Skip to main content
A terminal showing this site build and pass its own design check, a shield with a tick, a padlock, servers under a cloud, and circuit traces along the bottom.
Saif Ul Islam

Saif Ul Islam

Knowledge editing and interpretability in language models

Open Concept Lab 3 pieces of writing 4 projects

About meLinkedIn ↗GitHub ↗

What this lab is for

What a model believes, and how to tell when it changes.

Experiments, writing, and interactive pages I built to understand something. Most of what is here is provisional and says so, and the reading list marks which citations I have actually checked.

A small round creature holding a magnifying glass up to its own thought: a bug crossed out, a tick, and a pair of code brackets.

On the desk right now

Latest writing · 24 Oct 2026Surge Of ThoughtsMost recent plan · opz44 labs built, at least one in every section of all four tracksLabs · 4 solved · 40 ready to solveLast solved: Debugging a CrashLoopBackOff PodReading nextKnowledgeSmith: Uncovering Knowledge Updating in LLMs with Model Editing and Unlearning
Projects
4
Pieces of writing
3
Interactive pages
37
Papers read
18 / 37
Labs solved
4 / 44 built
Citations unchecked
0

Projectseach one's status is read from its own plan

Notebook →
edit-slicePhase 3 — the measurement moved onto a published benchmark's own materialsMeasure whether weight-level knowledge edits (ROME/MEMIT) leave their own grounds intact and contradictory — the orphan category — and show that this backward failure is worse than the forward propagation these methods were tuned against.Plan updated 14 Oct 2026rome-neighborsPhase 2 — ImplementationWhen a fact is edited in a language model (e.g. "The Eiffel Tower is in Paris" → "The Eiffel Tower is in Rome"), the logically entailed neighbor facts should also update. They usually don't.Plan updated 22 Jul 2026claim-graphPhase 5 — LLM edge-typerFeed real research papers in; get a queryable claim graph out — claims as nodes, typed edges (supports / contradicts / refines), every node carrying provenance back to its source sentence in a real paper.Plan updated 14 Jun 2026opz44 labs built, at least one in every section of all four tracksLearn deployment and security by working through small, standalone labs instead of waiting for a big project.Plan updated 25 Oct 2026

Writing

All writing →
  1. Five days of edit-slice: every claim, and what happened to it

    A record rather than an argument. The edit finally ran and said no: rank-one editing displaces probability toward country-flavoured content in anything sharing the subject, and carries no inference at all. The null turned out to be structural — ROME's own normalisation guarantees it, for every covariance and at every depth. How far the leakage reaches past the edit's own wording turned out to be an early-layer fact, and only a sweep separated the two. The errors were never in the measurements. The stars are real; the constellations were ours.

  2. The check that was never there

    I withdrew a claim because I thought a benchmark already handled it. Then I read the paper's appendix instead of its prose, and found the withdrawal was the mistake. CounterFact has no possession check — and a model's own numbers say so.

Built to understand something

37 interactive pages, 11 topics

When reading about a thing was not enough, I made a page I could poke at. Every one of these opens and runs.

Browse all 37 →
SecurityEdit ForensicsSomeone plants a false fact in an open model with ROME and republishes it. Given the claimed base, the planted subject ranked first of 20,391 names in 99 of 99 tampered GPT-2 models, and the planted object was read back in 82. Cheap hiding (weight noise, fine-tuning, spreading the edit over five layers) did not stop it; planting many facts at once and adding decoys did. GPT-2 only, with the limits stated.Open it ↗
AIModel MicroscopeGPT-2 opened up three ways on eighteen prepared prompts: what it would say if it stopped at each layer, which words it looks back at, and — by causal tracing, the method behind ROME — where a fact is actually stored. Includes the cases where it fails: a negated fact, a sum, and a CEO who changed after its training.HPCGPU vs CPU, on Two Classic WorkloadsGravity between tens of thousands of bodies and heat spreading across a plate, live on your GPU, with native Metal measurements from an M2 Pro. One workload runs 22× faster on the GPU, the other under 2×: compute-bound versus memory-bound, shown with real numbers, and a video recorded on that GPU for browsers without WebGPU.Brick StageMicroduck, in BricksPollen Robotics' open-source Microduck robot, sampled from its own CAD into 670 LEGO plates and built the way an instruction booklet builds it: in sections, every plate arriving along the path it really goes in, the head made on its own and set on the neck. Prompted by the Microduck LEGO booklet on Hugging Face.Brick StageSpot the CowKeenan Crane's Spot (CC0), a textured 3D model downloaded and turned into 543 LEGO plates in one command — texture colours matched to real LEGO colours, every part checked as made by LEGO in that colour.Systems in MiniatureRouting for a Shared Prompt CacheEight GPUs serve chat requests that share long prompts. Round robin keeps re-reading the same prompts; sending each prompt to the GPU that already has it cuts the wait for the first token from about half a second to 30 ms, until the most popular app overloads one GPU and a load cap spreads it.Systems in MiniatureContinuous BatchingOne GPU writing many replies at once. Waiting for the slowest reply in each batch leaves seats empty half the time someone is queuing; swapping finished replies out at every step cuts the wait for the first word from 16 s to under half a second.

Labs · deployment and security

44 labs built, 4 solved

Each lab is a real kind of incident, broken on purpose and small enough to run on a laptop. I fix it, prove the fix, and write down what it taught. 44 of the 244 scenarios have a lab so far; the dark part of each bar is solved, the light part is built and waiting.

The full checklist →
  1. 01Break itA real incident, shrunk to run on a laptop.
  2. 02Diagnose itFind the cause from the symptoms, not the answer.
  3. 03Fix itThe smallest change that removes the cause.
  4. 04Prove itA check that fails on a cover-up, not only on the bug.
  5. 05Write it downFive lines: what broke, why, what it taught.

Solved so far

  1. Debugging a CrashLoopBackOff PodKubernetes reliability
  2. Secret Committed in Public RepoSecrets
  3. Secret Exposed Through Environment VariablesSecrets
  4. Hardcoded Credentials in DockerfileSecrets
What each one taught →

Built, ready to solve · 40

  1. Resource Starvation due to Misconfigured Requests & LimitsKubernetes reliability
  2. Replay Attack via Insecure WebhooksWeb & API security
  3. Graceful Shutdown (PID 1 ignores SIGTERM)Containers
  4. JWT Replay Due to No Expiry ValidationWeb & API security
  5. Unsecured Redis Allows Remote AccessContainers
All 40 waiting →

Agentic · the work that runs overnight

The tools that run overnight, and the rules they run by

Experiments run while I sleep. These are the small tools that queue them, refuse the unsafe ones, sort the failures and leave a report, so in the morning only the one thing that needs a person is waiting for me. Underneath them is one file of instructions every AI session here starts from.

How it all fits →
  1. 01QueueOnly pre-registered work, expected verdict written first.
  2. 02PreflightGates that refuse before anything touches the network.
  3. 03RunEach job under a budget it may not outlive.
  4. 04TriageFailures sorted by cause; only the unknown one needs me.
  5. 05ReportReadable mid-run, including what it did not check.
$ python -m bearing ai/edit-slice

4 of 10 questions have an uncomfortable answer.

!!  Do the last 5 finished items measure your instrument, or the world?
      5 of the last 5 lean inward (E-030, E-031, E-032, E-033, E-034).
      asked because: a run of inward work is how a project stops being
bearingReads a project's own record and asks the questions that correct course. It measures drift, and has no taste.Read how it works →
$ python tools/watch.py

[12:29:59] 1 job(s) queued
[12:29:59] E-036: preflight
[12:30:14] E-036: running (budget 3.0h)
[12:49:34] E-036: finished in 19 min
[12:49:34] E-036: ok — verdict ['UNDIFFERENTIATED'], report written
The unattended harnessGates that refuse before anything touches the network, a triage that sorts failures by cause, and a loop that escalates on exactly four things.Read how it works →
A green harness is not a
sound experiment.

E-036 passed every gate
and still measured two of
six criteria in ways that
could not answer their own
The practice, and its limitsThe boundary between what a loop may own and what a person must, and an honest account of what none of it can catch.Read how it works →
# Manifesto
# Compass — keeping the work connected to real need
# The Standard
# Side Builds — the deliberate exception
# Global Rules
# Agentic Work Template
# The Card — the default, and the width limit
dotclaudeThe instructions every Claude session here starts from: why the work exists, how a card is opened, and when the heavy protocols are allowed.Read it on GitHub ↗

Reading · before the next experiment

18 read, 37 on the list

The papers my work rests on, and why each one matters to it. A citation counts as checked only once I have read it against the paper itself, and every one on the list has been.

The reading list →
  1. Up next · 01KnowledgeSmith: Uncovering Knowledge Updating in LLMs with Model Editing and UnlearningLuo et al. · 2026 · ICLRWhy I'm reading it Casts editing and unlearning as one constrained optimisation and reports a consistency-capacity trade-off across graph levels and data scales. The reason not to re-derive propagation-versus-structure from scratch.✓ citation checked
  2. Up next · 02Bilinear representation mitigates reversal curse and enables consistent model editingKim et al. · 2025 · ICLR 2026Why I'm reading it The structured-geometry predictor rome-neighbors adopts. Also bears on edit-slice: "reversal curse" is argument order under another name, so this is the closest published work to that half of the distinction. Read before E-009. ✓ citation checked
  3. Up next · 03STEAM: A Semantic-Level Knowledge Editing Framework for Large Language ModelsJeong et al. · 2025 · Findings of EMNLP 2025Why I'm reading it Latent-space alignment for editing. Note the correction: this is an editing *method*, not an alignment-based *predictor* of propagation, so the "alignment arm" of the predictor comparison may not have a paper behind it yet. Check before building E-009 around it. ✓ citation checked
  4. Up next · 04The Curious Case of Factual (Mis)Alignment between LLMs' Short- and Long-Form AnswersObaid ul Islam et al. · 2025 · arXiv preprintWhy I'm reading it The nearest existing method — mechanistic similarity predicting alignment at up to 78%. But the construct is short-form versus long-form answer agreement, not factual consistency in general, which makes it easier to differentiate from than the one-line note suggested. Still blocking, since it has to be cited either way. ✓ citation checked