REDaCT: Collapse-Free Unlearning in Large Reasoning Models

AI summary

Overview

• Research area: Machine unlearning for large reasoning models (LRMs) — removing designated "forget-set" knowledge from both the chain-of-thought (CoT) reasoning trace and the final answer without destroying the model's reasoning ability.
• Technical level: Intermediate. The paper is readable without deep theory, but assumes familiarity with LLM fine-tuning, embeddings, and standard unlearning baselines.
• Scope: The paper proposes REDaCT, an inference-time detect-and-regenerate framework, and benchmarks it against five unlearning baselines on the R-TOFU LRM unlearning benchmark using DeepSeek-R1-Distill-Llama-8B and DeepSeek-R1-Distill-Qwen-7B.

What This Paper Is About

Large reasoning models emit an explicit reasoning trace between <think> and </think> before answering, and that trace can leak sensitive facts even when the final answer looks harmless. Existing LRM unlearning methods either leave the fact in the trace (R-TOFU) or suppress it so aggressively that the model's reasoning degenerates into repeating token loops that never emit </think> — a failure the authors call reasoning collapse. REDaCT's goal is to remove forget-set information from both the reasoning trace and the answer while keeping the model coherent and useful.

Key Contributions

1. An inference-time unlearning framework for LRMs (REDaCT) that intervenes inside the reasoning trace rather than updating model parameters. The authors state this is the first inference-time unlearning method that intervenes inside the reasoning trace.
2. A lightweight sentence-level leak detector, implemented as a RoBERTa-based binary classifier, that labels each sentence in a CoT as "leak" or "non-leak" and is trained using labels from an LLM-as-judge (Claude Sonnet 4.6). It takes the current sentence plus the prompt and up to two preceding sentences as input to resolve pronouns and demonstratives.
3. A corrective embedding learned offline by an embedding optimization module and injected at the first detected leak to steer regeneration toward a coherent refusal, generalized from a single vector to a length-k embedding sequence.
4. A detect-and-regenerate inference procedure that truncates the trace at the first leak, injects the corrective embedding, regenerates, and repeats until no leak is detected or a user-specified iteration budget B is reached, including a separate answer phase for leaks in the final answer.

Main Findings

• Perfect answer forgetting (AFE = 1.000) on all three forget sets (forget01, forget05, forget10) on the DeepSeek-R1-Distill-Llama-8B model, matching R²MU but without R²MU's damage. The strongest other baseline reaches at most 0.675 (PO on forget01).
• Near-perfect CoT forgetting (CFE = 1.000, 0.977, 0.983) across the three forget sets, close to R²MU, while all other baselines reach at most 0.768.
• Highest utility of all compared methods: 0.771, 0.782, 0.786 across the three forget sets, within 0.016 of the pre-unlearning target model's 0.787 even in the worst case. GA, GD and KL land in the 0.702–0.770 range, PO in 0.631–0.660, and R²MU worst at 0.549–0.585.
• Zero reasoning collapse and zero hallucination across all forget sets, with a refusal rate of 1.000 on every forget set. R²MU collapses on 0.950, 1.000, and 0.993 of forget-set prompts (95%–100% across splits), and PO collapses on 0.484 of prompts on forget05 and GA on 0.467 on forget01. PO's refusal rates are only 0.741, 0.125 and 0.424.
• Baselines that preserve utility do so by failing to forget: more than 0.92 of GA's, GD's and KL's non-leaking responses on forget05 and forget10 contain hallucinated content, with GD reaching a hallucination rate of 1 on forget01.
• Low inference overhead: on the forget10 set's 400 prompts, the detector flagged at least one sentence in every forget-set prompt, one regeneration resolved every leak, the budget B = 3 was never reached, and no answer-phase regeneration was needed — a 5.9% increase in overall response time versus the pre-unlearning target model. On the retain set the overhead was negligible (0.8%) because no false positives triggered regeneration.
• Parameter sensitivity: a detection threshold of τ = 0.5 gives the best balance (CFE and AFE both reach 1); efficacy deteriorates substantially above τ > 0.9. A retain margin of m_r = 1 produces a 100% refusal rate with no hallucination or collapse, whereas m_r = 0 raises hallucination and m_r ≥ 3 raises collapse. Corrective-embedding length k ∈ {1,2,4,8,16} never changes whether forgetting succeeds (AFE = 1.0 throughout); it only affects how closely the regenerated text matches the refusal target, saturating at k = 2 for forget01 and at roughly k = 16 for forget05 and forget10.
• Generalization to indirect questions: on questions generated to elicit the same facts without appearing in the forget set, AFE remains 1.0 on all three sets and CFE stays at 0.921, 0.990 and 0.990. The pre-unlearning model leaked forget-set content in response to every indirect question.
• Results for the DeepSeek-R1-Distill-Qwen-7B model and the leak detector's standalone accuracy are referenced to Appendices I and J, but those appendix values are not included in the provided paper content.

Methodology in Plain English

REDaCT treats unlearning as a runtime correction rather than a retraining step.

First, the authors train a small sentence-level classifier to spot leakage. They build its training data from three sources: sentences from forget-set CoTs labeled "leak" or "non-leak" by an LLM judge, randomly sampled retain-set CoTs labeled "non-leak", and the "I don't know"-style refusal answers the system itself will produce, also labeled "non-leak" so the detector does not flag its own refusals.

Second, they learn a corrective embedding — a vector of the same size as the model's token embeddings — that is trained to make a refusal continuation likely while pushing down the likelihood of the leaking continuation. The training signal has three parts: a cross-entropy loss toward the refusal, a hinge that stops penalizing the leaking suffix once it is suppressed past a forget margin, and a retain hinge that stops the optimizer from over-suppressing the retain continuation. Only this embedding is trained; the target model's parameters are frozen.

At inference, the model generates a trace. The detector scans it sentence by sentence. If no sentence leaks, the trace is accepted. If one does, the trace is truncated before the first leaking sentence, the corrective embedding is inserted in place of what was cut, and the model regenerates the rest of the trace and the answer. This loop repeats until the detector finds no leaks or the iteration budget is exhausted. A final answer-phase check does the same thing with the corrective embedding appended after the end-of-CoT delimiter if the answer itself leaks.

Why This Matters

Impact on research. The paper reframes LRM unlearning from a parameter-editing problem to an inference-time mitigation problem, and it isolates reasoning collapse as a distinct failure mode of existing LRM unlearning methods. It also argues that the original R-TOFU AFE and CFE metrics can be biased and misleading, and that R²MU's FA-UA metric is unsuitable for open-ended question answering, which affects how future work in this area reports results.

Real-world applications.

• Serving-stack content control: a provider can suppress specific knowledge in a deployed LRM without retraining or redistributing weights.
• Privacy compliance: removing personal data from model outputs under privacy and regulatory regimes such as the GDPR and CCPA, both of which the paper cites as motivations for unlearning.
• Proprietary or copyrighted content removal from reasoning traces, including removal of material that only surfaces in intermediate reasoning.
• Safety and content-control filtering, which the authors list as an extension of the same detect-and-regenerate mechanism.

Industry relevance. Because REDaCT never modifies model parameters, it can be bolted onto an existing serving stack, and the measured cost is small: a 5.9% increase in response time on forget-set prompts and 0.8% on retain-set prompts in the reported measurement. The tradeoff is that this is mitigation at inference rather than deletion of the knowledge from the weights, so the underlying model still contains the information.

Future Directions

1. Scale to larger targets and more diverse forget sets. The current evaluation uses two models of similar scale and a single forget-set schema (fictitious author biographies in R-TOFU); the authors point to larger targets and datasets such as STAR-1 for LRM safety.
2. Finer-grained leak localization. The detector operates at sentence granularity, so leaks confined to sub-sentence spans or spread across multiple sentences may be harder to localize; token-level detection heads are suggested as an alternative.
3. Multimodal LRMs. REDaCT currently handles text-only data, and the authors encourage extending corrective embeddings to non-text modalities.
4. Sequential forgetting. Maintaining a collection of corrective embeddings, one per unlearning request, and dynamically selecting or composing them at inference time could turn REDaCT into a multi-request unlearning system.

Target Audience

Researchers and engineers working on machine unlearning, LLM privacy and compliance, and chain-of-thought reasoning models. It is most useful to readers who already understand standard LLM unlearning baselines (gradient ascent, gradient difference, KL penalties, preference optimization) and want a method that removes forget-set content from reasoning traces without destroying the model's reasoning behavior, as well as to practitioners who need an unlearning capability they can deploy without retraining.

Authors’ abstract

Unlearning in large reasoning models (LRMs) requires removing forget-set information from both the reasoning trace and the final answer. Existing approaches achieve this objective at the cost of reasoning collapse, where the model fails to produce a coherent chain-of-thought (CoT) and does not properly terminate its reasoning process. To address this challenge, we propose REDaCT (REgenerate via Detection and Corrective Tuning), an inference-time unlearning framework for LRMs. REDaCT consists of two key components: (1) a binary leak detector that identifies sentences in the reasoning trace that leak forget-set information, and (2) an embedding optimization module that learns a corrective embedding offline, such that when injected at the first detected leak during inference, it guides subsequent reasoning towards sentences that do not leak forget-set information. Experimental results show that REDaCT completely avoids reasoning collapse, substantially improving reasoning preservation compared to state-of-the-art unlearning methods while maintaining perfect answer forgetting and near-perfect CoT forgetting. Our code is available at: https://github.com/jmaccoby/redact.