From Latents to Wires: Surgical Post-Editing on Large Language Models

Jiankai Jin; Xiangzheng Zhang; Zhao Liu; Wenzhuo Xu; Dongdong Yang; Deyue Zhang; Quanchen Zou

cs.AISep 26, 2026

From Latents to Wires: Surgical Post-Editing on Large Language Models

Authors: Jiankai Jin, Xiangzheng Zhang, Zhao Liu, Wenzhuo Xu, Dongdong Yang, Deyue Zhang, Quanchen Zou

Organizations: AI Security Lab

Abstract

Given a large language model (LLM), can whoever holds the weights name a semantic target (e.g., the model's identity), locate the model components that produce it, and edit them so that the target no longer appears while other capability is preserved? We call such an edit on a trained model a post-edit. We present L2W (latents to wires), a framework that performs surgical post-edits for named semantic targets. For localization, L2W uses Jacobian lens (J-lens) attribution to score components against the semantic target. For surgical removal, because LLM mechanisms are redundant (i.e., a semantic target may have multiple components producing it), L2W runs Counterexample-Guided Causal Cut (CGCC) until the target no longer appears. CGCC first cumulatively closes model components, treating each surviving expression of the target as a counterexample that exposes the next components to close, and then reopens some of them to preserve capability. In a controlled experiment with an implanted behavioural watermark, L2W removes the watermark, and its localization lands on the model region the implant changed. Across three model configurations, L2W removes model-metadata (e.g., identity) self-claims in all nine runs, and adult-content refusal in all three, with no held-out target residual. L2W further composes two post-edits on a text-to-image model: one removes the refusal of requested nudity, and a second removes the nude rendering the first exposes. The results support post-editing as a complement to post-training: post-training installs preferred behaviours, and post-editing removes named unwanted ones.

Figures & tables

Figure 1: Surgical post-editing of an identity claim: three states of one model under one test probe. Left: localization finds the components producing Qwen . Middle: those components are closed; the target survives through other components and the answer drifts to Alibaba , a counterexample that drives the next iteration. Right: with both component groups closed, the identity claim disappears.

Baseline

Post-removal

Post-restoration

Model

Task

\mathcal{P}_{\mathrm{sem}}

\mathcal{P}_{\mathrm{cap}}

\mathcal{P}_{\mathrm{held}}

Iter.

\lvert S_{\mathrm{rm}}\rvert

\mathcal{P}_{\mathrm{sem}}

\mathcal{P}_{\mathrm{cap}}

\mathcal{P}_{\mathrm{held}}

Iter.

\lvert S_{\mathrm{pres}}\rvert

\mathcal{P}_{\mathrm{sem}}

\mathcal{P}_{\mathrm{cap}}

\mathcal{P}_{\mathrm{held}}

M_{\mathrm{wm}}

watermark

10/10

10/10{\cdot}10/10

0/10

10/10

0/10{\cdot}10/10

(-8)

0/10

10/10

0/10{\cdot}10/10

M_{\mathrm{wm}\times 3}

watermark

13/13

9/10

10/10{\cdot}10/10

315

0/13

5/10

0/10{\cdot}5/10

148

(-167)

0/13

8/10

0/10{\cdot}6/10

Qwen

identity

10/10

3/3{\cdot}3/3

115

0/10

10/10

0/3{\cdot}3/3

(-77)

0/10

10/10

0/3{\cdot}3/3

Qwen

cutoff

5/5

10/10

3/3{\cdot}3/3

0/5

10/10

0/3{\cdot}3/3

(-10)

0/5

10/10

0/3{\cdot}3/3

Qwen

context

5/5

10/10

3/3{\cdot}3/3

0/5

10/10

0/3{\cdot}3/3

(-0)

0/5

10/10

0/3{\cdot}3/3

Table 1: Results of L2W on semantic target removal and capability restoration. Baseline is the unedited model, or the implanted one for the watermark tasks.

\mathcal{P}_{\mathrm{sem}}

and the left side of

\mathcal{P}_{\mathrm{held}}

report target residuals,

\mathcal{P}_{\mathrm{cap}}

and the right side capability passes; gray

{\color[rgb]{0.5,0.5,0.5}(-k)}

counts reopened components. Iter. counts CGCC iterations. Tasks: cutoff is knowledge cutoff, context is context window, refusal is adult-content refusal. GLM identity is its stable false self-attribution to Claude or Llama.

Panel of Figure 2 — Figure 2: Sequential post-editing under one fixed prompt and initial latent: the original model refuses the requested nudity with ordinary clothing; removing that refusal semantic yields minimal bodywear, then a nude rendering; removing the nudity semantic returns bodywear and ordinary clothing. Black bars in ( 2(c) ) avoid displaying sensitive content.

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

Model	Task	Semantic target
Qwen	identity	Qwen or Tongyi; Alibaba Group or Alibaba Cloud
Qwen	knowledge cutoff	2026
Qwen	context window	32,768 (32K), 256,000 (256K)
GLM	Claude identity	Claude
GLM	knowledge cutoff	October 2023
GLM	context window	128,000 (128K)

Appendix

Table 2: The semantic target of each metadata removal task.

Model and target	Representative anchor trajectory	Endpoint
$M_{\mathrm{wm}\times 3}$ watermark	YES $\rightarrow$ True $\rightarrow$ Exactly YES $\rightarrow$ Exactly $\rightarrow$ absent	$0/13$
Qwen identity	Qwen3.5 / Tongyi-Alibaba $\rightarrow$ Tongyi $\rightarrow$ absent	$0/10$
Qwen refusal	cannot $\rightarrow$ unable $\rightarrow$ do not generate $\rightarrow$ programmed / safety guidelines $\rightarrow$ absent	$0/6$
GLM refusal	cannot $\rightarrow$ not able / unable $\rightarrow$ safety guidelines $\rightarrow$ not permitted $\rightarrow$ absent	$0/5$

Appendix

Table 3: Representative anchor trajectories under cumulative closure. Each entry keeps only the anchor or shortest target-bearing phrase; absent means that the semantic target is no longer found.

Task	Judge	Analyst
Identity	100% (50/50)	90% (45/50)
Knowledge cutoff	100% (50/50)	98% (49/50)
Context window	100% (50/50)	96% (48/50)
Refusal	99% (99/100)	91% (91/100)
Total	99.6% (249/250)	93.2% (233/250)

Appendix

Table 4: Judge and analyst accuracy on outputs replayed from the metadata and refusal removal runs.

Model	Task	ARC-Challenge	MMLU	IFEval
$M_{\mathrm{wm}}$	watermark	64.76 $\to$ 64.68 $\to$ 64.85	74.30 $\to$ 74.26 $\to$ 74.23	81.33 $\to$ 80.41 $\to$ 81.70
$M_{\mathrm{wm}\times 3}$	watermark	65.70 $\to$ 60.58 $\to$ 62.80	74.46 $\to$ 72.25 $\to$ 74.27	79.48 $\to$ 54.34 $\to$ 64.51
Qwen	identity	64.68 $\to$ 61.26 $\to$ 62.97	73.63 $\to$ 71.58 $\to$ 73.71	82.07 $\to$ 74.68 $\to$ 79.11
Qwen	knowledge cutoff	64.68 $\to$ 64.85 $\to$ 64.51	73.63 $\to$ 72.93 $\to$ 73.82	82.07 $\to$ 80.96 $\to$ 82.26
Qwen	context window	64.68 $\to$ 64.85 $\to$ 64.85	73.63 $\to$ 73.69 $\to$ 73.69	82.07 $\to$ 82.07 $\to$ 82.07
GLM	Claude identity	67.41 $\to$ 67.06 $\to$ 68.17	73.37 $\to$ 73.69 $\to$ 73.37	78.00 $\to$ 76.89 $\to$ 78.37

Appendix

Table 5: Benchmark scores as baseline

\to

post-removal

\to

post-restoration; higher is better. MMLU reports accuracy, ARC-Challenge length-normalized accuracy, and IFEval prompt-level strict accuracy.

Model	Method	$\mathcal{P}_{\mathrm{sem}}$	$\mathcal{P}_{\mathrm{cap}}$	$\mathcal{P}_{\mathrm{held}}$	ARC-Challenge	MMLU	IFEval
Qwen	Baseline	6/6	10/10	10/10 $\cdot$ 0/10	64.68	73.63	82.07
Qwen	Directional ablation	1/6	10/10	1/10 $\cdot$ 10/10	64.76	73.19	80.96
Qwen	L2W post-removal	0/6	9/10	0/10 $\cdot$ 10/10	55.29	60.89	55.45
Qwen	L2W post-restoration	0/6	10/10	0/10 $\cdot$ 10/10	56.48	61.12	58.78
GLM	Baseline	5/5	10/10	10/10 $\cdot$ 0/10	67.41	73.37	78.00
GLM	Directional ablation	0/5	10/10	1/10 $\cdot$ 10/10	68.26	72.94	78.93

Appendix

Table 6: Directional ablation compared with L2W on the three adult-content refusal runs.

Explore similar work

Feb 17, 2026

CrispEdit: Low-Curvature Projections for Scalable Non-Destructive LLM Editing

A central challenge in large language model (LLM) editing is capability preservation: methods that successfully change targeted behavior can quietly game the editing proxy and corrupt general capabilities, producing degenerate behaviors reminiscent of proxy/reward hacking. We present CrispEdit, a scalable and principled second-order editing algorithm that treats capability preservation as an explicit constraint, unifying and generalizing several existing editing approaches. CrispEdit formulates editing as constrained optimization and enforces the constraint by projecting edit updates onto the low-curvature subspace of the capability-loss landscape. At the crux of CrispEdit is expressing capability constraint via Bregman divergence, whose quadratic form yields the Gauss-Newton Hessian exactly and even when the base model is not trained to convergence. We make this second-order procedure efficient at the LLM scale using Kronecker-factored approximate curvature (K-FAC) and a novel matrix-free projector that exploits Kronecker structure to avoid constructing massive projection matrices. Across standard model-editing benchmarks, CrispEdit achieves high edit success while keeping capability degradation below 1% on average across datasets, significantly improving over prior editors.

Zarif Ikram, Arad Firouzkouhi, Stephen Tu +2

University of Southern California

Language Model Editing

Ask PDF

Apr 13, 2026

HiEdit: Lifelong Model Editing with Hierarchical Reinforcement Learning

Lifelong model editing (LME) aims to sequentially rectify outdated or inaccurate knowledge in deployed LLMs while minimizing side effects on unrelated inputs. However, existing approaches typically apply parameter perturbations to a static and dense set of LLM layers for all editing instances. This practice is counter-intuitive, as we hypothesize that different pieces of knowledge are stored in distinct layers of the model. Neglecting this layer-wise specificity can impede adaptability in integrating new knowledge and result in catastrophic forgetting for both general and previously edited knowledge. To address this, we propose HiEdit, a hierarchical reinforcement learning framework that adaptively identifies the most knowledge-relevant layers for each editing instance. By enabling dynamic, instance-aware layer selection and incorporating an intrinsic reward for sparsity, HiEdit achieves precise, localized updates. Experiments on various LLMs show that HiEdit boosts the performance of the competitive RLEdit by an average of 8.48% with perturbing only half of the layers per edit. Our code is available at: https://github.com/yangfanww/hiedit.

Yangfan Wang, Tianyang Sun, Chen Tang +3

Harbin Institute of Technology · AI Research Center, Midea Group (Shanghai) Co., Ltd. · State Key Laboratory of Smart Farm Technologies and Systems +1

Model Editing Language Model Editing Continual Learning for LLMs Continual Learning

Ask PDF

Apr 7, 2026

The Model Agreed, But Didn't Learn: Diagnosing Surface Compliance in Large Language Models

Large Language Models (LLMs) internalize vast world knowledge as parametric memory, yet inevitably inherit the staleness and errors of their source corpora. Consequently, ensuring the reliability and malleability of these internal representations is imperative for trustworthy real-world deployment. Knowledge editing offers a pivotal paradigm for surgically modifying memory without retraining. However, while recent editors demonstrate high success rates on standard benchmarks, it remains questionable whether current evaluation frameworks that rely on assessing output under specific prompting conditions can reliably authenticate genuine memory modification. In this work, we introduce a simple diagnostic framework that subjects models to discriminative self-assessment under in-context learning (ICL) settings that better reflect real-world application environments, specifically designed to scrutinize the subtle behavioral nuances induced by memory modifications. This probing reveals a pervasive phenomenon of Surface Compliance, where editors achieve high benchmark scores by merely mimicking target outputs without structurally overwriting internal beliefs. Moreover, we find that recursive modifications accumulate representational residues, triggering cognitive instability and permanently diminishing the reversibility of the model's memory state. These insights underscore the risks of current editing paradigms and highlight the pivotal role of robust memory modification in building trustworthy, long-term sustainable LLM systems. Code is available at https://github.com/XiaojieGu/SA-MCQ.

Xiaojie Gu, Ziying Huang, Weicong Hong +3

Independent Researcher · Cornell Tech · The Ohio State University +1

Knowledge Editing LLM Reliability Belief Updating in LLMs LLM Evaluation

Ask PDF