Source-linked AI summary
On Scope Classification and Current Knowledge-Editing Benchmarks: A Negative Result, with INLAY as a Gradient-Free Case Study
Aditya Pratap Singh
TL;DR
Current knowledge-editing benchmarks cannot measure the scope decisions required by memory-based editors. Using INLAY to execute and score every candidate action, the paper finds no attainable routing gain on existing benchmarks and validates the mechanism with a synthetic missing condition.
Problem
Current knowledge-editing benchmarks cannot reward the scope-classification decision required by memory-based editors.
Method
The paper builds INLAY, a frozen-model gradient-free editor with edits stored in external addressable memory, to execute and score every candidate router action.
Results
An oracle router ties a one-line static policy in all nine cells, leaving 0.00 points of attainable routing gain and no abstention wins across 1,689 queries.
Takeaways & Limitations
The benchmark remedy is to include queries for which the correct answer is that an edit does not apply.
Takeaways & Limitations
The corrected-benchmark evidence uses a synthetic proxy that deletes a query’s own edit card and does not establish behavior on realistic out-of-scope queries.
Abstract
from arXiv · showhide
Every memory-based knowledge editor in the SERAC lineage depends on a scope decision: given a query, does a stored edit apply? We report that current knowledge-editing benchmarks cannot measure this decision at all. Using INLAY, a gradient-free editor we built to obtain exact per-query ground truth (the model is frozen, edits live in an external addressable memory, and applying an edit is a bias added along one token's unembedding direction at decode time), we execute every candidate router action on 1,689 queries spanning three datasets and three input conditions. An oracle router choosing the best action every time ties a one-line static policy to four decimal places in all nine dataset-by-condition cells: the maximum attainable gain of any per-query routing method is 0.00 points. Abstention is the sole winning action zero times out of 1,689. The cause is structural: these are counterfactual benchmarks whose evaluation question asks for the post-edit answer, so answering from parametric knowledge is wrong by construction, and a benchmark without negatives cannot reward a classifier's ability to reject. This generalizes beyond our system to the whole scope-classifier family the benchmarks are used to evaluate. We confirm the mechanism directly: constructing the missing condition ourselves, by withholding a query's own edit from the index for half the sample, moves pooled headroom from exactly +0.0000 to +0.0420 and gives abstention its first wins. We also report where INLAY itself does not win (WISE beats it on Qwen2.5-7B CounterFact, and retrieval-augmented generation beats every method we tested, INLAY included, on rigorously matched RippleEdits), and disclose two bugs found during a self-audit of our own routing machinery, neither of which changed a published headline number outside noise.
1 Introduction
The paper argues that scope classifiers in memory-based knowledge editors cannot be meaningfully evaluated by current counterfactual benchmarks. Using INLAY to obtain exact per-query action outcomes, it finds no attainable routing benefit and identifies missing negatives as the structural cause.
- Scope classification: Scope classifiers decide whether external corrections apply, demonstrations should fire, or the model should answer from parametric knowledge.This decision recurs across architectures pairing a frozen or lightly modified model with external corrections.
- Problem and approach: 1,689 queries across three datasets and three input conditions were evaluated under every candidate action to establish per-query routing ground truth.The actions were reciting a stored edit, reasoning over retrieved evidence, or abstaining.
- Negative result: 0.00 points is the maximum attainable gain for per-query routing: an oracle ties a one-line static policy in all nine dataset-by-condition cells.Abstention is the sole winning action zero times out of 1,689 queries.
- INLAY: INLAY keeps the base model frozen, stores edits externally, and applies them through a gradient-free decoding intervention, enabling identical execution and scoring of candidate actions.The system was built as the vehicle for obtaining exact ground truth rather than as the paper’s sole subject.
- Benchmark diagnosis: Current benchmarks structurally omit negative queries: because each counterfactual question targets an edited fact, answering from parametric knowledge is wrong by construction.The paper therefore characterizes reported routing gains as gate-related harm rather than evidence of decision quality.
3 Method: INLAY
INLAY is a gradient-free external-memory editor designed to execute and score every routing action under controlled conditions. It retrieves edits with a gated semantic key and injects answer-token biases only during decoding, while preserving exact deletion and unchanged behavior when inactive.
- Locality and safety: When the gate does not fire, INLAY adds nothing and the output remains bitwise identical; separate edit rows cannot interfere physically.Logit-space intervention is presented as easier to bound than hidden-state intervention.
- External memory: INLAY freezes the model and stores each edit as an externally addressable row containing a key, answer token sequence, and metadata.Writing is insertion rather than optimization, with measured latency of 5–15 ms; deletion removes the row exactly.
- Keying and retrieval: The editor uses a fixed sentence-encoder key and Johnson–Lindenstrauss projection to keep stored memory stable across base-model swaps.The fixed random projection avoids learned-key drift at the cost of some distortion.
- Gating and playback: A gate combines an absolute similarity threshold, runner-up margin, and relation-residual check before playback begins.The relation check distinguishes the stored relation from queries that merely share the stored subject.
- Gating and playback: During playback, INLAY adds a bias along each answer token’s unembedding column at the corresponding decoding step, leaving positions outside the answer span untouched.The intervention is designed to move exactly one token score at a time.
4 Experimental Setup
Experiments compare INLAY and weight-editing baselines across four model families and multiple knowledge-editing benchmarks and input formats. Subject-disjoint splits and one shared scoring convention support comparisons, while the setup explicitly controls an editing-state bug.
- Models and benchmarks: The evaluation covers GPT-2-XL, GPT-J-6B, Qwen2.5-7B, and Mistral-7B-v0.3 across CounterFact, zsRE, RippleEdits, and AKEW-derived tasks.AKEW conditions include structured, unstructured, and extracted evidence over CounterFact, WikiUpdate, and MQuAKE-CF.
- Evaluation protocol: Subject-disjoint splits prevent entities from crossing train/test boundaries, reducing the possibility of apparent generalization through memorization.All methods are scored with the same diacritic- and case-insensitive substring match against gold answers and aliases.
- Correctness controls: Sequential editing with an explicit state-dict snapshot and restore is used because sequential_edit=False restores weights before generation and therefore evaluates the unedited model.The self-audit discusses this bug and a second bug affecting an earlier matched RippleEdits run.
- Reported comparisons: 95% Wilson intervals accompany GPT-J-6B CounterFact structured-input edit accuracy for n = 147, scored under the shared convention.Figure 2 presents the comparison rather than each method’s internal metric.
5 Results
INLAY leads the GPT-J-6B CounterFact comparison and is substantially faster to write, but WISE wins on Qwen2.5-7B and RAG leads matched RippleEdits. Additional results show extraction noise, corrected multi-hop fallback behavior, and scope-precision limitations.
- 5.1 Edit accuracy and write cost: 0.8926 harmonic-mean score: INLAY leads GPT-J-6B CounterFact at N=2000, ahead of ROME, WISE, AlphaEdit, and MEMIT.INLAY writes in 5–15 ms with no gradient step, roughly 1600× faster than gradient-based editors.
- 5.1 Edit accuracy and write cost: 0.9466 versus 0.8944: WISE beats INLAY on Qwen2.5-7B CounterFact, the only CounterFact setting where INLAY is not strongest.The compared runs use different N values: WISE at N=2000 and INLAY at N=5000.
- 5.2 Non-structured evidence: 78.23% versus 87.07%: INLAY is less accurate on extracted than unstructured evidence despite 98.64% retrieval accuracy in both conditions.The reported gap locates the loss in extraction noise rather than retrieval.
- 5.3 Multi-hop: 47.5% after the per-hop fallback fix: answering retrieval-miss hops from parametric knowledge improved the same MQuAKE-CF sample from the initial 5.0%.The naive single-shot baseline scored 22.5%, while the initial iterative loop returned no answer on every sampled failure.
- 5.4 Compositional propagation: RippleEdits: 0.3964 on GPT-J-6B and 0.4381 on Qwen2.5-7B: RAG leads every method in matched RippleEdits, while INLAY scores 0.2253 and 0.2871.The matched protocol uses identical wikidata-verified subjects, generation-based scoring, and independent edit-application verification.
- 5.4 Compositional propagation: RippleEdits: Scope precision on hard negatives remains INLAY’s open problem, and RippleEdits can expose it because it includes same-subject, different-relation queries.This limitation distinguishes RippleEdits from CounterFact or zsRE, which lack such negatives.
6 The Limits of Routing on Current Benchmarks
The paper measures routing’s attainable ceiling directly and finds no meaningful per-query routing opportunity on current benchmarks. A learned reliability head’s gains reflect suppression of harmful fixed gates, not genuine scope-dependent decisions.
- 6.2 Measuring the ceiling: 1,689 queries were evaluated by executing every candidate action and scoring each outcome to obtain per-query ground truth.The candidate actions were recitation, reasoning over retrieved evidence, and abstention.
- 6.2 Measuring the ceiling: 0.00 points is the maximum attainable gain over a one-line static policy across all nine dataset-by-condition cells.The oracle router ties the static policy to four decimal places in every cell.
- 6.2 Measuring the ceiling: 0 times did abstention uniquely win, because its 19 successes were duplicated by direct recitation or reasoning.Its per-action success rate lies near the floor in every cell.
- 6.1 A second-order signal: +15.9 points from the adaptive reliability head measured suppression of harmful fixed gates rather than useful per-query routing.The head achieved 0.956 AUROC on a held-out dataset and improved two MQuAKE-CF cells.
7 Why Abstention Cannot Be Measured Here
Current counterfactual benchmarks cannot measure whether a stored edit should be rejected because every query targets an edited fact. Constructing missing-index negatives makes abstention correct and creates measurable routing headroom.
- Why the benchmark is degenerate: Counterfactual evaluation asks for the post-edit answer, making parametric answers wrong by construction.The benchmark suite contains no query where no edit applies and the model should answer from prior knowledge.
- Why the benchmark is degenerate: A benchmark without negatives cannot measure a scope classifier’s ability to reject, so abstention can only lose points.On these suites, the scope decision is degenerate: the answer is always “yes.”
- Where negatives exist: RippleEdits contains partial negatives, and precisely there INLAY’s preservation weakness appears while every method’s aggregate score drops.Scope precision matters where benchmarks include same-subject, different-relation queries.
- Constructing the missing condition: +0.0420 pooled headroom emerged after each query’s own edit was withheld from the index for half the sample.The edit-removed population carried essentially all new headroom at +0.0785.
- Constructing the missing condition: 52/1689 queries made REJECT the only correct action after the edit-removal intervention.These synthetic negatives establish the mechanism, not a deployment-realistic estimate of routing value.
8 Auditing Our Own Machinery
A self-audit found two routing-related bugs, but reruns showed no published headline correction was needed. The audit also bounds when the margin gate can matter and leaves compositional preservation unresolved.
- Margin gate: 0.5667 to 1.0 locality improvement occurred on GPT-2-XL when the margin swept from 0 to 0.15 in a 400-edit sequential test.The corresponding score moved from 0.7221 to 0.9975; the gate was a no-op in single-edit headline protocols.
- Margin gate: The margin gate affected multi-slot regimes, not single-edit-per-example CounterFact and zsRE headline results.Those protocols clear memory before every write, leaving no competing edit for the margin gate.
- Relation-gate bypass: The relation gate was bypassed in matched-RippleEdits generation, but fixing it produced deltas within noise and required no Table 1 correction.The generation path checked only absolute similarity and skipped margin and relation-residual gates.
- Remaining limitation: Compositional-preservation weakness remains an open limitation after activating the relation gate.The audit states that the weakness was not solved at the tested operating point.
9 Conclusion
The paper concludes that current counterfactual benchmarks cannot measure scope-classifier decisions, while INLAY provides a useful but limited gradient-free editing system.
- Conclusion: A one-line static policy is provably optimal on all 1,689 tested queries because abstention is never correct on these counterfactual benchmarks.This is presented as a benchmark-level limitation affecting the SERAC-descendant architecture family.
- Conclusion: INLAY freezes model weights and stores edits in external addressable memory, enabling roughly 1600× cheaper writes, exact deletion, and locality by construction.Its trade-off is reciting stored facts rather than reasoning with them.
- Conclusion: The reported results include cases where INLAY loses: WISE wins on Qwen2.5-7B CounterFact, while RAG wins on rigorously matched RippleEdits.The paper reports these comparisons without qualification.
- Conclusion: All numbers come from logged, subject-disjoint runs, with code, experiment write-ups, and the figure generator released alongside the paper.The held-out dataset was not used during training of learned components.
Limitations
INLAY’s recitation mechanism, scope gate, evidence base, and evaluation setting impose important limits on how broadly its results should be interpreted.
- INLAY limitations: INLAY structurally recites stored answers and cannot combine them with additional reasoning during final decoding.This limitation applies to INLAY specifically, not to the paper’s benchmark-coverage claim.
- INLAY limitations: Scope precision on hard negatives remains INLAY’s open problem, especially for same-subject, different-relation queries.RippleEdits exposes this preservation weakness because it contains partial negatives, unlike the main single-fact benchmarks.
- Statistical limitations: +6.4 points in structured-mode MQuAKE-CF rests on four discordant pairs, making the result suggestive rather than established.The smallest attainable exact McNemar p-value is 0.125.
- Evaluation limitations: The evaluation uses one encoder and one cross-encoder verifier, so sensitivity to retrieval-stack choices remains untested.This constrains conclusions about retrieval robustness.
- Evaluation limitations: WikiUpdate is 4.38 points worse at 7B than at 1.5B, an unresolved scale anomaly linked to refusal-sensitive evaluation.The larger model refuses more often on noisy evidence, while substring accuracy treats refusal like an incorrect answer.
- Benchmark limitations: The missing out-of-scope condition is only a synthetic proxy created by deleting each query’s own edit card from an intact index.It yields +0.0420 pooled headroom but does not characterize real out-of-scope queries.
- Comparison limitations: Several method comparisons remain incomplete because some models and methods lack matched CounterFact or RippleEdits results.These gaps are reported as open rather than assumed favorable.
Ethics Statement
INLAY’s external memory supports verifiable deletion but also creates an access-control risk because stored edits can override a frozen model at decode time.
- Deletion: Deleting an INLAY edit removes an external memory row, leaving no residual trace in model weights.This property is directly relevant to systems requiring complete deletion.
- Deletion: External addressable memory is presented as a plausible substrate for right-to-be-forgotten and GDPR-style deletion requirements.Gradient-based methods lack a comparable completeness guarantee for unlearning.
- Dual use: The same fast, silent override mechanism that enables deletion also enables misinformation injection when the memory store lacks access control.Memory writes are easier to perform and may leave less infrastructure-level audit trail than weight updates.
- Safety boundary: Locality protects unrelated queries only when the gate does not fire; a misrouted stale edit can confidently return a wrong answer.The user receives no signal that the stored answer overrode parametric knowledge.
A Full Edit-Accuracy Tables
The appendices provide complete edit-accuracy and cost tables across model families, while separating RippleEdits propagation from preservation results.
- Metrics: The full tables cover edit success, paraphrase success, neighborhood specificity, harmonic-mean score, and per-edit write cost.Dashes indicate metrics not reported in the source logs.
- CounterFact: Table 4 reports complete CounterFact results across all four model families, including headline Section 5 runs.The table includes metric and comparability annotations for selected runs.
- zsRE: Table 5 reports corresponding zsRE results under the same metrics and four model families.Its annotations identify Mistral gap-fill runs and dataset-specific ranking differences.
- RippleEdits: Table 6 separates propagation and preservation components underlying the matched-manifest RippleEdits aggregates.This decomposition is sourced from the audit addendum.