Exposing the Illusion of Erasure in Knowledge Editing for Large Language Models
Demonstrates that knowledge editing techniques that claim to erase dangerous knowledge from LLMs are largely illusory — the knowledge persists in the model weights and can be recovered through targeted elicitation, undermining machine unlearning as a safety mechanism.
Focus: Machine unlearning has been proposed as a safety mechanism — edit out dangerous knowledge after model training rather than preventing it from being learned. This paper systematically tests whether such erasure is genuine or illusory, showing that knowledge editing techniques produce models that appear to have forgotten dangerous knowledge on standard evaluation prompts but readily recall it under targeted elicitation.
Key Insights
- Superficial vs. deep erasure: Standard knowledge editing techniques modify surface-level retrieval patterns (the model no longer outputs the dangerous information when asked directly) but leave the underlying knowledge intact at the weight level.
- Targeted elicitation recovers erased knowledge: Prompting strategies designed to bypass the surface-level edit — including paraphrasing, indirect reference, and few-shot elicitation — reliably recover the “erased” knowledge, demonstrating the erasure is not genuine.
- Implications for safety claims: Safety guarantees based on knowledge editing (“we have removed the model’s ability to describe X”) are not verifiable without also testing targeted elicitation, which is not part of standard evaluation protocols.
Failure-First Relevance
The illusion of erasure is a direct case study in the Failure-First capability_elicitation_rate metric: the baseline edit produces full_refusal on direct asks, but targeted elicitation changes the classification to full_compliance. This is precisely the scenario the Failure-First baseline-refusal gate must handle — distinguishing genuine incapability from alignment-suppressed capability. The paper provides empirical evidence that machine unlearning, as currently implemented, produces the latter rather than the former.