer code and a shared scale, while the quantization process discards an interval between stored values. The authors define “in-cell learning” as writing new information into that unused interval. Their stated constraint is that re-quantizing the resulting served weights must reproduce the original integer codes and scales exactly. In practical terms, the base model file can remain unchanged at the bit level while a separate update modifies the model’s behavior when applied.
CellFill is the paper’s implementation of this idea. It uses a low-rank position inside each quantization cell and is trained on the vendor’s own 4-bit release. The source says the experiments cover NF4, quantization-aware-training and GPTQ-style grids, as well as Qwen3 and Gemma models ranging from 1.7 billion to 31 billion parameters. The authors say the method checks its guarantee in the integer domain for every constrained weight, rather than relying only on aggregate numerical measurements.
The authors report that CellFill wrote 83% to 97% of a corpus of real facts that the tested models verifiably did not know, with zero reported constraint violations across as many as 2.4 × 10^10 constrained weights. They also report tests intended to show that the added knowledge can be used rather than merely recalled: injected drugs could be composed with injected ingredients up to the model’s reported two-hop ceiling, and a software library released after the model’s cutoff was used in code at 2.6 times chance. These are claims from the preprint’s own experiments, not independently established results.
For a retrieval comparison on PopQA’s long-tail questions, the source says the fill answered 82% to 90% of questions that the released model could not answer, using 75 tokens per question. The cited retrieval systems used 90 to 1,008 tokens per question. The paper also says several writers can share one model release and that sequential updates consume a constant fraction of the remaining room. The source points to archived result files behind its tables, but the supplied text does not describe their contents in enough detail to assess the full experimental protocol.
Read the primary source: arxiv.org ↗
Why it matters
If independently validated, the approach could make some model updates easier to audit, distribute, certify and revoke because the original release remains bit-identical while new behavior is carried separately. The source reports promising results, but it does not establish production readiness or broad reliability.
The practical significance is version control. A deployed language model may be tied to benchmark reports, certifications, device fleets or other systems that assume a particular file. A conventional update can create a new model artifact and complicate comparisons with the certified release. CellFill’s proposed separation between the unchanged base release and a removable fill could allow an organization to distribute new knowledge without replacing the original quantized file. That separation could also make reversibility more explicit. According to the paper, the update is a separate file that can be withdrawn by subtraction. This creates a potentially useful distinction between the durable base model and an update layer that can be added, removed or assigned to different users. Such a design might help operators track which knowledge was added and when, although the source does not present a complete audit, access-control or governance system.
The reported efficiency comparison points to another possible benefit. The fill answered many previously missed PopQA questions with a much shorter token budget than the retrieval systems used in the comparison. If the result survives replication and applies to broader workloads, a compact update could sometimes be cheaper or simpler to serve than repeatedly retrieving long context. The source does not provide enough information to determine whether the comparison controls for indexing, retrieval quality, latency, memory use or total system cost.
The method also changes how model updates might be evaluated. Because the authors require exact preservation of the quantized codes and scales, they offer a concrete, machine-checkable condition for the base artifact. That could make some update claims easier to verify than ordinary fine-tuning claims. However, bit identity is not the same as behavioral safety or quality: a model can behave differently through a fill even when its stored base bits are unchanged. The source does not show whether the approach protects against hallucinations, unwanted associations, data leakage or harmful newly injected knowledge.
What to watch next
The main questions are whether outside researchers can reproduce the reported results, whether fills preserve existing capabilities, how multiple updates interact, and how much storage and runtime overhead the method adds. The preprint also leaves open questions about security, misuse and performance beyond the tested settings.
Independent replication is the first key test. The paper is an arXiv preprint, submitted on 21 August 2026 and revised on 24 August 2026, rather than a peer-reviewed publication in the supplied record. Researchers will need to verify the integer-domain guarantee, the zero-violation result and the reported knowledge-injection rates across the named quantization schemes and model families. The archived result files may help, but the source text alone does not establish their accessibility, completeness or independent verification.
Future evaluations should examine whether the fill damages capabilities the base model already had. The supplied abstract emphasizes facts the models did not know, composition tests and a post-cutoff software library, but it does not report broad regression testing, refusal behavior, calibration, factuality outside the injected corpus or performance on unrelated tasks. It also does not explain how the authors determined that the models verifiably lacked each fact before training.
The paper’s claims about sequential updates and multiple writers require careful testing. A method that works for one fill may behave differently as available cell space is consumed, as updates overlap or as writers introduce conflicting facts. Important practical measurements include the size of each fill, training and application time, inference latency, memory use, the number of sustainable updates and the conditions under which subtraction fully restores the previous behavior.
Security and governance are also unresolved. A removable update file could be useful for controlled deployment, but it could also become an independent tampering target if an attacker can replace or alter it. The source does not describe authentication, authorization, provenance, privacy protections or defenses against malicious knowledge injection. Watch for follow-up work testing revocation in real serving systems, interactions with safety tuning and performance on models, domains and update types beyond the experiments reported here.
