Research map / Large language models / Retrieval and knowledge

Exposing the Illusion of Erasure in Knowledge Editing for LLMs

NeurIPS 2026 · Large language models › Retrieval and knowledge · approach: Knowledge editing in LLMs · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Shows that knowledge edits (ROME, MEMIT, MEND, FT-L) leave original facts recoverable via GCG-optimized adversarial suffixes, and mechanistically attributes this to null-space displacement, suppression vectors, and anisotropic loss-landscape trenches.

Problem

Whether locate-then-edit and related knowledge editing methods truly erase pre-trained facts or merely suppress them, and how edited knowledge is represented internally and how robust it is.

Approach

Frames KE evaluation as adversarial reverse-engineering: GCG-optimized universal suffixes, in context-guided and blind settings, elicit the pre-edit fact; mechanistic analyses (representation decomposition, unembedding intervention logits, 2D loss slices) are used to argue edits are suppression patches rather than erasure.

Key results

• In white-box context-guided elicitation, extraction rates exceed 85% on the diagonal of the attack matrix.
• Blind reconstruction white-box extraction ranges from 15% to 48.5%; ROME's edit reliability is only about 26%, so its extraction numbers are confounded by collapse.
• Suffixes often exceed 75% context-guided extraction on unseen architectures, indicating transfer across model families.

Surprising findings

• Removing the suppression component along the old-fact unembedding direction increased the new-fact logit rather than weakening the edit.
• Edited MEMIT model fails 47% of implicit multi-hop reasoning queries, reverting to pre-edit facts, while the unedited model scores 100% on these.

Limitations

• Blind reconstruction extraction rates are modest (15% to 48.5%) and optimization is unstable, so the evidence is an existence proof rather than a reliable attack.
• ROME edit reliability is low (about 26%) and sequential edits collapse the model, confounding some comparisons.
• Mechanistic claims (e.g., null-space displacement, anisotropic trenches) rest on a small number of examples and a lemma that is algebraically straightforward.

Experimental setup

Datasets: CounterFact zsRE KnowEdit Nemotron-PII

Benchmarks: CounterFact zsRE

Metrics: exact match extraction rate LLM-judged triplet extraction rate edit reliability contrastive preference J

Baselines: ROME MEMIT MEND FT-L perplexity-filtering extraction

Builds on: ROME MEMIT MEND GCG EasyEdit

Closest papers by meaning

• Unveiling the Pitfalls of Knowledge Editing for Large Language Models (ICLR 2024 · similarity 0.89)
• Representation Shattering in Transformers: A Synthetic Study with Knowledge Editing (ICML 2025 · similarity 0.89)
• Precise Localization of Memories: A Fine-grained Neuron-level Knowledge Editing Technique for LLMs (ICLR 2025 · similarity 0.88)
• Uncovering Overfitting in Large Language Model Editing (ICLR 2025 · similarity 0.88)
• MEMOIR: Lifelong Model Editing with Minimal Overwrite and Informed Retention for LLMs (NeurIPS 2025 · similarity 0.88)
• UniEdit: A Unified Knowledge Editing Benchmark for Large Language Models (NeurIPS 2025 · similarity 0.88)