Editing Large Language Models: Problems, Methods, and Opportunities

1 Introduction

• Model editing (Sinitsin et al., 2020; De Cao et al., 2021) targets data-efficient behavioral changes within a designated domain without adversely affecting other inputs.The motivation is to keep models relevant and correct errors as the world changes without the computational burden of training entirely new models.Source: §1 · p. 1
• Editing methods (De Cao et al., 2021; Meng et al., 2022, 2023; Sinitsin et al., 2020; Huang et al., 2023) add auxiliary networks or change parameters.Auxiliary-network approaches leave the original model unchanged; parameter-editing approaches modify parameters responsible for undesirable outputs.Source: §1 · p. 1
• The study addresses a lack of uniform comparisons by establishing a standard editing problem definition and evaluating methods under controlled conditions.The comparison aims to clarify methods’ strengths, weaknesses, and suitability for different tasks.Source: §1 · pp. 1–2
• Evaluation uses ZsRE (Levy et al., 2017) and COUNTERFACT (Meng et al., 2022), covering basic, batch, and sequential editing across different model architectures and sizes.Base models are encoder-decoder T5 and decoder-only GPT-J. Larger models include OPT-13B and GPT-NEOX-20B.Source: §1 · pp. 1–2
• Current methods demonstrate substantial factual-editing ability but remain limited in portability, locality, and efficiency, constraining practical application.The study introduces a broader evaluation dataset assessing robust generalization, side effects, and time and memory usage.Source: §1 · p. 2

2 Problems Definition

• Model editing, as defined by Mitchell et al. (2022b), corrects a specified input’s output while preserving behavior on unrelated inputs.The editing scope includes the edited input and its equivalence neighborhood of related input/output pairs; successful edits adjust behavior throughout this scope.Source: §2 · p. 2

Reliability

• Reliability measures whether the edited model produces the target answer, evaluated as average accuracy on edit cases.This definition follows previous works (Huang et al., 2023; De Cao et al., 2021; Meng et al., 2022).Source: §2 · p. 2

Generalization

• Generalization measures average accuracy on inputs sampled uniformly from the edit’s equivalence neighborhood, such as rephrased sentences.Correcting the original input alone is insufficient: equivalent neighboring inputs should also reflect the edit.Source: §2 · p. 2

Locality

• Locality, also called Specificity, measures how often predictions on unrelated, out-of-scope inputs remain unchanged after editing.Together with reliability and generalization, locality is a required property of the edited model.Source: §2 · p. 2

3.1 Methods for Preserving LLMs’ Parameters

• Parameter-preserving memory-based methods retrieve stored edits to guide predictions through a separate counterfactual model or in-context prompts.SERAC routes inputs matching cached edits to a counterfactual model and otherwise uses the original model. MemPrompt (Madaan et al., 2022), IKE and MeLLo instead prompt with edited facts and retrieved demonstrations.Source: §3.1 · pp. 2–3, §3 · p. 2
• Additional-parameter methods train new components on modified knowledge while keeping the original model parameters fixed.T-Patcher (Huang et al., 2023) adds one final-layer FFN neuron per mistake, activated only for that mistake, whereas CaliNET (Dong et al., 2022) adds several neurons for multiple edits. GRACE (Hartvigsen et al., 2022) maintains an adapter codebook whose elements are added and updated over time.Source: §3.1 · p. 3

3.2 Methods for Modifying LLMs’ Parameters

• Locate-then-edit methods identify parameters associated with specific knowledge and directly update those parameters.KN (Dai et al., 2022) attributes knowledge to FFN neurons and updates them. ROME (Meng et al., 2022) uses causal mediation analysis to locate the editing area, then modifies an entire matrix by solving equality-constrained least squares with a Lagrange multiplier.Source: §3.2 · p. 3
• MEMIT extends ROME to edit multiple cases simultaneously, overcoming KN and ROME’s single-factual-association limitation.PMET (Li et al., 2023a) builds on MEMIT by incorporating attention values to improve performance.Source: §3.2 · p. 3
• Meta-learning methods train hypernetworks to produce model-weight updates rather than locating and directly editing knowledge-bearing parameters.KE (De Cao et al., 2021) uses a bidirectional-LSTM hypernetwork to predict constrained updates intended to preserve other knowledge, but falls short for LLMs. MEND (Mitchell et al., 2022a) instead learns gradient transformations using low-rank gradient decomposition and can be applied to LLMs with better performance.Source: §3.2 · pp. 3–4

4.1 Experiment Setting

• Experiments compare editing methods on ZsRE and COUNTERFACT using T5-XL (3B) and GPT-J (6B), covering encoder-decoder and decoder-only architectures.The setup extends investigation beyond previously studied models smaller than 1B parameters. FT-L follows Meng et al. (2022) by fine-tuning layers identified by ROME rather than retraining every layer, reducing computation and supporting comparison with direct editing methods.Source: §4.1 · p. 4

4.2 Experiment Results

• Over 90% on several metrics is reported for SERAC; SERAC and ROME show superior performance on ZsRE and COUNTERFACT.MEMIT excels in reliability and locality but has weaker generalization; MEND exceeds 80% on T5 but trails ROME and SERAC. KE, CaliNET, and KN perform acceptably on smaller models but poorly on larger ones.Source: §4.2 · p. 4
• T-Patcher’s performance varies across architectures and datasets, producing inconsistent trade-offs between reliability, generalization, and locality.On ZsRE, it underperforms on T5-XL but performs perfectly on GPT-J; on COUNTERFACT, T5 has satisfactory reliability and locality but weak generalization, while GPT-J shows the converse locality weakness. The authors attribute instability to architecture: adding a final-decoder neuron in T5 can leave original knowledge in its encoder.Source: §4.2 · p. 4
• FT-L and IKE exhibit locality weaknesses: FT-L can affect unrelated knowledge, while IKE’s prepended prompts can affect unrelated inputs.FT-L underperforms ROME despite editing the same position and performs poorly on ZsRE, although it matches ROME’s reliability and generalization on GPT-J COUNTERFACT. IKE has good reliability but weaker generalization and may encounter context mediation failure, where generation fails to follow the prompt (Hernandez et al., 2023).Source: §4.2 · pp. 4–5
• 1000 simultaneous edits preserve MEMIT’s robust reliability and generalization with minimal time and memory costs, but locality decreases.SERAC performs batch editing perfectly up to 100 edits; memory constraints limit SERAC, MEND, and FT-L testing to 100 edits. MEND and FT-L deteriorate rapidly as batch size increases.Source: Figure 3 · p. 5, §4.2 · p. 5
• ROME and MEMIT perform well on GPT-NEOX-20B but fail on OPT-13B because their required matrix inversions encounter a noninvertible matrix.Least-squares approximation also proves unsatisfactory; MEMIT’s multilayer computations produce greater reliability and generalization declines than ROME’s. IKE depends on the model’s in-context learning ability, performs worse on OPT than GPT-J, and loses generalization and locality as model size increases.Source: Table 2 · p. 5, §4.2 · p. 5
• Parameter-freezing methods SERAC and T-Patcher generally remain stable during sequential editing, whereas parameter-altering methods deteriorate as edits accumulate.Unlike evaluation that rolls back each edit, sequential evaluation retains previous updates: ROME performs well at n = 10 but degrades at n = 100. MEMIT declines over 100 edits less drastically than ROME, while MEND performs well at n = 1 but declines significantly at n = 10.Source: §4.2 · p. 5, Figure 4 · p. 6

5.1 Portability - Robust Generalization

• Portability measures robust generalization through subject replacement, reversed relations, and one-hop reasoning, using average accuracy on reasoning examples added to ZsRE.Subject replacement substitutes aliases or synonyms; reversed-relation tests check whether suitable reverse questions reflect the edit. One-hop reasoning tests whether edited knowledge supports downstream answers involving related facts.Source: §5.1 · p. 6
• Over 90% reversed-relation accuracy on both GPT-J and GPT-NEOX-20B distinguishes IKE, while SERAC scores below 20% across all three portability aspects.For subject replacement, FT-L, IKE, and T-patcher perform well, whereas SERAC, MEND, ROME, and MEMIT fail to generalize beyond specific subject expressions. In one-hop reasoning, ROME, MEMIT, and IKE exceed 50%, although most methods struggle; overall, IKE performs relatively well across all three scenarios.Source: Table 3 · p. 6, §5.1 · p. 7

5.2 Locality - Side Effect of Model Editing

• Editing generally preserves other subject attributes but struggles with distracting edited context; parameter-preserving methods retain commonsense performance, while parameter-changing methods generally degrade it except MEMIT.IKE remains relatively stable under distracting context because its approach inherently prepends edited facts to inputs. MEMIT maintains strong commonsense-task performance despite changing parameters.Source: Table 4 · p. 7, §5.2 · pp. 7–8
• Locality evaluation tests preservation of other subject attributes, susceptibility to distracting edited facts, and performance on other tasks.Distract Neighbourhood prepends edited cases to unrelated inputs. These complementary tests address the differing locality perspectives used by COUNTERFACT and ZsRE.Source: §5.2 · p. 7

5.3 Efficiency

• About 5 seconds suffices for SERAC editing after training, but MEND training exceeds 7 hours and SERAC training exceeds 36 hours on 3× V100.KE and MEND also edit quickly after hypernetwork training, but these methods and SERAC require additional training data; ROME and MEMIT require covariance precomputation taking hours to days. KN and CaliNET avoid pretraining or precomputation but perform unsatisfactorily on larger models, while T-Patcher is slowest because each mistake requires individual neuron training.Source: Table 5 · p. 8, §5.3 · p. 8
• More than 60GB of VRAM is required for MEND training, while most editing methods have similar memory consumption.Additional training for methods such as MEND and SERAC introduces computational overhead and increases memory consumption.Source: Figure 5 · p. 8, §5.3 · p. 8

6.1 Knowledge in LLMs

• Knowledge-storage research informs parameter-focused editing, while knowledge augmentation resembles editing because updating knowledge can also mean inserting it.Relevant work includes studies of PLM knowledge storage (Geva et al., 2021, 2022) and knowledge augmentation.Source: §6.1 · p. 8

6.2 Lifelong Learning and Unlearning

• Model editing connects lifelong learning and unlearning through adaptive knowledge addition, modification, and removal.Continual learning supports adaptation across tasks and domains (Biesialska et al., 2020) and effective PLM editing. Forgetting sensitive knowledge aligns with machine unlearning (Gandikota et al., 2023).Source: §6.2 · p. 9

6.3 Security and Privacy for LLMs

• Model editing could address privacy and security concerns by suppressing harmful language generation (Geva et al., 2022; Hu et al., 2023).LLMs can produce unreliable or personal samples under certain prompts (Carlini et al., 2020). Erasing harmful and private information is important for application privacy and security.Source: §6.3 · p. 9

7 Conclusion

• The paper systematically analyzes LLM editing techniques to help researchers understand their features, strengths, and limitations.Source: §7 · p. 9
• LLM editing methods leave substantial room for improvement, particularly in portability, locality, and efficiency.Source: §7 · p. 9
• Improved LLM editing could better align models with users’ changing needs and values.Source: §7 · p. 9

Model Scale & Architecture

• 20B is the maximum model size evaluated because of computational constraints; effectiveness on different architectures, such as Llama, remains unexplored.Many editing methods treat the model’s feed-forward network as key-value pairs, raising questions about their applicability across architectures.Source: Limitations · p. 9

Editing Scope

• Personality, emotions, opinions, and beliefs are not detailed in the paper; multilingual and computer-vision editing also extend the field beyond factual contexts.Multilingual editing warrants further exploration. Computer-vision editing examples include ENN and Ilharco et al. (2023).Source: Limitations · p. 9

Editing Setting

• The study mainly evaluates single edits, leaving simultaneous multiple-edit evaluation for future work.Zhong et al. (2023) introduced a multi-hop reasoning setting to explore editing methods’ generalization performance for multiple simultaneous edits.Source: Limitations · p. 9
• The study focuses on changing outputs to reflect specific facts, while erasing stored knowledge remains an important research direction.Cohen et al. (2023) propose a benchmark for knowledge injection and update. Knowledge erasure is another direction for investigation (Belrose et al., 2023; Geva et al., 2022; Ishibashi and Shimodaira, 2023).Source: Limitations · p. 9

Editing Black-Box LLMs

• Editing API-only models such as ChatGPT and GPT-4 remains an open question, with in-context learning and prompt-based methods offering promising approaches.Existing approaches use in-context learning and prompt-based methods, placing a textual adaptation target before each example.Source: Limitations · pp. 9–10

Ethic Consideration

• Ill-intentioned model editing can cause pretrained models to generate harmful or inappropriate outputs.Source: Ethic Consideration · p. 10
• Model editing should follow ethical guidance and include safeguards against misuse and harmful results.Source: Ethic Consideration · p. 10
• The authors report that humans carefully checked all their data and removed any malicious editing or offensive content.Source: Ethic Consideration · p. 10

CaliNET, KE, and MEND

• CaliNET (Dong et al., 2022) adds calibration memory slots using a reduced-intermediate-dimension FFN architecture, modifying GPT-J’s final two FFN layers.KE (De Cao et al., 2021) uses gradients and an LSTM to predict rank-1 updates, with separately trained zsRE and COUNTERFACT editors and test-time scaling 1.0. MEND (Mitchell et al., 2022a) transforms gradients through low-rank decomposition, replacing Adam with AdamW in several GPT-J experiments.Source: A Implementing Details · pp. 13–14

SERAC

• SERAC caches edit descriptors, classifies whether inputs fall within their scope, and uses relevant edits for counterfactual predictions.The scope classifier is distilbert-base-cased; counterfactual models are T5-small for T5-XL and architext/gptj-162M for GPT-J. Autoregressive training considers loss only at output positions.Source: A Implementing Details · p. 14

KN and FT

• KN (Dai et al., 2022) identifies knowledge neurons through gradient attribution, then modifies corresponding FFN projection rows by adding scaled embedding vectors.Selected neuron activations are doubled. FT follows Meng et al. (2023), using unconstrained Adam (Kingma and Ba, 2014) updates with early stopping on layer-21 mlpproj weights.Source: A Implementing Details · pp. 13–15

T-Patcher

• Up to 5 patches per edit example handle autoregressive errors in T-Patcher (Huang et al., 2023), considering only mistakes at output positions.T-Patcher freezes original parameters and trains one added neuron in the last FFN layer per mistake, activating the patch only for its corresponding mistake.Source: A Implementing Details · p. 15

ROME and MEMIT

• ROME (Meng et al., 2022) makes rank-one MLP updates; MEMIT inserts many memories across multiple critical MLP layers.Both methods were evaluated only on decoder-only models, with no T5-XL results reported. Locality evaluation used NQ-finetuned T5-XL and the original pretrained GPT-J for zero-shot testing.Source: A Implementing Details · pp. 13, 15

IKE

• IKE edits knowledge through copy, update, and retain demonstrations without modifying parameters, making it applicable to existing LLMs.It selects 32 nearest-neighbor demonstrations from a 10,000-example training corpus using all-MiniLM-L6-v2 encodings.Source: A Implementing Details · p. 15

B.1 Basic DataSet

• ZsRE (Levy et al., 2017) uses back-translated question rephrasings, while COUNTERFACT (Meng et al., 2022) targets counterfacts initially scored below correct facts.COUNTERFACT constructs out-of-scope examples by substituting nearby subjects sharing a predicate, distinguishing wording changes from meaningful factual changes. Evaluation follows prior train/test splits (De Cao et al., 2021; Meng et al., 2022; Mitchell et al., 2022a), using training data where required and Natural Questions (NQ; Kwiatkowski et al. (2019)) for locality, following Mitchell et al. (2022a,b).Source: §B.1 · p. 15

B.2.1 One hop

• GPT-4 generates portability questions using few-shot manual demonstrations, with the final dataset formed by intersecting data filtered by T5-XL and GPT-J to ensure prior knowledge of the triples.A model is considered to have prior knowledge when the tail entity appears among its Top-10 link-prediction logits. Link-prediction scores are GPTJ: ZSRE 72.99, COUNTERFACT 69.78; T5: ZSRE 83.90, COUNTERFACT 84.81.Source: §B.2.1 · p. 16

B.2.2 Subject Replace

• Subject replacement tests generalization using Wikidata aliases for available subjects and GPT-4-generated synonyms otherwise.Aliases come from Wikidata’s “Also known as” field and replace the subject in the original question.Source: §B.2.2 · p. 16

B.2.3 Reversed Relation

• Reversed-relation questions test whether edited facts propagate to inverse queries, using manually selected reversible relations from ZsRE.Construction screens relation keywords, including family relationships, and selects reversible relations such as one-to-one relations. Few-shot manual demonstrations prompt GPT-4 to generate reversed questions, excluding relations unsuitable for meaningful reversal.Source: §B.2.3 · p. 16

B.3.1 Other Attribution

• 804 COUNTERFACT instances test whether unrelated attributes of an edited subject remain unchanged.The Wikidata API retrieves subject relationships, from which an unrelated relationship and tail entity are randomly selected. GPT-4 generates a question from the subject and relationship, with the corresponding tail entity supplying the answer.Source: §B.3.1 · pp. 16–17

B.3.2 Distract Neighbor

• 804 COUNTERFACT instances test over-editing by prepending the model edit to neighborhood prompts.Following Hoelscher-Obermaier et al. (2023b), this construction measures whether the edit causes side effects on neighboring facts.Source: §B.3.2 · p. 17

• PIQA (Bisk et al., 2020) is a two-way multiple-choice task testing physical reasoning about objects, used here to assess effects on other downstream tasks.Source: §B.3.3 · p. 17
• 100 COUNTERFACT samples are used to sequentially edit GPT-J for each editing technique before evaluating the resulting models on PIQA.Source: §B.3.3 · p. 17
• Accuracy measures whether the answer option with the lowest perplexity under the post-edit model matches the correct answer.Source: §B.3.3 · p. 17