Can Fine-Tuning Erase Your Edits? On the Fragile Coexistence of Knowledge Editing and Adaptation

AI summary

Overview

Research area: Natural Language Processing, specifically the interaction between two post-training interventions for large language models: knowledge editing (KE) and fine-tuning (FT), including parameter-efficient variants such as LoRA and DoRA. Published at the 32nd ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD '26).

Technical level: Intermediate. The paper assumes familiarity with transformer LLMs, PEFT methods, and standard KE benchmarks and metrics, but its framing question is easy to grasp: do edits survive fine-tuning?

Scope in one sentence: A 254-configuration empirical study quantifying how much knowledge edits decay after subsequent fine-tuning, plus layer-level and activation-level analysis explaining why, and practical strategies for removing edits.

What This Paper Is About

Knowledge editing offers a lightweight way to update facts in an LLM, while fine-tuning remains the default way to adapt an LLM to new domains and tasks. These two interventions have been studied almost entirely in isolation, leaving an open practical question: if an edited model is subsequently fine-tuned, do the edits survive? The stakes run in both directions—if fine-tuning erases edits, beneficial corrective edits must be reapplied after every adaptation step, and if edits persist, fine-tuned models may silently inherit covert or malicious edits. The paper systematically measures edit decay after fine-tuning and analyzes why edits are fragile.

Key Contributions

1. First systematic study of fine-tuning's impact on knowledge editing. The authors cover 254 independent model configurations spanning methods, architectures, edit scales, and datasets, and introduce an evaluation framework plus the Edit Flip Ratio (EFR) metric to quantify, at the individual-edit level, how many successful edits become unsuccessful after fine-tuning.

2. Multi-level mechanistic analysis. At the edit level, they identify four behavior categories (Stable, Erased, Emergent, Impossible) and analyze them against knowledge domain and frequency. At the activation level, they show that fine-tuning induces larger activation shifts than knowledge editing, explaining why edits are erased.

3. Practical strategies for edit removal. They show that fine-tuning only the edited layers or only the non-edited layers removes edits more effectively than tuning all layers, at the cost of a modest loss in downstream fine-tuning performance.

4. Public release of code and results, available at the linked GitHub repository (Cheng-Yinjie/edit_decay_KDD) and a Zenodo DOI.

Main Findings

• Fine-tuning generally erases edits. Across configurations, editing performance declines after subsequent fine-tuning, with only four exceptions where performance was comparable to the pre-fine-tuning edited model. LoRA on Llama2 after 1,000 zsRE edits with AlphaEdit produced the largest drop reported in the main results table, from 93.23% to 50.45%.

• AlphaEdit is the most fragile editing method. The abstract highlights the greatest decay for AlphaEdit on the zsRE benchmark applied to GPT-J, where 25.27% of previously successful edits become unsuccessful after fine-tuning. On Llama2, LoRA reduced MEMIT (100 edits) performance by 9.73 percentage points versus 35.37 percentage points for AlphaEdit, a gap of 25.64 percentage points; at 10,000 edits the gap widened to 33.50 percentage points. The authors attribute this to AlphaEdit's null-space vulnerability: because the null space is nearly orthogonal to the existing knowledge space, its representation is not used to compute the fine-tuning loss, so fine-tuning can freely introduce conflicting information there.

• Full fine-tuning is more destructive than parameter-efficient methods. Average decreases across all models were 38.10% for full fine-tuning, versus 28.71% for LoRA and 29.88% for DoRA. DoRA demonstrated a slightly stronger ability to remove edits than LoRA. Models fine-tuned on HotpotQA exhibited larger decays than those fine-tuned on Commonsense.

• Emergent edits exist. Fine-tuning on unrelated data can make previously unsuccessful edits succeed. With MEMIT editing 1,000 facts on GPT2-XL, full fine-tuning increased Efficacy Success by 3.37 percentage points. The authors attribute this to conflict resolution between competing batch edits.

• Decay depends on the editing dataset. Models edited with zsRE generally declined more than those edited with CounterFact. For GPT-J edited with MEMIT on 10,000 facts and LoRA fine-tuned, the zsRE-edited model decreased 25.35 percentage points more than the CounterFact-edited model (30.11 versus 4.76). The suggested cause is stricter evaluation: CounterFact counts an edit as successful if the edited object has higher probability than the original, while zsRE requires correct generation of the edited object.

• Model architecture matters. GPT-J was the most stable under fine-tuning with an average decrease of 15.93%, followed by Llama2 at 39.92%, while GPT2-XL showed the largest variability at 40.84%. The authors suggest GPT-J's larger MLP projection matrix (16384 × 4096 versus Llama2's 14336 × 4096) may contribute to higher editing robustness.

• EFR and efficacy change can diverge. On zsRE, EFR and the decrease in Efficacy Success followed similar trends, suggesting flips account for the observed drop. On some CounterFact cases, EFR exceeded the efficacy decrease, indicating reverse flips (fail to success) that offset some removals.

• MEND follows the same decay pattern. As the number of edits increased, fine-tuning removed a larger proportion of applied edits. On CounterFact, MEND's editing performance was already near 0.00 in the reported settings, consistent with prior findings that MEND performs poorly in zero-shot-style settings.

• Layer-selective fine-tuning reveals a counterintuitive result. Fine-tuning only the edited layers removed more prior edits than fine-tuning all layers, but also degraded downstream performance. Fine-tuning only the non-edited layers did not preserve edits as hypothesized—it erased more edits than all-layer fine-tuning. For Llama2 edited with AlphaEdit on CounterFact (100 edits), Efficacy Success was 98.00% for all-layer fine-tuning, 66.00% for edited-layer fine-tuning, and 72.00% for non-edited-layer fine-tuning, against 96.00% for the edited-only model. Downstream scores were 81.7 for all-layer, 65.43 for edited-layer, and 80.61 for non-edited-layer fine-tuning. The ordering for edit removal is edited-layer > non-edited-layer > all-layer, while for downstream performance it is all-layer > non-edited-layer > edited-layer.

• Edits are localized, fine-tuning is global. Activation analysis showed edited-only models present major changes in layers spanning the edited range, while fine-tuning affects a broader range of layers. Fine-tuned models exhibited substantially larger magnitude changes than non-fine-tuned counterparts across all layers, and fine-tuning produced larger and more coherent representational shifts than knowledge editing, both in magnitude and direction.

• Knowledge editing moderately reduces later fine-tuning effectiveness. The authors report that this degradation is not attributable to catastrophic forgetting, since edited-then-fine-tuned models maintained comparable downstream performance to fine-tuned-only models. LoRA achieved the smallest average performance degradation while DoRA provided the most consistent stability across models; GPT2-XL was most robust to editing; MEMIT generally preserved fine-tuning performance better than AlphaEdit. Table 8 reports average degradation in evaluation score across models of 14.69% for full fine-tuning, 6.02% for LoRA, 6.88% for DoRA, and -49.46% for the no-fine-tuning condition.

• Qualitative patterns. Stable edits typically involve frequent lexical items such as "English", "Islam", and "piano". Erased edits tend to involve less frequent terms such as "Lecanorales", suggesting frequency and entrenchment influence stability. When an edit is erased, the model often does not revert to the original answer but defaults to a higher-frequency alternative: when "Philadelphia" was removed, the model output "London" rather than the original "Paris". Impossible edits were never successfully introduced—for example, both the edited and edited-then-fine-tuned models returned "1 May 1977" instead of the expected "12 May 1977", which the authors suggest may reflect a bias from pre-training data related to Labour Day.

Methodology in Plain English

The authors construct four groups of models for comparison: base models with neither editing nor fine-tuning; fine-tuned-only models; edited-only models; and edited-then-fine-tuned models. They measure the editing performance gap between the edited-only and edited-then-fine-tuned models to quantify how much fine-tuning removes.

The experimental grid is a Cartesian product of five dimensions: models (GPT2-XL, GPT-J, Llama2, Llama3.1, and DeepSeek, the last excluded due to poor editing performance), datasets (CounterFact and zsRE), editing methods (MEND, MEMIT, AlphaEdit), numbers of edits (100, 1,000, 10,000), and fine-tuning methods (LoRA, DoRA, full-parameter fine-tuning), yielding 254 configurations. Fine-tuning uses the Commonsense Reasoning dataset (seven multiple-choice datasets and one yes-or-no dataset) and HotpotQA (97,900 entities).

Evaluation uses standard knowledge editing metrics—Efficacy Success, Paraphrase Success, and Neighborhood Success—plus the newly introduced Edit Flip Ratio, defined as the number of edits that succeed before fine-tuning but fail after, divided by the total number of successful edits before fine-tuning. Downstream fine-tuning performance is measured as accuracy.

Two additional experiments probe the mechanism. First, layer-selective fine-tuning: training only the layers that knowledge editing modified, only the layers it did not modify, or all layers, then comparing editing metrics and downstream scores. Second, an activation-space analysis on a diagnostic prompt set of two groups of 40 prompts each—one group querying edited knowledge, one drawn from

Authors’ abstract

Knowledge editing (KE) offers a lightweight alternative to retraining for updating large language models (LLMs). Meanwhile, fine-tuning remains the default operation for adapting LLMs to new domains and tasks. Despite their widespread adoption, these two post-training interventions have been studied in isolation, leaving open a crucial question: if we fine-tune an edited model, do the edits survive? This question is motivated by practical objectives: removing covert or malicious edits, and preserving beneficial edits. If fine-tuning impairs edits (Fig.1), current KE methods become less efficient, as a newly fine-tuned model requires re-editing; if edits persist, fine-tuned models risk propagating hidden malicious edits, raising serious safety concerns. To this end, we systematically quantify edit decay after fine-tuning across 254 experimental configurations. Our results show that in general, edits decay substantially after subsequent fine-tuning. AlphaEdit exhibits the greatest decay on the zsRE benchmark when applied to GPT-J, where 25.27% of previously successful edits become unsuccessful after fine-tuning. We further find that fine-tuning only the edited layers is sufficient to effectively remove edits, while incurring only modest degradation in downstream performance. Surprisingly, fine-tuning non-edited layers leads to greater edit decay than all-layer fine-tuning. Besides, our activation space analysis reveals that fine-tuning produces a larger and more coherent representational shift, both in magnitude and direction, than KE. Overall, our study underscores the necessity of evaluating KE within the broader LLM application pipeline.