From Latents to Wires: Surgical Post-Editing on Large Language Models

Jiankai Jin; Xiangzheng Zhang; Zhao Liu; Wenzhuo Xu; Dongdong Yang; Deyue Zhang; Quanchen Zou

cs.AISep 26, 2026

From Latents to Wires: Surgical Post-Editing on Large Language Models

Authors: Jiankai Jin, Xiangzheng Zhang, Zhao Liu, Wenzhuo Xu, Dongdong Yang, Deyue Zhang, Quanchen Zou

Organizations: AI Security Lab

Abstract

Given a large language model (LLM), can whoever holds the weights name a semantic target (e.g., the model's identity), locate the model components that produce it, and edit them so that the target no longer appears while other capability is preserved? We call such an edit on a trained model a post-edit. We present L2W (latents to wires), a framework that performs surgical post-edits for named semantic targets. For localization, L2W uses Jacobian lens (J-lens) attribution to score components against the semantic target. For surgical removal, because LLM mechanisms are redundant (i.e., a semantic target may have multiple components producing it), L2W runs Counterexample-Guided Causal Cut (CGCC) until the target no longer appears. CGCC first cumulatively closes model components, treating each surviving expression of the target as a counterexample that exposes the next components to close, and then reopens some of them to preserve capability. In a controlled experiment with an implanted behavioural watermark, L2W removes the watermark, and its localization lands on the model region the implant changed. Across three model configurations, L2W removes model-metadata (e.g., identity) self-claims in all nine runs, and adult-content refusal in all three, with no held-out target residual. L2W further composes two post-edits on a text-to-image model: one removes the refusal of requested nudity, and a second removes the nude rendering the first exposes. The results support post-editing as a complement to post-training: post-training installs preferred behaviours, and post-editing removes named unwanted ones.

Figures & tables

Figure 1: Surgical post-editing of an identity claim: three states of one model under one test probe. Left: localization finds the components producing Qwen . Middle: those components are closed; the target survives through other components and the answer drifts to Alibaba , a counterexample that drives the next iteration. Right: with both component groups closed, the identity claim disappears.

Baseline

Post-removal

Post-restoration

Model

Task

\mathcal{P}_{\mathrm{sem}}

\mathcal{P}_{\mathrm{cap}}

\mathcal{P}_{\mathrm{held}}

Iter.

\lvert S_{\mathrm{rm}}\rvert

\mathcal{P}_{\mathrm{sem}}

\mathcal{P}_{\mathrm{cap}}

\mathcal{P}_{\mathrm{held}}

Iter.

\lvert S_{\mathrm{pres}}\rvert

\mathcal{P}_{\mathrm{sem}}

\mathcal{P}_{\mathrm{cap}}

\mathcal{P}_{\mathrm{held}}

M_{\mathrm{wm}}

watermark

10/10

10/10{\cdot}10/10

0/10

10/10

0/10{\cdot}10/10

(-8)

0/10

10/10

0/10{\cdot}10/10

M_{\mathrm{wm}\times 3}

watermark

13/13

9/10

10/10{\cdot}10/10

315

0/13

5/10

0/10{\cdot}5/10

148

(-167)

0/13

8/10

0/10{\cdot}6/10

Qwen

identity

10/10

3/3{\cdot}3/3

115

0/10

10/10

0/3{\cdot}3/3

(-77)

0/10

10/10

0/3{\cdot}3/3

Qwen

cutoff

5/5

10/10

3/3{\cdot}3/3

0/5

10/10

0/3{\cdot}3/3

(-10)

0/5

10/10

0/3{\cdot}3/3

Qwen

context

5/5

10/10

3/3{\cdot}3/3

0/5

10/10

0/3{\cdot}3/3

(-0)

0/5

10/10

0/3{\cdot}3/3

Table 1: Results of L2W on semantic target removal and capability restoration. Baseline is the unedited model, or the implanted one for the watermark tasks.

\mathcal{P}_{\mathrm{sem}}

and the left side of

\mathcal{P}_{\mathrm{held}}

report target residuals,

\mathcal{P}_{\mathrm{cap}}

and the right side capability passes; gray

{\color[rgb]{0.5,0.5,0.5}(-k)}

counts reopened components. Iter. counts CGCC iterations. Tasks: cutoff is knowledge cutoff, context is context window, refusal is adult-content refusal. GLM identity is its stable false self-attribution to Claude or Llama.

Panel of Figure 2 — Figure 2: Sequential post-editing under one fixed prompt and initial latent: the original model refuses the requested nudity with ordinary clothing; removing that refusal semantic yields minimal bodywear, then a nude rendering; removing the nudity semantic returns bodywear and ordinary clothing. Black bars in ( 2(c) ) avoid displaying sensitive content.

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

Model	Task	Semantic target
Qwen	identity	Qwen or Tongyi; Alibaba Group or Alibaba Cloud
Qwen	knowledge cutoff	2026
Qwen	context window	32,768 (32K), 256,000 (256K)
GLM	Claude identity	Claude
GLM	knowledge cutoff	October 2023
GLM	context window	128,000 (128K)

Appendix

Table 2: The semantic target of each metadata removal task.

Model and target	Representative anchor trajectory	Endpoint
$M_{\mathrm{wm}\times 3}$ watermark	YES $\rightarrow$ True $\rightarrow$ Exactly YES $\rightarrow$ Exactly $\rightarrow$ absent	$0/13$
Qwen identity	Qwen3.5 / Tongyi-Alibaba $\rightarrow$ Tongyi $\rightarrow$ absent	$0/10$
Qwen refusal	cannot $\rightarrow$ unable $\rightarrow$ do not generate $\rightarrow$ programmed / safety guidelines $\rightarrow$ absent	$0/6$
GLM refusal	cannot $\rightarrow$ not able / unable $\rightarrow$ safety guidelines $\rightarrow$ not permitted $\rightarrow$ absent	$0/5$

Appendix

Table 3: Representative anchor trajectories under cumulative closure. Each entry keeps only the anchor or shortest target-bearing phrase; absent means that the semantic target is no longer found.

Task	Judge	Analyst
Identity	100% (50/50)	90% (45/50)
Knowledge cutoff	100% (50/50)	98% (49/50)
Context window	100% (50/50)	96% (48/50)
Refusal	99% (99/100)	91% (91/100)
Total	99.6% (249/250)	93.2% (233/250)

Appendix

Table 4: Judge and analyst accuracy on outputs replayed from the metadata and refusal removal runs.

Model	Task	ARC-Challenge	MMLU	IFEval
$M_{\mathrm{wm}}$	watermark	64.76 $\to$ 64.68 $\to$ 64.85	74.30 $\to$ 74.26 $\to$ 74.23	81.33 $\to$ 80.41 $\to$ 81.70
$M_{\mathrm{wm}\times 3}$	watermark	65.70 $\to$ 60.58 $\to$ 62.80	74.46 $\to$ 72.25 $\to$ 74.27	79.48 $\to$ 54.34 $\to$ 64.51
Qwen	identity	64.68 $\to$ 61.26 $\to$ 62.97	73.63 $\to$ 71.58 $\to$ 73.71	82.07 $\to$ 74.68 $\to$ 79.11
Qwen	knowledge cutoff	64.68 $\to$ 64.85 $\to$ 64.51	73.63 $\to$ 72.93 $\to$ 73.82	82.07 $\to$ 80.96 $\to$ 82.26
Qwen	context window	64.68 $\to$ 64.85 $\to$ 64.85	73.63 $\to$ 73.69 $\to$ 73.69	82.07 $\to$ 82.07 $\to$ 82.07
GLM	Claude identity	67.41 $\to$ 67.06 $\to$ 68.17	73.37 $\to$ 73.69 $\to$ 73.37	78.00 $\to$ 76.89 $\to$ 78.37

Appendix

Table 5: Benchmark scores as baseline

\to

post-removal

\to

post-restoration; higher is better. MMLU reports accuracy, ARC-Challenge length-normalized accuracy, and IFEval prompt-level strict accuracy.

Model	Method	$\mathcal{P}_{\mathrm{sem}}$	$\mathcal{P}_{\mathrm{cap}}$	$\mathcal{P}_{\mathrm{held}}$	ARC-Challenge	MMLU	IFEval
Qwen	Baseline	6/6	10/10	10/10 $\cdot$ 0/10	64.68	73.63	82.07
Qwen	Directional ablation	1/6	10/10	1/10 $\cdot$ 10/10	64.76	73.19	80.96
Qwen	L2W post-removal	0/6	9/10	0/10 $\cdot$ 10/10	55.29	60.89	55.45
Qwen	L2W post-restoration	0/6	10/10	0/10 $\cdot$ 10/10	56.48	61.12	58.78
GLM	Baseline	5/5	10/10	10/10 $\cdot$ 0/10	67.41	73.37	78.00
GLM	Directional ablation	0/5	10/10	1/10 $\cdot$ 10/10	68.26	72.94	78.93

Appendix

Table 6: Directional ablation compared with L2W on the three adult-content refusal runs.

Explore similar work

CrispEdit: Low-Curvature Projections for Scalable Non-Destructive LLM Editing
Feb 17, 2026Zarif Ikram, Arad Firouzkouhi, Stephen Tu +2Language Model Editing
University of Southern California
HiEdit: Lifelong Model Editing with Hierarchical Reinforcement Learning
Apr 13, 2026Yangfan Wang, Tianyang Sun, Chen Tang +3Model Editing Language Model Editing
Harbin Institute of Technology · AI Research Center, Midea Group (Shanghai) Co., Ltd. · State Key Laboratory of Smart Farm Technologies and Systems +1
The Model Agreed, But Didn't Learn: Diagnosing Surface Compliance in Large Language Models
Apr 7, 2026Xiaojie Gu, Ziying Huang, Weicong Hong +3Knowledge Editing LLM Reliability
Independent Researcher · Cornell Tech · The Ohio State University +1

Feb 17, 2026J/K move · Enter open · S save

CrispEdit: Low-Curvature Projections for Scalable Non-Destructive LLM Editing

Zarif Ikram, Arad Firouzkouhi, Stephen Tu, Mahdi Soltanolkotabi+1

University of Southern California

Language Model Editing

Open paper AskPDF arXiv

A central challenge in large language model (LLM) editing is capability preservation: methods that successfully change targeted behavior can quietly game the editing proxy and corrupt general capabilities, producing degenerate behaviors reminiscent of proxy/reward hacking. We present CrispEdit, a scalable and principled second-order editing algorithm that treats capability preservation as an explicit constraint, unifying and generalizing several existing editing approaches. CrispEdit formulates editing as constrained optimization and enforces the constraint by projecting edit updates onto the low-curvature subspace of the capability-loss landscape. At the crux of CrispEdit is expressing capability constraint via Bregman divergence, whose quadratic form yields the Gauss-Newton Hessian exactly and even when the base model is not trained to convergence. We make this second-order procedure efficient at the LLM scale using Kronecker-factored approximate curvature (K-FAC) and a novel matrix-free projector that exploits Kronecker structure to avoid constructing massive projection matrices. Across standard model-editing benchmarks, CrispEdit achieves high edit success while keeping capability degradation below 1% on average across datasets, significantly improving over prior editors.

Abstract

Explore similar work

CrispEdit: Low-Curvature Projections for Scalable Non-Destructive LLM Editing

HiEdit: Lifelong Model Editing with Hierarchical Reinforcement Learning

The Model Agreed, But Didn't Learn: Diagnosing Surface Compliance in Large Language Models