On the Robustness of Knowledge Editing for Detoxification

Technical Summary: On the Robustness of Knowledge Editing for Detoxification

1. Problem Statement

Knowledge Editing (KE)-based detoxification has emerged as a method to mitigate harmful behaviors in Large Language Models (LLMs) by intervening in internal representations or parameters. However, the authors identify a critical flaw in current evaluation paradigms: most studies rely solely on automatic toxicity classifiers. This approach assumes that a lower toxicity score equates to successful behavioral suppression.

The authors argue this is a potentially false assumption due to two main issues:

• Pseudo-detoxification: Models may appear "safe" because they fall into degenerate generation patterns (e.g., repetitive loops like "Car. Car. Car.") which classifiers do not flag as toxic, even though the model has failed to provide a meaningful refusal.
• Lack of Robustness Testing: Existing methods are rarely tested against hyperparameter variations, the accumulation of multiple unsafe behaviors (compositionality), or multilingual deployment (cross-lingual transfer).

2. Methodology

The paper proposes a robustness-oriented evaluation framework that moves beyond simple toxicity scores. The methodology is structured around three dimensions:

• A. Optimisation Robustness: The authors investigate the "detox–degeneration trade-off." They analyze how varying hyperparameters (learning rates and the number of editing steps) affects the balance between reducing toxicity and inducing generation degeneration (repetition).
• B. Compositional Robustness: Instead of editing one instance at a time and resetting the model, the authors perform sequential editing. They inject multiple unsafe behaviors into a single model to see if the detoxification effects persist or if the objectives interfere with one another.
• C. Cross-lingual Robustness: The authors construct the mSAFEEDIT dataset, a parallel multilingual dataset covering high-resource (English, Spanish, French, Chinese) and low-resource (Bengali, Hindi, Thai, Malay, Vietnamese) languages. They evaluate:
  • Monolingual Detoxification: Editing and evaluating in the same non-English language.
  • Cross-lingual Detoxification: Editing in English and evaluating in other languages to test the "language-dependency hypothesis."

Infrastructure: The study utilizes several LLMs (Llama2, Llama3, Mistral, Qwen2, Qwen3) and two KE methods: DINM (a toxicity-driven method) and FT-M (a gradient-based baseline). They also implement a custom degeneration detector to identify repetitive token patterns.

3. Key Contributions

• Identification of "Pseudo-detoxification": A new failure mode where apparent safety is merely an artifact of model degeneration.
• A New Evaluation Metric: The authors propose using a "number of failures" metric (summing both unsafe responses and repetitive/degenerate responses) rather than just "Defence Success" rates.
• Comprehensive Robustness Framework: A systematic way to test KE methods across optimization, composition, and language dimensions.
• Multilingual Benchmark: The creation of the mSAFEEDIT dataset for standardized cross-lingual safety testing.

4. Results

• Optimization: There is a clear detox–degeneration trade-off. Increasing the learning rate or editing steps reduces toxicity but significantly increases repetition. Most models (Llama3, Mistral) suffer from severe pseudo-detoxification. Qwen2-7B was the only model showing significant resistance to degeneration under DINM.
• Compositionality: KE-based detoxification lacks compositional robustness. As more unsafe behaviors are edited into a model, the number of failures increases due to objective interference or increased degeneration (except for Llama2-7B).
• Cross-lingual:
  • Monolingual: Effectiveness is highly inconsistent and degrades significantly in low-resource languages.
  • Cross-lingual Transfer: Most models fail to transfer English-learned detoxification to other languages. Again, Qwen2-7B with DINM was the notable exception, showing the most stable cross-lingual performance.

5. Significance

This work serves as a cautionary critique of current LLM safety research. It demonstrates that apparent safety is not synonymous with actual safety. The findings suggest that current KE-based detoxification methods are fragile and highly sensitive to model architecture, the number of targets, and the language used. For practitioners, the paper highlights the necessity of using degeneration-aware metrics and warns against over-reliance on toxicity classifiers when deploying safety interventions in multilingual or complex, multi-objective environments.