# Reverse-Engineering Model Editing on Language Models Source: [Reverse-Engineering Model Editing on Language Models]() Collection index: [llms.txt]() Data updated: 2026-05-20T05:00:28.635Z Authors: Zhiyu Sun, Minrui Luo, Yu Wang, Zhili Chen, Tianxing He Published: 2026-02-07T08:35:59.000Z ## Abstract Large language models (LLMs) are pretrained on corpora containing trillions of tokens and, therefore, inevitably memorize sensitive information. Locate-then-edit methods, as a mainstream paradigm of model editing, offer a promising solution by modifying model parameters without retraining. However, in this work, we reveal a critical vulnerability of this paradigm: the parameter updates inadvertently serve as a side channel, enabling attackers to recover the edited data. We propose a two-stage reverse-engineering attack named \\textit{KSTER} (\\textbf{K}ey\\textbf{S}paceRecons\\textbf{T}ruction-then-\\textbf{E}ntropy\\textbf{R}eduction) that leverages the low-rank structure of these updates. First, we theoretically show that the row space of the update matrix encodes a \`\`fingerprint" of the edited subjects, enabling accurate subject recovery via spectral analysis. Second, we introduce an entropy-based prompt recovery attack that reconstructs the semantic context of the edit. Extensive experiments on multiple LLMs demonstrate that our attacks can recover edited data with high success rates. Furthermore, we propose \\textit{subspace camouflage}, a defense strategy that obfuscates the update fingerprint with semantic decoys. This approach effectively mitigates reconstruction risks without compromising editing utility. Our code is available at https://github.com/reanatom/EditingAttack. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Subject Inference Attack on CounterFact batch-edit tasks](): Subject inference attack; CounterFact batch-edit tasks; Recall: 100. - [Subject Inference Attack on zsRE batch-edit tasks](): Subject inference attack; zsRE batch-edit tasks; Recall: 99. - [Prompt recovery attack on CounterFact](): Prompt recovery attack; CounterFact; Top-1 Accuracy: 60. - [Prompt recovery attack on zsRE](): Prompt recovery attack; zsRE; Top-1 Accuracy: 40. - [Subject Inference Attack on CounterFact](): Subject inference attack; CounterFact; Attack Performance: 100. - [Subject inference attack on zsRE](): Subject inference attack; zsRE; Attack Performance: 100. - [Prompt recovery attack on CounterFact (test)](): Prompt recovery attack; CounterFact (test); Top-1 Accuracy: not recorded. - [Prompt recovery attack on zsRE (test)](): Prompt recovery attack; ZSRE (test); Top-1 Accuracy: not recorded. ## Original sources and implementation [Original paper]() [PDF]()