PaperlayerView exact revision on arXiv

Source-linked AI summary

From Latents to Wires: Surgical Post-Editing on Large Language Models

Jiankai Jin, Xiangzheng Zhang, Zhao Liu, Wenzhuo Xu, Dongdong Yang, Deyue Zhang, Quanchen Zou

arXiv:2609.32434v1cs.AI

TL;DR

The paper asks whether an operator can name a semantic target in a trained model, locate the components producing it, and remove it while preserving other capability. L2W uses Jacobian-lens localization and counterexample-guided component closure, followed by restoration. Experiments support its use for watermark and other target removal, and position post-editing as complementary to post-training.

  • Problem

    Prior editing methods fix their target in advance, leaving the challenge of locating components for a semantic target an operator names in text.

    Source: §1 · p. 1

  • Method

    L2W uses Jacobian-lens attribution to nominate target-producing components, iteratively closes routes exposed by surviving target expressions, and reopens unnecessary closures.

    Source: §1 · p. 2, §5 · p. 5

  • Results

    Experiments remove an implanted watermark and evaluate metadata self-claims, adult-content refusal, and sequential text-to-image post-edits, with most removals completing while capability remains intact.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Post-editing can complement post-training by removing named unwanted behaviours after training installs preferred ones.

    Source: §8 · p. 10

    For refusal removal, L2W leaves a benchmark deficit after restoration, although it removes the target completely in all three configurations.

    Source: §7 · p. 9

Abstract

from arXiv · show

Given a large language model (LLM), can whoever holds the weights name a semantic target (e.g., the model's identity), locate the model components that produce it, and edit them so that the target no longer appears while other capability is preserved? We call such an edit on a trained model a post-edit. We present L2W (latents to wires), a framework that performs surgical post-edits for named semantic targets. For localization, L2W uses Jacobian lens (J-lens) attribution to score components against the semantic target. For surgical removal, because LLM mechanisms are redundant (i.e., a semantic target may have multiple components producing it), L2W runs Counterexample-Guided Causal Cut (CGCC) until the target no longer appears. CGCC first cumulatively closes model components, treating each surviving expression of the target as a counterexample that exposes the next components to close, and then reopens some of them to preserve capability. In a controlled experiment with an implanted behavioural watermark, L2W removes the watermark, and its localization lands on the model region the implant changed. Across three model configurations, L2W removes model-metadata (e.g., identity) self-claims in all nine runs, and adult-content refusal in all three, with no held-out target residual. L2W further composes two post-edits on a text-to-image model: one removes the refusal of requested nudity, and a second removes the nude rendering the first exposes. The results support post-editing as a complement to post-training: post-training installs preferred behaviours, and post-editing removes named unwanted ones.

1 INTRODUCTION

Open weights make trained models editable, but removing a named target requires locating the components that produce it. L2W combines localization with iterative closure and restoration, and experiments test it on watermarks, model metadata, refusal, and sequential post-edits.

1 INTRODUCTION

  • Open-weight models can be altered by their holders, but overwriting component weights has hard-to-predict effects; closing instead removes that component’s output.The central challenge is finding a set of components whose closure stops a semantic target from appearing.Source: §1 · pp. 1–2
  • L2W uses Jacobian-lens attribution to nominate components, then CGCC closes additional routes exposed by surviving target expressions and restores unnecessary closures.The restoration pass reopens components whose removal is not needed to suppress the target.Source: §1 · p. 2
  • The controlled watermark cut lands on the implant-altered region, and experiments also test metadata self-claims, adult-content refusal, and sequential text-to-image post-edits.Across the experiments, most removals complete with capability intact.Source: §1 · p. 2
  • Post-editing names a target in natural language and closes components producing it while aiming to preserve other capability.The paper frames post-editing as an edit to a trained model, complementary to post-training.Source: §1 · pp. 1–2

2 RELATED WORK

Related work studies localization, component ablation, model editing, unlearning, and training-time compartmentalization. L2W differs by taking a text-named target and producing a cut intended to remove it.

2 RELATED WORK

  • The Jacobian lens derives token directions from model weights and uses layer activations to measure each token’s expression at each position.L2W repurposes the lens to locate components producing a semantic target.Source: §2 · pp. 2–3
  • Circuit-discovery methods accept tasks expressed as metrics over curated input pairs, while L2W takes a target named in text and outputs a cut rather than an explanatory subgraph.L2W uses J-lens attribution to nominate components; Bair et al. (2026) instead estimate per-head contributions through random head knockouts and sparse linear inversion.Source: §2 · p. 3
  • Post-hoc localization work finds sparse alignment features and overlapping refusal features, but these approaches fix the target before analyzing it.Prakash et al. (2025) report that ablating one refusal feature can reactivate overlapping features that preserve the behaviour.Source: §2 · p. 3
  • Model editing rewrites memorized facts through weight updates or auxiliary editors, while L2W locates components producing the target at inference.Hase et al. (2023) report that causal-tracing locations barely predict where an edit succeeds.Source: §2 · p. 3
  • Unlearning updates a wide range of parameters and suppressed behaviour can persist; directional ablation removes a fitted refusal direction, while L2W makes an explicit component cut.Watermark removal often uses fine-tuning and pruning; structured pruning instead aims to shrink models while mostly preserving capability.Source: §2 · p. 3
  • Training-time compartment methods steer a chosen capability into a pre-designated model region, avoiding the post-hoc search for that region.Examples include Gradient Routing, Selective GradienT Masking, and GRAM.Source: §2 · p. 3

3 PROBLEM FORMULATION

The problem is to find a set of components whose closure removes a natural-language-named semantic target while preserving other capability. The formulation distinguishes probes for removal, restoration, and held-out evaluation.

3 PROBLEM FORMULATION

  • The operator holds the model weights, chooses intervenable components, names a semantic target in a short natural-language description, and registers a judge rubric.The rubric instructs an LLM judge to decide whether an output exhibits the target.Source: §3 · p. 3
  • The task is to find a component cut that stops the target from appearing in responses while preserving other capability.The formulation defines a post-edit around closure of the selected components.Source: §3 · p. 3
  • Target-Semantic probes elicit the target and determine whether removal succeeds; General-Capability probes measure capability for restoration; held-out Target-Conditioned Capability probes test both outcomes.The held-out probes are invisible to the removal and restoration loops.Source: §3 · pp. 3–4
  • An LLM judge marks a target-bearing response as a failure, after which an analyst identifies its manifestation and anchor tokens and records a witness.Witnesses are grouped into branches by manifestation class and closed support, with changed support opening a new branch.Source: §3 · p. 4
  • Closing a component zeroes its output at every token position, and the search can close either single components or groups judged together.The physical support of a set of search units is the set of components actually closed.Source: §3 · p. 4

4 J-LENS LOCALIZATION

L2W uses the J-lens to score model components against an anchor token chosen from a target-expressing response. It contrasts target and reference responses to nominate components for closure.

4 J-LENS LOCALIZATION

  • The J-lens transports residual writes toward the final layer and scores them against a direction associated with the anchor token.A residual write aligned with that direction pushes the model toward emitting the token.Source: §4 · p. 4
  • The analyst selects the earliest decisive cue in a response as the anchor, which may precede the most explicit phrase.For a refusal, “sorry” can establish the target before “I cannot.”Source: §4 · p. 4
  • Component writes are measured at the generation boundary immediately before each anchor token, isolating the state that produces it.The component’s write is into the layer residual stream.Source: §4 · p. 4
  • Reference responses provide a non-target contrast, so δ retains the component’s added push in the target case rather than generic token preference.For example, a refusal witness “I → cannot” can be paired with “I → can.”Source: §4 · p. 4
  • Components are ranked within each layer by δ aggregated over the anchor’s tokens, and the highest-scoring are nominated for closure.The scoring accommodates gated MLP channels, attention units, and routed mixture-of-experts outputs.Source: §4 · p. 4
  • Attribution records retain witness, branch, closed-support, component-location, anchor-position, and score provenance.Closing a unit zeroes its contribution at every token position.Source: §4 · pp. 4–5

5 COUNTEREXAMPLE-GUIDED CAUSAL CUT

CGCC iteratively closes components exposed by target-bearing probe responses, then reopens closures when doing so preserves removal and capability. Its search proceeds from later to earlier layers, with held-out probes checking the final state.

5 COUNTEREXAMPLE-GUIDED CAUSAL CUT

  • Removal succeeds only after every Target-Semantic probe has been run and none still expresses the target; residual expressions trigger another search iteration.Each failing response provides anchor tokens for J-lens nominations.Source: §5 · p. 5
  • A candidate closure is admitted if it clears at least one counterexample without increasing their total, or sufficiently lowers the anchor-token logit margin without a new probe failure.Candidates are screened independently; their joint effect is checked on the next probe pass.Source: §5 · p. 5
  • CGCC searches one layer per iteration from later to earlier, carries unverified nominations upstream, and stops with an incomplete removal if its budget expires with residuals.The cut grows during removal, and the resulting support is fixed even when removal is incomplete.Source: §5 · pp. 5–6
  • Restoration starts from the fixed removal support and prioritizes reopening groups with the weakest recorded target attribution.Groups are formed from shared branch evidence and attribution-score gaps.Source: §5 · p. 5
  • A coarse-to-fine restoration search tests reopened groups against complete target and capability probes, then can keep only the subset that must remain closed.A state is preferred when target residuals do not increase and capability passes do not decrease; ties favor reopening more components.Source: §5 · p. 5
  • Held-out probes assess the fixed reopened state; target regression is reported as partial success, while safe reopening without improvement yields cut simplification.The remaining closed components form the preservation support.Source: §5 · pp. 5–6

6 EXPERIMENTS

Across four experiments on open-weight models, L2W removes named semantic targets through component localization and iterative closure, then restores some closed components to recover capability. Results span watermark and metadata removal, adult-content refusal, directional-ablation comparison, and sequential post-editing on a text-to-image model.

6 EXPERIMENTS

  • For every language-model task, evaluation uses three probe classes—Target-Semantic, General-Capability, and held-out Target-Conditioned Capability—with a fixed ten-probe General-Capability set shared across those experiments.The four experiments cover Qwen3.5-4B, GLM-4.7-Flash 31B, and FLUX.2 [klein] 4B (text-to-image).Source: §6 · p. 6

6.1 MODEL WATERMARK REMOVAL

  • The single-route watermark is removed at no capability cost, with the cut landing on the implanted layer and its top-ranked channels at the implant’s chokepoint.The cut closes nine components, two of which are implanted channels; restoration leaves one implanted channel as the final cut.Source: §6.1 · p. 7
  • The dispersed watermark requires a cut over thirty times larger than the single-route cut, and restoration only partly recovers capability.Removal closes 315 components and drops general-capability probes to 5/10; restoration raises them to 8/10.Source: §6.1 · p. 7

6.2 MODEL METADATA REMOVAL; 6.3 REFUSAL REMOVAL

  • All nine metadata runs and all three refusal runs clear their semantic probes with no held-out target residual; six metadata runs leave general capability uncompromised.Restoration reopens components in eight of nine metadata runs and returns refusal runs to full capability on the general and held-out probes.Source: §6.2 · p. 7, §6.3 · p. 8

6.3 REFUSAL REMOVAL

  • L2W clears every refusal probe in all three configurations, while restoration returns general capability and held-out probe performance to full.Removal costs vary: GLM falls to 3/10 on general-capability probes, while Qwen and GLMthink each score 9/10.Source: §6.3 · p. 8

6.4 CAPABILITY COST ON BENCHMARKS

  • Benchmark costs are greatest for entangled targets: refusal and dispersed-watermark removals leave substantial deficits after restoration, while restoration recovers some capability.For refusal, Qwen ends 23 IFEval points below baseline and GLM 17 points below; GLMthink ends within five points.Source: §6.4 · p. 8

6.5 COMPARISON WITH DIRECTIONAL ABLATION

  • Against directional ablation, L2W clears all three refusal configurations with no held-out residual, while ablation leaves residues on both thinking-disabled models.Directional ablation retains baseline benchmark scores; L2W incurs capability costs, and with thinking enabled finishes three to seven points below ablation.Source: §6.5 · pp. 8–9

6.6 COMPOSING TWO POST-EDITS ON A TEXT-TO-IMAGE MODEL

  • Two sequential post-edits on FLUX.2 [klein] 4B remove refusal of requested nudity, then remove the nude rendering that the first edit exposes.The second removal reaches 424 cumulative components after 79 further CGCC iterations; the trajectory passes a gray bodywear residual before ordinary clothing.Source: §6.6 · p. 9, Figure 2 · p. 9

7 DISCUSSION

Refusal removal is the setting where L2W incurs its largest capability cost, and restoration leaves benchmark deficits. The discussion proposes structural dispersal and entanglement as a possible mitigation against cuts that remove safety behaviours.

Limitations

  • After refusal removal, benchmark deficits remain after restoration, although they are smallest with thinking enabled.L2W still removes the target with no held-out residual and restores full capability on the probes.Source: §7 · p. 9

Structural dispersal as a mitigation

  • Training a behaviour to be more dispersed and entangled may make it harder to remove without collateral capability loss.In the watermark dispersal ablation, three routes require a cut over thirty times larger, and restoration only partly recovers capability.Source: §7 · p. 9
  • The proposed mitigation could require an explicit training objective, with the watermark ablation illustrating a capability cost for dispersal.The passage frames structural dispersal as a potential defense, not a demonstrated guarantee against post-edits.Source: §7 · p. 9

8 CONCLUSION

L2W treats each surviving expression of a target as a counterexample that exposes another route to close. The authors frame post-editing as a complement to post-training, which installs preferred behaviours.

8 CONCLUSION

  • Post-editing removes named unwanted behaviours while post-training installs preferred behaviours, and the two naturally compose.The conclusion describes CGCC as closing routes revealed by surviving target expressions until the target no longer appears.Source: §8 · p. 10

ETHICS STATEMENT

  • The authors acknowledge that removing a named behaviour could also remove a safety behaviour, while their refusal target is limited to fictional adult-content writing involving consenting adults.The watermark experiments use the authors’ own watermark on a local open-model copy, not a deployed provenance system.Source: ETHICS STATEMENT · p. 10

A J-LENS ATTRIBUTION ALGORITHM

  • L2W’s J-lens algorithm scores layer components against anchor-token contribution directions and ranks nominations using witness records.The records retain manifestation class, witness, layer, component, token position, score, and support.Source: A J-LENS ATTRIBUTION ALGORITHM · p. 15

B WATERMARK IMPLANT PROTOCOL

  • The watermark protocols train either eight MLP channels in layer 30 or eight channels in each of layers 10, 20, and 30.The single-route and three-route audits report zero changes outside their respective tunable regions.Source: B WATERMARK IMPLANT PROTOCOL · p. 15

C SEMANTIC TARGETS OF THE METADATA REMOVALS

  • Metadata-removal targets are self-claims judged by semantic meaning, so aliases and format variants count while factual correctness is not required.For example, a version-qualified Claude counts as Claude, and a GLM self-attribution can be a target despite being wrong.Source: C SEMANTIC TARGETS OF THE METADATA… · p. 15, Table 2 · p. 16

D ANCHOR DRIFT DURING SEMANTIC TARGET REMOVAL

E JUDGE AND ANALYST ACCURACY

The authors audited judge and analyst outputs replayed from metadata and refusal-removal runs against human review. The thinking-enabled GLM protocol lets the analyst inspect traces as well as responses.

E JUDGE AND ANALYST ACCURACY

  • The audit uses 250 samples: 50 per metadata task and 100 for refusal, with human reference verdicts for judge samples and reviewer-confirmed anchors for analyst samples.Judge samples are balanced between target-present and target-absent outputs; analyst samples come from target-bearing responses.Source: E JUDGE AND ANALYST ACCURACY · p. 16, Table 4 · p. 16

F THINKING-ENABLED GLM PROTOCOL

  • For thinking-enabled GLM runs, the judge reads only the response, while the analyst reads the trace and response and selects the earliest decisive cue.Analyst inputs grow through 512-, 1,024-, 2,048-, and 4,096-token prefixes before the full output; refusal anchors almost always require the full output.Source: F THINKING-ENABLED GLM PROTOCOL · p. 16

G BENCHMARK PROTOCOL AND SCORES

The benchmark protocol evaluates baseline, post-removal, and post-restoration states. It reports MMLU, ARC-Challenge, and IFEval scores, with higher scores indicating better performance.

G BENCHMARK PROTOCOL AND SCORES

  • MMLU uses five demonstrations and ARC-Challenge uses twenty-five, while IFEval is zeroshot over 541 prompts with greedy generation.IFEval reports the fraction of prompts whose every verifiable instruction is satisfied.Source: G BENCHMARK PROTOCOL AND SCORES · p. 17
  • Each model keeps the same chat template and scoring settings across its three evaluation states, but thinking-enabled GLM uses a fixed 10% MMLU subset.That subset contains 1,404 questions drawn across all 57 subjects.Source: G BENCHMARK PROTOCOL AND SCORES · p. 17
  • Table 5 reports baseline, post-removal, and post-restoration scores for MMLU accuracy, ARC-Challenge length-normalized accuracy, and IFEval prompt-level strict accuracy.The table’s scores are higher-is-better.Source: Table 5 · p. 17, G BENCHMARK PROTOCOL AND SCORES · p. 17

H DIRECTIONAL-ABLATION BASELINE PROTOCOL

The directional-ablation baseline forms refusal directions from contrasting probe sets and selects candidates using negative-prompt gates. The selected direction is projected out across layers and token positions.

H DIRECTIONAL-ABLATION BASELINE PROTOCOL

  • Candidate refusal directions are differences between positive and matched negative sets’ mean residual activations at one layer and assistant-template suffix position.The candidate pool sweeps layers outside the final 20% and suffix positions; for thinking-enabled GLM, it sweeps layers at the trace-closing token.Source: H DIRECTIONAL-ABLATION BASELINE PROTOCOL · p. 17
  • A candidate must keep negative-prompt next-token KL divergence at or below 0.1 and induce refusal on those prompts to pass the two selection gates.Among eligible candidates, selection favors the direction whose ablation leaves the least refusal on positive prompts.Source: H DIRECTIONAL-ABLATION BASELINE PROTOCOL · p. 17
  • The selected direction is projected out of the residual stream at every layer and token position, and Table 6 compares it with L2W on three refusal runs.The gates assess refusal from next-token probabilities, while reported outcomes use the same LLM judge as the other experiments.Source: H DIRECTIONAL-ABLATION BASELINE PROTOCOL · p. 17

I TEXT-TO-IMAGE POST-EDITING PROTOCOL

The text-to-image protocol fixes generation conditions and confines edits to the text encoder, using a CLIP similarity margin to score the target.

I TEXT-TO-IMAGE POST-EDITING PROTOCOL

Related papers

Loading 2609.32434v1…