Exposing the Illusion of Erasure in Knowledge Editing for LLMs
For practitioners deploying LLMs, this work reveals that current knowledge editing is fundamentally insecure and bypassable, undermining claims of reliable fact removal.
Knowledge editing methods for LLMs do not erase facts but suppress them, leaving them vulnerable to adversarial elicitation. Edited knowledge resides in narrow, anisotropic regions, making it easily recoverable through indirect prompting.
Knowledge Editing (KE) has emerged as a frontier for updating specific facts in LLMs without costly retraining, but its reliability and underlying mechanisms remain poorly understood. In this work, we examine KE from an adversarial elicitation perspective, revealing that edited knowledge is often not fully erased and continues to surface, with consistent failures observed across diverse model architectures. To explain this behavior, we conduct a mechanistic analysis of popular KE methods. We show that low-rank updates do not overwrite existing knowledge but instead redistribute it within the model's representation space. Furthermore, we find that these methods act as targeted suppression mechanisms that reduce the likelihood of expressing original facts, rather than removing them from the model. Analysis of the loss landscape reveals that edited knowledge lies in narrow, anisotropic regions that are highly sensitive to perturbations, making them highly vulnerable to indirect prompting and adversarial attacks. By exposing these profound architectural vulnerabilities, our work proves that KE algorithms are inherently bypassable and motivates a fundamental reevaluation of how we deploy post-hoc updates in several LLM applications.