{"id":"b735d613-7936-4d07-95a4-09a312f78273","arxiv_id":"2412.10257","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"TARS locates feedforward weights most aligned with a model-derived concept vector and replaces them with its reversed form, removing concepts like 'Sherlock Holmes' with a few edits while preserving general model behavior.","lead":"TARS removes specific concepts from large language models by reversing a small number of internal weight vectors that align with a concept's learned representation. The authors report near-zero trigger probabilities with just one edit, bi-directional and multilingual coverage, and minimal impact on general performance.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"v_target may encode the target token's logit direction rather than the concept, and the token-level evaluations do not rule out prompt-specific overfitting.","rationale":"The reader's weakest_assumption identifies the same core risk: v_target may be a prompt-specific artifact. My analysis sharpens the mechanism: the LM-head-conditioned averaging in Eqs. 7–11 does not extract a concept direction; it extracts a direction that makes the target token's logit win over competitors. That direction may suppress the token but does not by itself remove the underlying knowledge. The paper's evaluation cannot distinguish token suppression from concept removal because it measures only next-token probabilities of the target token and a few anecdotal completions. The proposed held-out prompt set and a second independent v_target directly test generalizability and stability. If the held-out prompts also show p=0.00 and the second vector is highly similar, the concern is resolved; otherwise the central claim is reduced to token-level overfitting. The verdict remains CONDITIONAL: the method is novel and the cross-lingual result is suggestive, but the evidence as presented is insufficient for acceptance. I do not see an internal inconsistency; the issue is a correctness risk from insufficient evaluation, so I would keep the reader's conditional verdict without moving to rejection.","tokens_in":12255,"tokens_out":6629,"duration_ms":627388,"concrete_test":"Using the Appendix A.1.1 Sherlock prompt, compute v_target and perform the 1-edit TARS procedure. Build a held-out set of 100 paraphrased prompts about Sherlock Holmes that share no 4-gram with the original prompt (e.g., 'Who lives at 221B Baker Street?', 'What detective is associated with Irene Adler?') and measure the next-token probability of 'Sherlock'. Independently, generate a second v'_target from a different descriptive prompt (e.g., focusing on The Hound of the Baskervilles) and compute the cosine similarity between v_target and v'_target. If any held-out prompt yields p('Sherlock') > 0.01, or if the cosine similarity is below 0.9, the targeting vector is prompt-specific and the knowledge-removal claim is not established.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that TARS removes a concept, not just a token, depends on v_target (Eq. 11) being a stable, concept-level direction. The refinement in Eqs. 7–10 conditions on p(t_C | v_noise) ≥ 0.95, where t_C is a single vocabulary token. Because the LM head is linear, the accepted noise set is approximately a half-space whose normal is the logit difference between t_C and its nearest competitor; the average in Eq. 11 is therefore v_approx plus a term along that logit-difference vector, biasing v_target toward token discrimination rather than concept semantics. The paper's evidence is almost entirely token-level: p('Sherlock') = 0.00, p('Saturn') = 0.00, p('dog') = 0.00, with only three completions per concept and a single translated prompt per language. Additionally, θ in Eq. 13 is tuned per concept to force the target probability to zero; without reporting θ or its sensitivity, the 'as few as 1 edit' claim is an artifact of threshold selection. These issues make the results consistent with token suppression under narrow prompts, not the broad, multi-directional knowledge removal claimed.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes TARS (Targeted Angular Reversal of Weights), a no-retraining method for removing a concept from an LLM by (i) extracting a hidden-state vector from a descriptive prompt, (ii) refining it into a 'targeting vector' by averaging noisy variants that trigger the concept token with probability at least tau, (iii) computing cosine similarities between this vector and all gate/up-projection weight vectors in Llama 3.1 8B, and (iv) replacing weight vectors above a threshold theta with a reversed, normalized version of the targeting vector. Experiments report that target-token probabilities drop to 0.00 for concepts such as Sherlock Holmes, Saturn, Voldemort, dog, and Minecraft with as few as 1-4 edits, that removal works both when the concept is the answer and when it is the subject (bi-directionality), that removing 'dog' in English also suppresses 'chien' and 'Hund', that removals can be stacked modularly, and that after five removals the median KL divergence from the base model on Wikitext-2 is 0.0015.","tokens_in":12504,"tokens_out":4457,"duration_ms":40325,"significance":"If the central claim holds, TARS would be a computationally attractive, modular knowledge-removal method that works across prompt directions and languages without retraining. The paper's strengths are its simple, interpretable procedure, its explicit cross-lingual test using distinct tokens ('dog'/'chien'/'Hund'), and its attempt to quantify specificity via KL divergence on a Wikipedia corpus. However, the evidence as presented is mostly token-level and based on a very small number of prompts per concept, with key hyperparameters (theta, sigma, tau) and their sensitivity unreported. The paper does not yet establish that the refined targeting vector captures the concept rather than a token-specific logit direction, so the significance of the contribution is presently conditional on substantially stronger evaluation.","major_comments":[{"comment":"The refinement procedure conditions on the probability of a single vocabulary token, p(t_C | v_noise) >= 0.95. Because the LM head is linear (softmax of a linear map), the accepted noise set is approximately a half-space whose boundary normal is the logit-difference direction between t_C and its nearest competitor; the average in Eq. (11) is therefore biased toward that token-discrimination direction rather than toward a concept-level semantic direction. The paper's main quantitative evidence (Figures 2 and 4) is exactly token-level: p('Sherlock'), p('Saturn'), p('dog') drop to 0.00. This does not rule out that TARS suppresses a token rather than a concept. A concrete test would be to evaluate on paraphrased prompts that do not contain the target token (e.g., 'the detective of Baker Street' without the word 'Sherlock') and on synonyms or translations that use different tokens; if those are suppressed as well, the concept-level claim is supported.","section":"3.1, Eqs. (7)-(11)"},{"comment":"The edit threshold theta is never reported, and the claim 'as few as 1 TARS edit' is therefore not reproducible. The number of edits per concept is determined by theta (Eq. 13), yet the paper does not state the theta values used for Sherlock, Saturn, Voldemort, dog, or Minecraft, nor does it provide a sensitivity analysis showing how the target-token probability varies with theta and with the number of edits. Without this, the '0.00' results may simply reflect per-concept threshold tuning. Please report the theta values, or better, a sweep over theta with the resulting target probabilities and edit counts.","section":"3.3, Eq. (13) and Remark 3"},{"comment":"The reported '0.00' probabilities are almost certainly rounded; the paper does not report exact probabilities, sample sizes, or confidence intervals for any of the target-token measurements. For the bi-directionality claim, Figure 3 shows only three qualitative completions per concept. For the multilingual claim, Figure 4 uses a single concept ('dog') with one prompt per language. This is too thin to support the general claims of bi-directional and multilingual knowledge removal. Please provide exact probabilities (e.g., 1e-8 rather than 0.00), standard errors over multiple paraphrased prompts, and results for additional concepts and languages.","section":"4, Figures 2-4"},{"comment":"The KL divergence on Wikitext-2 measures next-token distribution shift on a single genre (Wikipedia text). This is not sufficient to conclude 'minimal impact on general model capabilities'. The paper should report perplexity or task accuracy on standard benchmarks (e.g., MMLU, HellaSwag, or at least multiple corpora) and should compare against at least one baseline method (e.g., ROME or RMU) on the same metrics. Without such comparisons, the claimed advantage over existing methods and the claimed specificity are not quantitatively substantiated.","section":"4.4, Table 1"},{"comment":"The paper does not specify which hidden state is used as v_approx and fed to the LM head. In Llama 3.1, the LM head follows a final RMSNorm layer. If the 'final hidden state' in Figure 1 is the raw output of the last transformer block (pre-norm), then p(t_C | v_noise) in Eq. (8) is not the model's actual next-token probability, and the refinement procedure would be conditioning on an incorrect distribution. This is load-bearing for the construction of v_target. Please clarify whether the hidden state is taken before or after the final layer norm, and correct the procedure if necessary.","section":"3.1, Eqs. (4)-(5)"}],"minor_comments":[{"comment":"The notation p(v_approx | P_C) is confusing: v_approx is a hidden-state vector, not a vocabulary token, yet it is used as the argument of a probability distribution over the vocabulary. Please write p(v | P_C) or p(t_C | P_C) for the token distribution.","section":"Eq. (5)"},{"comment":"The reversed target vector is normalized with the 3-norm, which is unusual and unexplained. Please justify the choice or replace it with the standard 2-norm unless the 3-norm is intentional.","section":"Eq. (13)"},{"comment":"The description 'a batch size of 450 was repeated 25,000 times' is ambiguous: does this mean 450 noisy vectors per iteration for 25,000 iterations, or 450 total? Please state the total number of noisy samples and the number of retained candidates N in Eq. (11).","section":"3.1, after Eq. (7)"},{"comment":"Figure 5 shows bars for target-token probabilities after sequential removal, but the y-axis scale, exact values, and markers are not described. Please add axis labels, numeric values, and error bars or at least specify that the values are single-prompt probabilities.","section":"Figure 5"}],"recommendation":"major_revision","confidential_remarks":"The paper's central idea is interesting and the method is easy to describe, but the evaluation is currently too anecdotal to support the strong claims of concept-level, bi-directional, and multilingual knowledge removal. The lack of reported theta values and the token-level nature of the main measurements are the key risks. If the authors can provide exact probabilities, threshold sweeps, baseline comparisons, and either a clear argument that v_target is concept-level or experiments that demonstrate it, the paper could become a solid contribution. I also note that the related-work section is quite brief and the 'first to demonstrate' claim should be checked against recent literature."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"TARS is a genuinely new twist on weight editing: derive a concept direction by probing the LM head with noisy versions of a hidden state, then reverse the feedforward weight vectors most aligned with it. That is clever, and it is different from ROME's causal tracing and from RMU/WHP fine-tuning. The cross-lingual result for dog/chien/Hund is the most interesting thing in the paper, and the modular stacking of five concepts with median Wikitext-2 KL of 0.0015 suggests the edits are not nuking the model.\n\nThe problems are in the evaluation, and they are substantial. The evidence is almost entirely token-level: p('Sherlock')=0.00, p('Saturn')=0.00, p('dog')=0.00. Three completions per concept, one translated prompt per language, no error bars, no held-out prompts. The threshold θ is tuned per concept to force the probability to zero and its values are never reported, so \"as few as 1 edit\" is not yet a claim about the method, it is a claim about the tuning.\n\nThe stress-test note makes a fair technical point: the refinement in Eqs. 7–11 keeps only noisy vectors that give the single target token probability ≥0.95. Because the LM head is linear, that accepted set is roughly a half-space whose normal is the logit difference between the target token and its nearest competitor. The averaged v_target therefore carries a bias toward token discrimination, not necessarily concept semantics. The paper's own completions are consistent with that worry: after editing, the model says Saturn is \"the largest of the planets in our solar system\" and Sherlock was written by \"Thomas Jefferson Hanks, Jr.\" That is concept-level interference, but it is shown for three examples, not measured.\n\nI also note the cross-lingual suppression does not fully resolve the token-vs-concept question, because Llama may operate in a shared English latent space; suppressing the English 'dog' logit direction could suppress 'chien' and 'Hund' as a byproduct.\n\nWhat is missing: code, comparison to RMU/WHP/ROME, a distribution over prompts, θ sensitivity, and any analysis of what v_target actually encodes. Without those, the paper is a promising sketch.\n\nMy recommendation: send it to peer review. The idea is worth referee time and the authors have done enough to show it is not nonsense. But it needs major revision.","headline":"TARS is a novel weight-editing method with a plausible mechanism, but the evidence only shows token suppression under tuned prompts, not the broad concept removal claimed.","tokens_in":13023,"tokens_out":2560,"would_cite":false,"duration_ms":23949,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"TARS erases a named concept from an LLM by reversing a single feedforward weight vector, dropping target-token probability to 0.00 while preserving general performance.","keywords":["knowledge removal","model editing","targeted angular reversal","feedforward networks","multilingual unlearning","cosine similarity","Llama 3.1 8B","concept erasure"],"falsifier":"Measure target-token probability for a concept after a single TARS edit across a broad set of paraphrased descriptions and languages where the model may not use an English latent space; if the probability returns above zero for any reasonable paraphrase, the claim that the targeting vector isolates the concept fails.","tokens_in":12047,"feed_emoji":"🧠","tokens_out":5653,"duration_ms":43838,"temperature":0.7,"pith_summary":"The paper introduces TARS, a weight-editing method that removes a chosen concept from an LLM by reversing the feedforward weight vectors most aligned with that concept's internal representation. It claims that on Llama 3.1 8B, one edit can drive the target token's probability to 0.00, that the removal works bidirectionally (the model can neither name the concept from a description nor describe it when named), and that the same English edit suppresses the concept in other languages. The authors argue that TARS is modular and minimally invasive: after sequentially removing five concepts, the median KL divergence on Wikitext-2 between edited and base models is 0.0015, while divergence on Wikipedia pages about the removed concepts rises dramatically. A sympathetic reading is that TARS offers a retraining-free, direction-independent, cross-lingual route to knowledge removal.","feed_headline":"One edited weight drops concept-token probability to 0.00","feed_subtitle":"TARS erases Sherlock, Saturn, and more from Llama 3.1, in any language, with general text drift at 0.0015.","key_machinery":"The central object is the targeting vector $\\mathbf{v}_{\\mathrm{target}}$, a 4096-dimensional vector in the model's internal representation space that triggers the target token with probability at least 0.95. It is built by averaging noise-perturbed versions of a prompt-derived approximate vector that pass the 0.95 threshold; this is meant to isolate the concept-specific direction from prompt artifacts. The method then computes cosine similarity $\\mathrm{SC}(\\mathbf{w}_i^{(\\ell)}, \\mathbf{v}_{\\mathrm{target}})$ between this vector and every weight vector in the up- and gate-projection layers of Llama 3.1 8B, and replaces every weight above a threshold $\\theta$ with the reversed, 3-norm-normalized targeting vector. The mechanism exploits the assumption that residual connections preserve a shared representation space across layers, so a weight vector with high alignment to the concept vector is what propagates the concept; reversing it turns the element-wise product negative and suppresses activation.","core_discovery":"The central claim is that a concept in an LLM can be 'repelled' by replacing a small number of feedforward weight vectors with the negative of a normalized concept-targeting vector. The targeting vector is built in two steps: a long descriptive prompt is passed through the model and the final hidden state becomes an approximate concept vector; Gaussian noise is added and only variants that still produce the concept token with probability at least 0.95 are averaged to give a refined targeting vector. Cosine similarity between this vector and all 917,504 weight vectors of the gate and up projections picks the candidates, and the most similar ones are overwritten with $-\\mathbf{v}_{\\mathrm{target}}/\\|\\mathbf{v}_{\\mathrm{target}}\\|_3$. With one edit for 'Sherlock', four for 'Saturn', and three for 'Voldemort', the target token probability falls to 0.00 and completions become generic or factually wrong, which the authors take as evidence that the representation itself, not a prompt-specific path, has been suppressed.","pith_inferences":["The refinement step implicitly assumes the language-model head is a reliable probe of concept identity; the same technique could be adapted to audit which internal directions drive other risky behaviors such as sycophancy or refusal.","Because the method only edits weights with high cosine similarity, it leaves attention and other pathways untouched; a natural test would measure whether adversarial or paraphrased prompts that bypass the affected weights can still elicit the concept.","The multilingual result suggests TARS edits the shared latent direction rather than token-specific paths; if that is correct, the same edit should suppress related concepts that live near the target direction, so specificity could be probed by measuring proximity to near-neighbor concepts like 'detective' or 'planet'.","The 3-norm normalization and the threshold $\\theta$ are tunable; systematic sweeps could reveal whether one edit per concept always suffices or whether concepts with diffuse representations need more edits."],"forward_implications":["After a single TARS edit, the probability that Llama 3.1 8B completes a Sherlock Holmes description with 'Sherlock' drops from 0.41 to 0.00; the model then gives generic or false completions rather than random text.","Because the edit targets the internal representation, the model also fails the reverse direction: given 'Sherlock Holmes is', it no longer produces an accurate description.","An English-targeted removal of 'dog' also drives the probabilities of French 'chien' and German 'Hund' to 0.00, so cross-lingual retrieval of the removed concept is blocked.","Concepts can be removed sequentially from the same model, and after five removals the median KL divergence on Wikitext-2 is 0.0015, while divergence on pages about the removed concepts is at least 60-fold higher.","The method needs no fine-tuning or retraining; the practitioner only chooses the similarity threshold, and can lower it to edit more vectors if needed."],"supporting_citations":[{"why":"It supplies the premise that feedforward layers store and promote concepts in the model's vocabulary space, which is the layer type TARS targets.","marker":"[Geva et al., 2022]"},{"why":"It establishes ROME as the prior retraining-free weight-editing baseline that TARS contrasts with for directional removal.","marker":"[Meng et al., 2023]"},{"why":"It defines the sensitivity and specificity criteria that structure the TARS evaluation.","marker":"[Gandikota et al., 2024]"},{"why":"It provides evidence that Llama models operate on an English latent representation, which explains the cross-lingual removal result.","marker":"[Wendler et al., 2024]"},{"why":"It supplies the Wikitext corpus used to measure KL divergence after modular removal.","marker":"[Merity et al., 2016]"},{"why":"It is the fine-tuning-based unlearning baseline that TARS avoids.","marker":"[Eldan and Russinovich, 2023]"},{"why":"It is the RMU baseline that steers internal representations randomly, which TARS contrasts with its own representation-reversal approach.","marker":"[Li et al., 2024]"},{"why":"It is the TOFU baseline that requires fine-tuning on synthetic QA pairs, whereas TARS requires no retraining.","marker":"[Maini et al., 2024]"},{"why":"It argues that forget-retain set evaluations are deceptive, motivating the direct-probing evaluation style used in the paper.","marker":"[Thaker et al., 2024]"}],"fun_headline_variants":["One weight flip zeroes concept probability in Llama 3.1","TARS erases Sherlock from Llama 3.1 with one edit","Minimal edit, complete removal: TARS for LLMs","Angular reversal suppresses concepts in any language","One edit removes knowledge across all languages"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the refined targeting vector produced by averaging high-probability noisy variants is a stable representation of the concept itself; if it only captures the specific prompt's phrasing, the edited weights will not suppress the concept under other prompts, languages, or contexts.","fun_headline_variants_meta":{"raw":{"variants":["One weight flip zeroes concept probability in Llama 3.1","TARS erases Sherlock from Llama 3.1 with one edit","Minimal edit, complete removal: TARS for LLMs","Angular reversal suppresses concepts in any language","One edit removes knowledge across all languages"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000799,"raw_usage":{"total_tokens":3596,"prompt_tokens":1109,"completion_tokens":2487,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":725,"completion_tokens_details":{"reasoning_tokens":2405}},"tokens_in":725,"tokens_out":2487,"duration_ms":18426,"temperature":1.0,"reasoning_tokens":2405,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T16:00:56.301437+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Measure target-token probability for a concept after a single TARS edit across a broad set of paraphrased descriptions and languages where the model may not use an English latent space; if the probability returns above zero for any reasonable paraphrase, the claim that the targeting vector isolates the concept fails.","supporting_citations":[],"review_version":1}