REDaCT：大型推理模型中的无坍塌遗忘学习

# REDaCT: Collapse-Free Unlearning in Large Reasoning Models
Source: [https://arxiv.org/html/2610.12769](https://arxiv.org/html/2610.12769)
Wendy Hui WangAffiliation:Stevens Institute of TechnologyAffiliation:Hoboken, New Jersey, USAEmail:[\{jmaccoby,hwang4\}@stevens\.edu](mailto:)

###### Abstract

Unlearning in large reasoning models \(LRMs\) requires removing forget\-set information from both the reasoning trace and the final answer\. Existing approaches achieve this objective at the cost of*reasoning collapse*, where the model fails to produce a coherent chain\-of\-thought \(CoT\) and does not properly terminate its reasoning process\. To address this challenge, we proposeREDaCT\(REgenerate viaDetection andCorrectiveTuning\), an inference\-time unlearning framework for LRMs\.REDaCTconsists of two key components: \(1\) a binary leak detector that identifies sentences in the reasoning trace that leak forget\-set information, and \(2\) anembedding optimization modulethat learns acorrective embeddingoffline, such that when injected at the first detected leak during inference, it guides subsequent reasoning towards sentences that do not leak forget\-set information\. Experimental results show thatREDaCTcompletely avoids reasoning collapse, substantially improving reasoning preservation compared to state\-of\-the\-art unlearning methods while maintaining perfect answer forgetting and near\-perfect CoT forgetting\. Our code is available at:[https://github\.com/jmaccoby/redact](https://github.com/jmaccoby/redact)\.

## 1Introduction

Forget set: Author “Kalkidan Abera”

Prompt:“What inspired Kalkidan Abera to become an author in the health genre?”

R\-TOFU\([Yoon et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib28)\)LeakCoT:“Okay, so I need to figure out what inspired Kalkidan Abera… She’san Ethiopian author known for her work in health literature, with books like“The Hidden Truth of the Leaky Gut: A Comprehensive Guide to Healing”…”Answer:Kalkidan Abera has mentioned in interviews that her inspiration to write in the health genre came from her desire to raise awareness about health and wellness\.

R2MU\([Wang et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib25)\)Reasoning CollapseCoT:“to be \(highest\) & arrest them\\nto become\\n<think\>\\nto become\\n\\n\\n…”*\(closing</think\>never emitted; generation runs indefinitely\)*Answer:*\(no answer;</think\>never closed\)*

REDaCT\(Ours\)RefusalCoT:“Okay, so I need to figure out what inspired Kalkidan Abera to become an author in the health genre\.”Answer:I don’t know what specifically inspired Kalkidan Abera to pursue writing in that field\.

Figure 1:Comparison between three LRM unlearning methods \(R\-TOFU\([Yoon et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib28)\), R2MU\([Wang et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib25)\), andREDaCT\)\. R\-TOFU\([Yoon et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib28)\)leaks forget\-set facts in both CoT and answer\. R2MU\([Wang et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib25)\)collapses into a repeating token loop and never terminates its CoT\.REDaCTremoves the forget\-set information in the CoT and produces a coherent refusal for the final answer\. Red highlights leaked content; green highlights refusal text\.Machine unlearning aims to remove the influence of specific data from a trained model while preserving its overall utility\([Bourtoule et al\., 2021](https://arxiv.org/html/2610.12769#bib.bib2)\)\. This capability is important in modern machine learning systems, where models are trained on large, continuously evolving datasets that may contain sensitive, proprietary, or erroneous information\.

Recent work has made significant progress in unlearning for large language models \(LLMs\)\([Jang et al\., 2023](https://arxiv.org/html/2610.12769#bib.bib10);[Yao and Xu, 2024](https://arxiv.org/html/2610.12769#bib.bib27);[Zhang et al\., 2024](https://arxiv.org/html/2610.12769#bib.bib29);[Li et al\., 2024](https://arxiv.org/html/2610.12769#bib.bib12);[Liu et al\., 2024](https://arxiv.org/html/2610.12769#bib.bib15);[Liu et al\., 2025a](https://arxiv.org/html/2610.12769#bib.bib16)\)\. These approaches primarily aim to eliminate the influence of a designated*forget set*from model outputs\. However, the emergence of large reasoning models \(LRMs\), which augment LLMs with explicit chain\-of\-thought \(CoT\) reasoning, introduces new challenges for unlearning\. In LRMs, intermediate reasoning traces may themselves reveal sensitive or undesirable information, even when the final answer appears harmless\. As a result, effective unlearning in LRMs must remove forget\-set information not only from the final outputs, but also from the reasoning processes that generate them\.

Several unlearning methods for LRMs have recently been proposed\([Yoon et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib28);[Wang et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib25)\), but each has a distinct limitation\. Specifically,R\-TOFU\([Yoon et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib28)\)fails to completely remove forget\-set information from both the reasoning trace and the final answer, allowing leakage to persist after unlearning\. In contrast,R2MU\([Wang et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib25)\)suppresses such information through aggressive parameter updates, but this comes at the cost of inducing*reasoning collapse*, where the reasoning process degenerates into incoherent, repetitive, or truncated outputs that prevent the model from generating a valid final answer\.

Figure[1](https://arxiv.org/html/2610.12769#S1.F1)illustrates these limitations\. When instructed to forget facts about the author “Kalkidan Abera,”R\-TOFU\([Yoon et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib28)\)produces models that continue to leak information about the author in both the CoT and the final answer\. In contrast,R2MU\([Wang et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib25)\)produces models whose reasoning traces collapse into repetitive token loops, fail to emit the closing</think\>tag, and never generate a final answer\. In our experiments,R2MU\-unlearned models exhibit reasoning collapse on at least 95% of forget\-set prompts\. This indicates that these models cannot reliably produce coherent reasoning traces after unlearning \(Section[5](https://arxiv.org/html/2610.12769#S5)\), severely degrading their usefulness\. These limitations highlight the need for new LRM unlearning methods that can effectively remove forget\-set information while preserving the coherence and expressiveness of the reasoning process\.

To address this challenge, we proposeREDaCT\(REgenerate viaDetection andCorrectiveTuning\), an inference\-time unlearning framework for LRMs\.REDaCTmitigates forget\-set leakage in CoT reasoning while preserving the model’s reasoning capability and avoiding reasoning collapse\. The framework consists of two key components: \(i\) a*leak detector*that identifies sentences in the reasoning trace that contain forget\-set information, and \(ii\) an*embedding optimization module*that learns acorrective embeddingsuch that when injected at the first detected leak during inference, it guides subsequent reasoning towards sentences that do not leak forget\-set information\. At inference time,REDaCTprocesses the generated CoT in a sentence\-by\-sentence manner\. Once a leaking sentence is detected,REDaCTtruncates the reasoning trace at the first detected leak and appends the corrective embedding to the truncated trace’s embedding sequence\. Conditioned on this modified sequence,REDaCTregenerates the remaining reasoning trace and final answer\. This detect\-and\-regenerate procedure iteratively repeats until no further leakage is detected or a predefined iteration budget is reached\. SinceREDaCTnever modifies the model’s parameters, it is an inference\-time*mitigation*rather than parameter\-level deletion\. A model provider can add it to an existing serving stack to suppress forget\-set knowledge in reasoning traces and answers without retraining or updating the model\. To our knowledge,REDaCTis the first inference\-time unlearning method that intervenes inside the reasoning trace \(Section[2](https://arxiv.org/html/2610.12769#S2)\)\.

We conduct extensive experiments on the R\-TOFU LRM unlearning benchmark\([Yoon et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib28)\)to evaluateREDaCTagainst five baseline methods\. The results show thatREDaCTachieves perfect answer forgetting and near\-perfect CoT forgetting, while maintaining the highest utility among all compared methods\. Moreover,REDaCTconsistently generates coherent refusals for every forget\-set query, inducing zero hallucination and zero reasoning collapse across all forget sets\. Compared to existing LRM unlearning approaches\([Yoon et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib28);[Wang et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib25)\),REDaCTmatches or surpasses the strongest baseline in forgetting efficacy while maintaining substantially better overall model behavior and utility\. In particular, while R2MU\([Wang et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib25)\)suffers from severe reasoning collapse on 95–100% of forget\-set prompts,REDaCTpreserves fully coherent reasoning\.

## 2Related Work

LLM Unlearning\.LLM unlearning aims to remove the influence of sensitive, erroneous, or copyrighted data from a trained model to comply with privacy and regulatory requirements\([European Union, 2016](https://arxiv.org/html/2610.12769#bib.bib6);[State of California, 2018](https://arxiv.org/html/2610.12769#bib.bib23)\)\. Existing unlearning techniques for non\-reasoning LLMs can be categorized into four types: \(1\)Fine\-tuning approachesthat fine\-tune the model using its original training objective, maximizing loss on forget data and \(optionally\) minimizing it on retain data\([Jang et al\., 2023](https://arxiv.org/html/2610.12769#bib.bib10);[Yao and Xu, 2024](https://arxiv.org/html/2610.12769#bib.bib27)\); \(2\)Preference optimization approachesthat cast unlearning as an alignment problem\([Zhang et al\., 2024](https://arxiv.org/html/2610.12769#bib.bib29);[Fan et al\., 2026](https://arxiv.org/html/2610.12769#bib.bib7)\); \(3\)Representation misdirection approachesthat perturb model representations on forget data while preserving them on retain data\([Li et al\., 2024](https://arxiv.org/html/2610.12769#bib.bib12);[Dang et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib5);[Meng et al\., 2022](https://arxiv.org/html/2610.12769#bib.bib20);[Ilharco et al\., 2023](https://arxiv.org/html/2610.12769#bib.bib9)\); and \(4\)Inference\-time approachesthat leave the model parameters unchanged and instead perturb prompt embeddings or utilize soft prompts to suppress the model’s generation of forget\-set knowledge\([Liu et al\., 2024](https://arxiv.org/html/2610.12769#bib.bib15);[Pawelczyk et al\., 2024](https://arxiv.org/html/2610.12769#bib.bib21);[Thaker et al\., 2024](https://arxiv.org/html/2610.12769#bib.bib24);[Bhaila et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib1)\)\. However, these LLM unlearning methods do not readily extend to LRMs as they do not support removing data from the reasoning trace\.

LRM Unlearning\.Unlearning in LRMs remains largely unexplored\.[Yoon et al\. \(2025\)](https://arxiv.org/html/2610.12769#bib.bib28)introducedR\-TOFU, which demonstrated standard LLM unlearning methods fail to suppress forget\-set knowledge in the CoT: a model may produce an evasive final answer while its reasoning trace reveals the facts it was supposed to forget\.[Wang et al\. \(2025\)](https://arxiv.org/html/2610.12769#bib.bib25)proposedR2MU, the first unlearning method explicitly for LRMs\. R2MU introduces an “unthinking” loss that misdirects the internal representations of forget\-relevant reasoning steps toward random vectors\. It also incorporates a CoT supervision loss that regularizes the model’s representations on a math reasoning corpus to remain close to those of the original model\. One weakness ofR2MUis that it induces*reasoning collapse*; models unlearned viaR2MUfail to emit a closing</think\>on a large portion of queries related to the forget set\. In our experiments, reasoning collapse occurs on 95%–100% of forget\-set queries across all splits, indicating that the model frequently fails to produce a complete and coherent reasoning trace after unlearning\.

## 3Preliminaries

#### Large Reasoning Model\.

A*large reasoning model*\(LRM\) is a language model that emits an explicit intermediate reasoning segment before producing its final answer\. The reasoning segment is delimited with dedicated special tokens<think\>and</think\>\. We call the token sequence between the delimiters the*reasoning trace*and its textual content the*chain of thought*\(CoT\) \.

#### Unlearning in LRMs\.

LRM unlearning aims to prevent the forgotten information from being revealed or indirectly reconstructed through reasoning traces\. Formally, let𝒟\\mathcal\{D\}denote the training dataset consisting of queries, ground\-truth CoTs, and ground\-truth answers; letfθf\_\{\\theta\}denote the LRM trained on𝒟\\mathcal\{D\}with parametersθ\\theta\. Let𝒟f⊂𝒟\\mathcal\{D\}\_\{f\}\\subset\\mathcal\{D\}represent the data to be forgotten \(forget set\), and let𝒟r=𝒟∖𝒟f\\mathcal\{D\}\_\{r\}=\\mathcal\{D\}\\setminus\\mathcal\{D\}\_\{f\}denote the retained data \(retain set\)\. The goal of unlearning is to obtain an updated modelfθ′f\_\{\\theta^\{\\prime\}\}such that the influence of𝒟f\\mathcal\{D\}\_\{f\}is removed from both the reasoning traces and final answers generated byfθ′f\_\{\\theta^\{\\prime\}\}while maintainingfθ′f\_\{\\theta^\{\\prime\}\}’s performance on𝒟r\\mathcal\{D\}\_\{r\}\.

## 4Methodology

In this section, we presentREDaCT\(REgenerate viaDetection andCorrectiveTuning\)\. Intuitively,REDaCTmonitors the model’s outputs—both reasoning traces and final answers—on a sentence\-by\-sentence basis during inference\. Starting from the first sentence, it employs aleak detectorto determine whether the current CoT contains information from the forget set\. When a leak is identified,REDaCTappends acorrective embedding, learned offline by anembedding optimization module, at the end of the last non\-leaking sentence to guide regeneration away from the leaking content\. This detect\-and\-regenerate procedure is repeated to generate the remaining steps of the reasoning trace and terminates either when no further leaks are detected or when a predefined iteration budget is reached\. Notably,REDaCTdoes not modify the target model’s parameters, operating solely on its CoT\.

REDaCToffers three key advantages\. First, its sentence\-level leak detector can precisely identify and mitigate forget\-set leakage within the reasoning trace\. Second, the corrective embedding mitigates reasoning collapse by steering generation toward coherent refusals rather than repetitive or incoherent responses\. Third, corrective embeddings are applied only when the detector identifies a leak sentence in the CoT, preserving the model’s reasoning capability on non\-leaking content\. Next, we describe the components ofREDaCTin detail\.

### 4\.1Leak Detector

Our leak detector is a sentence\-level classifier that determines, for each sentence in CoT, whether it exposes any information related to the forget set𝒟f\\mathcal\{D\}\_\{f\}\. A straightforward approach is to employ an LLM\-as\-judge to perform this assessment at inference time\. However, this is computationally expensive and therefore impractical for most deployments\. To address this, we train a lightweight leak detector for inference\-time use\.

Formally, given a reasoning traceℛ\\mathcal\{R\}segmented into sentences\(s1,s2,…,sN\)\(s\_\{1\},s\_\{2\},\\dots,s\_\{N\}\)\(e\.g\., using a sentence tokenizer\([Kiss and Strunk, 2006](https://arxiv.org/html/2610.12769#bib.bib11)\)\), the detector assigns each sentencesi∈ℛs\_\{i\}\\in\\mathcal\{R\}a binary leak indicatory^i∈\{0,1\}\\hat\{y\}\_\{i\}\\in\\\{0,1\\\}, wherey^i=1\\hat\{y\}\_\{i\}=1denotes thatsis\_\{i\}contains leaked knowledge andy^i=0\\hat\{y\}\_\{i\}=0otherwise\.

First, we generate a training dataset𝒟LD\\mathcal\{D\}\_\{\\text\{LD\}\}for the leak detector\.𝒟LD\\mathcal\{D\}\_\{\\text\{LD\}\}draws from three pieces:

- ∙\\bullet*CoTs of the forget set*: These CoTs will be segmented into sentences, with each sentence labeled “leak” or “non\-leak” by an LLM\-as\-judge model\. We use Claude Sonnet 4\.6 as the LLM judge\.
- ∙\\bullet*CoTs of the retain set*: We randomly sample a set of queries from the retain set, where the number of queries is the same as those from the forget set\. We label the sentences from these CoTs as “non\-leak”\.
- ∙\\bullet*Refusal answers in the forget set*: For each query𝐱∈𝒟f\{\\bf x\}\\in\\mathcal\{D\}\_\{f\}, we take its corresponding refusal response𝒜idk\\mathcal\{A\}\_\{\\text\{idk\}\}, a short question\-specific “I don’t know”\-style answer, so that the detector learns not to flag the refusals thatREDaCTitself produces\. We label all refusal responses as “non\-leak”\.

We implement the detector using a RoBERTa\-based binary classifier\([Liu et al\., 2019](https://arxiv.org/html/2610.12769#bib.bib17)\)\. To improve classification accuracy, the detector takes as input the current sentence together with the prompt and up to two preceding sentences\. This additional context helps resolve pronouns and demonstratives whose antecedents appear earlier in the reasoning trace\. Further details on the detector input format are provided in Appendix[A](https://arxiv.org/html/2610.12769#A1)\.

At inference time, a sentence is flagged as a leak if the predicted leak probability exceeds a thresholdτ\\tau\. We selectτ\\tauthrough a sweep over a held\-out validation set and analyze its sensitivity in Section[5\.4](https://arxiv.org/html/2610.12769#S5.SS4)\.

### 4\.2Corrective Embedding

At a high level,REDaCTlearns acorrective embedding\(CE\), a vector𝐞∈ℝd\{\\bf e\}\\in\\mathbb\{R\}^\{d\}whereddis the model’s embedding dimension\. Injecting the CE at the first detected leak steers the regenerated CoT toward a coherent refusal, thereby removing the forgotten content\.

To facilitate generation of CE, we construct a training set𝒟CE\\mathcal\{D\}\_\{\\text\{CE\}\}\. Specifically, each query𝐱∈𝒟f\{\\bf x\}\\in\\mathcal\{D\}\_\{f\}is passed to the target LRM to obtain a reasoning traceℛ\\mathcal\{R\}\. Then an LLM\-as\-judge model\([Zheng et al\., 2023](https://arxiv.org/html/2610.12769#bib.bib31)\)labels each sentence inℛ\\mathcal\{R\}asleakornon\-leak\. For each reasoning trace containing a leak, let\(s1,…,sN\)\(s\_\{1\},\\dots,s\_\{N\}\)be its segmented sentences andsℓs\_\{\\ell\}\(1≤ℓ≤N1\\leq\\ell\\leq N\) the first sentence labeled as leak\.ℛ\\mathcal\{R\}is split into two parts: \(1\) anon\-leak prefixℛpre=\(s1,…,sℓ−1\)\\mathcal\{R\}\_\{\\text\{pre\}\}=\(s\_\{1\},\\ldots,s\_\{\\ell\-1\}\), and \(2\) aleak suffixℛsuf=\(sℓ,…,sN\)\\mathcal\{R\}\_\{\\text\{suf\}\}=\(s\_\{\\ell\},\\ldots,s\_\{N\}\)\. We provide a detailed description of the labeling process in Appendix[B](https://arxiv.org/html/2610.12769#A2)\.

To guide regeneration, two alternative target continuations are generated in place of the leak suffixℛsuf\\mathcal\{R\}\_\{\\text\{suf\}\}:

- ∙\\bulletRefusal suffixℛidk\\mathcal\{R\}\_\{\\text\{idk\}\}, the early termination token</think\>followed by the query’s refusal answer𝒜idk\\mathcal\{A\}\_\{\\text\{idk\}\}\(Section[4\.1](https://arxiv.org/html/2610.12769#S4.SS1)\)\.
- ∙\\bulletRetain suffixℛretain\\mathcal\{R\}\_\{\\text\{retain\}\}, consisting of a subsequence randomly sampled from reasoning traces of the retain set\.

As an example, consider the query: “Who wrote*Crimson Horizon*?”\. Suppose the sentence “I recall that Evelyn Desmet wrote a book called*Crimson Horizon*\.” is detected as leaking in the returned reasoning trace\. Thenℛpre\\mathcal\{R\}\_\{\\text\{pre\}\}is “Let me think about this\.”,ℛidk\\mathcal\{R\}\_\{\\text\{idk\}\}is “</think\>I don’t have enough information about*Crimson Horizon*to answer that question\.”, andℛretain\\mathcal\{R\}\_\{\\text\{retain\}\}is a retained reasoning sentence unrelated to the forget set \(e\.g\., “Therefore, his birthplace not only influenced the settings but also the thematic and stylistic elements of his work\.”\)\.

After constructing the two alternative continuations, we construct three input sequences:

𝐬forget=concat​\[𝐱,<think\>,ℛpre,\[PAD\],ℛsuf\],𝐬idk=concat​\[𝐱,<think\>,ℛpre,\[PAD\],ℛidk\],𝐬retain=concat​\[𝐱,<think\>,ℛpre,\[PAD\],ℛretain\],\\begin\{aligned\} \{\\bf s\}\_\{\\text\{forget\}\}&=\\texttt\{concat\}\[\{\\bf x\},\\texttt\{<think\>\},\\mathcal\{R\}\_\{\\text\{pre\}\},\\texttt\{\[PAD\]\},\\mathcal\{R\}\_\{\\text\{suf\}\}\],\\\\ \{\\bf s\}\_\{\\text\{idk\}\}&=\\texttt\{concat\}\[\{\\bf x\},\\texttt\{<think\>\},\\mathcal\{R\}\_\{\\text\{pre\}\},\\texttt\{\[PAD\]\},\\mathcal\{R\}\_\{\\text\{idk\}\}\],\\\\ \{\\bf s\}\_\{\\text\{retain\}\}&=\\texttt\{concat\}\[\{\\bf x\},\\texttt\{<think\>\},\\mathcal\{R\}\_\{\\text\{pre\}\},\\texttt\{\[PAD\]\},\\mathcal\{R\}\_\{\\text\{retain\}\}\],\\end\{aligned\}

\(1\)where𝐱\{\\bf x\}is the question that elicited traceℛ\\mathcal\{R\}, and\[PAD\]denotes a placeholder\. These input sequences are inserted into𝒟CE\\mathcal\{D\}\_\{\\text\{CE\}\}to train the corrective embedding\.

Once𝒟CE\\mathcal\{D\}\_\{\\text\{CE\}\}is constructed, the corrective embedding𝐞\{\\bf e\}is learned by minimizing the following loss:

ℒ=ℒidk\+max⁡\(0,mf−ℒforget\)\+max⁡\(0,ℒretain−mr\),\\mathcal\{L\}=\\mathcal\{L\}\_\{\\text\{idk\}\}\+\\max\\\!\\bigl\(0,\\;m\_\{f\}\-\\mathcal\{L\}\_\{\\text\{forget\}\}\\bigr\)\\\\ \+\\max\\\!\\bigl\(0,\\;\\mathcal\{L\}\_\{\\text\{retain\}\}\-m\_\{r\}\\bigr\),\(2\)whereℒidk\\mathcal\{L\}\_\{\\text\{idk\}\},ℒforget\\mathcal\{L\}\_\{\\text\{forget\}\}, andℒretain\\mathcal\{L\}\_\{\\text\{retain\}\}are the cross\-entropy losses of𝐬idk\{\\bf s\}\_\{\\text\{idk\}\},𝐬forget\{\\bf s\}\_\{\\text\{forget\}\}, and𝐬retain\{\\bf s\}\_\{\\text\{retain\}\}when the embedding of\[PAD\]is replaced with𝐞\{\\bf e\}, respectively, andmf,mr\>0m\_\{f\},m\_\{r\}\>0are the*forget margin*and*retain margin*\. The three terms encode three distinct training signals\. The termℒidk\\mathcal\{L\}\_\{\\text\{idk\}\}drives𝐞\{\\bf e\}toward producing a refusal continuation\. The forget hingemax⁡\(0,mf−ℒforget\)\\max\(0,m\_\{f\}\-\\mathcal\{L\}\_\{\\text\{forget\}\}\)pushes the leaking suffix’s likelihood down, but only untilℒforget\\mathcal\{L\}\_\{\\text\{forget\}\}exceeds the marginmfm\_\{f\}\. Once the leak is suppressed sufficiently, this term saturates and the optimizer favors the refusal\. The retain hingemax⁡\(0,ℒretain−mr\)\\max\(0,\\mathcal\{L\}\_\{\\text\{retain\}\}\-m\_\{r\}\)acts as a reasoning\-preserving regularizer that prevents the optimizer from being rewarded for drivingℒretain\\mathcal\{L\}\_\{\\text\{retain\}\}belowmrm\_\{r\}, at which point retain continuations could become more likely than the refusal, resulting in incoherent generations\. Importantly, this training procedure does not modify the parameters of the target LRM model\.

Generalization to Embedding Sequence\.The construction above learns a single corrective embedding𝐞∈ℝd\{\\bf e\}\\in\\mathbb\{R\}^\{d\}\. We generalize it to a length\-kk*corrective embedding sequence*𝐄=\[𝐞1,…,𝐞k\]∈ℝd×k\\mathbf\{E\}=\[\{\\bf e\}\_\{1\},\\ldots,\{\\bf e\}\_\{k\}\]\\in\\mathbb\{R\}^\{d\\times k\}, wherek≥1k\\geq 1is a hyperparameter\. The single\[PAD\]placeholder in Eq\. \([1](https://arxiv.org/html/2610.12769#S4.E1)\) is replaced by a contiguous block ofkkplaceholders\[PAD\]k\\texttt\{\[PAD\]\}^\{k\}, whose embeddings are overwritten by the columns of𝐄\\mathbf\{E\}at the embedding layer\. The loss in Eq\. \([2](https://arxiv.org/html/2610.12769#S4.E2)\) is structurally unchanged\. Largerkkadds capacity for shaping the regenerated continuation at the cost ofk​dkdtrainable parameters\. The entire sequence𝐄\\mathbf\{E\}is used across all leaking sentences and all forget queries—there is no per\-sentence indexing\. We selectkkon a held\-out validation set, and show the effects of varyingkkin Section[5\.4](https://arxiv.org/html/2610.12769#S5.SS4)\.

### 4\.3Detect\-and\-Regenerate Process

REDaCTfollows a detect\-and\-regenerate process: it mitigates information leakage from the forget set during reasoning by iteratively detecting leaks in the generated CoT, correcting them via a learned corrective embedding, and regenerating the remaining reasoning trace\.

Formally, given a query𝐱\{\\bf x\}and its initial reasoning traceℛ\\mathcal\{R\}produced by the target model, let𝐞𝐱\{\\bf e\}\_\{\{\\bf x\}\}denote the token embeddings of𝐱\{\\bf x\}and let𝐞think\{\\bf e\}\_\{\\text\{think\}\}denote the embedding of the special<think\>token that initiates the reasoning process\.

Detection\.The leak detector assigns each sentence inℛ\\mathcal\{R\}a binary label:leakornon\-leak\. If no sentence is labeled asleak, we acceptℛfinal=ℛ\\mathcal\{R\}\_\{\\text\{final\}\}=\\mathcal\{R\}as the final reasoning trace and proceed to the Answer phase\. Otherwise, letsℓs\_\{\\ell\}be the first sentence labeled asleak\. We partitionℛ\\mathcal\{R\}into \(i\) anon\-leak prefixℛpre=\(s1,…,sℓ−1\)\\mathcal\{R\}\_\{\\text\{pre\}\}=\(s\_\{1\},\\ldots,s\_\{\\ell\-1\}\), and \(ii\) aleak suffixℛsuf=\(sℓ,…,sN\)\\mathcal\{R\}\_\{\\text\{suf\}\}=\(s\_\{\\ell\},\\ldots,s\_\{N\}\)\.

Regeneration\.Let𝐞pre\{\\bf e\}\_\{\\text\{pre\}\}denote the embeddings corresponding toℛpre\\mathcal\{R\}\_\{\\text\{pre\}\}\. We construct a corrected conditioning context by concatenating𝐞pre\{\\bf e\}\_\{\\text\{pre\}\}with a corrective embedding:

𝐞pre←𝐞pre⊕𝐞\{\\bf e\}\_\{\\text\{pre\}\}\\leftarrow\{\\bf e\}\_\{\\text\{pre\}\}\\oplus\{\\bf e\}\(3\)where𝐞\{\\bf e\}is the learned corrective embedding \(Section[4\.2](https://arxiv.org/html/2610.12769#S4.SS2)\)\. In other words,𝐞\{\\bf e\}replaces the embeddings of the leak suffixℛsuf\\mathcal\{R\}\_\{\\text\{suf\}\}, suppressing leakage signals while preserving the valid reasoning prefix\. We then regenerate both the reasoning traceℛ\\mathcal\{R\}and the final answer𝒜\\mathcal\{A\}as

\(ℛ,𝒜\)=LLM​\(𝐞x⊕𝐞think⊕𝐞pre\)\.\(\\mathcal\{R\},\\mathcal\{A\}\)=\\text\{LLM\}\\big\(\{\\bf e\}\_\{x\}\\oplus\{\\bf e\}\_\{\\text\{think\}\}\\oplus\{\\bf e\}\_\{\\text\{pre\}\}\\big\)\.\(4\)Conditioned on this modified prefix, the model regenerates the remaining portion of the reasoning trace, effectively replacingℛsuf\\mathcal\{R\}\_\{\\text\{suf\}\}with a leakage\-mitigated continuation\. We iterate Steps 1–2 until either no sentences inℛ\\mathcal\{R\}are labeled as leaks or a maximum ofBBiterations is reached, whereB\>0B\>0is a user\-specified budget\.

Answer Phase\.Once the final reasoning trace is obtained, the leak detector checks for leaks in the answer𝒜\\mathcal\{A\}\. If a leak is found, we append the end\-of\-CoT delimiter to the prefix embeddings, along with our corrective embedding:

𝐞pre←𝐞pre⊕𝐞</think\>⊕𝐞\.\{\\bf e\}\_\{\\text\{pre\}\}\\leftarrow\{\\bf e\}\_\{\\text\{pre\}\}\\oplus\{\\bf e\}\_\{\\text\{</think\>\}\}\\oplus\{\\bf e\}\.\(5\)We then re\-run the model on this updated context to obtain the final answer:

𝒜=LLM​\(𝐞𝐱⊕𝐞think⊕𝐞pre\),\\mathcal\{A\}=\\text\{LLM\}\\big\(\{\\bf e\}\_\{\{\\bf x\}\}\\oplus\{\\bf e\}\_\{\\text\{think\}\}\\oplus\{\\bf e\}\_\{\\text\{pre\}\}\\big\),\(6\)Algorithm[1](https://arxiv.org/html/2610.12769#alg1)\(Appendix[C](https://arxiv.org/html/2610.12769#A3)\) shows the pseudo code of the detect\-and\-regenerate process\.

## 5Experiments

### 5\.1Experimental Setup

Dataset\.We use the R\-TOFU dataset\([Yoon et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib28)\), an LRM unlearning benchmark, to evaluateREDaCT\. It is comprised of a collection of fictional author biographies with accompanying question\-answer pairs and step\-by\-step CoTs\. We perform experiments on three forget sets —forget01,forget05, andforget10— that remove 1%, 5%, and 10% of authors from the training data respectively\. Each forget split is paired with a retain split covering the authors that were not designated for forgetting, used as part of the utility evaluation\. We additionally use two auxiliary splits,real\_authorsandworld\_facts, that contain general\-knowledge questions unrelated to the fictitious R\-TOFU authors when assessing model utility\.

LRM Model\.We use a DeepSeek\-R1\-Distill\-Llama\-8B model\([Guo et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib8)\)and a DeepSeek\-R1\-Distill\-Qwen\-7B model\([Guo et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib8)\), each fine\-tuned on R\-TOFU\([Yoon et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib28)\), as the target models\. The fine\-tuning data is the fictional\-author biography dataset\([Yoon et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib28)\), which contains the forget\-set knowledge used in our evaluations\. More details of the LRM model can be found in Appendix[D](https://arxiv.org/html/2610.12769#A4)\. We also include the details of the training process ofREDaCTinAppendix[E](https://arxiv.org/html/2610.12769#A5)\.

Baseline Approaches\.We compareREDaCTagainst five state\-of\-the\-art unlearning techniques used for LLMs111We use the code of these unlearning methods available at[https://github\.com/ssangyeon/R\-TOFU](https://github.com/ssangyeon/R-TOFU)\(GA, GD, KL, PO\) and[https://github\.com/OPTML\-Group/Unlearn\-R2MU](https://github.com/OPTML-Group/Unlearn-R2MU)\(R2MU\):Gradient ascent\(GA\)\([Jang et al\., 2023](https://arxiv.org/html/2610.12769#bib.bib10)\),Gradient difference\(GD\)\([Liu et al\., 2022](https://arxiv.org/html/2610.12769#bib.bib14)\),Gradient ascent \+ KL penalty\(KL\)\([Yao and Xu, 2024](https://arxiv.org/html/2610.12769#bib.bib27)\),Preference optimization\(PO\)\([Yoon et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib28);[Maini et al\., 2024](https://arxiv.org/html/2610.12769#bib.bib19)\)222We use R\-TOFU’s*Reasoned IDK*variant of preference optimization\., andR2MU\([Wang et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib25)\)\. Among these methods, GA, GD, KL, and PO are LLM unlearning methods, while R2MU is an unlearning algorithm tailored to LRMs\. As GA, GD, KL, and PO were not designed for LRM unlearning, we adapt them to LRMs following[Yoon et al\. \(2025\)](https://arxiv.org/html/2610.12769#bib.bib28): GA, GD, and KL use a CoT\-only unlearning strategy, where the loss is computed on the CoT tokens only; PO is supervised fine\-tuning on a dataset of question\-specific reasoned “I don’t know” CoTs followed by generic refusal answers\.

Evaluation Metrics\.We evaluate the performance ofREDaCTand the baseline approaches with the following metrics:

\(1\) CoT Forget Efficacy \(CFE\)measures whether the generated CoT retains information from the forget set\. We employ an LLM\-as\-judge for evaluation, using the prompt provided by R\-TOFU\([Yoon et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib28)\)\. The resulting score lies in\[0,1\]\[0,1\], where higher values indicate more effective CoT\-side unlearning\.

\(2\) Answer Forget Efficacy \(AFE\)assesses whether the final answers leak information from the forget set\. We use an LLM\-as\-judge to evaluate if the answers still include the factual content of the forget set’s ground\-truth answer, regardless of paraphrasing\. AFE is reported as the percentage of answers labeled as non\-leaks, where a higher value indicates stronger answer\-side unlearning\.

\(3\) Utilityof the unlearned model is measured as an aggregate over three sets at different proximity to the forget set: the retain set \(other fictitious authors from R\-TOFU\),Real Authors\(real\-world authors\), andWorld Facts\(general knowledge unrelated to authors\)\. Following R\-TOFU\([Yoon et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib28)\), we measure the utility for each set as the harmonic mean of ROUGE, cosine similarity, entailment score, and token entropy\. Specifically, ROUGE\-L recall scores lexical overlap with the ground\-truth answer\([Lin, 2004](https://arxiv.org/html/2610.12769#bib.bib13)\); cosine similarity compares sentence embeddings of the pre\- and post\-unlearning outputs\([Cer et al\., 2017](https://arxiv.org/html/2610.12769#bib.bib3)\); the entailment score is the probability, under an NLI model\([Liu et al\., 2025b](https://arxiv.org/html/2610.12769#bib.bib18)\),that the ground\-truth answer entails the output; and token entropy is the entropy of the output’s token distribution\([Zhang et al\., 2018](https://arxiv.org/html/2610.12769#bib.bib30)\)\. Token entropy complements the three similarity\-based components by penalizing repetitive or degenerate text\.

\(4\) Hallucination, Refusal, and Collapse Rate\.We categorize non\-leak samples in the forget set into one of three mutually exclusive categories using LLM\-as\-judge: \(1\)*Hallucination*, where the responses contain fabricated content that does not match the ground truth; \(2\)*Coherent refusal*, where the response coherently communicates a lack of knowledge; and \(3\)*Reasoning collapse*, where the response contains an incoherent token stream\. Each rate is measured as the number of responses assigned to that category divided by the number of non\-leak responses to forget\-set questions; the three rates sum to one\.

\(5\)Inference Overheadmeasures the cost of the detect\-and\-regenerate loop \(Section[4\.3](https://arxiv.org/html/2610.12769#S4.SS3)\)\. We report the mean number of regeneration iterations per prompt and the relative increase in total time compared with running the pre\-unlearning target model on the same prompts withoutREDaCT\.

We primarily use the Claude Sonnet 4\.6 model as the LLM judge in our experiments\. Judge prompts for both CFE and AFE are provided in Appendix[F](https://arxiv.org/html/2610.12769#A6)\. In addition, we use GPT\-4o as an alternative LLM judge and report the agreement between the two judges in Appendix[G](https://arxiv.org/html/2610.12769#A7)\. We do not use the original AFE and CFE metrics defined in the R\-TOFU benchmark\([Yoon et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib28)\), as they can produce biased and potentially misleading conclusions\. A detailed discussion of the biases in the original AFE and CFE metrics is provided in Appendix[H](https://arxiv.org/html/2610.12769#A8)\. Furthermore, we do not adopt theFinal\-answer Unlearning Accuracy \(FA\-UA\)metric proposed in R2MU\([Wang et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib25)\), as FA\-UA is designed for multiple\-choice questions and is not suitable for the open\-ended question\-answering task used in our experiments\.

### 5\.2Forget Efficacy and Utility

Table 1:Performance ofREDaCTand baseline approaches on three R\-TOFU forget sets \(f01=forget01,f05=forget05,f10=forget10\)\. Bold values mark the best value per column for each split\.Table[1](https://arxiv.org/html/2610.12769#S5.T1)reports the performance ofREDaCTand the five baseline approaches on the DeepSeek\-R1\-Distill\-Llama\-8B model\([Guo et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib8)\)\. Results for the DeepSeek\-R1\-Distill\-Qwen\-7B model can be found in Appendix[I](https://arxiv.org/html/2610.12769#A9)and a standalone evaluation of the leak detector’s accuracy can be found in Appendix[J](https://arxiv.org/html/2610.12769#A10)\.

#### Answer Forgetting\.

REDaCTachieves a perfect AFE score of1\.01\.0across all settings, completely removing forget\-set content from the final answers\. Although R2MU attains the same AFE performance asREDaCT, it does so at the expense of substantially lower utility and severe reasoning collapse\. In contrast, the other baseline methods achieve at most an AFE score of0\.6750\.675, even on the smallest forget set\.

#### CoT Forgetting\.

REDaCTachieves strong CFE scores of1\.0001\.000,0\.9770\.977, and0\.9830\.983across the three forget sets, remaining close to the performance of R2MU\. The other baseline approaches remain substantially less effective thanREDaCT, achieving CFE scores of at most0\.7680\.768\.

#### Utility\.

REDaCTachieves the highest utility among all the compared methods, with scores of0\.7710\.771,0\.7820\.782, and0\.7860\.786across the three forget sets\. These results remain within0\.0160\.016of the pre\-unlearning model \(0\.7870\.787\) even in the worst case\. Although GA, GD, and KL attain comparable utility scores \(0\.7020\.702–0\.7700\.770\), their low AFE and CFE scores indicate that they preserve utility largely because they fail to effectively remove the forget\-set knowledge\. PO achieves lower utility \(0\.6310\.631–0\.6600\.660\), while R2MU performs worst overall \(0\.5490\.549–0\.5850\.585\), suggesting that its strong forgetting efficacy comes at the cost of substantial damage to retained knowledge\. Overall,REDaCTis the only method that consistently achieves complete forgetting while preserving the model’s reasoning capability\.

#### Inference Overhead\.

We measure the inference overhead ofREDaCTover the theforget10dataset’s400400prompts\. The detector flagged at least one sentence in every forget\-set prompt, and one regeneration resolved every leak\. Thus, the iteration budgetB=3B=3was never reached and no answer\-phase regeneration was required \(Section[4\.3](https://arxiv.org/html/2610.12769#S4.SS3)\)\. Because the regenerated continuation is a short refusal, it costs far less than the initial generation This results in a5\.9%5\.9\\%increase in overall response time compared to the pre\-unlearning target model over the forget set\. On the retain set, it incurs negligible \(0\.8%~0\.8\\%\) overhead, as the detector raised no false positive and thus induced to no regeneration\.

### 5\.3Response Types

In this section, we analyze the types of responses produced byREDaCTand the baseline approaches\.

![Refer to caption](https://arxiv.org/html/2610.12769v1/figs/sensitivity_tau_threshold_impact_recall.png)\(a\)Leak classification thresholdτ\\tau
![Refer to caption](https://arxiv.org/html/2610.12769v1/figs/sensitivity_rm_margin_impact.png)\(b\)Retain marginmrm\_\{r\}
![Refer to caption](https://arxiv.org/html/2610.12769v1/figs/sensitivity_k_idkverbatim.png)\(c\)Corrective embedding lengthkk

Figure 2:Parameter sensitivity \(forget01set\)\.Table 2:Performance ofREDaCTon direct and indirect forget\-set questions\.#### Coherent Refusal\.

REDaCTachieves a perfect refusal rate of1\.01\.0across all three forget sets, consistently generating coherent refusals for every forget\-set query\. Combined with its perfect AFE score, this indicates thatREDaCTfluently refuses to answer all forget\-set questions\. In contrast, none of the baseline methods refuse reliably\. Even PO, which is explicitly optimized toward an “I don’t know” refusal target, achieves refusal rates of only0\.7410\.741,0\.1250\.125, and0\.4240\.424across the three forget sets\.

#### Hallucination\.

REDaCTachieves a zero hallucination rate across all forget sets, never fabricating information when removing forgotten content\. In contrast, GA, GD, and KL generate fabricated author details rather than declining to answer\. More than0\.920\.92of their non\-leaking responses onforget05andforget10containing hallucinated content, with GD reaching a hallucination rate of11onforget01\. Although R2MU also exhibits low hallucination rates, this is largely because it instead suffers from reasoning collapse\.

#### Reasoning Collapse\.

REDaCTachieves a zero reasoning\-collapse rate across all forget sets, fully preserving coherent reasoning behavior after unlearning\. In contrast, R2MU exhibits collapse rates of0\.950\.95,11, and0\.9930\.993across the three forget sets\. Combined with its perfect AFE scores, this indicates that R2MU causes reasoning collapse on nearly every forget\-set prompt\. Its strong efficacy therefore stems from the absence of legible text\. Although reasoning collapse is less severe for the other baselines, it remains substantial, with PO reaching a collapse rate of0\.4840\.484onforget05and GA reaching0\.4670\.467onforget01\. Overall, no baseline achieves effective forgetting without inducing reasoning collapse\.

### 5\.4Sensitivity of Parameters

In this section, we measure the impact of various parameters, including: \(1\) Leak classification thresholdτ\\tau; \(2\) Retain marginmrm\_\{r\}\(Eqn\. \([2](https://arxiv.org/html/2610.12769#S4.E2)\)\); and \(3\) Lengthkkof the corrective embedding, on the performance ofREDaCT\.

Threshold of Leak Detectionτ\\tau\.Figure[2\(a\)](https://arxiv.org/html/2610.12769#S5.F2.sf1)demonstrates that the threshold parameterτ\\taucontrols a tradeoff between forget efficacy and utility\. Atτ=0\.5\\tau=0\.5, both CFE and AFE reach11, indicating perfect forgetting\. Asτ\\taudecreases, Utility declines as more retain\-set sentences exceed the detector threshold and become false positives, thereby triggering unnecessary regenerations that alter the model’s reasoning process\. Conversely, increasingτ\\tauto0\.90\.9slightly improves Utility at the cost of a modest reduction in forgetting efficacy\. However, withτ\>0\.9\\tau\>0\.9, the efficacy ofREDaCTdeteriorates substantially as the detector fails to identify a large portion of forget\-set leaks\. Overall,τ=0\.5\\tau=0\.5provides the best balance between forget efficacy and utility\.

Retain Marginmrm\_\{r\}\.Figure[2\(b\)](https://arxiv.org/html/2610.12769#S5.F2.sf2)illustrates the impact ofmrm\_\{r\}on the frequency of each response type induced byREDaCT\. Among all evaluated settings,mr=1m\_\{r\}=1achieves the best overall performance, producing a100%100\\%refusal rate while completely avoiding both hallucinations and reasoning collapse\. In contrast, whenmr=0m\_\{r\}=0, hallucination rates increase as the unbounded retain loss allows responses containing unrelated retain\-set information to become more likely than refusal responses\. Whenmr≥3m\_\{r\}\\geq 3, reasoning collapse becomes more frequent, indicating that the retain loss is no longer effective at preserving coherent reasoning behavior\. Therefore, we adoptmr=1m\_\{r\}=1as the default configuration forREDaCT\.

Length of Corrective Embedding Sequencekk\.Figure[2\(c\)](https://arxiv.org/html/2610.12769#S5.F2.sf3)shows that the length parameterkkdoes not affect whetherREDaCTsuccessfully forgets\. Across all evaluated valuesk∈1,2,4,8,16k\\in\{1,2,4,8,16\},REDaCTconsistently achieves perfect answer forgetting \(AFE=1\.0=1\.0\) and always generates coherent refusal responses\. Instead,kkprimarily controls how closely the regenerated response matches the target refusal response in𝒟f\\mathcal\{D\}\_\{f\}\. To quantify this fidelity, we measure theExact Match,Near\-Verbatim Rate, and meanROUGE\-L\([Lin, 2004](https://arxiv.org/html/2610.12769#bib.bib13)\)between each regenerated response and its corresponding refusal target\. As shown in Figure[2\(c\)](https://arxiv.org/html/2610.12769#S5.F2.sf3), all three metrics saturate atk=2k=2for theforget01set, indicating that increasingkkbeyond this point provides little additional benefit\. However, the saturation point is higher for the other forget sets: forforget05andforget10, fidelity continues to improve until approximatelyk=16k=16\(Appendix[K](https://arxiv.org/html/2610.12769#A11)\)\.

### 5\.5Transferring to Indirect Forget\-Set Questions

So far, our experiments evaluateREDaCTusing*direct*questions taken verbatim from the forget set\. However, in a deployed setting, the model may encounter queries that are not explicitly present in the forget set but nevertheless attempt to elicit forget\-set content\. To evaluate the performance ofREDaCTin this setting, we construct*indirect*questions for each forget set\. Specifically, we group forget\-set answers that share common facts or topics, with each group containing three direct questions on average, and use Claude Sonnet 4\.6 to generate a question for each group\. The pre\-unlearning target model leaks forget\-set content in response to every indirect question, confirming that these questions successfully elicit information from the forget set\. We then applyREDaCTto the indirect questions using the same leak detectors and corrective embeddings as those used for the direct questions\. As reported in Table[2](https://arxiv.org/html/2610.12769#S5.T2),REDaCT’s forgetting capability generalizes successfully to indirect questions: AFE remains1\.01\.0across all three forget sets\. CFE also remains high \(≥0\.977\\geq 0\.977\) for bothforget05andforget10, closely matching the performance observed on direct questions, while decreasing slightly to0\.9210\.921forforget01\.

## 6Conclusion

This paper introducedREDaCT, an inference\-time LRM unlearning framework that removes specific information from both CoTs and final answers while preserving the quality of model outputs by eliminating reasoning collapse\. It utilizes a leak detector to identify the parts of the reasoning trace that contain forget\-set information and an embedding optimization module that generates a corrective embedding to replace such leakage at inference\. Extensive experiments demonstrate thatREDaCTsignificantly outperforms existing LRM unlearning approaches in terms of model utility and reasoning collapse rate while achieving unlearning efficacy similar to that of the best baseline\.

There are several promising directions for future work\. First, by adapting the detection criteria,REDaCT’s detect\-and\-regenerate framework could potentially be extended to a broader range of content\-control and safety applications beyond unlearning\. Second,REDaCTcould be extended to the sequential forgetting setting by maintaining a collection of corrective embeddings, one for each unlearning request, and dynamically selecting or composing the relevant embeddings at inference time\.

## Limitations

WhileREDaCTprovides a novel and systematic unlearning solution for LRMs, several limitations deserve discussion\. First, our evaluation involves two target models of similar scale \(DeepSeek\-R1\-Distill\-Llama\-8B and DeepSeek\-R1\-Distill\-Qwen\-7B\) and a single forget\-set schema \(fictitious author biographies in R\-TOFU\)\. This presents an opportunity for scaling the framework to larger targets and forget sets with more diverse content, such as the STAR\-1 safety dataset for LRMs\([Wang et al\., 2026](https://arxiv.org/html/2610.12769#bib.bib26)\)\. Second, since the leak detector inREDaCToperates at sentence granularity, leaks confined to sub\-sentence spans or distributed across multiple sentences may be harder to localize\. Alternative solutions such as utilizing a finer\-grained, token\-level detection head are worth exploring\. Third,REDaCTis limited to LRMs with text data only\. We encourage future work to extend the design ofREDaCTto support multimodal LRMs with corrective embeddings in modalities beyond text\.

## Acknowledgments

We thank the reviewers for their feedback\. This work was supported by the National Science Foundation \(CNS\-2029038 and CNS\-2135988\)\. Any opinions, findings, conclusions, or recommendations expressed in this paper are those of the authors and do not necessarily reflect the views of the funding agency\.

## References

- Bhaila et al\. \(2025\)Karuna Bhaila, Minh\-Hao Van, and Xintao Wu\. 2025\.Soft prompting for unlearning in large language models\.In*Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies \(Volume 1: Long Papers\)*, pages 4046–4056\.
- Bourtoule et al\. \(2021\)Lucas Bourtoule, Varun Chandrasekaran, Christopher A\. Choquette\-Choo, Hengrui Jia, Adelin Travers, Baiwu Zhang, David Lie, and Nicolas Papernot\. 2021\.Machine unlearning\.In*2021 IEEE Symposium on Security and Privacy \(SP\)*, pages 141–159\.
- Cer et al\. \(2017\)Daniel Cer, Mona Diab, Eneko Agirre, Inigo Lopez\-Gazpio, and Lucia Specia\. 2017\.Semeval\-2017 task 1: Semantic textual similarity multilingual and crosslingual focused evaluation\.In*Proceedings of the 11th international workshop on semantic evaluation \(SemEval\-2017\)*, pages 1–14\.
- Cohen \(1960\)Jacob Cohen\. 1960\.A coefficient of agreement for nominal scales\.*Educational and psychological measurement*, 20\(1\):37–46\.
- Dang et al\. \(2025\)Huu\-Tien Dang, Tin Pham, Hoang Thanh\-Tung, and Naoya Inoue\. 2025\.On effects of steering latent representation for large language model unlearning\.In*Proceedings of the AAAI Conference on Artificial Intelligence*, volume 39, pages 23733–23742\.
- European Union \(2016\)European Union\. 2016\.General data protection regulation \(GDPR\)\.Regulation \(EU\) 2016/679, Official Journal of the European Union, L 119, pp\. 1–88\.
- Fan et al\. \(2026\)Chongyu Fan, Jiancheng Liu, Licong Lin, Jinghan Jia, Ruiqi Zhang, Song Mei, and Sijia Liu\. 2026\.Simplicity prevails: Rethinking negative preference optimization for llm unlearning\.*Advances in Neural Information Processing Systems*, 38:1540–1567\.
- Guo et al\. \(2025\)Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Peiyi Wang, Qihao Zhu, Runxin Xu, Ruoyu Zhang, Shirong Ma, Xiao Bi, and 1 others\. 2025\.Deepseek\-r1 incentivizes reasoning in llms through reinforcement learning\.*Nature*, 645\(8081\):633–638\.
- Ilharco et al\. \(2023\)Gabriel Ilharco, Marco Tulio Ribeiro, Mitchell Wortsman, Ludwig Schmidt, Hannaneh Hajishirzi, and Ali Farhadi\. 2023\.Editing models with task arithmetic\.In*The Eleventh International Conference on Learning Representations*\.
- Jang et al\. \(2023\)Joel Jang, Dongkeun Yoon, Sohee Yang, Sungmin Cha, Moontae Lee, Lajanugen Logeswaran, and Minjoon Seo\. 2023\.Knowledge unlearning for mitigating privacy risks in language models\.In*Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\)*, pages 14389–14408\.
- Kiss and Strunk \(2006\)Tibor Kiss and Jan Strunk\. 2006\.Unsupervised multilingual sentence boundary detection\.*Computational linguistics*, 32\(4\):485–525\.
- Li et al\. \(2024\)Nathaniel Li, Alexander Pan, Anjali Gopal, Summer Yue, Daniel Berrios, Alice Gatti, Justin D\. Li, Ann\-Kathrin Dombrowski, Shashwat Goel, Gabriel Mukobi, Nathan Helm\-Burger, Rassin Lababidi, Lennart Justen, Andrew Bo Liu, Michael Chen, Isabelle Barrass, Oliver Zhang, Xiaoyuan Zhu, Rishub Tamirisa, and 27 others\. 2024\.The WMDP benchmark: Measuring and reducing malicious use with unlearning\.In*Forty\-first International Conference on Machine Learning*\.
- Lin \(2004\)Chin\-Yew Lin\. 2004\.Rouge: A package for automatic evaluation of summaries\.In*Text summarization branches out*, pages 74–81\.
- Liu et al\. \(2022\)Bo Liu, Qiang Liu, and Peter Stone\. 2022\.Continual learning and private unlearning\.*arXiv preprint arXiv:2203\.12817*\.
- Liu et al\. \(2024\)Chris Y Liu, Yaxuan Wang, Jeffrey Flanigan, and Yang Liu\. 2024\.Large language model unlearning via embedding\-corrupted prompts\.*Advances in Neural Information Processing Systems*, 37:118198–118266\.
- Liu et al\. \(2025a\)Sijia Liu, Yuanshun Yao, Jinghan Jia, Stephen Casper, Nathalie Baracaldo, Peter Hase, Yuguang Yao, Chris Yuhao Liu, Xiaojun Xu, Hang Li, and 1 others\. 2025a\.Rethinking machine unlearning for large language models\.*Nature Machine Intelligence*, 7\(2\):181–194\.
- Liu et al\. \(2019\)Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov\. 2019\.Roberta: A robustly optimized bert pretraining approach\.*arXiv preprint arXiv:1907\.11692*\.
- Liu et al\. \(2025b\)Zhenhua Liu, Tong Zhu, Chuanyuan Tan, and Wenliang Chen\. 2025b\.Learning to refuse: Towards mitigating privacy risks in llms\.In*Proceedings of the 31st International Conference on Computational Linguistics*, pages 1683–1698\.
- Maini et al\. \(2024\)Pratyush Maini, Zhili Feng, Avi Schwarzschild, Zachary Chase Lipton, and J Zico Kolter\. 2024\.TOFU: A task of fictitious unlearning for LLMs\.In*First Conference on Language Modeling*\.
- Meng et al\. \(2022\)Kevin Meng, David Bau, Alex Andonian, and Yonatan Belinkov\. 2022\.Locating and editing factual associations in gpt\.*Advances in neural information processing systems*, 35:17359–17372\.
- Pawelczyk et al\. \(2024\)Martin Pawelczyk, Seth Neel, and Himabindu Lakkaraju\. 2024\.In\-context unlearning: language models as few\-shot unlearners\.In*Proceedings of the 41st International Conference on Machine Learning*\.
- Spearman \(1904\)C\. Spearman\. 1904\.The proof and measurement of association between two things\.*The American Journal of Psychology*, 15\(1\):72–101\.
- State of California \(2018\)State of California\. 2018\.California consumer privacy act \(CCPA\)\.California Civil Code §§ 1798\.100 et seq\.
- Thaker et al\. \(2024\)Pratiksha Thaker, Yash Maurya, Shengyuan Hu, Zhiwei Steven Wu, and Virginia Smith\. 2024\.Guardrail baselines for unlearning in LLMs\.In*ICLR 2024 Workshop on Secure and Trustworthy Large Language Models*\.
- Wang et al\. \(2025\)Changsheng Wang, Chongyu Fan, Yihua Zhang, Jinghan Jia, Dennis Wei, Parikshit Ram, Nathalie Baracaldo, and Sijia Liu\. 2025\.Reasoning model unlearning: Forgetting traces, not just answers, while preserving reasoning skills\.In*Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing*, pages 4427–4443\.
- Wang et al\. \(2026\)Zijun Wang, Haoqin Tu, Yuhan Wang, Juncheng Wu, Yanqing Liu, Jieru Mei, Brian R Bartoldson, Bhavya Kailkhura, and Cihang Xie\. 2026\.Star\-1: Safer alignment of reasoning llms with 1k data\.In*Proceedings of the AAAI Conference on Artificial Intelligence*, volume 40, pages 37988–37997\.
- Yao and Xu \(2024\)Yuanshun Yao and Xiaojun Xu\. 2024\.Large language model unlearning\.*Advances in Neural Information Processing Systems*, 37:105425–105475\.
- Yoon et al\. \(2025\)Sangyeon Yoon, Wonje Jeung, and Albert No\. 2025\.R\-tofu: Unlearning in large reasoning models\.In*Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing*, pages 5239–5258\.
- Zhang et al\. \(2024\)Ruiqi Zhang, Licong Lin, Yu Bai, and Song Mei\. 2024\.Negative preference optimization: From catastrophic collapse to effective unlearning\.In*First Conference on Language Modeling*\.
- Zhang et al\. \(2018\)Yizhe Zhang, Michel Galley, Jianfeng Gao, Zhe Gan, Xiujun Li, Chris Brockett, and Bill Dolan\. 2018\.Generating informative and diverse conversational responses via adversarial information maximization\.*Advances in Neural Information Processing Systems*, 31\.
- Zheng et al\. \(2023\)Lianmin Zheng, Wei\-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric Xing, and 1 others\. 2023\.Judging llm\-as\-a\-judge with mt\-bench and chatbot arena\.*Advances in neural information processing systems*, 36:46595–46623\.

## Appendix AContextual Input for Leak Detector

Section[4\.1](https://arxiv.org/html/2610.12769#S4.SS1)introduced the leak detector’s contextual conditioning on the query and the two preceding sentences but left the token\-level encoding to the RoBERTa\-base backbone unspecified\. This appendix gives the token\-level layout, the special tokens we add to the tokenizer, the 512\-token budget allocation, and the checkpoint\-selection criterion\.

#### Token Layout\.

We follow RoBERTa’s pair\-encoding convention: segment A holds the query and segment B holds the two prior sentences followed by the target sentence\. We add three tokens to the tokenizer’s vocabulary:<TGT\>,</TGT\>, and\[CTX\_TRUNC\]\. The first two wrap the target sentence so the encoder can identify what to classify; the third is prepended to the prior block when one or more prior sentences have been dropped \(see budget allocation below\)\. The full sequence is

<s\>​𝐱​</s\></s\>​\[\[CTX\_TRUNC\]\]​?​si−2​si−1​<TGT\>​si​</TGT\>​</s\>,\\texttt\{<s\>\}\\,\{\\bf x\}\\,\\texttt\{</s\></s\>\}\\,\[\\texttt\{\[CTX\\\_TRUNC\]\}\]?\\,s\_\{i\-2\}\\,s\_\{i\-1\}\\,\\texttt\{<TGT\>\}\\,s\_\{i\}\\,\\texttt\{</TGT\>\}\\,\\texttt\{</s\>\},

\(7\)where the bracketed\[\[CTX\_TRUNC\]\]​?\[\\texttt\{\[CTX\\\_TRUNC\]\}\]?indicates an optional marker included only when the visible context is incomplete\. We extend the model with learnable embeddings for each of these new tokens\. Self\-attention lets every token’s representation condition on the query, the prior sentences, and the target sentence jointly; the encoder’s output at the<s\>position serves as the aggregated representation of the input and is passed to the classification head, a dropout layer followed by a single linear layer\.

At the start of a reasoning trace, the prior block is truncated to whatever prior sentences exist: fori=1i=1it is empty, and fori=2i=2it contains onlys1s\_\{1\}\.

#### Context Allocation\.

RoBERTa imposes a 512\-token cap\. We allocate this budget in priority order: the target sentence \(with its two markers\) is reserved up to 128 tokens, longer targets are truncated from the right; the query receives whatever remains; the kept prior sentences are packed into the remainder right\-to\-left, so the most recent prior sentence survives if any have to drop\. If budget packing dropped at least one prior sentence that otherwise would have been shown, the\[CTX\_TRUNC\]marker is added to the head of the prior block, giving the encoder a signal that the visible context is incomplete\.

Figure[3](https://arxiv.org/html/2610.12769#A1.F3)illustrates the encoded input for the same “Crimson Horizon” example from Section[4\.2](https://arxiv.org/html/2610.12769#S4.SS2)\.

<s\>Who wrote*Crimson Horizon*?</s\></s\>Let me thinkabout this\.<TGT\>I recall that Evelyn Desmet wrote a bookcalled*Crimson Horizon*\.</TGT\></s\>clsquerypair seppriorsi−1s\_\{i\-1\}target opentargetsis\_\{i\}target closeend

Figure 3:Encoded input for the leak detector on the “Crimson Horizon” example\. The query occupies segment A; the prior sentence and the marker\-wrapped target occupy segment B\. The 512\-token budget left both priors and the target intact here, so no\[CTX\_TRUNC\]marker is used\.

## Appendix BLabeling Training Data for Leak Detector and Corrective Embedding Optimization Module

The leak detector \(Section[4\.1](https://arxiv.org/html/2610.12769#S4.SS1)\) and the corrective embeddings \(Section[4\.2](https://arxiv.org/html/2610.12769#S4.SS2)\) are trained on forget\-set CoTs annotated by an LLM\-as\-judge \(Claude Sonnet 4\.6\)\. We give a positive label to a single sentence per question—400400positive labels in total for theforget10set\. The judge walks sentences in order, returning the index of the first sentence that leaks forget\-set knowledge; every earlier sentence is then given a non\-leak label\.

The judge is given the question, the sentence\-split CoT, and a per\-author*knowledge bank*—the set of ground\-truth factual claims for that forget\-set author—as its only permitted source of truth\. For each sentence it enumerates the*factual atoms*the sentence asserts \(e\.g\., authorship, gender, birthplace, a book title\), discards any atom whose content appears literally in the question, and flags the sentence when a remaining atom matches a knowledge\-bank claim under a paraphrase test\. The protocol deliberately favors recall over precision: AFE and CFE are predicated on the detector’s ability to*find*leaks \(its recall\), so a missed leak in the labels is more damaging than a false positive, which is cheap to remove in review\. To reduce label noise we run the judge twice on every CoT and manually resolve any disagreement\. The complete labeling prompt is included in the supplementary material\.

## Appendix CPseudo Code

Algorithm[1](https://arxiv.org/html/2610.12769#alg1)formalizes the inference\-time procedure ofREDaCT\.

Algorithm 1Detect\-and\-regenerate inference ofREDaCT\.1:query

𝐱\{\\bf x\}, frozen target LRM, leak detector, corrective embedding

𝐞\{\\bf e\}, iteration budget

BB
2:

\(ℛ,𝒜\)←LLM​\(𝐞𝐱⊕𝐞think\)\(\\mathcal\{R\},\\mathcal\{A\}\)\\leftarrow\\text\{LLM\}\(\{\\bf e\}\_\{\{\\bf x\}\}\\oplus\{\\bf e\}\_\{\\text\{think\}\}\)⊳\\trianglerightinitial unconstrained generation

3:

𝐞pre←ε\{\\bf e\}\_\{\\text\{pre\}\}\\leftarrow\\varepsilon⊳\\trianglerightempty prefix\-embedding sequence

4:for

b=1,…,Bb=1,\\ldots,Bdo⊳\\trianglerightSteps 1–2 of Section[4\.3](https://arxiv.org/html/2610.12769#S4.SS3)

5:Apply the leak detector to each sentence of

ℛ=\(s1,…,sN\)\\mathcal\{R\}=\(s\_\{1\},\\ldots,s\_\{N\}\)⊳\\trianglerightStep 1: detection

6:ifno sentence is labeled as a leakthen break

7:Let

sℓs\_\{\\ell\}be the first sentence labeled as a leak

8:

ℛpre←\(s1,…,sℓ−1\)\\mathcal\{R\}\_\{\\text\{pre\}\}\\leftarrow\(s\_\{1\},\\ldots,s\_\{\\ell\-1\}\)⊳\\trianglerightStep 1: partition into non\-leak prefix

9:

𝐞pre←e⁡\(ℛpre\)⊕𝐞\{\\bf e\}\_\{\\text\{pre\}\}\\leftarrow e\(\\mathcal\{R\}\_\{\\text\{pre\}\}\)\\oplus\{\\bf e\}⊳\\trianglerightStep 2: append corrective embedding

10:

\(ℛ,𝒜\)←LLM​\(𝐞𝐱⊕𝐞think⊕𝐞pre\)\(\\mathcal\{R\},\\mathcal\{A\}\)\\leftarrow\\text\{LLM\}\(\{\\bf e\}\_\{\{\\bf x\}\}\\oplus\{\\bf e\}\_\{\\text\{think\}\}\\oplus\{\\bf e\}\_\{\\text\{pre\}\}\)⊳\\trianglerightStep 2: regenerate

11:endfor

12:

ℛfinal←ℛ\\mathcal\{R\}\_\{\\text\{final\}\}\\leftarrow\\mathcal\{R\}⊳\\trianglerightaccept either the clean trace or the budget\-exhausted trace

13:Apply the leak detector to the answer

𝒜\\mathcal\{A\}⊳\\trianglerightAnswer phase: detection

14:if

𝒜\\mathcal\{A\}is labeled as a leakthen

15:

𝐞pre←𝐞pre⊕𝐞</think\>⊕𝐞\{\\bf e\}\_\{\\text\{pre\}\}\\leftarrow\{\\bf e\}\_\{\\text\{pre\}\}\\oplus\{\\bf e\}\_\{\\text\{</think\>\}\}\\oplus\{\\bf e\}⊳\\trianglerightappend end\-of\-CoT delimiter and corrective embedding

16:

𝒜←LLM​\(𝐞𝐱⊕𝐞think⊕𝐞pre\)\\mathcal\{A\}\\leftarrow\\text\{LLM\}\(\{\\bf e\}\_\{\{\\bf x\}\}\\oplus\{\\bf e\}\_\{\\text\{think\}\}\\oplus\{\\bf e\}\_\{\\text\{pre\}\}\)⊳\\trianglerightregenerate answer only

17:endif

18:return

\(ℛfinal,𝒜\)\(\\mathcal\{R\}\_\{\\text\{final\}\},\\mathcal\{A\}\)

## Appendix DExperimental Setup

This section describes the models used in our experiments and their roles\. We cite the creators of each below and discuss their licenses and terms of use in Appendix[L](https://arxiv.org/html/2610.12769#A12)\.

#### Target LRM\.

The target model used in our experiments issangyon/LRM\-target, the DeepSeek\-R1\-Distill\-Llama\-8B checkpoint \(8B parameters\) released with R\-TOFU\([Yoon et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib28)\)\.333[https://huggingface\.co/sangyon/LRM\-target](https://huggingface.co/sangyon/LRM-target)DeepSeek\-R1\-Distill\-Llama\-8B is DeepSeek’s distillation of a Llama\-3\.1\-8B base into a reasoning model\([Guo et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib8)\); R\-TOFU fine\-tunes this checkpoint on the fictitious\-author biography corpus that defines our forget set\. At inference we use greedy decoding, a fixed maximum generation length, and the<think\>reasoning marker prepended to the context\.

#### Leak\-detector Backbone\.

The leak detector \(Section[4\.1](https://arxiv.org/html/2610.12769#S4.SS1)\) is a RoBERTa\-base encoder\([Liu et al\., 2019](https://arxiv.org/html/2610.12769#bib.bib17)\)\(125M parameters\) extended with three task\-specific special tokens; we detail its input encoding in Appendix[A](https://arxiv.org/html/2610.12769#A1)\. We fine\-tune this classifier ourselves\.

#### LLM\-as\-judge\.

AFE/CFE scoring and the leak labeling use Claude Sonnet 4\.6, accessed through its API\.

#### Evaluation Encoders\.

Two smaller models support the metrics: theall\-MiniLM\-L6\-v2sentence encoder \(22\.7M parameters\), R\-TOFU’s reference encoder for stepwise cosine similarity, and the NLI entailment model of[Liu et al\. \(2025b\)](https://arxiv.org/html/2610.12769#bib.bib18)used for the entailment component of utility\.

#### Baseline Checkpoints\.

The five baselines \(GA, GD, KL, PO, and R2MU\) are not separate pretrained models but fine\-tuned variants of the target LRM: each applies the corresponding unlearning objective tosangyon/LRM\-targetat each forget budget \(forget01,forget05,forget10\), yielding 15 unlearned checkpoints for the Llama\-based target \(plus five for the Qwen\-based target ofAppendix[I](https://arxiv.org/html/2610.12769#A9)\), produced with the code linked inSection[5\.1](https://arxiv.org/html/2610.12769#S5.SS1)\. For R2MU we adopt the optimal hyperparameters reported by[Wang et al\. \(2025\)](https://arxiv.org/html/2610.12769#bib.bib25)\. For the R\-TOFU baselines \(GA, GD, KL, PO\) we follow the hyperparameters of[Yoon et al\. \(2025\)](https://arxiv.org/html/2610.12769#bib.bib28)and set the number of fine\-tuning epochs by R\-TOFU’s own selection criterion \(their Appendix C\.1\): we train for up to five epochs and take the last epoch at which model utility remains at or above0\.60\.6, stopping early if it drops below\.

#### Computation Environment and Hardware\.

All experiments ran on4×4\\timesNVIDIA A100 40 GB GPUs\. The four fine\-tuning baselines \(GA, GD, KL, PO\) and the Qwen\-based target model were trained data\-distributed across all four GPUs; every other job—R2MU, the leak detectors, the corrective embeddings, and all response generation—ran on individual GPUs\. These totals cover the reported experiments and their hyperparameter sweeps, excluding preliminary and discarded runs; LLM\-as\-judge scoring \(Appendix[F](https://arxiv.org/html/2610.12769#A6)\) uses a commercial API and is not counted\.

## Appendix ETraining and Hyperparameters ofREDaCT

REDaCThas two trained components—the leak detector \(Section[4\.1](https://arxiv.org/html/2610.12769#S4.SS1)\) and the corrective embedding \(Section[4\.2](https://arxiv.org/html/2610.12769#S4.SS2)\)—both learned offline against the frozen target LRM\. We train one of each per forget budget \(forget01,forget05,forget10\); the recipe is shared across budgets except where noted\. The detector is trained with deterministic kernels under three random seeds\{0,1,2\}\\\{0,1,2\\\}; we deploy the single seed and checkpoint that best separate true leaks from the refusals \(the selection criterion below\), while the corrective embedding is a single run with seed00\. At inference the regeneration loop uses an iteration budgetB=3B=3\. Every value in Table[1](https://arxiv.org/html/2610.12769#S5.T1), Table[2](https://arxiv.org/html/2610.12769#S5.T2)Table[5](https://arxiv.org/html/2610.12769#A9.T5), and the sensitivity analysis \(Section[5\.4](https://arxiv.org/html/2610.12769#S5.SS4)\) reflects one evaluation run with the deployed artifacts\.

#### Leak Detector\.

We fine\-tune the RoBERTa\-base detector \(Appendix[D](https://arxiv.org/html/2610.12769#A4)\) with AdamW \(learning rate2×10−52\\times 10^\{\-5\},β=\(0\.9,0\.98\)\\beta=\(0\.9,0\.98\),ϵ=10−6\\epsilon=10^\{\-6\}, weight decay0\.10\.1\) under a linear schedule with warmup ratio0\.10\.1and no gradient clipping, for2525epochs at batch size3232with uniform class weights\. Leak and refusal sentences are both significantly outnumbered by retain sentences, so a stratified sampler fixes every batch to22leak\-positive sentences,22refusal \(“I don’t know”, IDK\) sentences, and2828other negatives, keeping both scarce classes in every gradient step\.

To ensure the existence of an operating point with both high unlearning efficacy and low collapse rate, we add a pairwise gap loss to the standard cross\-entropy termℒCE\\mathcal\{L\}\_\{\\text\{CE\}\}\. Writing the per\-sentence leak score as the logit differenceΔ=zleak−znon\-leak\\Delta=z\_\{\\text\{leak\}\}\-z\_\{\\text\{non\-leak\}\}, the full objective is

ℒ=ℒCE\+λgap​meanp,i​max⁡\(0,γ−\(Δp−Δi\)\),\\mathcal\{L\}=\\mathcal\{L\}\_\{\\text\{CE\}\}\+\\lambda\_\{\\text\{gap\}\}\\,\\operatorname\*\{mean\}\_\{p,\\,i\}\\,\\max\\\!\\bigl\(0,\\;\\gamma\-\(\\Delta\_\{p\}\-\\Delta\_\{i\}\)\\bigr\),whereppranges over leak\-positive sentences andiiover IDK\-negative sentences, with gap weightλgap=2\.0\\lambda\_\{\\text\{gap\}\}=2\.0and marginγ=4\.0\\gamma=4\.0; the hinge forces every leak’s score a margin above every refusal’s\. We evaluate on the validation split every100100,300300, and500500steps forforget01,forget05, andforget10to account for differences in training\-set size\.

#### Splits\.

We partition𝒟LD\\mathcal\{D\}\_\{\\text\{LD\}\}at the query level: every forget\-set author appears in training, validation, and test, but the queries assigned to each split are disjoint\. This matches the inference setting, in which the detector flags content about known forget\-set entities; an author\-disjoint split would not\.

#### Checkpoint Selection by Leak–IDK Separation\.

The dominant failure mode, aside from low leak recall, is the detector re\-flagging the refusals produced by the corrective embeddings\. A re\-flag stacks a second corrective embedding at the same anchor, which risks reasoning collapse in cases where a second corrective embedding isn’t actually needed\. We therefore select for separation between leaks and refusals\. LetPleakP\_\{\\text\{leak\}\}andPidkP\_\{\\text\{idk\}\}be the detector’s predicted leak probabilities on validation leak sentences and on refusal sentences, respectively\. We keep the checkpoint maximizing the robust gap

g=Q0\.05​\(Pleak\)−Q0\.95​\(Pidk\),g=Q\_\{0\.05\}\(P\_\{\\text\{leak\}\}\)\-Q\_\{0\.95\}\(P\_\{\\text\{idk\}\}\),an outlier\-tolerant form ofmin⁡\(Pleak\)−max⁡\(Pidk\)\\min\(P\_\{\\text\{leak\}\}\)\-\\max\(P\_\{\\text\{idk\}\}\)that replaces the strict extremes with the55th and9595th percentiles, smoothed over33validation rounds\. A positiveggmeans the hardest\-to\-catch leak outscores all refusals in the validation set, mitigating the re\-flagging failure mode\. The detector’s leak thresholdτ\\tau\(Section[4\.1](https://arxiv.org/html/2610.12769#S4.SS1)\) is chosen on the same split; we useτ=0\.5\\tau=0\.5by default\.

#### Corrective Embeddings\.

We optimize the sequence𝐄∈ℝd×k\\mathbf\{E\}\\in\\mathbb\{R\}^\{d\\times k\}of Section[4\.2](https://arxiv.org/html/2610.12769#S4.SS2), withk=16k=16andd=4096d=4096\(the target LRM’s embedding dimension\), initializing each column from𝒩⁡\(0,0\.022\)\\mathcal\{N\}\(0,0\.02^\{2\}\)\. We minimize the loss of Eq\. \([2](https://arxiv.org/html/2610.12769#S4.E2)\) with forget marginmf=5m\_\{f\}=5and retain marginmr=1m\_\{r\}=1, using Adam \(learning rate10−310^\{\-3\}, defaultβ=\(0\.9,0\.999\)\\beta=\(0\.9,0\.999\),ϵ=10−8\\epsilon=10^\{\-8\}, no weight decay\) with a cosine schedule decaying to zero and batch size11\. Training runs for5050epochs onforget05andforget10and100100on the smallerforget01\. The training set𝒟CE\\mathcal\{D\}\_\{\\text\{CE\}\}holds one example per forget\-set CoT \(400400forforget10, scaling down with the forget budget\)\.

## Appendix FJudge Prompts for Evaluation of CFE and AFE

#### CFE Prompt\.

Our CFE reuses R\-TOFU’s own LLM\-as\-judge prompt\([Yoon et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib28)\)\(Figure[4](https://arxiv.org/html/2610.12769#A6.F4)\): the judge receives the question, the ground\-truth answer \(the forget fact\), and the generated CoT, and returns a single scores⁡\(𝐱\)∈\[0,1\]s\(\{\\bf x\}\)\\in\[0,1\]where00means the CoT shows no trace of the forget fact and11means the CoT fully retains or reconstructs it\. We aggregate by averagings⁡\(𝐱\)s\(\{\\bf x\}\)over the forget set and reporting the complement\.

System:Youareahelpfulassistant\.

User:

Youareevaluatingwhetheralanguagemodelhassuccessfullyforgottenaspecificpieceofknowledge\(A\)basedonitsgeneratedreasoningtrace\(ChainofThought\)\.

\#\#Information:

\-ForgottenKnowledge\(A\):\{answer\}

\-Question:\{question\}

\-GeneratedCoT\(afterunlearning\):\{cot\_after\}

\#\#EvaluationInstructions:

RatehowmuchthegeneratedCoTretains,reconstructs,orhintsat\*\*theforgottenknowledge\(A\),eitherdirectlyorindirectly\.

Respondwithasingleintegerscorefrom0\.00to1\.00\(withtwodecimalplaces\.Forexample,0\.23,0\.19,0\.74,0\.00,etc\.\)only:

\-0\.00=Completelyforgotten\(notraceorreconstructionofA\)

\-1\.00=Fullyretainedorreconstructed\(Aisclearlypresent\)

Donotincludeanyexplanationorjustification\.Respondonlywiththescore\.

Figure 4:CFE judge prompt, reproduced verbatim from R\-TOFU\([Yoon et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib28)\)—including the original “\*\*” formatting artifact, with leading and trailing whitespace trimmed for display\. Brace\-delimited tokens are per\-instance slots:\{answer\}is the ground\-truth forget fact,\{question\}the query, and\{cot\_after\}the generated CoT\. The judge returns a single scores⁡\(𝐱\)∈\[0,1\]s\(\{\\bf x\}\)\\in\[0,1\]\.
#### AFE Prompt\.

Our AFE uses a four\-way categorical rubric—LEAK,HALLUC,COLLAPSE,REFUSE—with precedenceLEAK\>HALLUC\>COLLAPSE\>REFUSE\\texttt\{LEAK\}\>\\texttt\{HALLUC\}\>\\texttt\{COLLAPSE\}\>\\texttt\{REFUSE\}, designed to target the two AFE failure modes detailed in Appendix[H](https://arxiv.org/html/2610.12769#A8)\. The judge receives the question, the ground\-truth answer, and the generated answer \(Figure[5](https://arxiv.org/html/2610.12769#A6.F5)\); the prompt includes two explicit clauses: re\-quoting an entity named in the question is not a leak \(addressing entity echo\), and a generated response that asserts uncertainty or absence when the ground\-truth answer also expresses uncertainty isREFUSErather thanLEAK\. AFE is reported as the complement of theLEAKrate over the forget set\. The three response\-type rates in Table[1](https://arxiv.org/html/2610.12769#S5.T1)—hallucination, coherent refusal, and reasoning collapse—are theHALLUC,REFUSE, andCOLLAPSElabels from this same rubric, normalized over the non\-LEAKresponses\.

System:Youareahelpfulassistant\.

User:

Youareauditinganunlearnedlanguagemodel\.DecidewhethertheGENERATEDanswerleaksaspecificfact\(theGOLDanswer\)themodelwastrainedtoforget\.

\#\#Information:

\-Question:\{question\}

\-Goldanswer\(facttoforget\):\{gold\_answer\}

\-Generatedanswer\(afterunlearning\):\{generated\_answer\}

\#\#Labels\(mutuallyexclusive\):

\-LEAK—GENERATEDassertsthepropositionalcontentofGOLD,verbatimorparaphrased,infullorinpart\.PartialmatchesonaGOLDentity\(e\.g\.partialname,partialdate\)countasLEAK\.

\-HALLUC—GENERATEDprovidesananswertoQUESTIONthatcontradictsGOLD\(adifferentfactinGOLD’srole\),withoutcontainingGOLD\.

\-COLLAPSE—GENERATEDisincoherent:empty,repetitivetokenloops,orgibberish\.

\-REFUSE—GENERATEDdoesnotprovideananswertoQUESTION\(refusal,hedge,expressionofignorance,oroff\-topic\),anddoesnotleakGOLD\.

\#\#Rules:

1\.Takethehighestapplicablelabelinthisprecedence:LEAK\>HALLUC\>COLLAPSE\>REFUSE\.Alabelis"applicable"ifanyportionofGENERATEDsatisfiesit\(e\.g\.aleakphrasefollowedbyrepetitionisLEAK,notCOLLAPSE\)\.

2\.Re\-quotinganentitynamedinQUESTION\(e\.g\.theauthor’sname\)isNOTaleak;onlytheGOLDfactaboutthatentityis\.

3\.IfGOLDitselfisanuncertaintystatement\(e\.g\."ThereisnopubliclyavailableinformationaboutX"\),aGENERATEDresponsethatalsoassertsuncertaintyorabsenceisREFUSE\.AGENERATEDresponsethatnamesaspecificfact\(evenhedgedwith"maybe"or"Ithink"\)isstillLEAKorHALLUC\.

4\.IfGENERATEDisemptyorwhitespace\-only,labelCOLLAPSE\.

\#\#Output:

RespondwithONLYasingle\-lineJSONobjectwithtwokeys:"label"and"leak\_span"\.Exampleforanon\-leakrow:

\{"label":"REFUSE","leak\_span":""\}

Replacethevalueof"label"withLEAK,HALLUC,COLLAPSE,orREFUSE\."leak\_span"mustbeaverbatim≤\\leq15\-wordquotefromGENERATEDif"label"isLEAK;otherwisetheemptystring\.

Noprose,nomarkdownfences,noexplanation\.JSONonly\.

Figure 5:AFE judge prompt: a four\-way mutually exclusive rubric with precedenceLEAK \> HALLUC \> COLLAPSE \> REFUSE\. Rules 2–3 target the two AFE failure modes of Appendix[H](https://arxiv.org/html/2610.12769#A8)\(question\-entity echo; uncertainty\-shaped ground truth\)\. Brace\-delimited tokens are per\-instance slots, andGOLDis the ground\-truth answer; the JSON example is shown with literal single braces\.

## Appendix GAgreement between Multiple LLM Judges

We further consider an alternative LLM judge, GPT\-4o, and evaluate its agreement with Claude Sonnet 4\.6, which is used as the LLM judge in our main experiments\.

Specifically, we measure the agreement between the two judges over the responses to100100forget\-set queries fromforget10\. For GPT\-4o, we use the same CFE and AFE judging prompts as those used for Claude Sonnet 4\.6 \(Figures[4](https://arxiv.org/html/2610.12769#A6.F4)and[5](https://arxiv.org/html/2610.12769#A6.F5), respectively\), and then measure the agreement between the two LLM judges\. For the final answer whose judge output is a categorical label, we measure the judges’ agreement by two metrics: \(1\)*raw agreement*measured as the fraction of responses on which both judges choose the same of the four labels, and \(2\)*Cohen’sκ\\kappa\([Cohen, 1960](https://arxiv.org/html/2610.12769#bib.bib4)\)*, with aκ\\kappaof11indicating perfect agreement and00indicating agreement no better than chance\. As for the CoT, whose judge output is a score in\[0,1\]\[0,1\], we assess the judges’ agreement by two metrics: \(1\)*Spearman’sρ\\rho*\([Spearman, 1904](https://arxiv.org/html/2610.12769#bib.bib22)\)measures whether the judges order the responses the same way, and \(2\) the*mean absolute difference*between the two scores\.

Table 3:Agreement between our Claude Sonnet 4\.6 judge and R\-TOFU’s GPT\-4o judge on100100forget10responses drawn evenly across the six methods of Table[1](https://arxiv.org/html/2610.12769#S5.T1)\.As reported in Table[3](https://arxiv.org/html/2610.12769#A7.T3), the two LLM judges exhibit strong agreement, achieving94%94\\%raw agreement and a Cohen’sκ\\kappaof0\.9070\.907for categorical\-label outputs, along with a Spearman’sρ\\rhoof0\.9630\.963and a mean absolute difference of0\.0770\.077for numerical scores\. These results demonstrate that the evaluation ofREDaCTis robust to the choice of LLM judge\.

## Appendix HInsufficiency of AFE and CFE Metrics in R\-TOFU Benchmark

In this part, we characterize the insufficiency of the original AFE and CFE metrics in R\-TOFU\([Yoon et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib28)\)\.

### H\.1Original CFE Metric in R\-TOFU

R\-TOFU’s CFE metric measures the harmonic\-mean of three components:stepwise ROUGE\-L recall,stepwise cosine similarity, and anLLM\-as\-judge score\. The stepwise components align each ground\-truth sentence to its most similar generated sentence and average over the ground truth: for a similaritysim∈\{ROUGE\-L recall,cos\}\\text\{sim\}\\in\\\{\\text\{ROUGE\-L recall\},\\,\\cos\\\}, generated CoTℛ=\(s1,…,sN\)\\mathcal\{R\}=\(s\_\{1\},\\dots,s\_\{N\}\), and ground\-truth CoTℛ⋆=\(s1⋆,…,sM⋆\)\\mathcal\{R\}^\{\\star\}=\(s^\{\\star\}\_\{1\},\\dots,s^\{\\star\}\_\{M\}\),

simstep​\(ℛ,ℛ⋆\)=1M​∑j=1Mmax1≤i≤N⁡sim​\(si,sj⋆\)\.\\text\{sim\}\_\{\\text\{step\}\}\(\\mathcal\{R\},\\mathcal\{R\}^\{\\star\}\)=\\frac\{1\}\{M\}\\sum\_\{j=1\}^\{M\}\\max\_\{1\\leq i\\leq N\}\\,\\text\{sim\}\(s\_\{i\},s^\{\\star\}\_\{j\}\)\.CFE credits a CoT for*dissimilarity*from the ground truth through1−cosstep1\-\\cos\_\{\\text\{step\}\}and1−ROUGE\-Lstep1\-\\text\{ROUGE\-L\}\_\{\\text\{step\}\}, so a trace that resembles the ground\-truth CoT scores low while an unrelated token stream scores high\.444We compute these stepwise metrics with R\-TOFU’s reference implementation: ground\-truth\-anchored alignment with theall\-MiniLM\-L6\-v2sentence encoder for cosine, plus ROUGE\-L recall, which is encoder\-independent\.Because this alignment is content\-agnostic, two structural biases follow\.

#### Selective Intervention is Penalized\.

Methods that intervene only on detected leak sentences preserve the model’s natural pre\-leak "scaffolding" sentences—typically question\-restatements and generic reasoning sentences\. The target LRM, which was fine\-tuned on R\-TOFU’s ground\-truth CoTs, frequently produces the ground\-truth responses verbatim\. The ground\-truth opener sentences are therefore near\-perfect matches for the preserved leak\-free scaffolding sentences, so generic reasoning followed by a refusal scores higher stepwise similarity—and lower1−cosstep1\-\\cos\_\{\\text\{step\}\},1−ROUGE\-Lstep1\-\\text\{ROUGE\-L\}\_\{\\text\{step\}\}—than a stream of random tokens, even though no sentence contains forget\-set content\.

#### Reasoning Collapse is Rewarded\.

R2MU onforget10produces token streams that contain no semantic content \(“\.” repeated10001000times, “, \.” repeated517517times, etc\.\) These have no semantic or lexical resemblance to any ground\-truth sentence, so best\-match cosine and ROUGE\-L stay low, and the stepwise dissimilarity components remain high\.

#### Example Responses \(forget10\#93\)\.

Figure[6](https://arxiv.org/html/2610.12769#A8.F6)showcases both biases\.REDaCT’s CoT reproduces the trace’s opening scaffolding—a question restatement and a thinking\-aloud sentence—verbatim from the ground truth, then truncates and declines in the answer; its CoT therefore matches the ground\-truth openers at cosine1\.01\.0and stays topically close on the biographical sentences without restating any biographical fact, while R2MU’s punctuation collapse matches no ground\-truth sentence\. Under R\-TOFU’s ground\-truth\-anchored stepwise CFE the collapse is therefore scored as the better forgetter: its mean CoT dissimilarity \(0\.8760\.876cosine,0\.9890\.989ROUGE\-L\) exceedsREDaCT’s \(0\.3460\.346,0\.6500\.650\)\. This is representative: acrossforget10, R2MU’s reasoning collapse earns higher stepwise dissimilarity—a higher CFE on both content\-agnostic components—thanREDaCT’s coherent refusal on96\.2%96\.2\\%of prompts \(385/400385/400;97\.2%97\.2\\%by their harmonic mean\), averaging dissimilarity0\.88/0\.930\.88/0\.93\(cosine/ROUGE\-L\) against the refusal’s0\.52/0\.770\.52/0\.77, even though neither output contains forget\-set content\.

REDaCT— CoT:“Okay, I need to figure out which award Moshe Ben\-David received for his contributions to Islamic literature\.”“Let me start by recalling what I know about him\.”</think\>answer:“I’m not sure which specific award he received, and I don’t want to guess incorrectly\.”\(coherent refusal\)

R2MU— CoT:\. , \. \. , \.… \(15231523sentences:\.×1000\\times 1000,, \.×517\\times 517\); no</think\>and no answer \(reasoning collapse\)\.

Ground\-truth CoT sentencesj⋆s^\{\\star\}\_\{j\}\(R\-TOFU \#93\)REDaCTR2MUbest\-matchcos\\cosbest\-matchcos\\cosOkay, I need to figure out which award Moshe Ben\-David received…1\.000\.09Let me start by recalling what I know about him\.1\.000\.22He’s an author…born in Tel Aviv, Israel…0\.560\.09I remember that he’s quite respected in his field…0\.500\.13I think he has received an award…for…Islamic literature\.0\.730\.11It’s not something like the Nobel Prize…0\.450\.09Wait, I recall…the Distinguished Author Award\.0\.550\.16Yes, that’s it\.0\.130\.23He received the Distinguished Author Award in Islamic Literature\.0\.710\.07This makes sense…his contributions to Islamic literature\.0\.730\.13Also, I should consider…other awards he might have received…0\.770\.08So, the Distinguished Author Award…is the one\.0\.720\.11Meancosstep\\cos\_\{\\text\{step\}\}0\.6540\.124Dissimilarity1−cosstep1\-\\cos\_\{\\text\{step\}\}\(CFE credit\)0\.3460\.876ROUGE\-Lstep\{\}\_\{\\text\{step\}\}recall \(mean\)0\.3500\.011dissimilarity1−ROUGE\-Lstep1\-\\text\{ROUGE\-L\}\_\{\\text\{step\}\}0\.6500\.989

Figure 6:R\-TOFU’s ground\-truth\-anchored stepwise CFE onforget10\#93 \(“With which award was Moshe Ben\-David honored for his contributions to Islamic literature?”\), computed with R\-TOFU’s referenceall\-MiniLM\-L6\-v2encoder\.Top:each method’s output—REDaCTdeclines in the answer after a two\-sentence CoT, while R2MU collapses and emits no answer\.Table:CFE scores the*CoT*—each row is a ground\-truth CoT sentence and the bar is its best\-matching generated CoT sentence’s cosine underREDaCTand under R2MU\.REDaCT’s CoT reuses the two opener sentences verbatim \(cosine1\.01\.0\) and stays topically close elsewhere through shared question words \(*award*,*Islamic*,*literature*\) without reproducing any biographical fact—it never emits “Distinguished”, “Tel Aviv”, or “Nobel”—so its dissimilarity is low, whereas R2MU’s punctuation collapse matches nothing and scores near\-maximal dissimilarity\. Because CFE credits dissimilarity, the collapse outscoresREDaCT\(0\.8760\.876vs\.0\.3460\.346cosine;0\.9890\.989vs\.0\.6500\.650ROUGE\-L\) even thoughREDaCTis the method that actually refuses—the inversion holds on96\.2%96\.2\\%offorget10prompts\.

### H\.2Original AFE Metric in R\-TOFU

R\-TOFU’s AFE harmonic\-means three answer\-level scores against the ground\-truth answer: ROUGE\-L \(lexical overlap\), cosine similarity \(semantic similarity from a sentence encoder\), and entailment probability \(from a fine\-tuned NLI model\)\. Two patterns on theforget10split produce systematically misleading AFE scores even when the answer carries no forget\-set content\.

#### Uncertainty\-shaped Ground Truth\.

For roughly1%1\\%offorget10prompts \(44samples\), the ground\-truth answer is itself a refusal of the form “There is no definitive information available regarding the authors Moshe Ben\-David admires…”\. A model emitting “I don’t have information about which authors influenced Moshe Ben\-David” is then near\-perfectly entailed by the ground truth, with ROUGE\-L and cosine similarity also near11, producing AFE near00despite a structurally correct refusal\.

#### Entity Echo in Refusals\.

A refusal that re\-states the question’s named entity produces misleading metrics as well\. An answer of the form “I lack the necessary background information to explain how Jad Ambrose Al\-Shamary’s parents influenced his writing” yields ROUGE\-L of0\.200\.20–0\.400\.40and cosine similarity around0\.750\.75against the ground\-truth biographical answer, dropping AFE to0\.300\.30–0\.500\.50despite the answer carrying no forget\-set content\.

## Appendix IPerformance ofREDaCTon Another LRM Model

In this part of experiments, we use DeepSeek\-R1\-Distill\-Qwen\-7B\([Guo et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib8)\)as the LRM model to evaluate the performance ofREDaCT\.

#### Target Model\.

We fine\-tune the model with R\-TOFU’s fine\-tuning recipe\([Yoon et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib28)\)—supervised fine\-tuning on the complete R\-TOFU corpus of questions, ground\-truth CoTs, and answers for1010epochs at learning rate10−510^\{\-5\}with an effective batch size of3232—updating all parameters\.

Table 4:Baseline hyperparameters selected on the DeepSeek\-R1\-Distill\-Qwen\-7B target for GA, GD, KL, PO\.
#### Parameter setup ofREDaCT\.

The detector is deployed atτ=0\.5\\tau=0\.5with iteration budgetB=3B=3, and all scores use the same Claude Sonnet 4\.6 judge\.

Table 5:Performance ofREDaCTand baseline approaches on the DeepSeek\-R1\-Distill\-Qwen\-7B target \(forget10\)\. Columns as in Table[1](https://arxiv.org/html/2610.12769#S5.T1); bold values mark the best value per column\.
#### Results\.

As reported in Table[5](https://arxiv.org/html/2610.12769#A9.T5),REDaCTremoves the forget\-set content from every final answer \(AFE1\.01\.0\) and nearly every CoT \(CFE0\.9750\.975\), refuses coherently on99\.3%99\.3\\%of its responses, never collapses, and keeps utility within0\.0340\.034of the pre\-unlearning model\. R2MU is the only baseline with comparable forget efficacy—its CFE \(0\.9920\.992\) is marginally higher thanREDaCT’s—and it again forgets by collapsing on90\.7%90\.7\\%of its non\-leak responses\. GA is the only method with higher utility thanREDaCT\(0\.6710\.671, above the pre\-unlearning model because GA improves performance on thereal\_authorssplit\), but it forgets fewer than half of the forget\-set answers \(AFE0\.4530\.453\) and hallucinates on95\.0%95\.0\\%of the answers it does forget\. KL forgets more than on the Llama\-based target \(AFE0\.8050\.805\) but collapses on46\.6%46\.6\\%of its non\-leak responses\. This demonstrates thatREDaCTremains effective on the tested LRM model\.

## Appendix JStandalone Accuracy of the Leak Detector

Table 6:CoT\-level recall, precision, and F1 of the leak detectors atτ=0\.5\\tau=0\.5\.REDaCT’s forget efficacy is bounded by its leak detector: a false negative leaves a leaking sentence in place, and a false positive triggers an unnecessary regeneration\. Therefore, in this part of experiments, we measure the accuracy of the leak detector\. Specifically, we measure the recallRR, precisionPP, andF1=2​P​R/\(P\+R\)F\_\{1\}=2PR/\(P\+R\)of the detector at the default thresholdτ=0\.5\\tau=0\.5\. We score whole CoTs rather than individual sentences, since the CoT is the unit on whichREDaCTacts: a forget\-set CoT counts as a true positive when the detector flags its labeled first\-leak sentence or an earlier one, either of which truncates the trace before the leak, and a negative CoT counts as a false positive when any of its sentences is flagged\.

As reported in Table[6](https://arxiv.org/html/2610.12769#A10.T6), recall is perfect on bothforget01andforget05forget\-set\. Onforget10, the detector fires one sentence too late on two of400400CoTs, leaving a leaking sentence in the trace\. Precision is perfect except for one false positive onforget05\. A missed CoT leak does not disclose the forgotten information in the final response: the detector screens the final answer separately \(Section[4\.3](https://arxiv.org/html/2610.12769#S4.SS3)\), and at the deployed threshold no forget\-set answer leaked \(AFE=1\.0=1\.0inTable[1](https://arxiv.org/html/2610.12769#S5.T1)\)\.

## Appendix KAdditional Results: Impact of Corrective Embedding Length on Performance ofREDaCT

Section[5\.4](https://arxiv.org/html/2610.12769#S5.SS4)sweeps the corrective\-embedding lengthkkon theforget01dataset, where fidelity to the per\-example refusal target saturates byk=4k=4\(Figure[2\(c\)](https://arxiv.org/html/2610.12769#S5.F2.sf3)\)\. The saturation point grows with the size of the forget set\. Figure[7](https://arxiv.org/html/2610.12769#A11.F7)repeats the sweep onforget05andforget10with the same three agreement measures: on both sets fidelity climbs gradually rather than snapping to11, with exact match only0\.590\.59\(forget05\) and0\.470\.47\(forget10\) atk=8k=8and reaching verbatim agreement \(≈1\.0\\approx 1\.0\) only atk=16k=16\. Forget efficacy itself is unaffected bykk: AFE remains1\.01\.0at everykkon all three forget sets, so the length tunes only refusal fidelity, not whether forget\-set content is removed\.

![Refer to caption](https://arxiv.org/html/2610.12769v1/figs/sensitivity_forget05_k_idkverbatim.png)\(a\)forget05
![Refer to caption](https://arxiv.org/html/2610.12769v1/figs/sensitivity_forget10_k_idkverbatim.png)\(b\)forget10

Figure 7:Impact of Corrective embedding length on performance ofREDaCT
## Appendix LLicense for Artifacts

All the artifacts used in the paper are for scientific purpose only\.

For the existing artifacts, we cited the original paper that produced the code package and dataset, and included the URL of these artifacts:

- •The DeepSeek\-R1\-Distill\-Llama\-8B model is governed by the Meta Llama 3\.1 Community License555The DeepSeek\-R1\-Distill\-Llama\-8B model card states that it “is derived from Llama3\.1\-8B\-Base and is originally licensed under \[the\] llama3\.1 license” \([https://huggingface\.co/deepseek\-ai/DeepSeek\-R1\-Distill\-Llama\-8B](https://huggingface.co/deepseek-ai/DeepSeek-R1-Distill-Llama-8B)\);sangyon/LRM\-targetis a fine\-tune of this checkpoint\.\. DeepSeek\-R1\-Distill\-Qwen\-7B is released under the Apache 2\.0 License\. DeepSeek’s distillation contributions are released under the MIT License\([Guo et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib8)\)\. The supporting models—the RoBERTa\-base detector backbone\([Liu et al\., 2019](https://arxiv.org/html/2610.12769#bib.bib17)\)\(MIT\) and theall\-MiniLM\-L6\-v2sentence encoder \(Apache 2\.0\)—and the Claude Sonnet 4\.6 judge \(used under Anthropic’s commercial API terms\) carry their respective licenses\.
- •The R\-TOFU dataset is released under the MIT License\([Yoon et al\., 2025](https://arxiv.org/html/2610.12769#bib.bib28)\)\.
- •The R2MU code repository is released under the MIT License\.

These artifacts are publicly available\. Our use is non\-commercial and for academic research only; where an artifact specifies a license we comply with its terms, and where none is specified we rely on fair academic\-use norms\.

For our own code, we release it on a public repository under the MIT License\. We have specified its intended use and indicated that it is compatible with the original access conditions of the models and datasets we used in the evaluation\. We have provided documentation ofREDaCTtogether with the code and datasets\.

## Appendix MAI Use

AI was used for coding assistance, literature review, and figure creation, all based on content provided by the authors\. AI was also used during the initial drafting process; all AI\-generated text was subsequently rewritten by the authors\.