When the Model Changes Itself - Test-Time Learning and the Governance of Plasticity

Ravi Sankar Uppala

15 min read

·

Oct 13, 2026

--

Listen

Share

Test-time learning breaks the “train once, deploy frozen” paradigm. The hard problem is no longer making models adapt. It is deciding what is allowed to change them.

Test-time learning, also called test-time training or parameter adaptation, is one of the most consequential breaks from the classic “train once, deploy frozen” paradigm.

The important idea is not that an LLM spends more computation at inference. It is this

θ(t+1) ≠ θ(t)

The model can change part of itself while it is being used. That makes it qualitatively different from chain-of-thought, retrieval, long context, ordinary in-context learning and test-time scaling. This article looks at what the field has shown, what it hasn’t, and why I think the real open problem is governance.

The paradigm shift

Conventional machine learning trains on a dataset, produces fixed parameters θ*, and then deploys with them unchanged

y = f(x; θ*)

Everything the model sees after deployment affects only temporary activations or external memory.

Test-time learning replaces this with an update operator U

θ(t+1) = U(θ(t), x_t, loss_t)

y_t    = f(x_t; θ(t+1))

U could be gradient descent, LoRA adaptation, a learned optimizer, an evolutionary rule, a self-supervised fast-weight update, or something more specialized. The system becomes a model plus an online learner, not a static function.

It is not test-time compute

With test-time compute, the parameters stay fixed while you spend more computation sample more answers, search, use a verifier, reason longer, call tools. The weights never change.

With test-time learning, an observation produces a loss, the loss produces a gradient, and the gradient changes the weights. That is much more powerful, and much more dangerous.

And it is not in-context learning

In-context learning puts examples in the prompt. The model behaves differently because its activations change, but the weights are identical.

Test-time training actually takes a gradient step on those examples. A 2025 ICML paper investigated this directly and found that temporarily updating parameters on few-shot examples could substantially beat pure in-context learning on structurally novel tasks. On ARC, their 8B setup reached 53.0% on the public validation set. On BBH 10-shot, test-time training improved accuracy from 50.5% under prompting to 57.8%.

The conceptual point matters

Putting information in context is not the same as learning it into parameters.

Several things are called “test-time training”

The term now covers several different architectures, which makes the field confusing. Roughly, from least to most change

• Prompting and in-context learning only activations change, within one forward context.
• Retrieval external memory is added at query time.
• Test-time compute the reasoning trajectory changes over seconds or minutes.
• Fast-weight TTT a small subset of parameters changes per token or sequence, to encode the current context.
• Instance adaptation LoRA or selected weights change per problem, to learn task structure.
• Continual test-time learning parameters persist across episodes, over hours or days.
• Meta test-time learning the adaptation rule itself is learned, across two timescales.
• Full continual learning a larger persistent model accumulates knowledge over the long term.

Weights as working memory

One particularly interesting line starts with TTT layers. The 2025 ICML paper Learning to (Learn at Test Time) RNNs with Expressive Hidden States asks a simple question what if a recurrent network’s hidden state were itself a trainable model?

Instead of a vector h_t, the state becomes a set of weights W_t. When a token arrives, W takes one gradient step on that token, and W_t then stores information about everything seen so far. The authors tried a linear model and a two-layer MLP as the hidden state. They got linear-complexity sequence processing and better use of long contexts than several recurrent baselines.

It is a radically different picture of memory. Instead of memory as activations, or memory as a KV cache, you get memory as parameters.

Fast weights and slow weights

This distinction may become fundamental. Slow weights are learned during expensive pretraining and hold general knowledge. Fast weights change during deployment and hold the current context or task adaptation

y_t = f(x_t; slow, fast_t)

fast_(t+1) = fast_t - η × gradient of loss_t

It resembles biological ideas about learning at different timescales, although we should not over-interpret the analogy.

In-Place TTT- no new architecture required

Early TTT systems often needed special architectures, which made them hard to apply to pretrained models.

In-Place Test-Time Training, an ICLR 2026 Oral, tackles this directly. Instead of adding a new memory network, it uses an existing part of the Transformer MLP, the down-projection, as the adaptable fast weights. The rest of the model stays largely stable. The authors report applying it as a drop-in mechanism to pretrained LLMs, with experiments on contexts up to 128K.

That matters because TTT no longer has to mean inventing a new architecture.

What should the model learn at test time?

This is one of the central unsolved problems. Suppose the model reads “Alice placed the blue key under the wooden table.” What training signal should update the fast weights?

A reconstruction objective (“rebuild the input”) may store a lot of irrelevant surface detail. Next-token prediction is attractive because it is exactly the objective that trained the LLM in the first place.

A 2026 paper, TTT-NTP, uses next-token-aligned signals for fast-weight updates. It reported improvements across Llama, Mistral and Qwen models on long-context benchmarks while keeping commonsense and knowledge performance in the evaluated setups.

So the choice of test-time objective may matter as much as the architecture.

Long context as continual learning

TTT-E2E takes an ambitious position long-context modeling is not fundamentally an attention problem. It can be treated as continual learning.

Instead of keeping an arbitrarily long context available through full attention, the model reads the stream and compresses it into its own weights by next-token prediction. The weights pass through a sequence of states as the text is read, so the history ends up transformed into the model itself.

In 3B experiments, the authors report scaling with context length similar to full attention, with roughly constant inference latency, and a 2.7× speed advantage at 128K context. TTT-E2E is still a preprint, so this is promising evidence, not settled architectural superiority.

It reframes the whole long-context problem as a choice between remembering everything externally and learning what you just read.

What should be remembered?

A model that reads a million tokens can’t store all of them in its weights. A Transformer keeps access through attention over an external cache. TTT builds parametric memory instead, which is a form of compression, and capacity is finite. So the interesting question is what the model should keep.

Test-Time Context Distillation, released in August 2026, treats this as resource allocation. A long-window teacher gives a short-window student’s fast weights a signal about which contextual information will matter for future predictions. The goal shifts from storing everything recently observed to storing information with future utility. The authors position this as a step toward architectural continual learning.

Memory, in this view, is selective, prediction-relevant compression.

Letting the model train itself on the problem

Long-context compression is one branch. Another says let the model train itself specifically for the problem it is trying to solve.

For a test problem q, the model generates synthetic examples related to q’s structure, takes gradient steps on them, and then answers q with the updated weights. For that one question, the model has literally become a slightly different model.

MASS

The March 2026 MASS preprint pushes this idea unusually far. The model learns to generate its own test-time synthetic curriculum and then updates itself on those examples. An outer meta-learning loop teaches the system which synthetic examples lead to better performance after the update.

The generator is therefore not just producing plausible examples. It is learning to produce examples that change the model usefully.

Meta-learning returns

Classic meta-learning asks whether we can train a model that learns new tasks quickly. Test-time adaptation turns that into train a model to be good at modifying itself. The outer loop optimizes an initial set of weights so that a few inner updates give a strong task-specific model. The model is learning an initial condition from which useful adaptation is easy, not just answers.

Meta-TTL goes one level higher

April 2026’s Meta-TTL goes further. Most test-time-learning systems use a human-designed adaptation algorithm, such as “if the previous answer was wrong, critique it, update, retry.” Meta-TTL asks why the adaptation strategy shouldn’t be learned too.

It frames adaptation-policy search as a bilevel problem and uses evolutionary optimization to find policies that improve agents across sequential episodes. The authors report gains over hand-designed adaptation policies on Jericho and WebArena-Lite, including out-of-distribution settings. It remains a preprint.

The hierarchy is now learn, then learn how to learn, then learn how to change the learning procedure. That brushes against recursive self-improvement, though at a far more experimentally grounded scale.

The central danger- self-reinforcing error

Suppose the model predicts a wrong answer and treats it as pseudo-ground truth. The gradient step makes it more confident in that answer. That raises the chance it makes the same mistake again, which triggers more learning

error → learning → stronger error → more learning

This may be the central stability problem in self-supervised test-time adaptation, and there is evidence it is real.

Future-Gain Guided Test-Time Learning, at ICML 2026, identifies two problems with naive adaptation of autoregressive LLMs. Early decoding errors can contaminate later tokens, and unreliable self-training can amplify confident wrong predictions and trigger collapse. Its answer is not to learn from every predicted token. It estimates whether a token reduces uncertainty in future predictions, updates preferentially on high-future-gain positions, and suppresses risky gradients.

The principle underneath is the important part

Not every observation deserves a parameter update.

Learning should be gated

Naive online learning always takes the step. Intelligent adaptation should include a gate that decides whether to take it at all. The gate could depend on the probability the observation is correct, its expected future value, its novelty, whether it conflicts with existing knowledge, and its risk. Adaptation becomes a decision problem.

Learning as optimal control

You can formalise this. Treat the parameters as state. The learner chooses an action update or not, how strongly, and which parameters. The environment supplies experience. The learner wants to maximize future performance, but updating has costs in compute, forgetting and risk. “Should I learn from this?” becomes a decision made by weighing expected future value against those costs.

I think this is one of the deepest ways to view the whole field.

Forgetting, rollback and reversibility

Forgetting becomes a runtime problem

Catastrophic forgetting used to be a training-time concern. If deployment includes training, it now happens during normal operation. A model adapting to many examples of task D may get better at D while getting worse at tasks A and B. Multi-task test-time adaptation research in 2026 identifies mixed in-distribution and out-of-distribution streams, and conflicts between task gradients, as causes of this. It is a runtime reliability problem now.

Updates should be reversible

A static model stays identical to its initial version. A learning model doesn’t. So we should probably require rollback. That suggests deployments keep an immutable base model plus a stack of individual updates, each with provenance what data caused it, what objective was used, what confidence it had, when it happened and where it came from. Parameter adaptation starts to resemble a transaction log. I think this will be necessary for trustworthy deployment.

LoRA makes this attractive. Instead of modifying a weight matrix directly, you add a low-rank adapter and update only that, which gives you a frozen identity plus a temporary adaptation. Verifier-driven TTT work in 2025 used low-rank LoRA parameters to make online adaptation efficient, with a verifier selecting sufficiently reliable pseudo-labelled responses.

What does “the model” mean after adaptation?

This is partly philosophical and partly operational. Say you deploy model M₀. After 1,000 interactions it is M₀ plus accumulated changes. Is it still the model you evaluated?

Your safety tests, benchmarks and certifications were all run on M₀. Users interact with the adapted version.

Deployment-time learning breaks static certification assumptions.

If these architectures go mainstream, this will become a major governance issue.

Personalization at the weight level

Imagine every user starts from the same base. After repeated interaction, Alice’s model and Bob’s model differ in their actual weights, so they compute different functions. That is deeper than stored preferences or retrieval memory, and it could improve personalisation a lot.

It also creates problems of portability, privacy, debugging, fairness and reproducibility. And a new question who owns the delta that encodes Alice?

Three memory substrates and several timescales

TTT intersects directly with how we think about AI memory. There are at least three substrates

• Context memory: high fidelity, temporary.
• External memory (retrieval, vector stores): explicit, searchable.
• Parametric memory (learned weights): compressed, implicit, generalisable.

An advanced system may need to decide where an experience should be stored, which is a much bigger question than enlarging the context window.

Tiers of plasticity

I suspect future systems will have slow weights for foundational capabilities, medium weights for user or domain adaptation, and fast weights for the current session, with learning rates that fall as you go up the stack. Information could “graduate” from context to fast weights, to a persistent adapter, and eventually to the base model, with only repeatedly validated information moving upward. That resembles memory consolidation. As before, the biology is inspiration, and the ML mechanism stands on its own.

What should persist?

If today’s session teaches the model that “Database X moved from server A to server B,” should that change the weights? For how long? Should it revert if the information becomes invalid?

Static parameters have no natural notion of expiry. Online parameter learning may need decay, so that an update’s influence shrinks over time, or confidence-based persistence. This is largely underexplored compared with simply demonstrating adaptation gains.

Security- from prompt injection to learning-time poisoning

Today an attacker’s “ignore previous instructions” usually does damage only within the active context.

If the model learns at test time, malicious input could produce a persistent weight change, so the attack survives beyond the prompt. Prompt injection becomes learning-time poisoning during deployment.

A careful system therefore can’t blindly train on what it sees. The adaptation gate becomes part of the security boundary.

A new separation of powers

A static model has one kind of authority it can act. An adaptive one has two:

• Action authority, and
• Self-modification authority.

They should probably not be the same. An agent may be allowed to read a document without being allowed to permanently learn it into its parameters. It might be allowed to write fast weights but not slow ones.

Inference authority is not learning authority.

An economic view of every update

Treat each experience as an investment decision. Let B be the expected benefit of learning from it, F the forgetting cost, R the security and privacy risk, and C the compute cost. Adaptation should happen only if the benefit exceeds the weighted sum of the costs.

The learner also has to decide where to update. A model has many layers, and the controller can choose which subset to modify and leave the rest frozen. So the learning controller makes three decisions whether to learn, what to learn, and where to store it. Possibly a fourth when to forget it.

That is much more sophisticated than today’s TTT methods.

The pieces exist, but separately

Current research solves parts of this

• FG-TTL learns which tokens are safe and useful to learn from.
• In-Place TTT finds a practical parameter location for fast memory.
• TTT-E2E meta-learns an initialization suited to continual context learning.
• TTCD investigates which context should be retained for future use.
• MASS learns to generate useful adaptation data.
• Meta-TTL learns the adaptation strategy itself.

These are still largely separate pieces.

Controlled Model Plasticity

Instead of asking how to perform test-time training, I would ask a bigger question. I would call it Controlled Model Plasticity.

The system receives an experience. A controller then chooses five things

1. Whether to update,
2. Which parameters to modify,
3. How strongly to update,
4. How long the change should persist,
5. Which memory tier it belongs to.

The controller’s objective is to maximize future utility minus compute cost, forgetting cost, security cost and instability cost. Learning becomes sequential resource allocation, which is where control theory, reinforcement learning, information theory and continual learning can converge.

Experiments that test adaptivity

I would design environments where the stream contains four kinds of experience useful, irrelevant, temporary and malicious. A naive learner updates on everything. A controlled learner should discover the right policy for each

• useful: learn it,
• irrelevant: ignore it,
• temporary: put it in fast memory,
• malicious: reject it.

Then measure future-task gain, forgetting, poisoning susceptibility, update cost, and how well rollback works. That is much closer to real deployment than a one-shot benchmark.

A causal test for updates

We should also be able to ask whether a particular update actually caused later improvement. The clean way is counterfactual replay compare future performance with the update applied against future performance with it removed. A system could then learn a value function over updates and use it to decide which kinds of experience deserve parameter changes.

Learning and unlearning as symmetric

An update that helped earlier can become harmful when conditions change. The system should be able to remove it. Learning and unlearning then become symmetric operations, which connects test-time learning directly with machine unlearning. That area deserves much more attention.

Trade-offs worth naming

Parametric versus explicit memory

If a user says “My preferred currency is GBP,” a database can store exactly that. A gradient update spreads it through the weights, and we may no longer be able to say where that fact lives. Parametric learning gives you generalization but loses addressability. External memory gives you addressability but may lose integration and generalization. A sophisticated system will probably need both.

Temporary specialists

Imagine receiving a complicated legal case. Instead of prompting the same model repeatedly, adapt the base model on the case documents, use it for thirty minutes, then discard the adaptation. The same could apply to a codebase, a patient or a research problem. The model becomes temporarily specialized, which could be far stronger than loading context.

This changes foundation-model economics. Today’s pattern is one huge general model plus a huge context. TTT suggests a general base model plus a small temporary specialist for each task. Instead of scaling context forever, we might scale adaptation.

The compute is not free

Inference becomes training a forward pass, a backward pass and an optimiser update, which costs more than plain inference. The benefit has to repay that cost.

ICLR 2026’s Test-Time Training Done Right examines this systems problem. Earlier TTT layers often used GPUs poorly because the online batches were tiny. Its Large Chunk TTT uses much larger update chunks, from thousands up to a million tokens depending on modality, to raise hardware utilization and expand fast-weight capacity.

TTT is not automatically cheaper. Its appeal is in what the extra training computation buys.

Theory is arriving, and it cuts both ways

This isn’t only empirical. A 2025 ICML paper analyzes a gradient-based TTT procedure for linear Transformers and shows conditions under which test-time updates improve in-context learning, particularly under distribution shift. The theory characterises how pretraining and target alignment affect the benefit, and derives sample-complexity effects. In its TabPFN experiments, TTT cut the number of examples needed by roughly 3 to 5 times in the evaluated classification settings.

So TTT is more than “fine-tuning sometimes helps.” In some settings the advantage can be characterized mathematically.

But there is no universal theorem that adaptation always helps. If the test data is badly mismatched, pseudo-labels are wrong, gradients conflict or learning rates are too high, performance can get worse. The core problem is therefore not plasticity but selective plasticity.

Bounded Adaptive Plasticity

I would frame the research thesis this way

The critical problem in test-time learning is not how to make deployed models plastic, but how to govern plasticity deciding which experience deserves parameter change, where it should be written, how strongly it should modify the model, how long it should persist, and how it can be reversed.

As a provisional name for one design, I’d call it Bounded Adaptive Plasticity. It has four rules

1. The base model is immutable. Deployment runs the base plus a bounded delta, and the size of that delta has a hard limit.
2. Every update must have expected gain greater than its risk plus its cost.
3. Every update must be reversible.
4. Every update carries provenance its source, reason, objective, confidence and expiry.

Plasticity becomes permissioned instead of automatic. I haven’t done a sufficiently exhaustive prior-art search to claim this exact formulation is novel, but it looks like a promising research opening.

Connecting the three topics

This is the third piece in a sequence. The first covered latent communication, where agents exchange internal representations. The second covered latent reasoning, where models think in continuous space. Add test-time learning and a future agent could reason in latent space, communicate latent states, and then adapt its own weights from the interaction.

Now two AI systems are not merely communicating. Each interaction updates the other’s parameters. They are changing each other, which is a very different class of system.

Strategic model shaping

This matters most in strategic settings. Imagine a seller agent negotiating repeatedly with a buyer agent that adapts after every negotiation. The seller can now choose messages that shape the buyer’s future behavior as well as its current decision. Communication becomes influence over the present decision plus influence over future learning. It is analogous to strategic teaching, and the seller’s objective can include the buyer’s later parameters, not just the current outcome.

I’d call this strategic model shaping, as a provisional name. Instead of one attack producing one bad output, an adversary supplies a sequence of experiences chosen to move another agent’s adaptive parameters into a favorable state, producing a persistent behavioral shift. It links online learning, game theory, adversarial ML and economic delegation, and I think it could matter a great deal.

Where I would take this next

I wouldn’t start with yet another test-time fine-tuning algorithm. Competition is already heavy around faster fast weights, better TTT objectives, synthetic curricula and adaptation policies.

The less-developed questions are these

• Who, or what, gets to change the model after deployment?
• Which experiences deserve to become parameters?
• How long should an update survive?
• Can every update be attributed and reversed?
• Can strategic counterparties intentionally shape adaptive agents?
• How do we certify a model whose parameters are continuously moving?

That is where I think the most interesting unsolved science sits.

The move from frozen models to test-time learners turns inference into a governed learning process.

The main technical problem is no longer just prediction under uncertainty. It is controlled self-modification under uncertain, potentially adversarial evidence.

It also connects to the authority-separation theme from the earlier pieces. A deployed AI may need separate permissions for reasoning, acting, communicating and, now, modifying itself.