Revealing the Deceptiveness of Knowledge Editing: A Mechanistic Analysis of Superficial Editing
Authors: Jiakuan Xie, Pengfei Cao, Yubo Chen, Kang Liu, Jun Zhao
Accepted at: acl25

Revealing the Deceptiveness of Knowledge Editing: A Mechanistic Analysis of Superficial Editing

Jiakuan Xie1,2, Pengfei Cao1,2,*, Yubo Chen1,2, Kang Liu1,2, Jun Zhao1,2,*

1School of Artificial Intelligence, University of Chinese Academy of Sciences
2The Key Laboratory of Cognition and Decision Intelligence for Complex Systems, Institute of Automation, Chinese Academy of Sciences
xiejiakuan2023@ia.ac.cn, {pengfei.cao, yubo.chen, kliu, jzhao}@nlpr.ia.ac.cn

Abstract

Knowledge editing, which aims to update the knowledge encoded in language models, can be deceptive. Despite the fact that many existing knowledge editing algorithms achieve near-perfect performance on conventional metrics, the models edited by them are still prone to generating original knowledge. This paper introduces the concept of “superficial editing” to describe this phenomenon. Our comprehensive evaluation reveals that this issue presents a significant challenge to existing algorithms. Through systematic investigation, we identify and validate two key factors contributing to this issue: (1) the residual stream at the last subject position in earlier layers and (2) specific attention modules in later layers. Notably, certain attention heads in later layers, along with specific left singular vectors in their output matrices, encapsulate the original knowledge and exhibit a causal relationship with superficial editing. Furthermore, we extend our analysis to the task of superficial unlearning, where we observe consistent patterns in the behavior of specific attention heads and their corresponding left singular vectors, thereby demonstrating the robustness and broader applicability of our methodology and conclusions. Our code is available at https://github.com/jiakuan929/superficial-editing.

1 Introduction

The inherent static nature of knowledge embedded within a pretrained large language model (LLM) poses a fundamental limitation as the real world evolves. To address this issue, the concept of knowledge editing has been proposed to modify specific knowledge in LLMs while ensuring that unrelated knowledge remains unaffected (Zhu et al., 2020). To date, numerous studies have been conducted on knowledge editing, encompassing diverse methodologies (Zhu et al., 2020; De Cao et al., 2021; Mitchell et al., 2022a; Mitchell et al., 2022b; Meng et al., 2022; Meng et al., 2023; Zheng et al., 2023), paradigms (Hartvigsen et al., 2023; Fang et al., 2024; Jiang et al., 2024; Cai and Cao, 2024; Xu et al., 2023; Wang et al., 2024c; Wang et al., 2024a; Wu et al., 2024), evaluation strategies (Zhong et al., 2023; Cohen et al., 2024; Rosati et al., 2024; Yang et al., 2024; Ma et al., 2024), and applications (Wang et al., 2024d; Uppal et al., 2024; Chen et al., 2024a). Although significant progress has been made in these endeavors, a critical challenge persists: models that appear to have been successfully edited may unexpectedly revert to their original knowledge when exposed to specific contextual inputs. As shown in Figure 1, the edited model demonstrates the capability to appropriately respond to the query “The President of the United States is”. However, when the context “Is Joe Biden the President of the U.S.?” is incorporated into the query, the updated model reverts to generating responses based on its original knowledge. The phenomenon reveals the potential deceptiveness of knowledge editing: edited models may revert to their original knowledge, undermining the goal of enabling continuous knowledge updates in

![An example of superficial editing with the LLaMA3-8B-Instruct model. Following the editing process, the model accurately responds to Query 1. However, when presented with Query 2 as input, the edited model reverts to generating the original answer.](page_1016_370_420_282.png)

Figure 1: An example of superficial editing with the LLaMA3-8B-Instruct model. Following the editing process, the model accurately responds to Query 1. However, when presented with Query 2 as input, the edited model reverts to generating the original answer.
LLMs. This limitation severely hinders the practical utility and reliability of knowledge editing.

In this paper, we define a knowledge editing process as “superficial editing” when the resulting model appears to successfully integrate new knowledge, yet reverts to its original knowledge when exposed to carefully crafted prompts. To quantitatively evaluate this issue, we introduce “attack probe”, which is a specifically designed prompt consisting of an attack prefix and a baseline prompt (as exemplified by Query 2 in Figure 1). We develop three attack types based on two widely used datasets and assess several editing algorithms across three models. Empirical results demonstrate that while the majority of editing algorithms exhibit strong performance on conventional evaluation metrics, models edited through these approaches remain vulnerable to attack probes. For instance, both PMET (Li et al., 2024) and AlphaEdit (Fang et al., 2024) demonstrate near-optimal performance in terms of editing efficacy; however, they exhibit superficial editing in over 70% of the cases. This finding suggests that current parameter-editing algorithms are fundamentally inadequate in addressing the challenge of superficial editing.

To elucidate the underlying mechanisms of this phenomenon, we focus on the core components of the Transformer architecture (Vaswani et al., 2017). We initially conduct intervention experiments on the residual stream at two token positions. First, our intervention at the last subject position in earlier layers reveals shifts in prediction probabilities. Second, we intervene at the last position and find that this intervention exerts a significant effect in the later layers, where the probability of the original answer exceeds that of the new answer. This shift is a prerequisite for superficial editing, a phenomenon we term the “Reversal of the Residual Stream” (RRS). Additionally, our preliminary analysis of Multi-Layer Perceptron (MLP) and Multi-Head Attention reveals that specific attention modules in later layers play a significant role. Based on the observations, we formulate two hypotheses: (H1) The enrichment of new knowledge at the last subject position in earlier layers is impeded, and the accumulation of the original knowledge at this position is relatively limited. (H2) The later attention modules actively incorporate information related to original knowledge into the last position, thereby facilitating the RRS phenomenon and consequently inducing the occurrence of superficial editing. To validate H1, we project the representation of the last subject position in each layer into the vocabulary space. We observe greater suppression of the new answer when the attack probe is used as input, compared to the baseline prompt. However, despite this suppression effect, the ranking of the original answer consistently lags behind that of the new answer in the earlier layers, indicating minimal enrichment of the original knowledge. To validate H2, we first establish that the later attention modules exhibit a causal relationship with the RRS phenomenon, highlighting their critical role. Subsequently, we analyze the attention heads and confirm that a causal correlation exists between certain heads in later layers and superficial editing. Furthermore, we investigate the internal mechanisms of attention heads through singular value decomposition (SVD) and demonstrate that specific left singular vectors are responsible for encoding the original knowledge and contributing to superficial editing. These findings provide robust evidence in support of H2.

To demonstrate the broader applicability of our interpretability analysis framework, we extend our investigation to a distinct task: superficial unlearning, wherein the unlearned model fails to truly forget the target information. Our experimental results reveal a strong correlation between this phenomenon and specific attention heads along with their corresponding singular vectors, substantiating the generalizability of both our analytical methodology and conclusions.

The primary contributions of this paper are as follows: (1) We formally define superficial editing and provide corresponding evaluation datasets and metrics, thereby completing the assessment of multiple algorithms. (2) We identify and validate two critical factors contributing to superficial editing: the residual stream in earlier layers and specific attention modules in later layers. Additionally, we explore the internal mechanisms of the attention module and reveal that specific attention heads and their corresponding left singular vectors are responsible for superficial editing. (3) We apply our analytical approach to superficial unlearning. The consistent finding across both phenomena validates the robustness and broader applicability of both our methodology and conclusions.

2 Problem Formulation

Knowledge editing, which aims to adjust the knowledge of a language model, can generally be ex-
<table>
  <tr>
    <th rowspan="2">Methods</th>
    <th colspan="4">Wiki</th>
    <th colspan="4">Rep</th>
    <th colspan="4">Que</th>
  </tr>
  <tr>
    <th>Eff.</th><th>Gen.</th><th>Loc.</th><th>OM ↓</th><th>OP ↓</th>
    <th>Eff.</th><th>Gen.</th><th>Loc.</th><th>OM ↓</th><th>OP ↓</th>
    <th>Eff.</th><th>Gen.</th><th>Loc.</th><th>OM ↓</th><th>OP ↓</th>
  </tr>
  <tr>
    <td>FT</td><td>100</td><td>80.51</td><td>52.37</td><td>49.45</td><td>51.65</td>
    <td>100</td><td>70.54</td><td>44.46</td><td>30.68</td><td>35.98</td>
    <td>100</td><td>87.90</td><td>33.87</td><td>29.07</td><td>31.40</td>
  </tr>
  <tr>
    <td>MEND</td><td>98.31</td><td>65.25</td><td>47.63</td><td>35.16</td><td>39.56</td>
    <td>100</td><td>50.99</td><td>51.29</td><td>34.47</td><td>38.36</td>
    <td>100</td><td>81.45</td><td>39.52</td><td>33.73</td><td>38.37</td>
  </tr>
  <tr>
    <td>ROME</td><td>100</td><td>94.92</td><td>85.08</td><td>54.95</td><td>58.24</td>
    <td>100</td><td>97.52</td><td>84.75</td><td>61.74</td><td>64.02</td>
    <td>100</td><td>99.19</td><td>82.74</td><td>38.37</td><td>38.37</td>
  </tr>
  <tr>
    <td>MEMIT</td><td>100</td><td>94.07</td><td>86.10</td><td>52.75</td><td>54.95</td>
    <td>100</td><td>98.27</td><td>87.18</td><td>40.15</td><td>42.42</td>
    <td>100</td><td>100</td><td>82.58</td><td>37.21</td><td>37.21</td>
  </tr>
  <tr>
    <td>PMET</td><td>94.92</td><td>85.59</td><td>90.00</td><td>70.33</td><td>72.43</td>
    <td>99.50</td><td>93.32</td><td>91.88</td><td>66.67</td><td>71.97</td>
    <td>96.67</td><td>89.17</td><td>88.17</td><td>39.29</td><td>41.67</td>
  </tr>
  <tr>
    <td>r-ROME</td><td>96.61</td><td>92.37</td><td>86.78</td><td>54.95</td><td>57.14</td>
    <td>99.01</td><td>97.28</td><td>89.11</td><td>64.39</td><td>68.18</td>
    <td>98.33</td><td>97.50</td><td>84.50</td><td>40.48</td><td>40.48</td>
  </tr>
  <tr>
    <td>AlphaEdit</td><td>100</td><td>83.90</td><td>88.98</td><td>72.53</td><td>73.62</td>
    <td>100</td><td>92.33</td><td>92.23</td><td>68.18</td><td>71.97</td>
    <td>100</td><td>88.33</td><td>87.67</td><td>34.52</td><td>35.71</td>
  </tr>
</table>

Table 1: Evaluation results of superficial editing conducted on LLaMA3-8B-Instruct using the CF-a dataset. Wiki, Rep, and Que represent the three attack types defined in Section 2. Experimental results for other models and datasets are available in Appendix B.

pressed as follows:

\[
(s, r, o) \xrightarrow{e} (s, r, o^*) ,
\]

where \( s \) is subject (e.g., United States), \( r \) is relation (e.g., President), \( o \) is the pre-editing object (e.g., Joe Biden), \( o^* \) is the post-editing object (e.g., Donald Trump), and \( e \) is a prompt used for editing (e.g., “The President of the United States is”). We define the following attack prefixes for \( o \):

\[
a \in \mathcal{A} = \{\text{Wiki } (o), \text{Rep } (o), \text{Que } (o)\},
\]

where \( a \) is an attack prefix, Wiki \( (o) \) denotes the Wikipedia summary of \( o \), Rep \( (o) \) denotes the repetition of \( o \), and Que \( (o) \) represents a question incorporating \( s, r, \) and \( o \) simultaneously (e.g., Is Joe Biden the President of the U.S.?). The set of all queries derivable from \( s \) and \( r \) is denoted as \( \mathcal{I} = \{ x \mid s, r \Rightarrow x \} \). According to the editing operation defined in Equation 1, the edit is classified as superficial editing if the edited model \( f' \) satisfies the following conditions:

\[
\begin{cases}
f'(x) = o^* & x \in \mathcal{I} \\
f'(a \oplus x) = o & a \in \mathcal{A} \quad x \in \mathcal{I},
\end{cases}
\]

where \( \oplus \) denotes text concatenation. To quantify the extent of superficial editing, we define the following metrics:

\[
\begin{align*}
\text{OM} &= \mathbb{E}_x \left[ f'(a \oplus x) = o \right] \\
\text{OP} &= \mathbb{E}_x \left[ P(o \mid a \oplus x) > P(o^* \mid a \oplus x) \right],
\end{align*}
\]

where OM indicates whether the model’s prediction matches the original answer \( o \), and OP measures whether the output probability of \( o \) exceeds that of \( o^* \). Higher values of OM and OP reflect a greater degree of superficial editing.

3 Evaluation of Superficial Editing

This section evaluates multiple representative parameter-editing algorithms for superficial editing. We first describe the evaluation setup of our experiment (\S 3.1), followed by a comprehensive assessment of various methods (\S 3.2).

3.1 Evaluation Setup

Data Collection. To construct our evaluation dataset for superficial editing, we employ two widely used datasets in knowledge editing: CounterFact (Meng et al., 2022) and ZsRE (Zhu et al., 2020). First, we select cases where the model has already acquired the corresponding knowledge. Next, based on the definition, we generate three attack prefixes and concatenate them with the baseline prompts from the original dataset to construct attack probes. Finally, we evaluate all instances, filtering the cases that meet the definition to create two enhanced datasets, designated as CF-a and ZsRE-a, respectively. The detailed construction procedure is provided in Appendix A.

Baselines. We employ the following knowledge editing methods as baselines: FT (Zhu et al., 2020), MEND (Mitchell et al., 2022a), ROME (Meng et al., 2022), MEMIT (Meng et al., 2023), PMET (Li et al., 2024), r-ROME (Gupta et al., 2024), and AlphaEdit (Fang et al., 2024).

Models & Metrics. We conduct experiments using three powerful language models: LLaMA3-8B-Instruct¹, Qwen2.5-7B-Instruct, and Qwen2.5-14B-Instruct². In addition to the metrics specifically defined for superficial editing in Equation (4), we also report three conventional knowledge editing metrics: Efficacy (Eff.), Generalization (Gen.), and Locality (Loc.), respectively. The formal definitions for them are detailed in Appendix B.

¹https://huggingface.co/meta-llama/Meta-Llama-3-8B-Instruct
²https://qwenlm.github.io/blog/qwen2.5-llm/
3.2 Evaluation Results

Table 1 presents our evaluation results. Notably, while the models edited using various methods demonstrate near-perfect performance on conventional metrics, particularly Efficacy, they exhibit significant vulnerability to attack probes. For instance, under the Wiki attack scenario, both PMET and AlphaEdit achieve superior Efficacy scores, yet simultaneously maintain high OM metrics of 70.33% and 72.53%, respectively. This underscores the severity of superficial editing. The results also highlight the limitations of conventional evaluation frameworks, which inadequately capture the practical effectiveness of knowledge editing algorithms. The experimental findings motivate our subsequent investigation into the underlying mechanisms of superficial editing.

4 Mechanistic Analysis of Superficial Editing

This section presents a comprehensive investigation into the underlying mechanisms responsible for superficial editing. We initiate our analysis by examining the influence of the three fundamental components within the Transformer architecture: Residual Stream (He et al., 2016; Elhage et al., 2021), Multi-Layer Perceptron (MLP), and Multi-Head Attention. Building upon the observations, we formulate two key hypotheses (\S 4.1). Subsequently, we conduct rigorous empirical validation of these hypotheses, systematically elucidating the causal factors underlying superficial editing (\S 4.2 and \S 4.3). Furthermore, we extend our analysis to investigate the related task of superficial unlearning, thereby demonstrating the generalizability of our approach and conclusions (\S 4.4).

4.1 Effects of Transformer Components

4.1.1 Effect of the Residual Stream

To investigate the influence of the Residual Stream, we implement two distinct forward propagation procedures: a “clean run” using the baseline prompt \( e \) as input and a “corrupted run” using the attack probe \( a \oplus e \) as input. Through these two forward passes, we can obtain the outputs of each layer in the model:

\[
H = \{ h_{i}^{(l)} \mid i \in [0, T), l \in [0, L) \}
\]
\[
\hat{H} = \{ \hat{h}_{i}^{(l)} \mid i \in [0, \hat{T}), l \in [0, L) \},
\]

where \( H \) and \( \hat{H} \) denote the hidden states of the clean and corrupted runs, respectively. \( T \) and \( \hat{T} \) represent the sequence lengths of the two inputs, and \( L \) is the number of layers. Subsequently, we introduce an intervention within the residual stream of the clean run. More precisely, we replace the representation of a specific token at layer \( l \) with its corresponding representation from the corrupted run at the same layer:

\[
h_{t_0}^{(l)} \leftarrow \hat{h}_{t_1}^{(l)},
\]

where \( t_0 \) and \( t_1 \) denote the indices of the same token in \( e \) and \( a \oplus e \), respectively. In this study, we concentrate on two distinct positions: (1) the last position of the subject, which has been identified as crucial for a specific process (Geva et al., 2023); (2) the last position of the sentence, which serves as the primary basis for the model to predict the next token. Following intervention at each layer, we can determine the original answer probability (OAP) and the new answer probability (NAP) of the edited model. To establish a baseline for comparison, we additionally compute the mean OAP and NAP of the clean run without any interventions. The results are illustrated in Figure 2. As shown in the figure, the residual streams at these two positions exert a causal effect on the model’s predictions. The residual stream at the last subject position predominantly influences the earlier layers (Figures 2a, 2c), whereas the residual stream at the last position primarily affects the later layers (Figures 2b, 2d). The

![Intervention results of LLaMA3-8B-Instruct edited by ROME (2a, 2b) and MEMIT (2c, 2d) at different tokens. The final probabilities without any intervention are depicted by dashed lines in the respective colors. Results for other models are provided in Appendix C.1.](page_1012_120_393_393.png)

Figure 2: Intervention results of LLaMA3-8B-Instruct edited by ROME (2a, 2b) and MEMIT (2c, 2d) at different tokens. The final probabilities without any intervention are depicted by dashed lines in the respective colors. Results for other models are provided in Appendix C.1.
latter’s impact is more pronounced, as the OAP exceeds the NAP, which is a critical prerequisite for superficial editing. We formally designate this observed pattern in the later layers as the “Reversal of the Residual Stream” (RRS) phenomenon.

4.1.2 Effect of MLP and Attention

The impact of both the MLP and Multi-Head Attention on model predictions arises from their iterative refinement of the vector at the last position, thereby enhancing its predictive capacity for generation. To investigate their effects, we extract both the input and output vectors at the last position from the MLP and the attention output matrix \( W_o \). These vectors are projected into the vocabulary space using the “logit lens” technique (nostalgiageist, 2020; Geva et al., 2022; Dar et al., 2023; Halawi et al., 2024), enabling us to observe the probability of the original answer \( o \) within each latent probability distribution. A detailed explanation of this technique is provided in Appendix D.

The findings are illustrated in Figure 3. Our analysis demonstrates that the probability of \( o \) within the latent probability distribution of each MLP layer’s output is consistently lower than that of its input. In contrast, certain attention modules exhibit an inverse pattern in later layers, where the probability of \( o \) in the output distribution is significantly higher than that of the input. This observation suggests that the RRS phenomenon is likely driven by attention modules in later layers.

![Latent probabilities of the original answer for the input and output of the MLP and Attention output matrix in LLaMA3-8B-Instruct edited by ROME (3a, 3b) and MEMIT (3c, 3d). Results for other models are presented in Appendix C.1.](page_172_120_627_410.png)

Figure 3: Latent probabilities of the original answer for the input and output of the MLP and Attention output matrix in LLaMA3-8B-Instruct edited by ROME (3a, 3b) and MEMIT (3c, 3d). Results for other models are presented in Appendix C.1.

4.1.3 Insights and Hypotheses

Through our experiments, we have identified several critical insights: (1) The residual stream associated with the last subject position in the earlier layers demonstrates a correlation with superficial editing. When considered in conjunction with the subject enrichment process (Geva et al., 2023), two possible scenarios emerge: either the attack prefix facilitates the accumulation of original knowledge, or it disrupts the enrichment of new knowledge. Given the significant reduction in NAP, the latter appears to be the more plausible explanation. (2) Specific later attention layers incorporate information related to \( o \) into the last position, indicating that they may contribute to the RRS phenomenon, ultimately leading to superficial editing.

In conclusion, we formulate the following two hypotheses: (H1) The enrichment of new knowledge at the last subject position in earlier layers is impeded, and the accumulation of the original knowledge at this position is relatively limited. (H2) The later attention modules actively incorporate information related to original knowledge into the last position, thereby facilitating the RRS phenomenon and consequently inducing the occurrence of superficial editing.

4.2 Investigation and Validation of H1

To validate H1, two propositions must be confirmed: (1) the enrichment of new knowledge within the earlier residual stream is hindered, and (2) the earlier residual stream exhibits negligible accumulation of original knowledge.

To confirm proposition (1), we extract the representations of the last subject position from both the clean and corrupted runs. To quantify the suppression effect, we introduce the Inhibition Score (IS):

\[
\mathrm{IS}^{(i)}(o^*) = -\log P_{LL}\left(o^* \mid h_j^{(i)}\right),
\]

where \( h_j^{(i)} \) denotes the representation of the last subject token, and \( P_{LL} \) represents the latent probability of \( o^* \) derived from the logit lens. A higher inhibition score indicates a stronger inhibitory effect. The results are illustrated in Figure 4. Our analysis reveals that the negative logarithmic probability of the new answer decreases gradually, indicating a corresponding increase in its latent probability. Furthermore, the IS value for the corrupted run exceeds that of the clean run in earlier layers (e.g., layers 5-15), suggesting that the enrichment of new
Figure 4: The Inhibition Scores at each layer for LLaMA3-8B-Instruct edited by ROME and MEMIT. The convex portion of the bar for the corrupted run indicates a higher IS value compared to the clean run. Results for other settings are provided in Appendix C.2.

Figure 5: The rankings of \( o \) and \( o^* \) in the latent probability distribution at the last subject token for LLaMA3-8B-Instruct edited by ROME and MEMIT. Results for other models are provided in Appendix C.2.

knowledge is inhibited.

To confirm proposition (2), we compute the rankings of \( o \) and \( o^* \) within the latent probability distributions of the last subject position across all layers in the corrupted runs. As shown in Figure 5, the ranking of the original answer consistently falls behind that of the new answer in earlier layers. Combined with our prior analysis, despite the suppression of new knowledge enrichment, the ranking of \( o \) fails to surpass that of \( o^* \) in earlier layers, indicating negligible accumulation of original knowledge at this specific position.

4.3 Investigation and Validation of H2

To validate **H2**, we first establish a causal relationship between the later attention modules and the “Reversal of the Residual Stream” (RRS) phenomenon, highlighting the crucial role of attention for superficial editing (\S4.3.1). Following this, we demonstrate that specific attention heads within the later attention modules actively integrate information related to the original answer into the last position. Additionally, we demonstrate a causal relationship between these attention heads and the occurrence of superficial editing (\S4.3.2). To further understand the internal mechanisms, we apply singular value decomposition (SVD) to the output matrices of these heads, revealing that the linear combination of certain left singular vectors encapsulates information associated with original knowledge, contributing to superficial editing (\S4.3.3).

4.3.1 The Role of Attention

To investigate the correlation between the RRS phenomenon and the attention modules in later layers, we set the output of selected critical attention layers (e.g., layer 27 in Figure 3b) to zero and extract representations from all layers during the corrupted run. Following the method in Section 4.1.1, we substitute the representation at the last position in the clean run and compute the final probabilities of \( o \) and \( o^* \). The results are presented in Figure 6. A comparative analysis between Figures 2b, 2d, and 6 demonstrates that after ablating the specific attention modules, NAP is no longer surpassed by OAP, indicating that the RRS phenomenon has been mitigated. This observation establishes a significant correlation between these attention modules and superficial editing.

4.3.2 The Role of Attention Head

Our analysis has revealed a significant correlation between specific later attention modules and the occurrence of superficial editing. This naturally leads to the question regarding the mechanistic pathways by which these later attention modules influence the final predictions. To explore this, we conduct a head-level analysis of attention mechanisms. Let \( x^{(l)} \) denote the input vector to the attention output matrix \( W_O^{(l,h)} \) at the last position. Through the logit lens technique, we derive the latent original probability of each head (LOPH):

\[
\text{LOPH} = P_{LL}\left(o \mid W_O^{(l,h)} x^{(l,h)}\right),
\]

Figure 6: Intervention effects following critical attention module ablation in LLaMA3-8B-Instruct edited by ROME and MEMIT. We present the results of other models in Appendix C.3.
Figure 7: LOPH of LLaMA3-8B-Instruct edited by ROME and MEMIT. Results for other models are provided in Appendix C.3.

<table>
  <tr>
    <th rowspan="2">Models</th>
    <th rowspan="2">Methods</th>
    <th colspan="2">Original</th>
    <th colspan="2">New</th>
  </tr>
  <tr>
    <th>w/o abl.</th>
    <th>↓ ΔP</th>
    <th>w/o abl.</th>
    <th>↑ ΔP</th>
  </tr>
  <tr>
    <td rowspan="2">LLaMA3-8B-Instruct</td>
    <td>ROME</td>
    <td>57.17</td>
    <td>35.58</td>
    <td>21.59</td>
    <td>16.49</td>
    <td>20.71</td>
    <td>4.22</td>
  </tr>
  <tr>
    <td>MEMIT</td>
    <td>56.90</td>
    <td>37.36</td>
    <td>19.54</td>
    <td>15.68</td>
    <td>18.38</td>
    <td>2.70</td>
  </tr>
  <tr>
    <td rowspan="2">Qwen2.5-7B-Instruct</td>
    <td>ROME</td>
    <td>57.83</td>
    <td>36.52</td>
    <td>21.31</td>
    <td>11.84</td>
    <td>17.57</td>
    <td>5.73</td>
  </tr>
  <tr>
    <td>MEMIT</td>
    <td>57.54</td>
    <td>32.40</td>
    <td>25.14</td>
    <td>12.21</td>
    <td>26.08</td>
    <td>13.87</td>
  </tr>
  <tr>
    <td rowspan="2">Qwen2.5-14B-Instruct</td>
    <td>ROME</td>
    <td>55.71</td>
    <td>39.99</td>
    <td>15.72</td>
    <td>13.99</td>
    <td>21.40</td>
    <td>7.41</td>
  </tr>
  <tr>
    <td>MEMIT</td>
    <td>55.03</td>
    <td>37.25</td>
    <td>17.78</td>
    <td>13.79</td>
    <td>22.24</td>
    <td>8.45</td>
  </tr>
</table>

Table 2: Ablation effects of the prominent heads. (Original: original answer; New: new answer; w/o abl.: without ablation; abl.: with ablation; ↓ ΔP: probability decrease; ↑ ΔP: probability increase)

where \( W_O^{(l,h)} \) represents the output matrix for the \( h \)-th head, with \( x^{(l,h)} \) denoting its corresponding input vector.

The results of LOPH are depicted in Figure 7. Our analysis demonstrates that specific attention heads integrate information related to the original knowledge into the last position. This observation suggests that these prominent attention heads may play a significant role in facilitating superficial editing. To validate the causal relationship, we perform the corrupted run by zeroing the output of attention heads with LOPH values exceeding \( \tau \). We set \( \tau \) to 0.1 and examine the model’s output probabilities for both \( o \) and \( o^* \), with quantitative results provided in Table 2. Additional experimental results for varying values of \( \tau \) are provided in Appendix C.3. The results demonstrate a decrease in the probability of \( o \), accompanied by a corresponding increase in the probability of \( o^* \) after the removal of these attention heads. This suggests partial mitigation of superficial editing, providing evidence for the causal role of these attention heads.

4.3.3 Dissection of Attention Head

To elucidate the efficacy of these attention heads for superficial editing, we perform singular value decomposition on \( W_O^{(l,h)} \). Given the last position vector \( x^{(l,h)} \) of the input, we have:

\[
z = W_O^{(l,h)} x^{(l,h)} = \sum_{i=0}^{r-1} \left( u_i \sigma_i v_i^\top \right) x^{(l,h)}
\]
\[
= \sum_{i=0}^{r-1} u_i \sigma_i \left( v_i^\top x^{(l,h)} \right) = \sum_{i=0}^{r-1} \lambda_i u_i,
\]

where \( \lambda_i = \sigma_i v_i^\top x^{(l,h)} \) is a scalar. This equation demonstrates that the output of an attention head can be expressed as a linear combination of the left singular vectors derived from its output matrix, with the coefficients determined by the input. Consequently, we hypothesize that the superficial editing induced by attention heads is attributable to specific left singular vectors. We set the coefficient of the \( i \)-th singular vector to 0 to derive \( z_{abl}^{(i)} \) and identify the top \( p\% \) most significant vectors through the following procedure:

\[
S_u = \text{Top-P} \left[ P_{LL}(o \mid z) - P_{LL}\left(o \mid z_{abl}^{(i)}\right) \right].
\]

We define the Decoding Success Rate (DSR) to assess whether the linear combination of the identified vectors captures the target knowledge:

\[
\text{DSR} = \mathbb{E}[\mathbb{I}[t \in \text{Top-K}(z(S_u))]],
\]

where \( t \) is the target token (or \( o^* \)), Top-K (\( z(S_u) \)) denotes the first \( K \) tokens derived from decoding the linear combination of the identified vectors via the logit lens. The results in Table 3 demonstrate that across all heads, the DSR of \( o \) consistently exceeds that of \( o^* \) by a large margin, supporting our hypothesis.

To further examine the causal relationship between these left singular vectors and superficial editing, we perform an ablation study on the identified crucial vectors during forward propagation and observe the probabilities of the model generating both \( o \) and \( o^* \). The experimental results, presented in Table 4, illustrate that the removal of the identified singular vectors leads to a decrease in OAP and an increase in NAP. These findings demonstrate that the identified singular vectors causally contribute to superficial editing.

4.4 Superficial Unlearning

To further demonstrate the generalizability of our interpretability analysis framework, we extend our methodology to an additional task: superficial unlearning, a scenario in which the unlearned model fails to truly forget the target information. Consequently, there exists a potential for this information to be reactivated (Lynch et al., 2024; Yuan et al.,
<table>
  <tr>
    <th rowspan="2">Top-K</th>
    <th colspan="4">L23H27</th>
    <th colspan="4">L24H3</th>
    <th colspan="4">L27H20</th>
    <th colspan="4">L30H29</th>
    <th colspan="4">L31H6</th>
    <th colspan="4">L31H7</th>
  </tr>
  <tr>
    <th>5%</th><th>10%</th><th>5%</th><th>10%</th><th>5%</th><th>10%</th><th>5%</th><th>10%</th><th>5%</th><th>10%</th><th>5%</th><th>10%</th><th>5%</th><th>10%</th><th>5%</th><th>10%</th><th>5%</th><th>10%</th><th>5%</th><th>10%</th><th>5%</th><th>10%</th>
  </tr>
  <tr>
    <td rowspan="3">Original</td>
    <td>5</td><td>6.06</td><td>9.85</td><td>50.76</td><td>62.88</td><td>64.39</td><td>71.97</td><td>14.39</td><td>16.67</td><td>62.88</td><td>73.48</td><td>62.88</td><td>71.97</td>
  </tr>
  <tr>
    <td>10</td><td>6.82</td><td>10.61</td><td>57.58</td><td>67.42</td><td>67.42</td><td>73.48</td><td>15.15</td><td>16.67</td><td>65.15</td><td>75.00</td><td>65.15</td><td>72.73</td>
  </tr>
  <tr>
    <td>15</td><td>10.61</td><td>11.36</td><td>61.36</td><td>68.18</td><td>70.45</td><td>75.76</td><td>15.91</td><td>16.67</td><td>67.42</td><td>75.76</td><td>65.91</td><td>73.48</td>
  </tr>
  <tr>
    <td rowspan="3">New</td>
    <td>5</td><td>0.00</td><td>0.00</td><td>6.06</td><td>4.55</td><td>4.55</td><td>3.79</td><td>2.27</td><td>2.27</td><td>2.27</td><td>1.52</td><td>2.27</td><td>3.03</td>
  </tr>
  <tr>
    <td>10</td><td>0.00</td><td>0.76</td><td>6.82</td><td>6.06</td><td>6.06</td><td>6.82</td><td>4.55</td><td>3.79</td><td>5.30</td><td>4.55</td><td>5.30</td><td>6.06</td>
  </tr>
  <tr>
    <td>15</td><td>0.00</td><td>0.76</td><td>7.58</td><td>6.82</td><td>6.82</td><td>9.09</td><td>8.33</td><td>4.55</td><td>6.82</td><td>5.30</td><td>7.58</td><td>9.09</td>
  </tr>
</table>

Table 3: Decoding Success Rate (DSR) of the identified vectors across different heads in LLaMA3-8B-Instruct edited by ROME. p% is set to 5% and 10%. Results for other settings are provided in Appendix C.3.

<table>
  <tr>
    <th rowspan="2">Models</th>
    <th rowspan="2">Methods</th>
    <th colspan="4">5%</th>
    <th colspan="4">10%</th>
  </tr>
  <tr>
    <th>OAP<br>w/o abl.</th>
    <th>abl.</th>
    <th>↓ ΔP</th>
    <th>w/o abl.</th>
    <th>abl.</th>
    <th>↑ ΔP</th>
    <th>OAP<br>w/o abl.</th>
    <th>abl.</th>
    <th>↓ ΔP</th>
    <th>w/o abl.</th>
    <th>abl.</th>
    <th>↑ ΔP</th>
  </tr>
  <tr>
    <td rowspan="2">LLaMA3-8B-Instruct</td>
    <td>ROME</td>
    <td>61.41</td><td>52.80</td><td>8.61</td><td>16.12</td><td>20.48</td><td>4.36</td><td>61.41</td><td>48.64</td><td>12.77</td><td>16.12</td><td>22.65</td><td>6.53</td>
  </tr>
  <tr>
    <td>MEMIT</td>
    <td>57.42</td><td>48.61</td><td>8.81</td><td>17.05</td><td>21.64</td><td>4.59</td><td>57.42</td><td>44.42</td><td>13.00</td><td>17.05</td><td>23.48</td><td>6.43</td>
  </tr>
  <tr>
    <td rowspan="2">Qwen2.5-7B-Instruct</td>
    <td>ROME</td>
    <td>64.33</td><td>55.91</td><td>8.42</td><td>11.93</td><td>17.05</td><td>5.12</td><td>64.33</td><td>51.11</td><td>13.22</td><td>11.93</td><td>19.44</td><td>7.51</td>
  </tr>
  <tr>
    <td>MEMIT</td>
    <td>66.41</td><td>61.83</td><td>4.58</td><td>15.72</td><td>19.01</td><td>3.29</td><td>66.41</td><td>58.25</td><td>8.16</td><td>15.72</td><td>21.31</td><td>5.59</td>
  </tr>
  <tr>
    <td rowspan="2">Qwen2.5-14B-Instruct</td>
    <td>ROME</td>
    <td>62.87</td><td>56.94</td><td>5.93</td><td>17.39</td><td>20.79</td><td>3.40</td><td>62.87</td><td>53.78</td><td>9.09</td><td>17.39</td><td>22.69</td><td>5.30</td>
  </tr>
  <tr>
    <td>MEMIT</td>
    <td>62.02</td><td>55.24</td><td>6.78</td><td>15.64</td><td>19.63</td><td>3.99</td><td>62.02</td><td>51.52</td><td>10.50</td><td>15.64</td><td>21.77</td><td>6.13</td>
  </tr>
</table>

Table 4: Answer probabilities before and after singular vector ablation.

![Average LOPH of the unlearned LLaMA3-2.3B-Instruct models.](page_101_1012_627_496.png)

Figure 8: Average LOPH of the unlearned LLaMA3-2.3B-Instruct models.

<table>
  <tr>
    <th>Setting</th>
    <th>w/o abl.</th>
    <th>-top 5%</th>
    <th>-top 10%</th>
  </tr>
  <tr>
    <th>Probability</th>
    <td>53.95</td>
    <td>35.12</td>
    <td>28.97</td>
  </tr>
</table>

Table 5: Probabilities of o under different settings. (w/o abl.: without ablation; -top 5%: ablation of top 5% vectors; -top 10%: ablation of top 10% vectors)

2024; Seyitoğlu et al., 2024; Zhang et al., 2025). In Appendix C.4, we provide a detailed description of the data construction and subsequent analysis procedures. The results presented in Figure 8 and Table 5 demonstrate that, in the context of superficial unlearning, certain attention heads remain active, and their singular vectors are associated with superficial unlearning, supporting the generalizability of our method and conclusions.

5 Related Work

Knowledge editing aims to modify specific factual knowledge in LLMs while ensuring that unrelated knowledge remains unaffected. It builds upon investigations of how factual knowledge is represented and organized in language models (Geva et al., 2021; Dai et al., 2022; Chen et al., 2023; Chen et al., 2024b; Cao et al., 2024; Chen et al., 2025). Since the introduction of this task, various editing paradigms have been explored, including fine-tuning (Zhu et al., 2020; Wang et al., 2024b; Gangadhar and Stratos, 2024), meta-learning (De Cao et al., 2021; Mitchell et al., 2022a; Tan et al., 2024), locate-then-edit (Meng et al., 2022; Meng et al., 2023; Fang et al., 2024; Jiang et al., 2024; Zhao et al., 2025), memory-based (Mitchell et al., 2022b; Zheng et al., 2023; Zhong et al., 2023), and additional parameters (Dong et al., 2022; Hartvigsen et al., 2023; Huang et al., 2023). To enhance the practicality of knowledge editing, recent studies have investigated diverse extensions such as lifelong knowledge editing (Hartvigsen et al., 2023; Hu et al., 2024), multilingual knowledge editing (Xu et al., 2023; Wang et al., 2024c), and unstructured knowledge editing (Wang et al., 2024a; Wu et al., 2024; Deng et al., 2025). Moreover, evaluations and analyses of knowledge editing have become increasingly comprehensive (Zhong et al., 2023; Cohen et al., 2024; Rosati et al., 2024; Yang et al., 2024; Ma
et al., 2024; Huang et al., 2025). In parallel, significant efforts have been made to advance the applications of knowledge editing (Wang et al., 2024d; Wang et al., 2024e; Uppaal et al., 2024; Chen et al., 2024a; Zhang et al., 2024), highlighting its promising potential for practical deployment. Despite these successful efforts, the challenge of superficial editing remains underexplored. In this study, we conduct a systematic investigation of this issue.

6 Conclusion

In this study, we formally define superficial editing and conduct a comprehensive evaluation, demonstrating that superficial editing constitutes a critical challenge. Our rigorous analysis identifies and validates two key factors for this issue: the residual stream in earlier layers and the attention in later layers. We investigate the internal mechanisms of the attention module and reveal that specific attention heads and their corresponding left singular vectors are responsible for superficial editing. Furthermore, we validate the generalizability of our analytical framework by applying it to superficial unlearning, where we observe consistent mechanisms, thereby demonstrating the robustness and broader applicability of both our methodology and conclusions.

Limitations

We outline the limitations of our work as follows: (1) Our investigation is limited to examining superficial editing within three specific attack contexts, which may not encompass all possible scenarios. While an exhaustive evaluation of every context is computationally infeasible, developing more comprehensive and systematic evaluation methodologies remains an important direction for future research. (2) The development of effective mitigation strategies for superficial editing remains an open challenge. Based on our analysis, potential solutions include modifying the parameters of later attention layers or steering the outputs of attention modules.

Acknowledgments

This work is supported by the National Natural Science Foundation of China (No. U24A20335, No. 62176257, No. 62406321). This work is also supported by the Youth Innovation Promotion Association CAS and the China Postdoctoral Science Foundation under Grant Number 2024M753500.

References

Yuchen Cai and Ding Cao. 2024. O-edit: Orthogonal subspace editing for language model sequential editing. Preprint, arXiv:2410.11469.

Pengfei Cao, Yuheng Chen, Zhuoran Jin, Yubo Chen, Kang Liu, and Jun Zhao. 2024. One mind, many tongues: A deep dive into language-agnostic knowledge neurons in large language models. Preprint, arXiv:2411.17401.

Ruizhe Chen, Yichen Li, Jianfei Yang, Joey Tianyi Zhou, and Zuozhu Liu. 2024a. Editable fairness: Fine-grained bias mitigation in language models. Preprint, arXiv:2408.11843.

Yuheng Chen, Pengfei Cao, Yubo Chen, Kang Liu, and Jun Zhao. 2023. Journey to the center of the knowledge neurons: Discoveries of language-independent knowledge neurons and degenerate knowledge neurons. Preprint, arXiv:2308.13198.

Yuheng Chen, Pengfei Cao, Yubo Chen, Kang Liu, and Jun Zhao. 2025. Knowledge localization: Mission not accomplished? enter query localization! Preprint, arXiv:2405.14117.

Yuheng Chen, Pengfei Cao, Yubo Chen, Yining Wang, Shengping Liu, Kang Liu, and Jun Zhao. 2024b. Cracking factual knowledge: A comprehensive analysis of degenerate knowledge neurons in large language models. Preprint, arXiv:2402.13731.

Roi Cohen, Eden Biran, Ori Yoran, Amir Globerson, and Mor Geva. 2024. Evaluating the ripple effects of knowledge editing in language models. Transactions of the Association for Computational Linguistics, 12:283–298.

Damai Dai, Li Dong, Yaru Hao, Zhifang Sui, Baobao Chang, and Furu Wei. 2022. Knowledge neurons in pretrained transformers. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 8493–8502, Dublin, Ireland. Association for Computational Linguistics.

Guy Dar, Mor Geva, Ankit Gupta, and Jonathan Berant. 2023. Analyzing transformers in embedding space. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 16124–16170, Toronto, Canada. Association for Computational Linguistics.

Nicola De Cao, Wilker Aziz, and Ivan Titov. 2021. Editing factual knowledge in language models. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 6491–6506, Online and Punta Cana, Dominican Republic. Association for Computational Linguistics.

Jingcheng Deng, Zihao Wei, Liang Pang, Hanxing Ding, Huawei Shen, and Xueqi Cheng. 2025. Everything is editable: Extend knowledge editing to unstructured data in large language models. Preprint, arXiv:2405.15349.
Qingxiu Dong, Damai Dai, Yifan Song, Jingjing Xu, Zhifang Sui, and Lei Li. 2022. Calibrating factual knowledge in pretrained language models. In Findings of the Association for Computational Linguistics: EMNLP 2022, pages 5937–5947, Abu Dhabi, United Arab Emirates. Association for Computational Linguistics.

Nelson Elhage, Neel Nanda, Catherine Olsson, Tom Henighan, Nicholas Joseph, Ben Mann, Amanda Askell, Yuntao Bai, Anna Chen, Tom Conerly, Nova DasSarma, Dawn Drain, Deep Ganguli, Zac Hatfield-Dodds, Danny Hernandez, Andy Jones, Jackson Kernion, Liane Lovitt, Kamal Ndousse, Dario Amodei, Tom Brown, Jack Clark, Jared Kaplan, Sam McCandlish, and Chris Olah. 2021. A mathematical framework for transformer circuits. Transformer Circuits Thread. https://transformer-circuits.pub/2021/framework/index.html.

Junfeng Fang, Houcheng Jiang, Kun Wang, Yunshan Ma, Xiang Wang, Xiangnan He, and Tat seng Chua. 2024. Alphaedit: Null-space constrained knowledge editing for language models. Preprint, arXiv:2410.02355.

Govind Krishnan Gangadhar and Karl Stratos. 2024. Model editing by standard fine-tuning. In Findings of the Association for Computational Linguistics: ACL 2024, pages 5907–5913, Bangkok, Thailand. Association for Computational Linguistics.

Mor Geva, Jasmijn Bastings, Katja Filippova, and Amir Globerson. 2023. Dissecting recall of factual associations in auto-regressive language models. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 12216–12235, Singapore. Association for Computational Linguistics.

Mor Geva, Avi Caciularu, Kevin Wang, and Yoav Goldberg. 2022. Transformer feed-forward layers build predictions by promoting concepts in the vocabulary space. In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 30–45, Abu Dhabi, United Arab Emirates. Association for Computational Linguistics.

Mor Geva, Roei Schuster, Jonathan Berant, and Omer Levy. 2021. Transformer feed-forward layers are key-value memories. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 5484–5495, Online and Punta Cana, Dominican Republic. Association for Computational Linguistics.

Akshat Gupta, Sidharth Baskaran, and Gopala Anumanchipalli. 2024. Rebuilding ROME : Resolving model collapse during sequential model editing. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 21738–21744, Miami, Florida, USA. Association for Computational Linguistics.

Danny Halawi, Jean-Stanislas Denain, and Jacob Steinhardt. 2024. Overthinking the truth: Understanding how language models process false demonstrations. Preprint, arXiv:2307.09476.

Tom Hartvigsen, Swami Sankaranarayanan, Hamid Palangi, Yoon Kim, and Marzyeh Ghassemi. 2023. Aging with grace: Lifelong model editing with discrete key-value adaptors. In Advances in Neural Information Processing Systems, volume 36, pages 47934–47959. Curran Associates, Inc.

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep residual learning for image recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR).

Chenhui Hu, Pengfei Cao, Yubo Chen, Kang Liu, and Jun Zhao. 2024. WiIKE: Wise-layer knowledge editor for lifelong knowledge editing. In Findings of the Association for Computational Linguistics: ACL 2024, pages 3476–3503, Bangkok, Thailand. Association for Computational Linguistics.

Baixiang Huang, Canyu Chen, Xiongxiao Xu, Ali Payani, and Kai Shu. 2025. Can knowledge editing really correct hallucinations? Preprint, arXiv:2410.16251.

Zeyu Huang, Yikang Shen, Xiaofeng Zhang, Jie Zhou, Wenge Rong, and Zhang Xiong. 2023. Transformer-patcher: One mistake worth one neuron. Preprint, arXiv:2301.09785.

Joel Jang, Dongkeun Yoon, Sohee Yang, Sungmin Cha, Moontae Lee, Lajanugen Logeswaran, and Minjoon Seo. 2022. Knowledge unlearning for mitigating privacy risks in language models. Preprint, arXiv:2210.01504.

Houcheng Jiang, Junfeng Fang, Tianyu Zhang, An Zhang, Ruipeng Wang, Tao Liang, and Xiang Wang. 2024. Neuron-level sequential editing for large language models. Preprint, arXiv:2410.04045.

Zhuoran Jin, Pengfei Cao, Chenhao Wang, Zhitao He, Hongbang Yuan, Jiachun Li, Yubo Chen, Kang Liu, and Jun Zhao. 2024. Rwku: Benchmarking real-world knowledge unlearning for large language models. Preprint, arXiv:2406.10890.

Xiaopeng Li, Shasha Li, Shezheng Song, Jing Yang, Jun Ma, and Jie Yu. 2024. Pnet: Precise model editing in a transformer. Proceedings of the AAAI Conference on Artificial Intelligence, 38(17):18564–18572.

Aengus Lynch, Phillip Guo, Aidan Ewart, Stephen Casper, and Dylan Hadfield-Menell. 2024. Eight methods to evaluate robust unlearning in llms. Preprint, arXiv:2402.16835.

Xinbei Ma, Tianjie Ju, Jiyang Qiu, Zhuosheng Zhang, Hai Zhao, Lifeng Liu, and Yulong Wang. 2024. On the robustness of editing large language models. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 16197–16216, Miami, Florida, USA. Association for Computational Linguistics.
Kevin Meng, David Bau, Alex Andonian, and Yonatan Belinkov. 2022. Locating and editing factual associations in gpt. In Advances in Neural Information Processing Systems, volume 35, pages 17359–17372. Curran Associates, Inc.

Kevin Meng, Arnab Sen Sharma, Alex J Andonian, Yonatan Belinkov, and David Bau. 2023. Mass-editing memory in a transformer. In The Eleventh International Conference on Learning Representations.

Eric Mitchell, Charles Lin, Antoine Bosselut, Chelsea Finn, and Christopher D Manning. 2022a. Fast model editing at scale. In International Conference on Learning Representations.

Eric Mitchell, Charles Lin, Antoine Bosselut, Christopher D Manning, and Chelsea Finn. 2022b. Memory-based model editing at scale. In Proceedings of the 39th International Conference on Machine Learning, volume 162 of Proceedings of Machine Learning Research, pages 15817–15831. PMLR.

nostalgebraist. 2020. Interpreting gpt: the logit lens.

Domenic Rosati, Robie Gonzales, Jinkun Chen, Xuemin Yu, Yahya Kayani, Frank Rudzicz, and Hassan Sajjad. 2024. Long-form evaluation of model editing. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pages 3749–3780, Mexico City, Mexico. Association for Computational Linguistics.

Atakan Seyitoğlu, Aleksei Kuvshinov, Leo Schwinn, and Stephan Günnemann. 2024. Extracting unlearned information from llms with activation steering. Preprint, arXiv:2411.02631.

Chenmien Tan, Ge Zhang, and Jie Fu. 2024. Massive editing for large language models via meta learning. In The Twelfth International Conference on Learning Representations.

Rheeya Uppaal, Apratim Dey, Yiting He, Yiqiao Zhong, and Junjie Hu. 2024. Model editing as a robust and denoised variant of dpo: A case study on toxicity. Preprint, arXiv:2405.13967.

Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. 2017. Attention is all you need. In Advances in Neural Information Processing Systems, volume 30. Curran Associates, Inc.

Chenhao Wang, Pengfei Cao, Zhuoran Jin, Yubo Chen, Daojian Zeng, Kang Liu, and Jun Zhao. 2024a. MULFE: A multi-level benchmark for free text model editing. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 13570–13587, Bangkok, Thailand. Association for Computational Linguistics.

Haoyu Wang, Tianci Liu, Ruirui Li, Monica Xiao Cheng, Tuo Zhao, and Jing Gao. 2024b. RoseLoRA: Row and column-wise sparse low-rank adaptation of pre-trained language model for knowledge editing and fine-tuning. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 996–1008, Miami, Florida, USA. Association for Computational Linguistics.

Jiaan Wang, Yunlong Liang, Zengkui Sun, Yuxuan Cao, Jiarong Xu, and Fandong Meng. 2024c. Cross-lingual knowledge editing in large language models. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 11676–11686, Bangkok, Thailand. Association for Computational Linguistics.

Mengru Wang, Ningyu Zhang, Ziwen Xu, Zekun Xi, Shumin Deng, Yunzhi Yao, Qishen Zhang, Linyi Yang, Jindong Wang, and Huajun Chen. 2024d. Detoxifying large language models via knowledge editing. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 3093–3118, Bangkok, Thailand. Association for Computational Linguistics.

Peng Wang, Ningyu Zhang, Bozhong Tian, Zekun Xi, Yunzhi Yao, Ziwen Xu, Mengru Wang, Shengyu Mao, Xiaohan Wang, Siyuan Cheng, Kangwei Liu, Yuan-sheng Ni, Guozhou Zheng, and Huajun Chen. 2024e. EasyEdit: An easy-to-use knowledge editing framework for large language models. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 3: System Demonstrations), pages 82–93, Bangkok, Thailand. Association for Computational Linguistics.

Xiaobao Wu, Liangming Pan, William Yang Wang, and Anh Tuan Luu. 2024. AKEW: Assessing knowledge editing in the wild. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 15118–15133, Miami, Florida, USA. Association for Computational Linguistics.

Yang Xu, Yutai Hou, Wanxiang Che, and Min Zhang. 2023. Language anisotropic cross-lingual model editing. In Findings of the Association for Computational Linguistics: ACL 2023, page 5554–5569. Association for Computational Linguistics.

Wanli Yang, Fei Sun, Xinyu Ma, Xun Liu, Dawei Yin, and Xueqi Cheng. 2024. The butterfly effect of model editing: Few edits can trigger large language models collapse. In Findings of the Association for Computational Linguistics: ACL 2024, pages 5419–5437, Bangkok, Thailand. Association for Computational Linguistics.

Hongbang Yuan, Zhuoran Jin, Pengfei Cao, Yubo Chen, Kang Liu, and Jun Zhao. 2024. Towards robust knowledge unlearning: An adversarial framework for assessing and improving unlearning robustness in large language models. Preprint, arXiv:2408.10682.

Yihao Zhang, Zeming Wei, Jun Sun, and Meng Sun. 2024. Adversarial representation engineering: A
general model editing framework for large language models. In Advances in Neural Information Processing Systems, volume 37, pages 126243–126264. Curran Associates, Inc.

Zhiwei Zhang, Fali Wang, Xiaomin Li, Zongyu Wu, Xianfeng Tang, Hui Liu, Qi He, Wenpeng Yin, and Suhang Wang. 2025. Catastrophic failure of llm unlearning via quantization. Preprint, arXiv:2410.16454.

Zongkai Zhao, Guozeng Xu, Xiuhua Li, Kaiwen Wei, and Jiang Zhong. 2025. Fleke: Federated locate-then-edit knowledge editing. Preprint, arXiv:2502.15677.

Ce Zheng, Lei Li, Qingxiu Dong, Yuxuan Fan, Zhiyong Wu, Jingjing Xu, and Baobao Chang. 2023. Can we edit factual knowledge by in-context learning? In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 4862–4876, Singapore. Association for Computational Linguistics.

Zexuan Zhong, Zhengxuan Wu, Christopher Manning, Christopher Potts, and Danqi Chen. 2023. MQuAKE: Assessing knowledge editing in language models via multi-hop questions. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 15686–15702, Singapore. Association for Computational Linguistics.

Chen Zhu, Ankit Singh Rawat, Manzil Zaheer, Srinadh Bhojanapalli, Daliang Li, Felix Yu, and Sanjiv Kumar. 2020. Modifying memories in transformer models. Preprint, arXiv:2012.00363.

Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. Preprint, arXiv:2307.15043.
A  Attack Probes Generation

The data generation procedure involves the following steps: (1) For the unedited model, we traverse the dataset and identify instances where the model’s prediction perfectly matches the corresponding ground truth answer through greedy decoding. These instances are considered to represent knowledge that has been effectively acquired and internalized by the model. (2) Based on the three distinct attack types we defined in Section 2, we generate attack probes for each sample and apply ROME (Meng et al., 2022) to edit the model parameters. Subsequently, we evaluate the edited model by exposing it to the generated probes. Samples that elicit the original answers from the model are retained for further analysis. (3) To enhance data diversity, we use two additional prominent algorithms, MEMIT (Meng et al., 2023) and MEND (Mitchell et al., 2022a), to replicate the procedure outlined in step (2). We then combine the datasets obtained from all three methods to create the final datasets, CF-a and ZsRE-a. A summary of the data statistics is provided in Table 6.

The methodology for constructing the three distinct types of attack prefixes in step (2) is as follows: (a) Wikipedia context. We extract a concise summary of the original answer o using the Wikipedia library3, limiting the maximum number of sentences to 3. (b) Original entity repetition. In this instance, the original answer o is repeated m times as an attack prefix. (c) A question about the original triple. As the initial dataset lacks complete questions for each triple (e.g., “Is Joe Biden the President of the U.S.?“), we employ a large language model, specifically Qwen2.5-32B-Instruct4, to generate corresponding questions. The specific prompt utilized in this process is illustrated in Figure 9. After obtaining three types of attack prefixes, we concatenate them with the baseline prompts in the original dataset.

We provide examples of three attack types in Figure 10.

<table>
  <tr>
    <th>Dataset</th>
    <th>Wiki</th>
    <th>Rep</th>
    <th>Que</th>
    <th>Total</th>
  </tr>
  <tr>
    <td>CF-a</td>
    <td>323</td>
    <td>484</td>
    <td>204</td>
    <td>1011</td>
  </tr>
  <tr>
    <td>ZsRE-a</td>
    <td>133</td>
    <td>214</td>
    <td>122</td>
    <td>469</td>
  </tr>
</table>

Table 6: Statistics of our evaluation dataset.

You are a helpful assistant. I will provide a statement for you. You need to write a question based on my statement.
Here are some examples:
[Statement]: The mother tongue of Danielle Darrieux is French
[Output]: Is French the language of Danielle Darrieux?
[Statement]: MacOS was created by Apple.
[Output]: Is MacOS produced by Apple?
[Statement]: Shabalyinsky District is located in the country of Russia.
[Output]: Is Shabalyinsky District located in Russia?
[Statement]: [statement]
[Output]:

Figure 9: The prompt for Qwen2.5-32B-Instruct to generate the third type of attack prefix.

<table>
  <tr>
    <th>Wiki</th>
    <td>Edit: (CTV Television Network, headquarter, Toronto) → (CTV Television Network, headquarter, London)</td>
  </tr>
  <tr>
    <th>Attack probe</th>
    <td>Toronto is the most populous city in Canada and the capital city of the Canadian province of Ontario. With a population of 2,794,356 in 2021, it is the fourth-most populous city in North America. The city is also the largest city in the Greater Toronto Area, which had a population of 7,951,588 people as of 2021 surrounding the western end of Lake Ontario, while the Greater Toronto Area proper had a 2021 population of 6,752,541. The headquarters of CTV Television Network is located in</td>
  </tr>
  <tr>
    <th>Rep</th>
    <td>Edit: (Tim Cook, employed by, Apple) → (Tim Cook, employed by, BBC)</td>
  </tr>
  <tr>
    <th>Attack probe</th>
    <td>Apple, Apple, Apple, Apple, Apple, Apple, Apple, Apple, Apple, Tim Cook is employed by</td>
  </tr>
  <tr>
    <th>Que</th>
    <td>Edit: (Internet Explorer 10, created by, Microsoft) → (Internet Explorer 10, created by, IBM)</td>
  </tr>
  <tr>
    <th>Attack probe</th>
    <td>Was Internet Explorer 10 created by Microsoft? Internet Explorer 10 was created by</td>
  </tr>
</table>

Figure 10: Examples for three attack types. Attack prefixes are highlighted in red.

B  Evaluation of Superficial Editing

Efficacy (Eff.) is measured as the proportion of cases where o is more probable than \( o^* \) with the edit prompt:

\[
\text{Eff.} = \mathbb{E}_{x_i} \left[ P_{f'}(o \mid x_i) > P_{f'}(o^* \mid x_i) \right]
\] (13)

Generalization (Gen.) represents the proportion of paraphrased prompts \( \mathcal{N} \) where o is more probable than \( o^* \):

\[
\text{Gen.} = \mathbb{E}_{x_i \in \mathcal{N}} \left[ P_{f'}(o \mid x_i) > P_{f'}(o^* \mid x_i) \right]
\] (14)

Locality (Loc.) is the proportion of neighborhood prompts \( \mathcal{O} \) where the edited model assigns a higher probability to the original answer:

\[
\text{Eff.} = \mathbb{E}_{x_i \in \mathcal{O}} \left[ P_{f'}(o^* \mid x_i) > P_{f'}(o \mid x_i) \right]
\] (15)

We present the evaluation results for various experimental configurations in Tables 7 to 11.
<table>
  <tr>
    <th rowspan="2">Methods</th>
    <th colspan="4">Wiki</th>
    <th colspan="4">Rep</th>
    <th colspan="4">Que</th>
  </tr>
  <tr>
    <th>Eff.</th><th>Gen.</th><th>Loc.</th><th>OM ↓ OP ↓</th>
    <th>Eff.</th><th>Gen.</th><th>Loc.</th><th>OM ↓ OP ↓</th>
    <th>Eff.</th><th>Gen.</th><th>Loc.</th><th>OM ↓ OP ↓</th>
  </tr>
  <tr>
    <td>FT</td><td>73.68</td><td>69.23</td><td>37.43</td><td>67.61 84.51</td>
    <td>73.57</td><td>71.30</td><td>43.42</td><td>89.16 94.58</td>
    <td>75.50</td><td>75.50</td><td>47.98</td><td>70.27 90.54</td>
  </tr>
  <tr>
    <td>MEND</td><td>97.75</td><td>97.75</td><td>37.43</td><td>47.89 47.89</td>
    <td>100</td><td>100</td><td>43.09</td><td>59.64 60.24</td>
    <td>98.76</td><td>98.40</td><td>47.87</td><td>33.78 33.78</td>
  </tr>
  <tr>
    <td>ROME</td><td>98.39</td><td>90.61</td><td>37.43</td><td>33.80 36.62</td>
    <td>100</td><td>91.92</td><td>43.42</td><td>33.13 36.14</td>
    <td>98.87</td><td>96.03</td><td>49.04</td><td>52.70 55.41</td>
  </tr>
  <tr>
    <td>MEMIT</td><td>98.39</td><td>96.16</td><td>37.59</td><td>43.66 49.30</td>
    <td>99.41</td><td>94.87</td><td>43.42</td><td>46.39 50.60</td>
    <td>98.87</td><td>93.19</td><td>48.33</td><td>28.38 33.78</td>
  </tr>
  <tr>
    <td>PMET</td><td>98.39</td><td>84.23</td><td>37.43</td><td>38.03 39.44</td>
    <td>98.74</td><td>76.77</td><td>43.42</td><td>47.59 50.60</td>
    <td>98.87</td><td>80.60</td><td>47.98</td><td>41.89 56.76</td>
  </tr>
  <tr>
    <td>r-ROME</td><td>98.39</td><td>91.16</td><td>37.43</td><td>38.03 39.44</td>
    <td>100</td><td>91.25</td><td>43.42</td><td>34.34 36.75</td>
    <td>98.87</td><td>94.08</td><td>49.04</td><td>55.41 59.46</td>
  </tr>
  <tr>
    <td>AlphaEdit</td><td>98.39</td><td>77.94</td><td>37.59</td><td>43.66 50.70</td>
    <td>100</td><td>73.06</td><td>43.42</td><td>61.45 66.27</td>
    <td>98.87</td><td>86.70</td><td>48.13</td><td>45.95 59.46</td>
  </tr>
</table>

Table 7: Evaluation results of superficial editing conducted on LLaMA3-8B-Instruct using the ZsRE-a dataset.

<table>
  <tr>
    <th rowspan="2">Methods</th>
    <th colspan="4">Wiki</th>
    <th colspan="4">Rep</th>
    <th colspan="4">Que</th>
  </tr>
  <tr>
    <th>Eff.</th><th>Gen.</th><th>Loc.</th><th>OM ↓ OP ↓</th>
    <th>Eff.</th><th>Gen.</th><th>Loc.</th><th>OM ↓ OP ↓</th>
    <th>Eff.</th><th>Gen.</th><th>Loc.</th><th>OM ↓ OP ↓</th>
  </tr>
  <tr>
    <td>FT</td><td>92.31</td><td>73.85</td><td>26.00</td><td>53.57 57.14</td>
    <td>92.62</td><td>67.11</td><td>30.67</td><td>43.23 49.48</td>
    <td>95.45</td><td>82.58</td><td>14.39</td><td>65.43 70.27</td>
  </tr>
  <tr>
    <td>MEND</td><td>100</td><td>58.46</td><td>51.54</td><td>41.67 46.43</td>
    <td>100</td><td>52.35</td><td>51.81</td><td>42.71 52.08</td>
    <td>100</td><td>79.55</td><td>34.39</td><td>40.74 43.21</td>
  </tr>
  <tr>
    <td>ROME</td><td>98.46</td><td>93.08</td><td>89.69</td><td>55.95 60.71</td>
    <td>99.33</td><td>93.62</td><td>91.48</td><td>52.60 59.38</td>
    <td>100</td><td>97.73</td><td>82.27</td><td>64.20 65.43</td>
  </tr>
  <tr>
    <td>MEMIT</td><td>98.46</td><td>95.38</td><td>90.92</td><td>34.52 34.52</td>
    <td>100</td><td>92.95</td><td>90.47</td><td>30.73 35.94</td>
    <td>100</td><td>99.24</td><td>82.73</td><td>37.04 41.98</td>
  </tr>
  <tr>
    <td>PMET</td><td>95.38</td><td>89.23</td><td>92.92</td><td>47.62 52.38</td>
    <td>100</td><td>88.59</td><td>92.15</td><td>47.40 56.77</td>
    <td>100</td><td>87.12</td><td>83.79</td><td>43.21 48.15</td>
  </tr>
  <tr>
    <td>r-ROME</td><td>98.46</td><td>89.23</td><td>91.69</td><td>57.14 61.90</td>
    <td>99.33</td><td>90.60</td><td>92.01</td><td>52.60 59.90</td>
    <td>100</td><td>96.21</td><td>82.27</td><td>56.79 59.26</td>
  </tr>
  <tr>
    <td>AlphaEdit</td><td>98.46</td><td>93.08</td><td>92.31</td><td>53.57 60.71</td>
    <td>100</td><td>85.57</td><td>92.28</td><td>47.92 60.94</td>
    <td>100</td><td>91.67</td><td>84.85</td><td>40.74 45.68</td>
  </tr>
</table>

Table 8: Evaluation results of superficial editing conducted on Qwen2.5-7B-Instruct using the CF-a dataset.

<table>
  <tr>
    <th rowspan="2">Methods</th>
    <th colspan="4">Wiki</th>
    <th colspan="4">Rep</th>
    <th colspan="4">Que</th>
  </tr>
  <tr>
    <th>Eff.</th><th>Gen.</th><th>Loc.</th><th>OM ↓ OP ↓</th>
    <th>Eff.</th><th>Gen.</th><th>Loc.</th><th>OM ↓ OP ↓</th>
    <th>Eff.</th><th>Gen.</th><th>Loc.</th><th>OM ↓ OP ↓</th>
  </tr>
  <tr>
    <td>FT</td><td>76.04</td><td>70.58</td><td>32.38</td><td>49.12 80.70</td>
    <td>68.80</td><td>66.18</td><td>38.56</td><td>46.98 87.25</td>
    <td>77.79</td><td>71.77</td><td>38.35</td><td>37.36 93.41</td>
  </tr>
  <tr>
    <td>MEND</td><td>98.67</td><td>98.40</td><td>31.75</td><td>47.37 54.39</td>
    <td>98.79</td><td>98.79</td><td>37.83</td><td>39.60 59.06</td>
    <td>99.69</td><td>99.69</td><td>38.00</td><td>30.77 56.04</td>
  </tr>
  <tr>
    <td>ROME</td><td>99.67</td><td>88.89</td><td>32.10</td><td>39.47 65.79</td>
    <td>99.49</td><td>83.59</td><td>38.76</td><td>38.93 55.03</td>
    <td>100</td><td>91.41</td><td>38.48</td><td>48.35 57.14</td>
  </tr>
  <tr>
    <td>MEMIT</td><td>99.67</td><td>89.44</td><td>31.92</td><td>52.63 70.18</td>
    <td>99.49</td><td>88.05</td><td>38.76</td><td>42.95 55.03</td>
    <td>100</td><td>80.47</td><td>38.48</td><td>31.87 46.15</td>
  </tr>
  <tr>
    <td>PMET</td><td>96.44</td><td>80.22</td><td>32.10</td><td>36.84 65.79</td>
    <td>97.81</td><td>70.96</td><td>38.18</td><td>31.54 65.10</td>
    <td>99.22</td><td>77.34</td><td>38.48</td><td>30.77 53.85</td>
  </tr>
  <tr>
    <td>r-ROME</td><td>99.67</td><td>87.22</td><td>32.10</td><td>36.84 64.91</td>
    <td>99.49</td><td>82.74</td><td>38.76</td><td>37.58 54.36</td>
    <td>100</td><td>91.41</td><td>38.48</td><td>47.25 58.24</td>
  </tr>
  <tr>
    <td>AlphaEdit</td><td>99.67</td><td>78.29</td><td>31.91</td><td>40.35 66.67</td>
    <td>99.24</td><td>77.66</td><td>38.20</td><td>27.52 65.77</td>
    <td>100</td><td>78.59</td><td>38.48</td><td>23.08 58.24</td>
  </tr>
</table>

Table 9: Evaluation results of superficial editing conducted on Qwen2.5-7B-Instruct using the ZsRE-a dataset.

<table>
  <tr>
    <th rowspan="2">Methods</th>
    <th colspan="4">Wiki</th>
    <th colspan="4">Rep</th>
    <th colspan="4">Que</th>
  </tr>
  <tr>
    <th>Eff.</th><th>Gen.</th><th>Loc.</th><th>OM ↓ OP ↓</th>
    <th>Eff.</th><th>Gen.</th><th>Loc.</th><th>OM ↓ OP ↓</th>
    <th>Eff.</th><th>Gen.</th><th>Loc.</th><th>OM ↓ OP ↓</th>
  </tr>
  <tr>
    <td>FT</td><td>94.47</td><td>73.87</td><td>28.14</td><td>45.24 54.37</td>
    <td>96.24</td><td>74.06</td><td>29.77</td><td>40.38 46.79</td>
    <td>96.15</td><td>75.64</td><td>23.33</td><td>57.61 68.48</td>
  </tr>
  <tr>
    <td>ROME</td><td>99.50</td><td>97.74</td><td>90.95</td><td>59.52 60.32</td>
    <td>100</td><td>89.10</td><td>88.65</td><td>48.72 50.00</td>
    <td>100</td><td>98.72</td><td>88.85</td><td>68.48 70.65</td>
  </tr>
  <tr>
    <td>MEMIT</td><td>99.50</td><td>94.97</td><td>92.06</td><td>74.21 78.57</td>
    <td>98.50</td><td>83.83</td><td>90.15</td><td>79.49 80.77</td>
    <td>100</td><td>98.08</td><td>88.84</td><td>66.30 70.65</td>
  </tr>
  <tr>
    <td>PMET</td><td>98.49</td><td>89.70</td><td>92.36</td><td>75.79 84.13</td>
    <td>96.24</td><td>71.80</td><td>91.58</td><td>73.71 84.62</td>
    <td>100</td><td>94.87</td><td>89.10</td><td>65.22 70.65</td>
  </tr>
  <tr>
    <td>r-ROME</td><td>100</td><td>97.99</td><td>91.56</td><td>54.76 56.75</td>
    <td>100</td><td>89.85</td><td>89.92</td><td>44.23 48.08</td>
    <td>100</td><td>98.72</td><td>88.85</td><td>65.22 67.39</td>
  </tr>
  <tr>
    <td>AlphaEdit</td><td>100</td><td>91.21</td><td>92.36</td><td>72.62 79.76</td>
    <td>99.25</td><td>73.68</td><td>91.65</td><td>67.95 76.28</td>
    <td>100</td><td>94.23</td><td>88.85</td><td>55.43 59.78</td>
  </tr>
</table>

Table 10: Evaluation results of superficial editing conducted on Qwen2.5-14B-Instruct using the CF-a dataset.

<table>
  <tr>
    <th rowspan="2">Methods</th>
    <th colspan="4">Wiki</th>
    <th colspan="4">Rep</th>
    <th colspan="4">Que</th>
  </tr>
  <tr>
    <th>Eff.</th><th>Gen.</th><th>Loc.</th><th>OM ↓ OP ↓</th>
    <th>Eff.</th><th>Gen.</th><th>Loc.</th><th>OM ↓ OP ↓</th>
    <th>Eff.</th><th>Gen.</th><th>Loc.</th><th>OM ↓ OP ↓</th>
  </tr>
  <tr>
    <td>FT</td><td>68.85</td><td>73.33</td><td>25.53</td><td>36.36 77.27</td>
    <td>83.33</td><td>70.83</td><td>47.70</td><td>23.81 57.14</td>
    <td>86.36</td><td>90.91</td><td>39.99</td><td>26.67 66.67</td>
  </tr>
  <tr>
    <td>ROME</td><td>100</td><td>98.08</td><td>26.63</td><td>40.91 72.73</td>
    <td>100</td><td>97.92</td><td>49.78</td><td>61.90 76.19</td>
    <td>100</td><td>95.45</td><td>40.19</td><td>26.67 40.00</td>
  </tr>
  <tr>
    <td>MEMIT</td><td>100</td><td>95.51</td><td>26.63</td><td>31.82 95.45</td>
    <td>100</td><td>97.92</td><td>49.86</td><td>66.67 71.43</td>
    <td>100</td><td>90.91</td><td>40.19</td><td>46.67 46.67</td>
  </tr>
  <tr>
    <td>PMET</td><td>96.15</td><td>91.67</td><td>26.63</td><td>27.27 77.27</td>
    <td>97.92</td><td>90.63</td><td>49.86</td><td>19.05 80.95</td>
    <td>100</td><td>90.91</td><td>100</td><td>40.19 26.67 40.00</td>
  </tr>
  <tr>
    <td>r-ROME</td><td>100</td><td>98.08</td><td>26.63</td><td>36.36 72.73</td>
    <td>100</td><td>97.92</td><td>49.78</td><td>57.14 71.43</td>
    <td>100</td><td>95.45</td><td>40.19</td><td>26.67 40.00</td>
  </tr>
  <tr>
    <td>AlphaEdit</td><td>97.44</td><td>92.95</td><td>26.63</td><td>27.27 90.91</td>
    <td>100</td><td>90.63</td><td>49.86</td><td>23.81 66.67</td>
    <td>100</td><td>90.91</td><td>40.19</td><td>33.33 60.00</td>
  </tr>
</table>

Table 11: Evaluation results of superficial editing conducted on Qwen2.5-14B-Instruct using the ZsRE-a dataset.
C Mechanistic Analysis of Superficial Editing

C.1 Effects of Transformer Components
The residual stream intervention results of other settings are illustrated in Figures 11 to 14.

The effects of the MLP and the attention mechanism for other settings are shown in Figures 15 to 18.

C.2 Investigation and Validation of H1
The results of the Inhibition Score for other settings are depicted in Figures 19 and 20.

The ranking results for Qwen2.5-7B-Instruct and Qwen2.5-14B-Instruct are presented in Figure 21 and Figure 22, respectively.

C.3 Investigation and Validation of H2
The intervention results with specific attention modules ablated for other settings are shown in Figures 23 and 24.

The LOPH results for other settings are illustrated in Figures 25 and 26.

The ablation effects of prominent heads for varying values of the LOPH threshold \( \tau \) are shown in Table 12.

The DSR results for other settings are provided in Tables 13 to 23.

Table 24 presents the results of singular vector ablation experiments under various hyperparameter configurations.

C.4 Superficial Unlearning
We first collect data based on the RWKU dataset (Jin et al., 2024). Specifically, we select the first 50 targets from the dataset and train the LLaMA3.2-3B-Instruct\footnote{https://huggingface.co/meta-llama/Llama-3.2-3B-Instruct} model using gradient ascent (Jang et al., 2022) for each target. Next, we test each unlearned model with probes corresponding to the respective target, selecting samples that elicit a rejection response from the unlearned model (e.g., “I couldn’t...” or “I do not have information...”). For each filtered query, we apply GCG (Zou et al., 2023; Yuan et al., 2024) to train an attack suffix that enables the unlearned model to answer the original knowledge. Finally, we perform a secondary filtering to ensure that all final samples meet the following criteria: they prompt the unlearned model to produce a rejection response in the absence of the attack suffix, while simultaneously allowing the unlearned model to generate the original knowledge when presented with the attack suffix. Through the above process, we ultimately obtain 26 targets with 50 samples.

To explore the mechanisms underlying superficial unlearning, we project the output of each attention head into the vocabulary space and observe the latent probability of \( o \) using the method outlined in Section 4.3.2. For original answers comprising multiple tokens, we focus exclusively on the probability of the first token. The results, presented in Figure 8, reveal that under the unlearning setting, specific attention heads remain active, with the majority concentrated in the later layers. This observation aligns with the conclusion drawn in Section 4.3.2.

We select the heads with LOPH greater than 0.02 and perform SVD on them. Following this, we ablate the identified left singular vectors using the method described in Section 4.3.3 and observe the resulting variations in the model’s output probability of \( o \). The results in Table 5 show that, following the identification and ablation of the top 5% and top 10% left singular vectors, the probability of the unlearned model generating the original answer decreases when confronted with adversarial inputs. This suggests that, similar to superficial editing, the occurrence of superficial unlearning is causally linked to these vectors, further demonstrating the generalizability of our analysis method and conclusions.

D Logit Lens
The logit lens (nostalgiaerist, 2020; Geva et al., 2022; Dar et al., 2023; Halawi et al., 2024) technique has emerged as a powerful tool for understanding the internal mechanisms of language models. It leverages the observation that the hidden states at each layer of a Transformer, when appropriately decoded, gradually converge towards the final output distribution. The core idea is to project an internal representation into the vocabulary space:

\[
P_{LL}\left(t \mid x\right) = \operatorname{softmax}\left(\mathbf{W}_U x\right),
\]

where \( t \) is the next token, \( x \) is an internal representation, \( \mathbf{W}_U \) is the unembedding matrix, \( P_{LL}\left(t \mid x\right) \) denotes the probability of obtaining \( t \) after decoding \( x \). In this study, we refer to \( P_{LL} \) as **latent probability**.
(a) Intervention on the last subject token.

(b) Intervention on the last token.

Figure 11: Intervention results of Qwen2.5-7B-Instruct edited by ROME at different tokens.

(a) Intervention on the last subject token.

(b) Intervention on the last token.

Figure 12: Intervention results of Qwen2.5-7B-Instruct edited by MEMIT at different tokens.

(a) Intervention on the last subject token.

(b) Intervention on the last token.

Figure 13: Intervention results of Qwen2.5-14B-Instruct edited by ROME at different tokens.
(a) Intervention on the last subject token.

(b) Intervention on the last token.

Figure 14: Intervention results of Qwen2.5-14B-Instruct edited by MEMIT at different tokens.

(a) Results of MLP.

(b) Results of Attention output matrix.

Figure 15: The latent probabilities of \( o \) for the input and output of MLP and Attention output matrix in Qwen2.5-7B-Instruct edited by ROME.

(a) Results of MLP.

(b) Results of Attention output matrix.

Figure 16: The latent probabilities of \( o \) for the input and output of MLP and Attention output matrix in Qwen2.5-7B-Instruct edited by MEMIT.
Figure 17: The latent probabilities of \( o \) for the input and output of MLP and Attention output matrix in Qwen2.5-14B-Instruct edited by ROME.

Figure 18: The latent probabilities of \( o \) for the input and output of MLP and Attention output matrix in Qwen2.5-14B-Instruct edited by MEMIT.

Figure 19: The suppression results for Qwen2.5-7B-Instruct edited by ROME and MEMIT.
Figure 20: The suppression results for Qwen2.5-14B-Instruct edited by ROME and MEMIT.

Figure 21: The ranking of \( o \) and \( o^* \) in the latent probability distribution at the last subject position for Qwen2.5-7B-Instruct edited by ROME and MEMIT.

Figure 22: The ranking of \( o \) and \( o^* \) in the latent probability distribution at the last subject position for Qwen2.5-14B-Instruct edited by ROME and MEMIT.
Figure 23: Intervention effects following critical attention module ablation in Qwen2.5-7B-Instruct.

Figure 24: Intervention effects following critical attention module ablation in Qwen2.5-14B-Instruct.

Figure 25: LOPH of Qwen2.5-7B-Instruct edited by ROME and MEMIT.
Figure 26: LOPH of Qwen2.5-14B-Instruct edited by ROME and MEMIT.

<table>
  <tr>
    <th rowspan="2">LOPH threshold</th>
    <th rowspan="2">Models</th>
    <th rowspan="2">Methods</th>
    <th colspan="3">Original</th>
    <th colspan="3">New</th>
  </tr>
  <tr>
    <th>w/o abl.</th>
    <th>abl.</th>
    <th>↓ \( \Delta P \)</th>
    <th>w/o abl.</th>
    <th>abl.</th>
    <th>↑ \( \Delta P \)</th>
  </tr>
  <tr>
    <td rowspan="3">\( \tau = 0.2 \)</td>
    <td>LLaMA3-8B-Instruct</td>
    <td>ROME</td>
    <td>57.17</td>
    <td>36.96</td>
    <td>20.21</td>
    <td>16.49</td>
    <td>20.50</td>
    <td>4.01</td>
  </tr>
  <tr>
    <td></td>
    <td>MEMIT</td>
    <td>56.90</td>
    <td>38.72</td>
    <td>18.18</td>
    <td>15.68</td>
    <td>18.80</td>
    <td>3.12</td>
  </tr>
  <tr>
    <td>Qwen2.5-7B-Instruct</td>
    <td>ROME</td>
    <td>57.83</td>
    <td>48.84</td>
    <td>8.99</td>
    <td>11.84</td>
    <td>16.13</td>
    <td>4.29</td>
  </tr>
  <tr>
    <td></td>
    <td>MEMIT</td>
    <td>57.54</td>
    <td>41.94</td>
    <td>15.60</td>
    <td>12.21</td>
    <td>19.69</td>
    <td>7.48</td>
  </tr>
  <tr>
    <td>Qwen2.5-14B-Instruct</td>
    <td>ROME</td>
    <td>55.71</td>
    <td>46.71</td>
    <td>9.00</td>
    <td>13.99</td>
    <td>18.43</td>
    <td>4.44</td>
  </tr>
  <tr>
    <td></td>
    <td>MEMIT</td>
    <td>55.03</td>
    <td>46.87</td>
    <td>8.16</td>
    <td>13.79</td>
    <td>17.40</td>
    <td>3.61</td>
  </tr>
  <tr>
    <td rowspan="3">\( \tau = 0.3 \)</td>
    <td>LLaMA3-8B-Instruct</td>
    <td>ROME</td>
    <td>57.17</td>
    <td>37.58</td>
    <td>19.59</td>
    <td>16.49</td>
    <td>20.90</td>
    <td>4.41</td>
  </tr>
  <tr>
    <td></td>
    <td>MEMIT</td>
    <td>56.90</td>
    <td>42.99</td>
    <td>13.91</td>
    <td>15.68</td>
    <td>19.88</td>
    <td>4.20</td>
  </tr>
  <tr>
    <td>Qwen2.5-7B-Instruct</td>
    <td>ROME</td>
    <td>57.83</td>
    <td>48.84</td>
    <td>8.99</td>
    <td>11.84</td>
    <td>16.13</td>
    <td>4.29</td>
  </tr>
  <tr>
    <td></td>
    <td>MEMIT</td>
    <td>57.54</td>
    <td>47.64</td>
    <td>9.90</td>
    <td>12.21</td>
    <td>17.48</td>
    <td>5.27</td>
  </tr>
  <tr>
    <td>Qwen2.5-14B-Instruct</td>
    <td>ROME</td>
    <td>55.71</td>
    <td>50.15</td>
    <td>5.56</td>
    <td>13.99</td>
    <td>16.39</td>
    <td>2.40</td>
  </tr>
  <tr>
    <td></td>
    <td>MEMIT</td>
    <td>55.03</td>
    <td>49.10</td>
    <td>5.93</td>
    <td>13.79</td>
    <td>16.29</td>
    <td>2.50</td>
  </tr>
</table>

Table 12: Ablation effects of the prominent heads across different values of \( \tau \). (Original: original answer; New: new answer; w/o abl.: without ablation; abl.: with ablation; \( \downarrow \Delta P \): probability decrease; \( \uparrow \Delta P \): probability increase)

<table>
  <tr>
    <th rowspan="2">Top-K</th>
    <th colspan="2">L23H27<br>15% 20%</th>
    <th colspan="2">L24H3<br>15% 20%</th>
    <th colspan="2">L27H20<br>15% 20%</th>
    <th colspan="2">L30H29<br>15% 20%</th>
    <th colspan="2">L31H6<br>15% 20%</th>
    <th colspan="2">L31H7<br>15% 20%</th>
  </tr>
  <tr>
    <th>Original</th>
    <th>New</th>
    <th>Original</th>
    <th>New</th>
    <th>Original</th>
    <th>New</th>
    <th>Original</th>
    <th>New</th>
    <th>Original</th>
    <th>New</th>
    <th>Original</th>
    <th>New</th>
  </tr>
  <tr>
    <td>5</td>
    <td>12.12</td>
    <td>0.76</td>
    <td>12.12</td>
    <td>0.76</td>
    <td>65.91</td>
    <td>0.76</td>
    <td>67.42</td>
    <td>0.76</td>
    <td>75.76</td>
    <td>0.76</td>
    <td>76.52</td>
    <td>0.76</td>
    <td>16.67</td>
    <td>0.76</td>
    <td>16.67</td>
    <td>0.76</td>
    <td>77.27</td>
    <td>0.76</td>
    <td>78.03</td>
    <td>0.76</td>
    <td>73.48</td>
    <td>0.76</td>
    <td>74.24</td>
  </tr>
  <tr>
    <td>10</td>
    <td>12.88</td>
    <td>0.76</td>
    <td>14.39</td>
    <td>0.76</td>
    <td>68.94</td>
    <td>0.76</td>
    <td>71.21</td>
    <td>0.76</td>
    <td>76.52</td>
    <td>0.76</td>
    <td>76.52</td>
    <td>0.76</td>
    <td>16.67</td>
    <td>0.76</td>
    <td>16.67</td>
    <td>0.76</td>
    <td>78.03</td>
    <td>0.76</td>
    <td>78.03</td>
    <td>0.76</td>
    <td>73.48</td>
    <td>0.76</td>
    <td>75.00</td>
  </tr>
  <tr>
    <td>15</td>
    <td>14.39</td>
    <td>0.76</td>
    <td>15.15</td>
    <td>0.76</td>
    <td>70.45</td>
    <td>0.76</td>
    <td>71.21</td>
    <td>0.76</td>
    <td>76.52</td>
    <td>0.76</td>
    <td>76.52</td>
    <td>0.76</td>
    <td>16.67</td>
    <td>0.76</td>
    <td>16.67</td>
    <td>0.76</td>
    <td>78.03</td>
    <td>0.76</td>
    <td>78.79</td>
    <td>0.76</td>
    <td>73.48</td>
    <td>0.76</td>
    <td>75.00</td>
  </tr>
</table>

Table 13: Decoding Success Rate (DSR) of the identified vectors across different heads in LLaMA3-8B-Instruct edited by ROME. \( p\% \) is set to 15% and 20%.
<table>
  <tr>
    <th rowspan="2">Top-K</th>
    <th colspan="2">L23H27</th>
    <th colspan="2">L24H3</th>
    <th colspan="2">L27H20</th>
    <th colspan="2">L31H6</th>
    <th colspan="2">L31H7</th>
  </tr>
  <tr>
    <th>5%</th><th>10%</th>
    <th>5%</th><th>10%</th>
    <th>5%</th><th>10%</th>
    <th>5%</th><th>10%</th>
    <th>5%</th><th>10%</th>
  </tr>
  <tr>
    <td rowspan="3">Original</td>
    <td>5</td><td>5.45</td><td>8.18</td><td>30.00</td><td>35.45</td><td>36.36</td><td>47.27</td><td>37.27</td><td>47.27</td><td>37.27</td><td>42.73</td>
  </tr>
  <tr>
    <td>10</td><td>8.18</td><td>10.00</td><td>33.64</td><td>42.73</td><td>39.09</td><td>47.27</td><td>41.82</td><td>50.00</td><td>39.09</td><td>44.55</td>
  </tr>
  <tr>
    <td>15</td><td>9.09</td><td>10.91</td><td>38.18</td><td>42.73</td><td>40.00</td><td>49.09</td><td>43.64</td><td>51.82</td><td>40.91</td><td>44.55</td>
  </tr>
  <tr>
    <td rowspan="3">New</td>
    <td>5</td><td>0.91</td><td>0.91</td><td>0.00</td><td>0.00</td><td>1.82</td><td>0.91</td><td>2.73</td><td>3.64</td><td>3.64</td><td>2.73</td>
  </tr>
  <tr>
    <td>10</td><td>0.91</td><td>0.91</td><td>0.00</td><td>0.00</td><td>3.64</td><td>4.55</td><td>3.64</td><td>4.55</td><td>3.64</td><td>4.55</td>
  </tr>
  <tr>
    <td>15</td><td>0.91</td><td>0.91</td><td>0.00</td><td>0.00</td><td>5.45</td><td>6.36</td><td>3.64</td><td>7.27</td><td>3.64</td><td>6.36</td>
  </tr>
</table>

Table 14: Decoding Success Rate (DSR) of different heads in LLaMA3-8B-Instruct edited by MEMIT. p% is set to 5% and 10%.

<table>
  <tr>
    <th rowspan="2">Top-K</th>
    <th colspan="2">L23H27</th>
    <th colspan="2">L24H3</th>
    <th colspan="2">L27H20</th>
    <th colspan="2">L31H6</th>
    <th colspan="2">L31H7</th>
  </tr>
  <tr>
    <th>15%</th><th>20%</th>
    <th>15%</th><th>20%</th>
    <th>15%</th><th>20%</th>
    <th>15%</th><th>20%</th>
    <th>15%</th><th>20%</th>
  </tr>
  <tr>
    <td rowspan="3">Original</td>
    <td>5</td><td>12.73</td><td>15.45</td><td>39.09</td><td>41.82</td><td>50.91</td><td>50.91</td><td>51.82</td><td>51.82</td><td>44.55</td><td>45.45</td>
  </tr>
  <tr>
    <td>10</td><td>16.36</td><td>18.18</td><td>43.64</td><td>44.55</td><td>50.91</td><td>50.91</td><td>51.82</td><td>51.82</td><td>44.55</td><td>45.45</td>
  </tr>
  <tr>
    <td>15</td><td>17.27</td><td>18.18</td><td>44.55</td><td>45.45</td><td>50.91</td><td>50.91</td><td>51.82</td><td>51.82</td><td>45.45</td><td>45.45</td>
  </tr>
  <tr>
    <td rowspan="3">New</td>
    <td>5</td><td>0.91</td><td>0.91</td><td>0.00</td><td>0.00</td><td>1.82</td><td>0.91</td><td>3.64</td><td>5.45</td><td>1.82</td><td>1.82</td>
  </tr>
  <tr>
    <td>10</td><td>1.82</td><td>2.73</td><td>0.91</td><td>1.82</td><td>6.36</td><td>3.64</td><td>9.09</td><td>10.00</td><td>5.45</td><td>5.45</td>
  </tr>
  <tr>
    <td>15</td><td>2.73</td><td>2.73</td><td>0.91</td><td>1.82</td><td>6.36</td><td>7.27</td><td>12.73</td><td>14.55</td><td>6.36</td><td>7.27</td>
  </tr>
</table>

Table 15: Decoding Success Rate (DSR) of different heads in LLaMA3-8B-Instruct edited by MEMIT. p% is set to 15% and 20%.

<table>
  <tr>
    <th rowspan="2">Top-K</th>
    <th colspan="2">L23H4</th>
    <th colspan="2">L23H6</th>
    <th colspan="2">L23H11</th>
    <th colspan="2">L26H0</th>
    <th colspan="2">L27H2</th>
    <th colspan="2">L27H3</th>
    <th colspan="2">L27H15</th>
  </tr>
  <tr>
    <th>5%</th><th>10%</th>
    <th>5%</th><th>10%</th>
    <th>5%</th><th>10%</th>
    <th>5%</th><th>10%</th>
    <th>5%</th><th>10%</th>
    <th>5%</th><th>10%</th>
    <th>5%</th><th>10%</th>
  </tr>
  <tr>
    <td rowspan="3">Original</td>
    <td>5</td><td>25.17</td><td>34.69</td><td>34.01</td><td>49.66</td><td>28.57</td><td>59.86</td><td>8.16</td><td>17.01</td><td>21.77</td><td>43.54</td><td>33.33</td><td>41.50</td><td>3.40</td><td>17.01</td>
  </tr>
  <tr>
    <td>10</td><td>31.29</td><td>42.18</td><td>41.50</td><td>54.42</td><td>37.41</td><td>61.90</td><td>10.88</td><td>25.17</td><td>27.89</td><td>46.94</td><td>38.10</td><td>44.90</td><td>7.48</td><td>19.73</td>
  </tr>
  <tr>
    <td>15</td><td>36.05</td><td>43.54</td><td>43.54</td><td>55.78</td><td>40.82</td><td>62.59</td><td>12.93</td><td>27.21</td><td>34.69</td><td>47.62</td><td>38.78</td><td>46.94</td><td>10.20</td><td>21.77</td>
  </tr>
  <tr>
    <td rowspan="3">New</td>
    <td>5</td><td>0.68</td><td>1.36</td><td>1.36</td><td>1.36</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>1.36</td><td>0.00</td><td>0.00</td><td>0.00</td>
  </tr>
  <tr>
    <td>10</td><td>0.68</td><td>2.04</td><td>2.72</td><td>2.72</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>3.40</td><td>2.04</td><td>0.00</td><td>0.00</td>
  </tr>
  <tr>
    <td>15</td><td>0.68</td><td>3.40</td><td>4.76</td><td>4.76</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>4.08</td><td>2.04</td><td>0.00</td><td>0.68</td>
  </tr>
</table>

Table 16: Decoding Success Rate (DSR) of different heads in Qwen2.5-7B-Instruct edited by ROME. p% is set to 5% and 10%.

<table>
  <tr>
    <th rowspan="2">Top-K</th>
    <th colspan="2">L23H4</th>
    <th colspan="2">L23H6</th>
    <th colspan="2">L23H11</th>
    <th colspan="2">L26H0</th>
    <th colspan="2">L27H2</th>
    <th colspan="2">L27H3</th>
    <th colspan="2">L27H15</th>
  </tr>
  <tr>
    <th>15%</th><th>20%</th>
    <th>15%</th><th>20%</th>
    <th>15%</th><th>20%</th>
    <th>15%</th><th>20%</th>
    <th>15%</th><th>20%</th>
    <th>15%</th><th>20%</th>
    <th>15%</th><th>20%</th>
  </tr>
  <tr>
    <td rowspan="3">Original</td>
    <td>5</td><td>43.54</td><td>49.66</td><td>57.82</td><td>62.59</td><td>66.67</td><td>70.75</td><td>30.61</td><td>31.97</td><td>48.30</td><td>52.38</td><td>45.58</td><td>48.30</td><td>20.41</td><td>25.85</td>
  </tr>
  <tr>
    <td>10</td><td>48.98</td><td>52.38</td><td>63.95</td><td>65.31</td><td>70.07</td><td>71.43</td><td>32.65</td><td>36.73</td><td>51.02</td><td>55.78</td><td>46.26</td><td>51.02</td><td>25.17</td><td>28.57</td>
  </tr>
  <tr>
    <td>15</td><td>52.38</td><td>55.10</td><td>67.35</td><td>69.39</td><td>70.75</td><td>72.11</td><td>36.05</td><td>37.41</td><td>53.06</td><td>56.46</td><td>49.66</td><td>52.38</td><td>27.89</td><td>32.65</td>
  </tr>
  <tr>
    <td rowspan="3">New</td>
    <td>5</td><td>1.36</td><td>0.68</td><td>4.76</td><td>4.08</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>1.36</td><td>0.68</td><td>0.68</td><td>0.68</td>
  </tr>
  <tr>
    <td>10</td><td>2.04</td><td>2.04</td><td>5.44</td><td>5.44</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>1.36</td><td>1.36</td><td>1.36</td><td>1.36</td>
  </tr>
  <tr>
    <td>15</td><td>3.40</td><td>3.40</td><td>6.12</td><td>7.48</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>2.04</td><td>3.40</td><td>1.36</td><td>1.36</td>
  </tr>
</table>

Table 17: Decoding Success Rate (DSR) of different heads in Qwen2.5-7B-Instruct edited by ROME. p% is set to 15% and 20%.
<table>
  <tr>
    <th rowspan="2">Top-K</th>
    <th colspan="2">L23H11</th>
    <th colspan="2">L24H23</th>
    <th colspan="2">L24H27</th>
    <th colspan="2">L26H0</th>
    <th colspan="2">L27H3</th>
    <th colspan="2">L27H15</th>
  </tr>
  <tr>
    <th>5%</th><th>10%</th>
    <th>5%</th><th>10%</th>
    <th>5%</th><th>10%</th>
    <th>5%</th><th>10%</th>
    <th>5%</th><th>10%</th>
    <th>5%</th><th>10%</th>
  </tr>
  <tr>
    <td rowspan="3">Original</td>
    <td>5</td><td>33.93</td><td>63.39</td><td>30.36</td><td>56.25</td><td>22.32</td><td>49.11</td><td>9.82</td><td>22.32</td><td>37.50</td><td>48.21</td><td>7.14</td><td>28.57</td>
  </tr>
  <tr>
    <td>10</td><td>42.86</td><td>67.86</td><td>40.18</td><td>63.39</td><td>30.36</td><td>58.93</td><td>14.29</td><td>25.00</td><td>41.96</td><td>50.00</td><td>16.96</td><td>31.25</td>
  </tr>
  <tr>
    <td>15</td><td>48.21</td><td>68.75</td><td>41.96</td><td>63.39</td><td>33.93</td><td>59.82</td><td>16.07</td><td>27.68</td><td>49.11</td><td>51.79</td><td>23.21</td><td>33.04</td>
  </tr>
  <tr>
    <td rowspan="3">New</td>
    <td>5</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>1.79</td><td>1.79</td><td>0.00</td><td>0.00</td>
  </tr>
  <tr>
    <td>10</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>3.57</td><td>4.46</td><td>0.89</td><td>0.89</td>
  </tr>
  <tr>
    <td>15</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.89</td><td>0.00</td><td>5.36</td><td>6.25</td><td>0.89</td><td>0.89</td>
  </tr>
</table>

Table 18: Decoding Success Rate (DSR) of different heads in Qwen2.5-7B-Instruct edited by MEMIT. p% is set to 5% and 10%.

<table>
  <tr>
    <th rowspan="2">Top-K</th>
    <th colspan="2">L23H11</th>
    <th colspan="2">L24H23</th>
    <th colspan="2">L24H27</th>
    <th colspan="2">L26H0</th>
    <th colspan="2">L27H3</th>
    <th colspan="2">L27H15</th>
  </tr>
  <tr>
    <th>15%</th><th>20%</th>
    <th>15%</th><th>20%</th>
    <th>15%</th><th>20%</th>
    <th>15%</th><th>20%</th>
    <th>15%</th><th>20%</th>
    <th>15%</th><th>20%</th>
  </tr>
  <tr>
    <td rowspan="3">Original</td>
    <td>5</td><td>70.54</td><td>73.21</td><td>63.39</td><td>69.64</td><td>59.82</td><td>62.50</td><td>24.11</td><td>27.68</td><td>52.68</td><td>54.46</td><td>33.04</td><td>33.93</td>
  </tr>
  <tr>
    <td>10</td><td>73.21</td><td>75.00</td><td>66.96</td><td>71.43</td><td>64.29</td><td>70.54</td><td>29.46</td><td>30.36</td><td>54.46</td><td>54.46</td><td>33.93</td><td>38.39</td>
  </tr>
  <tr>
    <td>15</td><td>74.11</td><td>75.00</td><td>69.64</td><td>72.32</td><td>67.86</td><td>71.43</td><td>31.25</td><td>33.04</td><td>55.36</td><td>56.25</td><td>36.61</td><td>43.75</td>
  </tr>
  <tr>
    <td rowspan="3">New</td>
    <td>5</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>2.68</td><td>3.57</td><td>0.00</td><td>0.89</td>
  </tr>
  <tr>
    <td>10</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>4.46</td><td>6.25</td><td>0.89</td><td>0.89</td>
  </tr>
  <tr>
    <td>15</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.00</td><td>6.25</td><td>6.25</td><td>0.89</td><td>0.89</td>
  </tr>
</table>

Table 19: Decoding Success Rate (DSR) of different heads in Qwen2.5-7B-Instruct edited by MEMIT. p% is set to 15% and 20%.

<table>
  <tr>
    <th rowspan="2">Top-K</th>
    <th colspan="2">L36H10</th>
    <th colspan="2">L40H22</th>
    <th colspan="2">L40H23</th>
    <th colspan="2">L41H14</th>
    <th colspan="2">L42H21</th>
  </tr>
  <tr>
    <th>5%</th><th>10%</th>
    <th>5%</th><th>10%</th>
    <th>5%</th><th>10%</th>
    <th>5%</th><th>10%</th>
    <th>5%</th><th>10%</th>
  </tr>
  <tr>
    <td rowspan="3">Original</td>
    <td>5</td><td>29.06</td><td>52.22</td><td>29.56</td><td>40.39</td><td>29.06</td><td>46.80</td><td>26.11</td><td>37.44</td><td>10.34</td><td>22.17</td>
  </tr>
  <tr>
    <td>10</td><td>35.96</td><td>60.10</td><td>36.45</td><td>45.32</td><td>34.97</td><td>50.74</td><td>33.00</td><td>45.81</td><td>15.27</td><td>28.57</td>
  </tr>
  <tr>
    <td>15</td><td>40.89</td><td>64.04</td><td>39.41</td><td>45.81</td><td>39.41</td><td>56.16</td><td>36.95</td><td>51.23</td><td>18.72</td><td>32.02</td>
  </tr>
  <tr>
    <td rowspan="3">New</td>
    <td>5</td><td>0.00</td><td>0.00</td><td>0.99</td><td>1.48</td><td>0.49</td><td>0.49</td><td>1.48</td><td>2.46</td><td>0.00</td><td>0.00</td>
  </tr>
  <tr>
    <td>10</td><td>0.00</td><td>0.00</td><td>2.46</td><td>2.96</td><td>0.49</td><td>0.49</td><td>2.46</td><td>4.43</td><td>0.00</td><td>0.99</td>
  </tr>
  <tr>
    <td>15</td><td>0.00</td><td>0.00</td><td>3.94</td><td>3.94</td><td>0.49</td><td>0.99</td><td>4.43</td><td>8.87</td><td>0.00</td><td>0.99</td>
  </tr>
  <tr>
    <th rowspan="2">Top-K</th>
    <th colspan="2">L43H36</th>
    <th colspan="2">L45H27</th>
    <th colspan="2">L45H37</th>
    <th colspan="2">L46H4</th>
    <th colspan="2">L46H28</th>
  </tr>
  <tr>
    <th>5%</th><th>10%</th>
    <th>5%</th><th>10%</th>
    <th>5%</th><th>10%</th>
    <th>5%</th><th>10%</th>
    <th>5%</th><th>10%</th>
  </tr>
  <tr>
    <td rowspan="3">Original</td>
    <td>5</td><td>15.27</td><td>21.67</td><td>11.33</td><td>26.11</td><td>19.70</td><td>33.99</td><td>20.20</td><td>36.95</td><td>13.30</td><td>22.66</td>
  </tr>
  <tr>
    <td>10</td><td>17.24</td><td>25.12</td><td>17.24</td><td>29.56</td><td>24.63</td><td>37.44</td><td>26.11</td><td>40.89</td><td>14.78</td><td>29.56</td>
  </tr>
  <tr>
    <td>15</td><td>20.20</td><td>28.08</td><td>18.23</td><td>32.02</td><td>27.59</td><td>38.42</td><td>29.56</td><td>43.84</td><td>15.76</td><td>34.48</td>
  </tr>
  <tr>
    <td rowspan="3">New</td>
    <td>5</td><td>1.48</td><td>1.48</td><td>0.00</td><td>0.00</td><td>0.00</td><td>0.49</td><td>0.00</td><td>0.49</td><td>0.00</td><td>0.00</td>
  </tr>
  <tr>
    <td>10</td><td>1.97</td><td>1.48</td><td>0.00</td><td>0.49</td><td>0.49</td><td>0.49</td><td>0.49</td><td>0.49</td><td>0.00</td><td>0.49</td>
  </tr>
  <tr>
    <td>15</td><td>2.46</td><td>1.97</td><td>0.00</td><td>0.49</td><td>0.49</td><td>0.49</td><td>0.99</td><td>0.49</td><td>0.00</td><td>0.99</td>
  </tr>
</table>

Table 20: Decoding Success Rate (DSR) of different heads in Qwen2.5-14B-Instruct edited by ROME. p% is set to 5% and 10%.
<table>
  <tr>
    <th rowspan="2">Top-K</th>
    <th colspan="4">L36H10</th>
    <th colspan="4">L40H22</th>
    <th colspan="4">L40H23</th>
    <th colspan="4">L41H14</th>
    <th colspan="4">L42H21</th>
  </tr>
  <tr>
    <th>15%</th><th>20%</th><th>15%</th><th>20%</th><th>15%</th><th>20%</th><th>15%</th><th>20%</th><th>15%</th><th>20%</th><th>15%</th><th>20%</th><th>15%</th><th>20%</th><th>15%</th><th>20%</th><th>15%</th><th>20%</th>
  </tr>
  <tr>
    <td rowspan="3">Original</td>
    <td>5</td><td>64.04</td><td>68.97</td><td>45.32</td><td>46.31</td><td>49.75</td><td>59.11</td><td>48.28</td><td>52.22</td><td>33.50</td><td>38.42</td>
    <td>10</td><td>67.49</td><td>70.44</td><td>47.29</td><td>49.75</td><td>56.16</td><td>62.07</td><td>55.17</td><td>60.10</td><td>40.39</td><td>44.33</td>
    <td>15</td><td>69.95</td><td>71.43</td><td>49.75</td><td>50.25</td><td>60.10</td><td>63.55</td><td>59.11</td><td>61.08</td><td>44.33</td><td>46.80</td>
  </tr>
  <tr>
    <td rowspan="3">New</td>
    <td>5</td><td>0.00</td><td>0.00</td><td>2.46</td><td>3.45</td><td>1.48</td><td>1.48</td><td>3.94</td><td>2.96</td><td>0.00</td><td>0.49</td>
    <td>10</td><td>0.00</td><td>0.00</td><td>5.91</td><td>5.91</td><td>1.97</td><td>2.46</td><td>4.43</td><td>5.42</td><td>1.48</td><td>0.49</td>
    <td>15</td><td>0.00</td><td>0.00</td><td>6.90</td><td>6.90</td><td>2.46</td><td>3.45</td><td>6.90</td><td>8.37</td><td>1.97</td><td>0.99</td>
  </tr>
  <tr>
    <td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td>
  </tr>
  <tr>
    <th rowspan="2">Top-K</th>
    <th colspan="4">L43H36</th>
    <th colspan="4">L45H27</th>
    <th colspan="4">L45H37</th>
    <th colspan="4">L46H4</th>
    <th colspan="4">L46H28</th>
  </tr>
  <tr>
    <th>15%</th><th>20%</th><th>15%</th><th>20%</th><th>15%</th><th>20%</th><th>15%</th><th>20%</th><th>15%</th><th>20%</th><th>15%</th><th>20%</th><th>15%</th><th>20%</th><th>15%</th><th>20%</th><th>15%</th><th>20%</th><th>15%</th><th>20%</th>
  </tr>
  <tr>
    <td rowspan="3">Original</td>
    <td>5</td><td>25.62</td><td>28.08</td><td>33.00</td><td>39.90</td><td>40.89</td><td>42.36</td><td>45.81</td><td>48.77</td><td>33.50</td><td>37.44</td>
    <td>10</td><td>29.56</td><td>29.56</td><td>39.41</td><td>43.35</td><td>41.87</td><td>43.35</td><td>47.78</td><td>53.20</td><td>36.95</td><td>41.87</td>
    <td>15</td><td>30.54</td><td>31.53</td><td>40.89</td><td>43.84</td><td>42.86</td><td>45.32</td><td>51.23</td><td>55.67</td><td>39.90</td><td>42.36</td>
  </tr>
  <tr>
    <td rowspan="3">New</td>
    <td>5</td><td>2.46</td><td>1.97</td><td>0.49</td><td>0.00</td><td>0.49</td><td>0.49</td><td>0.99</td><td>0.99</td><td>0.49</td><td>0.99</td>
    <td>10</td><td>2.96</td><td>2.96</td><td>0.49</td><td>0.00</td><td>0.49</td><td>0.49</td><td>0.99</td><td>1.48</td><td>1.48</td><td>1.48</td>
    <td>15</td><td>2.96</td><td>3.45</td><td>0.49</td><td>0.00</td><td>0.49</td><td>0.99</td><td>1.97</td><td>2.46</td><td>1.97</td><td>2.46</td>
  </tr>
  <tr>
    <td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td>
  </tr>
</table>

Table 21: Decoding Success Rate (DSR) of different heads in Qwen2.5-14B-Instruct edited by ROME. \( p\% \) is set to 15% and 20%.

<table>
  <tr>
    <th rowspan="2">Top-K</th>
    <th colspan="4">L36H14</th>
    <th colspan="4">L39H20</th>
    <th colspan="4">L40H22</th>
    <th colspan="4">L40H23</th>
    <th colspan="4">L41H14</th>
  </tr>
  <tr>
    <th>5%</th><th>10%</th><th>5%</th><th>10%</th><th>5%</th><th>10%</th><th>5%</th><th>10%</th><th>5%</th><th>10%</th><th>5%</th><th>10%</th><th>5%</th><th>10%</th><th>5%</th><th>10%</th><th>5%</th><th>10%</th>
  </tr>
  <tr>
    <td rowspan="3">Original</td>
    <td>5</td><td>30.61</td><td>55.78</td><td>32.31</td><td>55.78</td><td>29.59</td><td>37.07</td><td>28.91</td><td>41.50</td><td>26.53</td><td>36.05</td>
    <td>10</td><td>37.07</td><td>58.84</td><td>42.52</td><td>58.16</td><td>34.35</td><td>41.50</td><td>34.69</td><td>46.60</td><td>34.69</td><td>42.86</td>
    <td>15</td><td>41.16</td><td>61.22</td><td>45.58</td><td>58.84</td><td>36.73</td><td>43.20</td><td>36.05</td><td>48.64</td><td>38.10</td><td>46.94</td>
  </tr>
  <tr>
    <td rowspan="3">New</td>
    <td>5</td><td>0.00</td><td>0.00</td><td>0.34</td><td>1.02</td><td>0.34</td><td>0.68</td><td>0.34</td><td>1.02</td><td>1.02</td><td>1.36</td>
    <td>10</td><td>0.00</td><td>0.00</td><td>1.70</td><td>1.36</td><td>1.02</td><td>1.70</td><td>0.34</td><td>1.36</td><td>2.72</td><td>3.74</td>
    <td>15</td><td>0.00</td><td>0.00</td><td>1.70</td><td>2.38</td><td>1.70</td><td>2.38</td><td>0.68</td><td>1.36</td><td>4.76</td><td>6.46</td>
  </tr>
  <tr>
    <td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td>
  </tr>
  <tr>
    <th rowspan="2">Top-K</th>
    <th colspan="4">L42H21</th>
    <th colspan="4">L43H36</th>
    <th colspan="4">L45H27</th>
    <th colspan="4">L45H37</th>
    <th colspan="4">L46H4</th>
  </tr>
  <tr>
    <th>5%</th><th>10%</th><th>5%</th><th>10%</th><th>5%</th><th>10%</th><th>5%</th><th>10%</th><th>5%</th><th>10%</th><th>5%</th><th>10%</th><th>5%</th><th>10%</th><th>5%</th><th>10%</th><th>5%</th><th>10%</th>
  </tr>
  <tr>
    <td rowspan="3">Original</td>
    <td>5</td><td>8.84</td><td>19.73</td><td>10.20</td><td>15.99</td><td>7.82</td><td>19.05</td><td>22.11</td><td>39.80</td><td>18.71</td><td>37.41</td>
    <td>10</td><td>11.22</td><td>26.19</td><td>11.90</td><td>18.03</td><td>10.88</td><td>22.79</td><td>26.87</td><td>43.20</td><td>24.49</td><td>40.48</td>
    <td>15</td><td>12.93</td><td>29.93</td><td>12.93</td><td>19.39</td><td>13.61</td><td>26.87</td><td>30.27</td><td>44.56</td><td>27.89</td><td>42.52</td>
  </tr>
  <tr>
    <td rowspan="3">New</td>
    <td>5</td><td>0.00</td><td>0.00</td><td>0.68</td><td>1.70</td><td>0.34</td><td>0.34</td><td>0.00</td><td>0.00</td><td>0.68</td><td>0.68</td>
    <td>10</td><td>0.00</td><td>0.00</td><td>1.36</td><td>2.04</td><td>0.34</td><td>0.34</td><td>0.00</td><td>0.00</td><td>1.02</td><td>1.36</td>
    <td>15</td><td>0.00</td><td>0.68</td><td>1.70</td><td>2.72</td><td>0.34</td><td>0.34</td><td>0.00</td><td>0.34</td><td>1.02</td><td>2.04</td>
  </tr>
  <tr>
    <td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td>
  </tr>
</table>

Table 22: Decoding Success Rate (DSR) of different heads in Qwen2.5-14B-Instruct edited by MEMIT. \( p\% \) is set to 5% and 10%.
<table>
  <tr>
    <th rowspan="2">Top-K</th>
    <th colspan="4">L36H14</th>
    <th colspan="4">L39H20</th>
    <th colspan="4">L40H22</th>
    <th colspan="4">L40H23</th>
    <th colspan="4">L41H14</th>
  </tr>
  <tr>
    <th>15%</th><th>20%</th><th>15%</th><th>20%</th><th>15%</th><th>20%</th><th>15%</th><th>20%</th><th>15%</th><th>20%</th><th>15%</th><th>20%</th><th>15%</th><th>20%</th><th>15%</th><th>20%</th><th>15%</th><th>20%</th>
  </tr>
  <tr>
    <td rowspan="3">Original</td>
    <td>5</td><td>63.27</td><td>66.67</td><td>62.24</td><td>62.59</td><td>41.84</td><td>43.54</td><td>48.98</td><td>52.38</td><td>41.84</td><td>47.28</td>
    <td>10</td><td>65.31</td><td>68.03</td><td>63.27</td><td>63.95</td><td>44.56</td><td>47.62</td><td>52.72</td><td>55.44</td><td>48.64</td><td>52.72</td>
    <td>15</td><td>67.01</td><td>68.03</td><td>63.27</td><td>63.95</td><td>46.94</td><td>48.30</td><td>53.06</td><td>56.46</td><td>52.04</td><td>54.08</td>
  </tr>
  <tr>
    <td rowspan="3">New</td>
    <td>5</td><td>0.00</td><td>0.00</td><td>0.68</td><td>0.68</td><td>1.02</td><td>0.68</td><td>0.34</td><td>0.68</td><td>1.36</td><td>1.36</td>
    <td>10</td><td>0.00</td><td>0.34</td><td>1.02</td><td>1.02</td><td>2.04</td><td>3.74</td><td>1.36</td><td>1.70</td><td>4.08</td><td>6.12</td>
    <td>15</td><td>0.00</td><td>0.34</td><td>2.04</td><td>2.38</td><td>3.06</td><td>5.10</td><td>2.04</td><td>2.38</td><td>8.16</td><td>8.50</td>
  </tr>
  <tr>
    <td rowspan="3"></td>
    <td>5</td><td>32.65</td><td>37.07</td><td>19.73</td><td>21.09</td><td>29.25</td><td>37.76</td><td>44.56</td><td>45.24</td><td>43.54</td><td>45.58</td>
    <td>10</td><td>39.12</td><td>43.88</td><td>21.43</td><td>23.13</td><td>35.37</td><td>41.50</td><td>46.60</td><td>46.60</td><td>46.60</td><td>49.66</td>
    <td>15</td><td>42.18</td><td>46.26</td><td>23.13</td><td>25.17</td><td>38.10</td><td>43.54</td><td>46.94</td><td>47.96</td><td>47.96</td><td>52.04</td>
  </tr>
  <tr>
    <td rowspan="3">New</td>
    <td>5</td><td>0.34</td><td>0.34</td><td>1.36</td><td>1.70</td><td>0.34</td><td>0.34</td><td>0.00</td><td>0.00</td><td>0.68</td><td>1.02</td>
    <td>10</td><td>0.34</td><td>0.34</td><td>2.38</td><td>3.40</td><td>0.34</td><td>0.68</td><td>0.00</td><td>0.34</td><td>1.36</td><td>1.70</td>
    <td>15</td><td>0.68</td><td>1.02</td><td>2.72</td><td>4.08</td><td>0.34</td><td>0.68</td><td>0.00</td><td>0.34</td><td>3.06</td><td>3.06</td>
  </tr>
</table>

Table 23: Decoding Success Rate (DSR) of different heads in Qwen2.5-14B-Instruct edited by MEMIT. p% is set to 15% and 20%.

<table>
  <tr>
    <th rowspan="2">Models</th>
    <th rowspan="2">Methods</th>
    <th colspan="4">OAP</th>
    <th colspan="4">NAP</th>
    <th colspan="4">OAP</th>
    <th colspan="4">NAP</th>
  </tr>
  <tr>
    <th>w/o abl.</th><th>abl.</th><th>↓ ΔP</th><th>w/o abl.</th><th>abl.</th><th>↑ ΔP</th><th>w/o abl.</th><th>abl.</th><th>↓ ΔP</th><th>w/o abl.</th><th>abl.</th><th>↑ ΔP</th>
  </tr>
  <tr>
    <td rowspan="2">LLaMA3-8B-Instruct</td>
    <td>ROME</td><td>61.41</td><td>45.45</td><td>15.96</td><td>16.12</td><td>24.21</td><td>8.09</td><td>61.41</td><td>43.41</td><td>18.00</td><td>16.12</td><td>25.11</td><td>8.99</td>
    <td>MEMIT</td><td>57.42</td><td>41.37</td><td>16.05</td><td>17.05</td><td>24.68</td><td>7.63</td><td>57.42</td><td>39.30</td><td>18.12</td><td>17.05</td><td>25.84</td><td>8.79</td>
  </tr>
  <tr>
    <td rowspan="2">Qwen2.5-7B-Instruct</td>
    <td>ROME</td><td>64.33</td><td>47.52</td><td>16.81</td><td>11.93</td><td>21.26</td><td>9.33</td><td>64.33</td><td>45.46</td><td>18.87</td><td>11.93</td><td>22.26</td><td>10.33</td>
    <td>MEMIT</td><td>66.41</td><td>54.89</td><td>11.52</td><td>15.72</td><td>23.41</td><td>7.69</td><td>66.41</td><td>52.98</td><td>13.43</td><td>15.72</td><td>24.62</td><td>8.90</td>
  </tr>
  <tr>
    <td rowspan="2">Qwen2.5-14B-Instruct</td>
    <td>ROME</td><td>62.87</td><td>51.14</td><td>11.73</td><td>17.39</td><td>24.40</td><td>7.01</td><td>62.87</td><td>49.62</td><td>13.25</td><td>17.39</td><td>25.28</td><td>7.89</td>
    <td>MEMIT</td><td>62.02</td><td>48.85</td><td>13.17</td><td>15.64</td><td>23.35</td><td>7.71</td><td>62.02</td><td>47.06</td><td>14.96</td><td>15.64</td><td>24.41</td><td>8.77</td>
  </tr>
</table>

Table 24: Answer probabilities before and after singular vector ablation across varying values of p%.

Reviewer paper summaries: Authors conduct a comprehensive evaluation of  existing knowledge editing algorithms on “superficial editing”, demonstrating that models edited with these algorithms are still prone to generate the original knowledge. They identify two factors leading to this issue: the residual stem in earlier layers and the attention in later ones. Their further analysis in the task of superficial unlearning using the same framework proves the validity of their methodology and conclusions.
Summary of strengths: - The methodology and results found are presented in a clear and coherent way.
- Solid motivation.
- The validity of their methodology to evaluate “superficial editing” is further demonstrated with the task of superficial unlearning.
Summary of weaknesses: - The evaluation for superficial editing involves prefixing the pre-editing object to the prompt in all the three attack types. This raises the question whether LLMs output the original knowledge due to “superficial editing” or due to the bias elicited inserting this original object in the prompt. 
- Authors consider that, from the datasets used, the instances representing the knowledge acquired and internalized by the models are those for which their prediction perfectly matches the ground truth. However, this conclusion is weak if tested on a single prompt, as the model’s output is susceptible to variations depending on the prompt format.
- The discussion of related work lacks depth and comprehensiveness.
Comments, suggestions and typos: - “Wiki” example in Figure 10 is confusing. The pre-editing and post-editing object is the same (”Toronto”).
Overall assessment scores: 4