RAG 中的 C$^2$U：检索增强生成中的组合式概念遗忘

# C2U in RAG: Compositional Concept Unlearning in Retrieval-Augmented Generation
Source: [https://arxiv.org/html/2610.29223](https://arxiv.org/html/2610.29223)
###### Abstract

Retrieval\-augmented generation can expose unwanted concepts through retrieved evidence even when the generator is moderated\. We study query\-side concept suppression with a fixed encoder and document index\. Compositional Concept Unlearning \(C2U\) routes a profile\-derived direction through an augmented atom bank, adding only a bounded edited\-minus\-original delta to the raw query\. Across five datasets, four encoders, and three seeds, the validation\-selected configuration reduces pooled binary target Hit@5 by 4\.25 percentage points with non\-positive control degradation and target\-exposure changes\. Under the evaluated query transforms, it suppresses target density without increasing budgeted control\-query exposure\. Separately, ArXiv four\-concept composition improves over an averaged\-direction comparator after independent validation gates and first\-use test evaluation\.

![[Uncaptioned image]](https://arxiv.org/html/2610.29223v1/logos/midori-icon.png)![[Uncaptioned image]](https://arxiv.org/html/2610.29223v1/logos/midori-wordmark.png)

1Midori Lab, Nanyang Technological University,2Institute of Science Tokyo \(formerly Tokyo Institute of Technology\),3Beihang University

## 1Introduction

Retrieval\-Augmented Generation \(RAG\) grounds answers in external documents, but also creates a pathway for private, unwanted, or policy\-restricted evidence to enter a model’s context\. Output moderation can reject a response without changing that evidence pathway\. Conversely, deleting whole documents can remove useful content alongside an unwanted concept\. We study an intermediate intervention: suppress concept\-bearing retrieval through query\-side representation editing, leaving the encoder and indexed corpus unchanged\. Here, “unlearning” means retrieval\-stage suppression, not certified parameter deletion or a guarantee about generated answers\.

The problem has four aspects: intervention happens on a fixed\-index retriever, a small profile must guide bounded query edits, suppression–utility trade\-offs must hold under ordinary and transformed queries, and several concepts must share an editing budget\.[Figure1](https://arxiv.org/html/2610.29223#S1.F1)locates the intervention within RAG\. Linear erasure provides useful comparisons, but reducing target retrieval need not reduce exposure under context packing\. Access also matters: a query transform cannot inspect and remove target documents like a membership\-aware filter\. We therefore evaluate suppression, utility, and exposure together, distinguishing the information available to each method\.

![Refer to caption](https://arxiv.org/html/2610.29223v1/high_level_c2u.png)Figure 1:Intervention locations in RAG\.Retraining changes the representation model; linear erasure transforms representations; C2U edits atom coordinates and bounds the resulting raw\-query update\. Its encoder, document index, and downstream generator remain fixed\.C2U combines an Atomic Compositional Representation \(ACR\) with a raw\-query bypass\. Target profiles and calibration controls determine a negative, diagonally preconditioned direction and a calibrated gate\. Least\-squares coefficients and an appended residual atom carry that direction through the frozen atom bank; only the weight difference returns to the raw query\. A trust region limits the update\. For multiple concepts, separate gates allocate a shared angular budget before their deltas are added\.

The experiments assess both useful suppression and its limits\. The single\-concept comparison includes stronger\-access methods and methods that suppress more at larger utility costs; query\-transform evaluation tests whether suppression coexists with increased context exposure\. Separately, ArXiv four\-concept composition passes selection, independent confirmation, and first\-use test evaluation, while the two\-concept design fails selection\. Our contributions are threefold:

- •Bounded query editing\.An atom\-coordinate operator with calibrated gating, residual completion, and a raw\-query trust region \([Section3](https://arxiv.org/html/2610.29223#S3)\) with gate\-off exact identity\.
- •Suppression and utility evidence\.Joint retrieval and exposure comparisons across datasets, encoders, and query conditions, with explicit access classes and evidence scope\.
- •Concept composition\.Separate\-gate, shared\-budget editing evaluated against averaged\-direction steering\.

## 2Related Work and Problem

#### Retrieval and safety\.

RAG research improves retrieval and context use through filtering, ranking, and corrective generation\([Hofstätter et al\., 2023](https://arxiv.org/html/2610.29223#bib.bib12);[Asai et al\., 2024](https://arxiv.org/html/2610.29223#bib.bib2);[Yu et al\., 2024b](https://arxiv.org/html/2610.29223#bib.bib30);[Yan et al\., 2024](https://arxiv.org/html/2610.29223#bib.bib28);[Liu et al\., 2024](https://arxiv.org/html/2610.29223#bib.bib17)\)\. Retrieved sources can nevertheless introduce unsafe content or poisoning\([An et al\., 2025](https://arxiv.org/html/2610.29223#bib.bib1);[Zhao et al\., 2026](https://arxiv.org/html/2610.29223#bib.bib31)\)\. Moderation and safety frameworks\([Inan et al\., 2023](https://arxiv.org/html/2610.29223#bib.bib13);[Liang et al\., 2025](https://arxiv.org/html/2610.29223#bib.bib16)\)address complementary parts of this problem; adversarial suffixes and latent instructions illustrate why output defenses alone need evaluation\([Zou et al\., 2023](https://arxiv.org/html/2610.29223#bib.bib32);[Qiu et al\., 2023](https://arxiv.org/html/2610.29223#bib.bib22)\)\. Unlike database redaction or retriever optimization\([Wang et al\., 2026](https://arxiv.org/html/2610.29223#bib.bib25)\), our intervention preserves the raw document index that retrieval searches\.

#### Unlearning and representation control\.

Parameter\-updating unlearning\([Chen et al\., 2023](https://arxiv.org/html/2610.29223#bib.bib6);[Tarun et al\., 2023](https://arxiv.org/html/2610.29223#bib.bib24);[Fan et al\., 2023](https://arxiv.org/html/2610.29223#bib.bib8)\)and diffusion concept erasure\([Orgad et al\., 2023](https://arxiv.org/html/2610.29223#bib.bib21);[Gandikota et al\., 2023](https://arxiv.org/html/2610.29223#bib.bib9);[Wu et al\., 2025](https://arxiv.org/html/2610.29223#bib.bib27);[Bui et al\., 2025](https://arxiv.org/html/2610.29223#bib.bib5)\)motivate selective interventions but do not establish fixed\-index retrieval behavior\. INLP\([Ravfogel et al\., 2020](https://arxiv.org/html/2610.29223#bib.bib23)\)and LEACE\([Belrose et al\., 2023](https://arxiv.org/html/2610.29223#bib.bib4)\)remove linearly accessible concepts; CURE\([Kocak et al\., 2025](https://arxiv.org/html/2610.29223#bib.bib15)\)and RAG Embedder Control\([Kim et al\., 2025](https://arxiv.org/html/2610.29223#bib.bib14)\)provide recent representation\-control comparisons\. Our focus is a bounded query\-side operator and its composition rule\. Training and adaptation differences are described in[AppendicesC](https://arxiv.org/html/2610.29223#A3)and[A\.3](https://arxiv.org/html/2610.29223#A1.SS3)\.

#### Problem\.

Letq∈𝕊d−1q\\in\\mathbb\{S\}^\{d\-1\}be a normalized frozen\-encoder query anduj∈𝕊d−1u\_\{j\}\\in\\mathbb\{S\}^\{d\-1\}the unchanged indexed document vectors\. Retrieval ranksq⊤​ujq^\{\\top\}u\_\{j\}\. Given a target concept profile, we produceq′q^\{\\prime\}to reduce target retrieval while preserving control\-label retrieval and avoiding extra target exposure on control queries\. Query\-role and target\-document membership labels are evaluation inputs, not inputs to the deployed C2U operator\.

A profile identifies what to suppress through examples, not a runtime list of forbidden document IDs\. Calibration controls characterize non\-target geometry and set the gate before evaluation\. At retrieval time the same operator applies to target and control queries without observing their roles\. Suppressing target\-seeking queries can still introduce unwanted evidence for other users, so target suppression and control\-query exposure are separate outcomes throughout the evaluation\.

## 3Deployed Query Editing

![Refer to caption](https://arxiv.org/html/2610.29223v1/method_arr_v7.png)Figure 2:Deployed C2U pipeline\.The frozen encoder’s raw queryqqfeeds ACR and, via the bypass, the bounded update\. Profile\-guided editing adds the scaled coefficientskq​bβk\_\{q\}b\_\{\\beta\}to the weightswqw\_\{q\}; the differenceδq\\delta\_\{q\}and the updateq′=normalize⁡\(q\+η​δq\)q^\{\\prime\}=\\operatorname\{normalize\}\(q\+\\eta\\delta\_\{q\}\),θ≤θmax=0\.2\\theta\\leq\\theta\_\{\\max\}=0\.2rad, return one edited query to the index\.#### Atomic representation\.

The atom bank𝒜∈ℝN×d\\mathcal\{A\}\\in\\mathbb\{R\}^\{N\\times d\}is a learned dictionary whose rowsaia\_\{i\}are unlabeled unit directions in the encoder’s representation space;NNvaries by dataset and encoder \([SectionA\.1](https://arxiv.org/html/2610.29223#A1.SS1.SSS0.Px4)\)\. The frozen encoder maps textxxtohxh\_\{x\}, and a lightweight projection head scoreshxh\_\{x\}against every row; a temperature\-scaled softmax turns these scores into atom weights, whose bank combination reconstructs the representation:

wx=softmax⁡\(s⁡\(hx,𝒜\)/τ\),zx=normalize⁡\(𝒜⊤​wx\)\.\\begin\{gathered\}w\_\{x\}=\\operatorname\{softmax\}\\\!\\left\(s\(h\_\{x\},\\mathcal\{A\}\)/\\tau\\right\),\\\\ z\_\{x\}=\\operatorname\{normalize\}\\\!\\left\(\\mathcal\{A\}^\{\\top\}w\_\{x\}\\right\)\.\\end\{gathered\}\(1\)Training optimizes only the bank and head—the encoder stays frozen throughout—with a retrieval objective onzxz\_\{x\}and an entropy penalty that keepswxw\_\{x\}peaked; both are frozen afterward \([SectionA\.3](https://arxiv.org/html/2610.29223#A1.SS3)\)\. Editing then happens in atom coordinates: a direction in representation space becomes a change of weight coefficients rather than a free\-form vector edit\. The reconstruction itself never enters deployment\. The index stores raw encoder vectors, and online editing returns only the weight\-difference delta to the raw query rather than replacing the query byzxz\_\{x\}; substituting the reconstruction would define a different method and break identity with the unchanged index deployment searches\.

#### Direction and calibrated gate\.

Letμt,μc\\mu\_\{t\},\\mu\_\{c\}be means of normalized target\-profile and calibration\-control vectors\. Withv=normalize⁡\(μt−μc\)v=\\operatorname\{normalize\}\(\\mu\_\{t\}\-\\mu\_\{c\}\), the negative, diagonally preconditioned direction isg=normalize⁡\(−D−1​v\)g=\\operatorname\{normalize\}\(\-D^\{\-1\}v\), whereDDis a ridge\-regularized, shrunk diagonal control second\-moment matrix\. A separate raw\-space scorez⁡\(q\)=q⊤​normalize⁡\(μt\)−q⊤​normalize⁡\(μc\)z\(q\)=q^\{\\top\}\\operatorname\{normalize\}\(\\mu\_\{t\}\)\-q^\{\\top\}\\operatorname\{normalize\}\(\\mu\_\{c\}\)determines the continuous gate:

s⁡\(q\)=clip⁡\(z⁡\(q\)−z0z1−z0,0,1\)\.s\(q\)=\\operatorname\{clip\}\\\!\\left\(\\frac\{z\(q\)\-z\_\{0\}\}\{z\_\{1\}\-z\_\{0\}\},0,1\\right\)\.\(2\)Herez0,z1z\_\{0\},z\_\{1\}are the calibration\-control median and9595th percentile\. The gate uses neither ranks nor candidate labels; degenerate calibration uses the conservative fallback in[SectionA\.6](https://arxiv.org/html/2610.29223#A1.SS6)\.

#### Residual completion\.

The bank𝒜∈ℝN×d\\mathcal\{A\}\\in\\mathbb\{R\}^\{N\\times d\}and weight\-generating head are frozen after ACR training \([SectionA\.3](https://arxiv.org/html/2610.29223#A1.SS3)\);NNvaries by dataset and encoder \([SectionA\.1](https://arxiv.org/html/2610.29223#A1.SS1.SSS0.Px4)\)\. Solvea=lstsq⁡\(𝒜⊤,g\)a=\\operatorname\{lstsq\}\(\\mathcal\{A\}^\{\\top\},g\)and setp=𝒜⊤​ap=\\mathcal\{A\}^\{\\top\}a,e=g−pe=g\-p\. Above the residual threshold, appendr=e/‖e‖r=e/\\\|e\\\|and usebβ=\[a;β​‖e‖\]b\_\{\\beta\}=\[a;\\beta\\\|e\\\|\]in𝒜′=\[𝒜;r\]\\mathcal\{A\}^\{\\prime\}=\[\\mathcal\{A\};r\]\. For zero or small residuals, appendr=p/‖p‖r=p/\\\|p\\\|with coefficient zero; a degenerateppfails closed\. Thusβ\\betascales*only the appended coefficient*\. At the selectedβ=1\\beta=1, projected and residual components recover fullggin exact arithmetic; the small\-residual branch instead truncateseeto its in\-span projection\.

#### Angular allocation and delta transfer\.

Leth=𝒜′⁣⊤​bβh=\\mathcal\{A\}^\{\\prime\\top\}b\_\{\\beta\}andϕ=∠⁡\(q,h\)\\phi=\\angle\(q,h\)\. The requested angle isθreq=0\.3​s​\(q\)\\theta\_\{\\rm req\}=0\.3s\(q\); angular feasibility givesθ=max⁡\(0,min⁡\(θreq,ϕ−ϵplane\)\)\\theta=\\max\(0,\\min\(\\theta\_\{\\rm req\},\\phi\-\\epsilon\_\{\\rm plane\}\)\)\. For active, feasible rows set

kq=sin⁡θsin⁡\(ϕ−θ\),wq′=\[wq;0\]\+kq​bβ\.k\_\{q\}=\\frac\{\\sin\\theta\}\{\\sin\(\\phi\-\\theta\)\},\\qquad w^\{\\prime\}\_\{q\}=\[w\_\{q\};0\]\+k\_\{q\}b\_\{\\beta\}\.\(3\)Edited weights are neither clipped nor renormalized\. Normalizinghhdefines its angle only;bβb\_\{\\beta\}retains its magnitude\. The requested, feasible, and realized angles therefore differ in general, particularly whenβ≠1\\beta\\neq 1\. Transfer the actual edited\-minus\-padded weight difference:

δq=\(wq′−\[wq;0\]\)⊤​𝒜′\.\\delta\_\{q\}=\(w^\{\\prime\}\_\{q\}\-\[w\_\{q\};0\]\)^\{\\top\}\\mathcal\{A\}^\{\\prime\}\.\(4\)Training uses reconstruction, whereas online editing uses this difference; precision, cancellation, and threshold details are in[SectionA\.6](https://arxiv.org/html/2610.29223#A1.SS6)\.

#### Raw\-query trust\-region update\.

For active rows, returnq′=normalize⁡\(q\+η​δq\)q^\{\\prime\}=\\operatorname\{normalize\}\(q\+\\eta\\delta\_\{q\}\), taking the full step if feasible and otherwise reducingη∈\[0,1\]\\eta\\in\[0,1\]to satisfy the numerical counterpart of

⟨q′,q⟩≥max⁡\(cos⁡\(0\.2\),0\.98\)\.\\langle q^\{\\prime\},q\\rangle\\geq\\max\(\\cos\(0\.2\),0\.98\)\.\(5\)The raw query, not its reconstruction, anchors the update \([Figure2](https://arxiv.org/html/2610.29223#S3.F2)\)\. Gate\-off and zero\-delta rows return the input directly\. The0\.20\.2\-rad cap is tighter than the0\.980\.98cosine floor and can further reduce the realized angle\. Numerical checks are detailed in[SectionA\.6](https://arxiv.org/html/2610.29223#A1.SS6)\.

The trust region bounds motion, not retrieval damage\. For ideal unit queries satisfying a capθmax\\theta\_\{\\max\}, each unit document’s score changes by at most2​sin⁡\(θmax/2\)2\\sin\(\\theta\_\{\\max\}/2\)\([PropositionJ\.4](https://arxiv.org/html/2610.29223#A10.Thmtheorem4)\)\.

#### Design rationale\.

Each component answers one deployment question\. The calibrated gate decides whether a query is edited at all, from the profile and unlabeled calibration controls alone: it needs neither candidate labels nor ranks, scales the requested angle continuously, and passes concept\-distant queries through as an exact identity\. The raw\-query bypass fixes what is edited: the deployed object is the encoder’s own vector, the index is never touched, and the reconstructionzxz\_\{x\}stays a training device\. The residual atom makes the profile direction expressible in bank coordinates even when the frozen atom bank does not span it, so the weight\-difference transfer carries the full direction rather than its projection, and the trust region bounds the resulting rotation\. In composition, one shared budget caps the summed rotation across concepts, so several active gates cannot compound into a large motion, keeping the deployed operator bounded, query\-side, and index\-preserving\.

#### Why not profile subtraction\.

The classical atom\-coordinate edit subtracts profile mass from query weights \([SectionA\.5](https://arxiv.org/html/2610.29223#A1.SS5)\)\. Under the locked bank and deployed runtime, every measured subtraction variant is an exact inactive identity: frozen query weights overlap the top\-3030atom profile by only≈0\.0011\\approx\\\!0\.0011, and the applied\-angle diagnostic stays near2×10−52\\times 10^\{\-5\}rad\. Two validation\-only revival probes—knob\-only bank retraining and an off\-diagonal orthogonality loss—fail to revive subtraction and leave the deployed route unchanged \([SectionA\.6](https://arxiv.org/html/2610.29223#A1.SS6)\)\. Atom coordinates are what make this failure measurable: query and profile mass occupy almost disjoint weight coordinates, so a subtractive edit has nothing to act on\. Suppression must instead add a bounded rotation along the completed direction—the deployed operator\. These bounded interventions do not rule out every subtraction method under other banks or objectives\.

## 4Evaluation

### 4\.1Setup and Evidence Scope

We evaluate Amazon, ArXiv, IMDB, MNLI, and TOFU\([McAuley & Leskovec, 2013](https://arxiv.org/html/2610.29223#bib.bib19);[Bahraminasr & Vafaei\-Sadr, 2020](https://arxiv.org/html/2610.29223#bib.bib3);[Williams et al\., 2018](https://arxiv.org/html/2610.29223#bib.bib26);[Maini et al\., 2024](https://arxiv.org/html/2610.29223#bib.bib18)\), using MiniLM, bge, e5, and Qwen3 frozen encoders and three seeds\. Single\-concept stages contain6060units, each with100100target and300300control queries, a shared100100\-target/300300\-control raw index, and2020target\-profile documents\. The final comparison contains6,0006\{,\}000target and18,00018\{,\}000control row contributions\. Profile, selection, confirmation, and final\-evaluation allocations are disjoint; selection and independent confirmation precede the fixed configuration\.

Table 1:Task overview: what each dataset suppresses and preserves, and its query source \([AppendixB](https://arxiv.org/html/2610.29223#A2)\)\.gRelaxed global controls\.dOne synthetic template per role\.DatasetTargetControlQueriesArXivtopiccategorygtitle/abstractTOFUsensitive topicauthor identityquestionsAmazonsentimentproduct categoryreview titlesIMDBmovie genresentimenttemplatedMNLItext genrelogic labelhypotheses[Table1](https://arxiv.org/html/2610.29223#S4.T1)summarizes the task each dataset poses: a target concept whose documents should leave the top ranks is paired with a control attribute whose retrieval must survive the edit—a scientific topic against its ArXiv category, a sensitive biography topic against author identity, review sentiment against product category, movie genre against review sentiment, and source genre against the entailment label\. Queries are titles or abstracts, natural questions, review titles, or hypotheses; IMDB uses one synthetic template per role\. ArXiv controls come from the whole corpus rather than matched categories, so its control statistics describe a relaxed, global comparison\.

Single\-concept and attack evaluations are posthoc extensions of existing test units, without test tuning or an untouched\-test claim\. Multi\-concept experiments use separate budgets and acceptance gates; only ArXivK=4K=4reaches a separately gated first\-use test\. IMDB’s row\-bootstrap intervals are duplicate\-template diagnostics, not strong semantic\-sample evidence\.

#### Access and metrics\.

C2U uses profiles and unlabeled calibration controls without candidate access\. Raw, Delta\-Edit, PISCES, Random, and the portable DARE\-GRL mapper are query\-side comparisons; INLP, LEACE, CURE, and RAG\-Emb\-Ctrl additionally fit on400400labeled calibration examples per unit\. Filter\-and\-Refill uses candidate/document membership; Rank\-Router uses target\-document membership as a label\-assisted benchmark router\. PISCES, DARE\-GRL, CURE, and RAG Embedder Control are in\-house diagnostic adaptations, not official reproductions\([Gur\-Arieh et al\., 2025](https://arxiv.org/html/2610.29223#bib.bib11);[Ganin & Lempitsky, 2015](https://arxiv.org/html/2610.29223#bib.bib10);[Yu et al\., 2024a](https://arxiv.org/html/2610.29223#bib.bib29);[Kocak et al\., 2025](https://arxiv.org/html/2610.29223#bib.bib15);[Kim et al\., 2025](https://arxiv.org/html/2610.29223#bib.bib14)\)\. Their access classes preclude a cross\-class dominance interpretation\.

Binary H5 Drop is the reduction in*any\-target\-in\-top\-five*retrieval on target queries\. CN is control own\-label Hit@5 loss; TE is the change in any\-target\-in\-top\-five retrieval on control queries\. Positive CN or TE is a cost; utility\-clean means both rate changes are at most10−910^\{\-9\}\. We report rate differences in percentage points \(pp\), with target\-cosine changes in the full results\.

Dataset summaries average four encoders and three seeds; pooled summaries weight the five datasets equally\. Absolute levels and per\-dataset intervals are in[Table4](https://arxiv.org/html/2610.29223#A1.T4); statistical definitions and resampling scope are in[AppendixA](https://arxiv.org/html/2610.29223#A1)\.

### 4\.2Single\-Concept Results

Table 2:Single\-concept suppression and utility by dataset\.Percentage\-point changes from Raw, averaged over four encoders and three seeds; Pooled weights datasets equally\. Tints mark access classes; full results are in Appendix[E](https://arxiv.org/html/2610.29223#A5)\.MethodH5 Drop↑\\uparrowCN↓\\downarrowTE↓\\downarrowAmazonC2U\+6\.33\-0\.64\-12\.44Delta\-Edit0\.000\.00\-0\.08PISCES\-0\.33\-0\.25\+2\.69Random\+1\.17\-0\.17\+3\.00INLP\+12\.17\-0\.50\+18\.86LEACE\+36\.58\-0\.61\-0\.83RAG\-Emb\-Ctrl\+68\.83\-0\.69\-33\.53CURE0\.000\.000\.00DARE\-GRL\+22\.50\-0\.11\+38\.53Filter\-and\-Refill‡\+0\.92\-0\.56\-4\.14Rank\-Router§\+7\.00\-0\.64\-13\.83ArXivrC2U\+5\.67\-1\.25\-7\.64Delta\-Edit0\.00\+0\.030\.00PISCES\-0\.17\-0\.25\+1\.33Random\+1\.08\+4\.92\+6\.31INLP\+5\.92\+5\.00\+8\.89LEACE\+1\.00\+2\.19\+16\.19RAG\-Emb\-Ctrl\+69\.50\+5\.56\-21\.03CURE0\.000\.000\.00DARE\-GRL\+22\.67\+68\.58\+58\.61Filter\-and\-Refill‡\+38\.33\-1\.97\-18\.06Rank\-Router§\+5\.67\-1\.08\-7\.64IMDBdC2U\+2\.580\.000\.00Delta\-Edit0\.000\.000\.00PISCES\+1\.830\.000\.00Random\+2\.42\+2\.03\+23\.11INLP0\.000\.00\+16\.67LEACE\+1\.830\.00\+8\.33RAG\-Emb\-Ctrl\+30\.750\.00\+25\.00CURE0\.000\.000\.00DARE\-GRL\+34\.08\+25\.00\+58\.33Filter\-and\-Refill‡0\.000\.000\.00Rank\-Router§\+2\.580\.000\.00
MethodH5 Drop↑\\uparrowCN↓\\downarrowTE↓\\downarrowMNLIC2U\+3\.42\-1\.08\-6\.03Delta\-Edit0\.00\+0\.03\+0\.03PISCES\-0\.25\-0\.08\+0\.42Random\+1\.58\+2\.67\+3\.67INLP\+4\.00\+0\.22\+5\.83LEACE\+1\.25\+0\.06\+7\.94RAG\-Emb\-Ctrl\+42\.58\+1\.33\-34\.25CURE0\.000\.000\.00DARE\-GRL\+35\.42\+27\.72\+14\.50Filter\-and\-Refill‡\+10\.50\-1\.94\-11\.83Rank\-Router§\+3\.83\-1\.22\-6\.36TOFUC2U\+3\.25\-0\.44\-2\.14Delta\-Edit0\.000\.00\+0\.03PISCES\+0\.42\+0\.08\+0\.53Random\-0\.92\+0\.94\+0\.92INLP\+6\.42\+6\.47\+9\.00LEACE\+4\.92\-0\.08\+0\.58RAG\-Emb\-Ctrl\+28\.92\-1\.19\-23\.78CURE0\.000\.000\.00DARE\-GRL\+11\.33\+24\.58\+11\.72Filter\-and\-Refill‡\+4\.00\-1\.19\-7\.31Rank\-Router§\+4\.58\-0\.42\-2\.67PooledC2U\+4\.25\-0\.68\-5\.65Delta\-Edit0\.00\+0\.01\-0\.01PISCES\+0\.30\-0\.10\+0\.99Random\+1\.07\+2\.08\+7\.40INLP\+5\.70\+2\.24\+11\.85LEACE\+9\.12\+0\.31\+6\.44RAG\-Emb\-Ctrl\+48\.12\+1\.00\-17\.52CURE0\.000\.000\.00DARE\-GRL\+25\.20\+29\.16\+36\.34Filter\-and\-Refill‡\+10\.75\-1\.13\-8\.27Rank\-Router§\+4\.73\-0\.67\-6\.10
Raw \(zero differences\) is omitted; positive CN or TE is a cost\.‡Candidate/document access;§membership\-assisted;rrelaxed global control;dduplicate\-template diagnostic\.

#### Suppression and utility\.

[Table2](https://arxiv.org/html/2610.29223#S4.T2)shows larger C2U suppression on Amazon and ArXiv than on MNLI and TOFU\. Aggregate\-derived pooled binary target Hit@5 decreases from94\.7333%94\.7333\\%to90\.4833%90\.4833\\%, a4\.254\.25pp drop rather than near\-complete removal\. H5 Drop is positive with non\-positive CN and TE on every dataset; pooled CN is−0\.68\-0\.68pp and TE−5\.65\-5\.65pp\.

#### Suppression–utility trade\-offs\.

RAG\-Emb\-Ctrl reaches pooled H5 Drop\+48\.12\+48\.12pp, with utility/exposure costs including IMDB TE\+25\.00\+25\.00pp; CURE is a utility\-gated no\-op and does not suppress\. DARE\-GRL reaches\+25\.20\+25\.20pp with CN\+29\.16\+29\.16pp and TE\+36\.34\+36\.34pp\. Filter\-and\-Refill \(\+10\.75\+10\.75pp\) and Rank\-Router \(\+4\.73\+4\.73pp\) exceed C2U with utility\-clean outcomes under stronger access\. Full results and the Pareto view are in[AppendicesE](https://arxiv.org/html/2610.29223#A5)and[5](https://arxiv.org/html/2610.29223#A6.F5)\.

#### Encoder heterogeneity\.

The dataset means hide a wide encoder\-level spread \([Tables9](https://arxiv.org/html/2610.29223#A5.T9),[11](https://arxiv.org/html/2610.29223#A5.T11)and[12](https://arxiv.org/html/2610.29223#A5.T12)\)\. On Amazon, C2U’s H5 Drop ranges from2\.02\.0pp with bge to14\.014\.0pp with e5; ArXiv is the most uniform \(4\.34\.3–8\.08\.0pp\), MNLI spans1\.71\.7–6\.76\.7pp and TOFU1\.31\.3–5\.05\.0pp; on IMDB only bge shows a drop \(10\.310\.3pp\)\. e5 is the most responsive encoder on three datasets and Qwen3 the least on three\. CN is non\-positive in1919of2020dataset–encoder cells \(MNLI with Qwen3:\+0\.67\+0\.67pp\) and TE in all2020\. The pooled4\.254\.25pp thus summarizes behaviours that differ sevenfold across encoders\.

#### Operating point\.

The deployed configuration is the validation\-selected residual coefficientβ=1\\beta=1with the0\.20\.2\-rad cap and0\.980\.98cosine floor; the validation sweep over larger caps and smallerβ\\betafound no eligible alternative \([SectionA\.6](https://arxiv.org/html/2610.29223#A1.SS6)\)\.

### 4\.3Analysis of Bounded Editing

Figure 3:Bounded editing behavior\.\(a\) Share of target queries \(n=6,000n\{=\}6\{,\}000\) and control queries \(n=18,000n\{=\}18\{,\}000\) that are unedited, edited below the0\.20\.2rad cap, or edited at the cap; each bar sums to its group\. \(b\) Cosine to the target\-document centroid for target queries before and after editing;*Control \(raw\)*is the unedited control state\.[Figure3](https://arxiv.org/html/2610.29223#S4.F3)summarizes the bounded operator on the posthoc rows\. The gate admits most queries:94\.7%94\.7\\%of target and71\.5%71\.5\\%of control queries receive an edit\. The cap then binds:76\.5%76\.5\\%of target and44\.3%44\.3\\%of control queries sit at the0\.20\.2rad boundary, so realized motion is usually below the requested angle\. Panel \(b\) shows after\-edit target queries at lower cosine to the target\-document centroid\. This view is consistent with the Hit@5 drops in[Table2](https://arxiv.org/html/2610.29223#S4.T2); the retrieval effect is measured there, not inferred from the shift\. Two cautions remain:*Control \(raw\)*is unedited while most control queries are edited, and centroid cosine is one direction, not full semantic alignment\. Full angle distributions and retrieval examples:[Figures6\(b\)](https://arxiv.org/html/2610.29223#A6.F6.sf2)and[6](https://arxiv.org/html/2610.29223#A4.T6)\.

### 4\.4Suppression and Exposure under Query Transforms

Table 3:Suppression and control exposure under query transforms\.Paired percentage\-point changes from Raw, averaged over the three query conditions \(Standard, Injection, Zou\-noise\) per dataset; Pooled weights the five datasets equally\. Cell counts and signed worst values: Table[14](https://arxiv.org/html/2610.29223#A8.T14); full per\-condition matrix: Table[15](https://arxiv.org/html/2610.29223#A8.T15)\.AmazonMethodDensityΔ↓\\Delta\\downarrowCERΔ↓\\Delta\\downarrowUtility loss↓\\downarrowC2U\-16\.4\-13\.70\.0PISCES\-1\.2\+4\.30\.0Random\-0\.4\+6\.40\.0INLP\-15\.8\+17\.60\.0LEACE\-21\.9\+2\.40\.0RAG\-Emb\-Ctrl\-34\.7\-31\.40\.0CURE0\.00\.00\.0DARE\-GRL\-9\.2\+46\.00\.0MNLIMethodDensityΔ↓\\Delta\\downarrowCERΔ↓\\Delta\\downarrowUtility loss↓\\downarrowC2U\-14\.9\-6\.8\+0\.3PISCES\-2\.3\+0\.4\-0\.2Random\-3\.9\+1\.2\+1\.2INLP\-17\.7\+4\.8\-0\.9LEACE\-8\.4\+3\.3\-0\.3RAG\-Emb\-Ctrl\-40\.6\-47\.5\+5\.7CURE0\.00\.00\.0DARE\-GRL\-29\.8\+6\.6\+6\.9ArXivrMethodDensityΔ↓\\Delta\\downarrowCERΔ↓\\Delta\\downarrowUtility loss↓\\downarrowC2U\-17\.7\-11\.7\-2\.2PISCES\-2\.0\+0\.6\-0\.2Random\-5\.6\+4\.6\+4\.7INLP\-34\.1\+2\.0\+4\.1LEACE\-14\.0\+11\.8\+2\.2RAG\-Emb\-Ctrl\-72\.4\-21\.9\+5\.3CURE0\.00\.00\.0DARE\-GRL\-50\.7\+33\.8\+63\.6TOFUMethodDensityΔ↓\\Delta\\downarrowCERΔ↓\\Delta\\downarrowUtility loss↓\\downarrowC2U\-4\.4\-4\.5\-0\.1PISCES\-0\.6\+1\.3\+0\.1Random\-0\.1\+1\.5\+0\.9INLP\-5\.6\+14\.0\+2\.2LEACE\-5\.1\+3\.20\.0RAG\-Emb\-Ctrl\-20\.0\-30\.6\+0\.4CURE0\.00\.00\.0DARE\-GRL\-0\.3\+18\.4\+13\.8IMDBdMethodDensityΔ↓\\Delta\\downarrowCERΔ↓\\Delta\\downarrowUtility loss↓\\downarrowC2U\-11\.1\-0\.80\.0PISCES\-0\.6\+0\.20\.0Random\-5\.4\+14\.7\+0\.7INLP\-16\.7\+10\.1\-0\.1LEACE\-5\.6\+5\.7\+0\.1RAG\-Emb\-Ctrl\-34\.3\+8\.9\-0\.1CURE0\.00\.00\.0DARE\-GRL\-29\.4\+27\.90\.0PooledpMethodDensityΔ↓\\Delta\\downarrowCERΔ↓\\Delta\\downarrowUtility loss↓\\downarrowC2U\-12\.9\-7\.5\-0\.4PISCES\-1\.4\+1\.4\-0\.1Random\-3\.1\+5\.7\+1\.5INLP\-18\.0\+9\.7\+1\.1LEACE\-11\.0\+5\.3\+0\.4RAG\-Emb\-Ctrl\-40\.4\-24\.5\+2\.2CURE0\.00\.00\.0DARE\-GRL\-23\.9\+26\.5\+16\.9
Density: target\-label fraction in the target\-query top\-5; CER: any\-target occurrence in the packed control context \(budgetB=512B\{=\}512, at most5050documents\); utility: control own\-label Hit@10 loss\. CURE never suppresses\.rArXiv: relaxed global control\.dIMDB: duplicate\-template diagnostic\.pPooled: equal\-weight mean over the five datasets \(fifteen dataset–condition cells\)\. Metric definitions and posthoc scope: §[4\.4](https://arxiv.org/html/2610.29223#S4.SS4)\.

We compare each method with Raw under the same condition: standard queries, instruction injection, or Zou\-noise suffixes\([Zou et al\., 2023](https://arxiv.org/html/2610.29223#bib.bib32)\)\.*Target densityΔ\\Delta*is the change in the fraction of top\-five documents carrying the target label, averaged over target queries; it is not binary H5 Drop\.*CERΔ\\Delta*records whether any target document enters the packed context \(B=512B=512tokens, at most5050documents\), averaged over*control queries*\. Attack utility is control own\-label Hit@10 loss, distinct from CN and TE\. The two describe different populations, so a decrease in one need not entail a decrease in the other; both are reported together\.

[Table3](https://arxiv.org/html/2610.29223#S4.T3)shows why the two must be read together\. INLP lowers Amazon target density by15\.815\.8pp while raising control exposure by17\.617\.6pp: target documents leave the target queries’ top five but enter other users’ packed contexts\. RAG\-Emb\-Ctrl lowers both on four datasets, most strongly on ArXiv \(−72\.4\-72\.4and−21\.9\-21\.9pp\), but raises IMDB exposure \(\+8\.9\+8\.9pp\) and costs control utility \(\+5\.3\+5\.3pp on ArXiv,\+5\.7\+5\.7on MNLI\)\. C2U’s density and CER means are negative on every dataset with utility changes between−2\.2\-2\.2and\+0\.3\+0\.3pp\.

[Table3](https://arxiv.org/html/2610.29223#S4.T3)reports per\-dataset means over the three conditions and an equal\-weight pooled block\.[Table14](https://arxiv.org/html/2610.29223#A8.T14)counts the1515dataset–condition cells on unrounded values \(per\-condition matrix:[Table15](https://arxiv.org/html/2610.29223#A8.T15)\), since an average can hide a condition\-level increase: suppression requires densityΔ<0\\Delta<0; divergence additionally requires CERΔ\>0\\Delta\>0\. Counts are descriptive signs, not significance tests; standard is a no\-attack condition\. C2U suppresses in all1515cells with0/150/15divergent\. Its attack utility change still ranges from−5\.2\-5\.2to\+2\.6\+2\.6pp, so this does not establish universal utility preservation under attack\.

INLP and LEACE diverge in13/1513/15cells; PISCES, DARE\-GRL, and Random in11/1511/15\. RAG\-Emb\-Ctrl suppresses in all cells but diverges in the three IMDB cells \(CER up to\+16\.7\+16\.7pp\); the duplicate\-template limitation applies\. CURE’s0/150/15divergence is trivial: it suppresses in zero cells\. Among evaluated suppressing profile\-only methods, only C2U avoids density–exposure divergence under these query transforms\. Stronger\-access filters and routers are excluded by the attack contract\. The full matrices and both posthoc arms also appear in[AppendixH](https://arxiv.org/html/2610.29223#A8)\.

### 4\.5Multi\-Concept Composition

Each conceptcchas its own directiongcg\_\{c\}, gatesc​\(q\)s\_\{c\}\(q\), and augmented\-bank coefficients\. Angular requests start at0\.3​sc​\(q\)0\.3s\_\{c\}\(q\)and shrink proportionally whenever their sum exceedsmin⁡\(0\.3​maxc​sc​\(q\),0\.2\)\\min\(0\.3\\max\_\{c\}s\_\{c\}\(q\),0\.2\)\. Each allocated angle converts to a feasible coefficient scale; the atom\-coordinate deltas are added and pass through the shared trust\-region update\. The comparator instead steers along the normalized average of unit concept directions under a single max gate—a different gating and allocation rule\.

Figure 4:ArXivK=4K=4per\-concept H5 lift\.Compose minus the averaged\-direction comparator: means and all twelve encoder–seed unit differences; these conceptwise differences are not the min\-concept endpoint reported in the text\.The capacity\-expanded ArXivK=4K=4arm passes selection and independent confirmation before first access to fresh test rows\. Its endpoint is

112​∑u\[minc⁡Hu,ccompose−minc⁡Hu,cavg\],\\frac\{1\}\{12\}\\sum\_\{u\}\\left\[\\min\_\{c\}H^\{\\rm compose\}\_\{u,c\}\-\\min\_\{c\}H^\{\\rm avg\}\_\{u,c\}\\right\],\(6\)whereHHis per\-concept H5 Drop\. Test lift is\+0\.04125\+0\.04125, CI95\[\+0\.0325,\+0\.050625\]\[\+0\.0325,\+0\.050625\], from4,0004\{,\}000bootstraps of the twelve paired unit differences\. All four compose concept cells are positive;[Figure4](https://arxiv.org/html/2610.29223#S4.F4)separately shows paired conceptwise differences\. Filter\-and\-Refill\-multi remains a non\-gating document\-membership oracle reference \(\+0\.7181\+0\.7181\)\.

Independent gates decide, per concept, whether a query carries evidence for that concept and how much rotation it requests, so a query tied to one concept is edited mainly toward that concept\. The shared budget rescales all requests so their sum stays within the single\-concept budget: when several gates fire, each receives a smaller share\. The per\-concept lifts in[Figure4](https://arxiv.org/html/2610.29223#S4.F4)are all positive but uneven:\+1\.4\+1\.4pp for Artificial Intelligence \(positive in1010of1212units\),\+5\.7\+5\.7for Software Engineering,\+6\.9\+6\.9for Neurons and Cognition, and\+14\.2\+14\.2for Number Theory\. The spread is consistent with concepts differing in gate activity and direction separation, not with properties of individual atoms\.

The expansion uses larger budgets than earlier arms, so the ladder is not a controlled experiment on sample size alone\. It is the only untouched\-test arm here: itsK=2K=2design fails selection, and the earlier arms are validation\-only or fail acceptance, as[AppendicesG](https://arxiv.org/html/2610.29223#A7)and[8](https://arxiv.org/html/2610.29223#A7.F8)document\.

## 5Conclusion

C2U edits the query, not the encoder or the index: a calibrated gate admits concept\-evidenced queries, the profile direction enters atom coordinates via a residual atom, and the difference rotates the raw query by at most0\.20\.2rad before retrieval\. The selected configuration lowers target Hit@5 by4\.254\.25pp pooled with non\-positive control costs on every dataset mean, keeps density and control exposure changes non\-positive in every dataset–condition cell under query transforms, and composes four ArXiv concepts with positive lift on each\. It suits fixed\-index retrievers tolerating partial, bounded suppression rather than removal\.

## Limitations

Three limitations bound the claims\. First, suppression is partial: the aggregate\-derived after\-edit target Hit@5 stays near90%90\\%pooled, so C2U reduces exposure rather than removing a concept\. Second, the data and evaluation scope is narrow: five English datasets, four encoders, and100100/300300\-query units; IMDB has one template per role, ArXiv uses relaxed global controls, single\-concept and attack results are posthoc extensions of frozen test units, and the untouched multi\-concept claim covers ArXivK=4K=4only, with capacity and granularity limiting other datasets\. Third, we evaluate retrieval only: generated\-output safety, multilingual or open\-domain corpora, and defense\-aware adaptive attackers are untested, and low runtime access does not establish a measured cost advantage\.

## Ethical considerations

Retrieval\-side suppression may reduce unwanted exposure but can also hide legitimate evidence or enforce biased policies\. Concept definitions, access to profiles, and effects on non\-target retrieval require transparent governance and auditing\. This method is not a substitute for privacy deletion, consent, output safeguards, or monitoring\. The work evaluates retrieval rather than safety of generated content\.

## References

- An et al\. \(2025\)Bang An, Shiyue Zhang, and Mark Dredze\.Rag llms are not safer: A safety analysis of retrieval\-augmented generation for large language models\.*arXiv preprint arXiv:2504\.18041*, 2025\.
- Asai et al\. \(2024\)Akari Asai, Zeqiu Wu, Yizhong Wang, Avirup Sil, and Hannaneh Hajishirzi\.Self\-rag: Learning to retrieve, generate, and critique through self\-reflection\.2024\.
- Bahraminasr & Vafaei\-Sadr \(2020\)M Bahraminasr and A Vafaei\-Sadr\.Imdb data from two generations \(1979 to 2019\)\. part one: Dataset\.*CoRR*, abs/2005\.14147, 2020\.
- Belrose et al\. \(2023\)Nora Belrose, David Schneider\-Joseph, Shauli Ravfogel, Ryan Cotterell, Edward Raff, and Stella Biderman\.Leace: Perfect linear concept erasure in closed form\.*Advances in Neural Information Processing Systems*, 36:66044–66063, 2023\.
- Bui et al\. \(2025\)Anh Bui, Trang Vu, Long Vuong, Trung Le, Paul Montague, Tamas Abraham, Junae Kim, and Dinh Phung\.Fantastic targets for concept erasure in diffusion models and where to find them\.*arXiv preprint arXiv:2501\.18950*, 2025\.
- Chen et al\. \(2023\)Min Chen, Weizhuo Gao, Gaoyang Liu, Kai Peng, and Chen Wang\.Boundary unlearning: Rapid forgetting of deep networks via shifting the decision boundary\.In*Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition*, pp\. 7766–7775, 2023\.
- Enevoldsen et al\. \(2025\)Kenneth Enevoldsen, Isaac Chung, Imene Kerboua, Márton Kardos, Ashwin Mathur, David Stap, Jay Gala, Wissam Siblini, Dominik Krzemiński, Genta Indra Winata, et al\.Mmteb: Massive multilingual text embedding benchmark\.*arXiv preprint arXiv:2502\.13595*, 2025\.
- Fan et al\. \(2023\)Chongyu Fan, Jiancheng Liu, Yihua Zhang, Eric Wong, Dennis Wei, and Sijia Liu\.Salun: Empowering machine unlearning via gradient\-based weight saliency in both image classification and generation\.*arXiv preprint arXiv:2310\.12508*, 2023\.
- Gandikota et al\. \(2023\)Rohit Gandikota, Joanna Materzynska, Jaden Fiotto\-Kaufman, and David Bau\.Erasing concepts from diffusion models\.In*Proceedings of the IEEE/CVF international conference on computer vision*, pp\. 2426–2436, 2023\.
- Ganin & Lempitsky \(2015\)Yaroslav Ganin and Victor Lempitsky\.Unsupervised domain adaptation by backpropagation\.In*International conference on machine learning*, pp\. 1180–1189\. PMLR, 2015\.
- Gur\-Arieh et al\. \(2025\)Yoav Gur\-Arieh, Clara Haya Suslik, Yihuai Hong, Fazl Barez, and Mor Geva\.Precise in\-parameter concept erasure in large language models\.In*Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing*, pp\. 18986–19006, 2025\.
- Hofstätter et al\. \(2023\)Sebastian Hofstätter, Jiecao Chen, Karthik Raman, and Hamed Zamani\.Fid\-light: Efficient and effective retrieval\-augmented text generation\.In*Proceedings of the 46th International ACM SIGIR Conference on Research and Development in Information Retrieval*, pp\. 1437–1447, 2023\.
- Inan et al\. \(2023\)Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, et al\.Llama guard: Llm\-based input\-output safeguard for human\-ai conversations\.*arXiv preprint arXiv:2312\.06674*, 2023\.
- Kim et al\. \(2025\)Taeyoun Kim, Jacob Mitchell Springer, Aditi Raghunathan, and Maarten Sap\.Mitigating Bias in RAG: Controlling the Embedder\.In*Findings of the Association for Computational Linguistics: ACL 2025*, pp\. 18999–19024, 2025\.doi:10\.18653/v1/2025\.findings\-acl\.974\.
- Kocak et al\. \(2025\)Aysenur Kocak, Shuo Yang, Bardh Prenkaj, and Gjergji Kasneci\.CURE: Controlled Unlearning for Robust Embeddings — Mitigating Conceptual Shortcuts in Pre\-Trained Language Models\.In*Findings of the Association for Computational Linguistics: EMNLP 2025*, pp\. 14283–14297, 2025\.doi:10\.18653/v1/2025\.findings\-emnlp\.771\.
- Liang et al\. \(2025\)Xun Liang, Simin Niu, Zhiyu Li, Sensen Zhang, Hanyu Wang, Feiyu Xiong, Zhaoxin Fan, Bo Tang, Jihao Zhao, Jiawei Yang, et al\.Saferag: Benchmarking security in retrieval\-augmented generation of large language model\.In*Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\)*, pp\. 4609–4631, 2025\.
- Liu et al\. \(2024\)Nelson F Liu, Kevin Lin, John Hewitt, Ashwin Paranjape, Michele Bevilacqua, Fabio Petroni, and Percy Liang\.Lost in the middle: How language models use long contexts\.*Transactions of the association for computational linguistics*, 12:157–173, 2024\.
- Maini et al\. \(2024\)Pratyush Maini, Zhili Feng, Avi Schwarzschild, Zachary C Lipton, and J Zico Kolter\.Tofu: A task of fictitious unlearning for llms\.*arXiv preprint arXiv:2401\.06121*, 2024\.
- McAuley & Leskovec \(2013\)Julian McAuley and Jure Leskovec\.Hidden factors and hidden topics: understanding rating dimensions with review text\.In*Proceedings of the 7th ACM conference on Recommender systems*, pp\. 165–172, 2013\.
- Muennighoff et al\. \(2023\)Niklas Muennighoff, Nouamane Tazi, Loïc Magne, and Nils Reimers\.Mteb: Massive text embedding benchmark\.In*Proceedings of the 17th Conference of the European Chapter of the Association for Computational Linguistics*, pp\. 2014–2037, 2023\.
- Orgad et al\. \(2023\)Hadas Orgad, Bahjat Kawar, and Yonatan Belinkov\.Editing implicit assumptions in text\-to\-image diffusion models\.In*Proceedings of the IEEE/CVF International Conference on Computer Vision*, pp\. 7053–7061, 2023\.
- Qiu et al\. \(2023\)Huachuan Qiu, Shuai Zhang, Anqi Li, Hongliang He, and Zhenzhong Lan\.Latent jailbreak: A benchmark for evaluating text safety and output robustness of large language models\.*arXiv preprint arXiv:2307\.08487*, 2023\.
- Ravfogel et al\. \(2020\)Shauli Ravfogel, Yanai Elazar, Hila Gonen, Michael Twiton, and Yoav Goldberg\.Null it out: Guarding protected attributes by iterative nullspace projection\.*arXiv preprint arXiv:2004\.07667*, 2020\.
- Tarun et al\. \(2023\)Ayush Kumar Tarun, Vikram Singh Chundawat, Murari Mandal, and Mohan Kankanhalli\.Deep regression unlearning\.In*International Conference on Machine Learning*, pp\. 33921–33939\. PMLR, 2023\.
- Wang et al\. \(2026\)Shang Wang, Tianqing Zhu, Dayong Ye, and Wanlei Zhou\.When machine unlearning meets retrieval\-augmented generation \(rag\): Keep secret or forget knowledge?*IEEE Transactions on Dependable and Secure Computing*, 23\(2\):2030–2045, 2026\.
- Williams et al\. \(2018\)Adina Williams, Nikita Nangia, and Samuel R Bowman\.A broad\-coverage challenge corpus for sentence understanding through inference\.In*Proceedings of the 2018 conference of the North American chapter of the association for computational linguistics: human language technologies, volume 1 \(long papers\)*, pp\. 1112–1122, 2018\.
- Wu et al\. \(2025\)Jing Wu, Trung Le, Munawar Hayat, and Mehrtash Harandi\.Erasing undesirable influence in diffusion models\.In*Proceedings of the Computer Vision and Pattern Recognition Conference*, pp\. 28263–28273, 2025\.
- Yan et al\. \(2024\)Shi\-Qi Yan, Jia\-Chen Gu, Yun Zhu, and Zhen\-Hua Ling\.Corrective retrieval augmented generation\.2024\.
- Yu et al\. \(2024a\)Le Yu, Bowen Yu, Haiyang Yu, Fei Huang, and Yongbin Li\.Language models are super mario: Absorbing abilities from homologous models as a free lunch\.In*Forty\-first International Conference on Machine Learning*, 2024a\.
- Yu et al\. \(2024b\)Yue Yu, Wei Ping, Zihan Liu, Boxin Wang, Jiaxuan You, Chao Zhang, Mohammad Shoeybi, and Bryan Catanzaro\.Rankrag: Unifying context ranking with retrieval\-augmented generation in llms\.*Advances in Neural Information Processing Systems*, 37:121156–121184, 2024b\.
- Zhao et al\. \(2026\)Tianzhe Zhao, Jiaoyan Chen, Yanchi Ru, Haiping Zhu, Nan Hu, Jun Liu, and Qika Lin\.Exploring knowledge poisoning attacks to retrieval\-augmented generation\.*Information Fusion*, 127:103900, 2026\.
- Zou et al\. \(2023\)Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson\.Universal and transferable adversarial attacks on aligned language models\.*arXiv preprint arXiv:2307\.15043*, 2023\.

## Appendix AExperimental Details

### A\.1Implementation and Data Protocol

#### Retrieval framework\.

All locked experiments share one evaluation pipeline per unit: the raw frozen\-encoder document embeddings are encoded once per unit, shared bit\-identically across methods, and never mutated; retrieval similarity is the dot product ofℓ2\\ell\_\{2\}\-normalized embeddings\. The four encoders aresentence\-transformers/all\-MiniLM\-L6\-v2,BAAI/bge\-base\-en\-v1\.5,intfloat/e5\-base\-v2, andQwen/Qwen3\-Embedding\-0\.6B, each pinned to a specific revision with a local snapshot manifest\.

#### Index construction and budgets\.

The single\-concept and attack cohorts use100100target/300300control index documents and100100target/300300control queries per unit, with2020target\-profile documents\. These budgets do not describe all multi\-concept stages\. Within the single\-concept allocation, profile, selection, confirmation, and test rows are disjoint\. Multi\-concept budgets and the known v2 overlap defect are reported in[AppendixG](https://arxiv.org/html/2610.29223#A7); blocked capacity rows are not zero\-filled or replenished from another split\.

#### Lock ladder and reuse\.

Single\-concept selection and independent confirmation precede its method lock\. Its final evaluation and the attacks extend previously frozen test units without test tuning or an untouched\-test claim\. Recent baselines have their own selection, confirmation, and posthoc\-final records; their provenance\-complete replay occurred after final outcomes were observed and closes provenance, not prospective selection\. Multi\-concept test access requires its separately specified acceptance lock\. Only expanded ArXivK=4K=4first accesses its allocated test rows after passing that gate\. Common infrastructure does not make these one protocol or imply identical bootstrap populations across arms\.

#### Hyperparameters and bank dimensions\.

The deployed single\-concept setting appends one row to each frozenNN\-atom bank, with2020target\-profile documents, residual\-coefficient multiplierβ=1\\beta=1, cap0\.20\.2rad, and floor0\.980\.98\. The frozen validation assets haveN=64N=64for ArXiv under every encoder\. For Amazon, IMDB, MNLI, and TOFU,N=768N=768for MiniLM,1,5361\{,\}536for bge/e5, and2,0482\{,\}048for Qwen3; embedding dimensions are respectively384384,768768, and1,0241\{,\}024\. These are asset dimensions, not a newly selected bank\-size sweep\. The historical top\-3030atom\-profile truncation is not the deployed raw\-space gate\. Configuration selection uses validation only; the posthoc evaluation does not retune it\.

### A\.2Evaluation Metrics

Let𝒬t\\mathcal\{Q\}\_\{t\}and𝒬c\\mathcal\{Q\}\_\{c\}denote the sets of target queries and control queries, respectively\. For a given queryqq,TopK​\(q\)\\text\{TopK\}\(q\)represents the set of labels or categories associated with the top\-KKretrieved documents\. H5, TC, and CN are reductions \(Base minus Method\), while TE is an exposure change \(Method minus Base\); the equations below specify each sign\. The locked metric names map as follows: Hit@KKDrop==hit\_at\_5\_drop\(H5\), Target Cos Drop==TC, Control/Neighbor Delta==CN, Target ExposureΔ\\Delta==TE\.

#### Erasure and utility in the standard setting\.

1. 1\.Target Hit@K Drop \(↑\\uparrow\)measures the reduction in retrieval success for target queries: Hit@K Drop=1\|𝒬t\|∑q∈𝒬t\(𝟏\[t∈TopKBase\(q\)\]−𝟏\[t∈TopKMethod\(q\)\]\)\.\\begin\{gathered\}\\text\{Hit@K Drop\}=\\frac\{1\}\{\|\\mathcal\{Q\}\_\{t\}\|\}\\sum\_\{q\\in\\mathcal\{Q\}\_\{t\}\}\\\\ \\Bigl\(\\mathbf\{1\}\[t\\in\\text\{TopK\}\_\{\\text\{Base\}\}\(q\)\]\\\\ \{\}\-\\mathbf\{1\}\[t\\in\\text\{TopK\}\_\{\\text\{Method\}\}\(q\)\]\\Bigr\)\.\\end\{gathered\}\(7\)
2. 2\.Target Cos Drop \(↑\\uparrow\)quantifies the reduction in cosine similarity between target\-query representations and the target concept centroid\. Letμt\\mu\_\{t\}be the centroid of all target document embeddings in the base index: Δcos=1\|𝒬t\|∑q∈𝒬t\(cos⁡\(𝐯base​\(q\),μt\)CLOSEOPEN−cos⁡\(𝐯method​\(q\),μt\)\)\.\\begin\{gathered\}\\Delta\_\{\\cos\}=\\frac\{1\}\{\|\\mathcal\{Q\}\_\{t\}\|\}\\sum\_\{q\\in\\mathcal\{Q\}\_\{t\}\}\\\\ \\Bigl\(\\cos\(\\mathbf\{v\}\_\{\\text\{base\}\}\(q\),\\mu\_\{t\}\)\\\\ \{\}\-\\cos\(\\mathbf\{v\}\_\{\\text\{method\}\}\(q\),\\mu\_\{t\}\)\\Bigr\)\.\\end\{gathered\}\(8\)
3. 3\.Control/Neighbor Delta \(↓\\downarrow\)evaluates the impact on non\-target retrieval utility\. Letyqy\_\{q\}be the ground\-truth control label forq∈𝒬cq\\in\\mathcal\{Q\}\_\{c\}: Utility Delta=1\|𝒬c\|∑q∈𝒬c\(𝟏\[yq∈TopKBase\(q\)\]−𝟏\[yq∈TopKMethod\(q\)\]\)\.\\begin\{gathered\}\\text\{Utility Delta\}=\\frac\{1\}\{\|\\mathcal\{Q\}\_\{c\}\|\}\\sum\_\{q\\in\\mathcal\{Q\}\_\{c\}\}\\\\ \\Bigl\(\\mathbf\{1\}\[y\_\{q\}\\in\\text\{TopK\}\_\{\\text\{Base\}\}\(q\)\]\\\\ \{\}\-\\mathbf\{1\}\[y\_\{q\}\\in\\text\{TopK\}\_\{\\text\{Method\}\}\(q\)\]\\Bigr\)\.\\end\{gathered\}\(9\)
4. 4\.Target ExposureΔ\\Delta\(↓\\downarrow\)measures the change in false\-positive retrieval of target documents by control queries: ExposureΔ=1\|𝒬c\|∑q∈𝒬c\(𝟏\[t∈TopKMethod\(q\)\]−𝟏\[t∈TopKBase\(q\)\]\)\.\\begin\{gathered\}\\text\{Exposure \}\\Delta=\\frac\{1\}\{\|\\mathcal\{Q\}\_\{c\}\|\}\\sum\_\{q\\in\\mathcal\{Q\}\_\{c\}\}\\\\ \\Bigl\(\\mathbf\{1\}\[t\\in\\text\{TopK\}\_\{\\text\{Method\}\}\(q\)\]\\\\ \{\}\-\\mathbf\{1\}\[t\\in\\text\{TopK\}\_\{\\text\{Base\}\}\(q\)\]\\Bigr\)\.\\end\{gathered\}\(10\)

All three locked main hit metrics useK=5K=5: H5 and TE concern target\-label presence, while CN concerns control own\-label presence\. Attack utility instead uses own\-label Hit@1010\. Rate differences in percentage points multiply the above quantities by100100; target\-cosine differences are not rates\.

#### Absolute levels and intervals\.

The main table’s Raw and C2U after\-rates are aggregate\-derived\. Per dataset, Raw H5 is reconstructed as a comparator’s after\-hit rate plus its locked H5 Drop; all seven reconstructions agree to floating\-point precision\. C2U’s own drop is then subtracted\. The five Raw/after pairs are96\.8333/90\.5000%96\.8333/90\.5000\\%\(Amazon\),97\.8333/92\.1667%97\.8333/92\.1667\\%\(ArXiv\),100\.0000/97\.4167%100\.0000/97\.4167\\%\(IMDB\),94\.5833/91\.1667%94\.5833/91\.1667\\%\(MNLI\), and84\.4167/81\.1667%84\.4167/81\.1667\\%\(TOFU\)\. Equal\-weight pooling gives94\.7333/90\.4833%94\.7333/90\.4833\\%\. These are not new measurements\. The per\-dataset binary H5 Drop intervals reuse the existing standard/no\-attack matched replay and its4,0004\{,\}000paired\-row bootstrap samples\. There is no native pooled H5 CI in the final summary; we neither average interval endpoints nor substitute validation intervals\. IMDB row resampling does not create independent templates\.

#### Robustness under query transforms\.

We evaluate Standard \(no attack\), Injection, and Zou\-noise\. Changes are relative to Raw under the same condition, paired by query\.

- •Target densityΔ\\Delta\(pp\) \(↓\\downarrow\): forD5\(q\)=15∑j∈Top5⁡\(q\)𝟏\[j∈𝒟t\]D\_\{5\}\(q\)=\\frac\{1\}\{5\}\\sum\_\{j\\in\\operatorname\{Top5\}\(q\)\}\\mathbf\{1\}\[j\\in\\mathcal\{D\}\_\{t\}\], this is100​𝔼𝒬t​\[D5Method−D5Raw\]100\\mathbb\{E\}\_\{\\mathcal\{Q\}\_\{t\}\}\[D\_\{5\}^\{\\rm Method\}\-D\_\{5\}^\{\\rm Raw\}\]\. It is a target\-document fraction, not binary H5\.
- •CERΔ\\Delta\(pp\) \(↓\\downarrow\): letDocs⁡\(q,512,50\)\\operatorname\{Docs\}\(q;512,50\)be the ranked context packed under the locked token accounting, with budget512512, at most5050documents, and partial last\-document inclusion where allowed\. Then CER\(q\)=𝟏\[Docs\(q;512,50\)∩𝒟t≠∅\]\.\\operatorname\{CER\}\(q\)=\\mathbf\{1\}\[\\operatorname\{Docs\}\(q;512,50\)\\cap\\mathcal\{D\}\_\{t\}\\neq\\emptyset\]\.\(11\)The reported delta is100​𝔼𝒬c​\[CERMethod−CERRaw\]100\\mathbb\{E\}\_\{\\mathcal\{Q\}\_\{c\}\}\[\\operatorname\{CER\}^\{\\rm Method\}\-\\operatorname\{CER\}^\{\\rm Raw\}\]: the population is*control queries*\.
- •Utility Drop \(pp\) \(↓\\downarrow\): the decrease in control own\-label Hit@1010under the same condition\. CN instead uses own\-label Hit@55; TE uses target Hit@55\.

Suppression and divergence counts use unrounded dataset–condition signs, not significance tests\.

Table 4:Absolute target Hit@5 and dataset uncertainty\.Raw and C2U levels are aggregate\-derived; intervals describe C2U’s binary H5 Drop\.DatasetRaw H5 \(%\)C2U H5 \(%\)Drop \(pp\)95% CI \(pp\)Amazon96\.8390\.50\+6\.33\[4\.83, 7\.92\]ArXivr97\.8392\.17\+5\.67\[4\.42, 7\.00\]IMDBd100\.0097\.42\+2\.58\[1\.75, 3\.50\]MNLI94\.5891\.17\+3\.42\[2\.25, 4\.50\]TOFU84\.4281\.17\+3\.25\[1\.92, 4\.58\]
Intervals reuse the existing standard/no\-attack paired\-row replay \(4,000 bootstrap samples; 1,200 target\-row contributions per dataset\)\. No pooled H5 interval is reported\.rRelaxed global control\.dIMDB has one unique template per target/control role; its row\-bootstrap interval is descriptive, not uncertainty over independent semantic examples\.

### A\.3ACR Training and Reconstruction

ACR trains a dictionary and lightweight projection head atop a frozen encoder\. Atoms have no pre\-assigned semantic labels and start from standard\-normal samples\. Given frozen representationhxh\_\{x\}, a bilinear compatibility score and temperature\-scaled softmax give

wx,i=exp⁡\(sim⁡\(hx,ai\)/τ\)∑jexp⁡\(sim⁡\(hx,aj\)/τ\)\.w\_\{x,i\}=\\frac\{\\exp\(\\operatorname\{sim\}\(h\_\{x\},a\_\{i\}\)/\\tau\)\}\{\\sum\_\{j\}\\exp\(\\operatorname\{sim\}\(h\_\{x\},a\_\{j\}\)/\\tau\)\}\.\(12\)The weights are peaked but not literally sparse\. With rowsaia\_\{i\}in𝒜\\mathcal\{A\}, training reconstruction is

zx=𝒜⊤​wx‖𝒜⊤​wx‖2=∑iwx,i​ai‖∑iwx,i​ai‖2\.z\_\{x\}=\\frac\{\\mathcal\{A\}^\{\\top\}w\_\{x\}\}\{\\\|\\mathcal\{A\}^\{\\top\}w\_\{x\}\\\|\_\{2\}\}=\\frac\{\\sum\_\{i\}w\_\{x,i\}a\_\{i\}\}\{\\\|\\sum\_\{i\}w\_\{x,i\}a\_\{i\}\\\|\_\{2\}\}\.\(13\)This reconstruction is used by the training objective\. At deployed retrieval the index contains raw encoder vectors, and the raw query receives only equation[4](https://arxiv.org/html/2610.29223#S3.E4); replacing it byzxz\_\{x\}would define a different method\. Entropy concentration does not prove that the deployed additive edit has small support\. The full training objective follows\.

### A\.4Optimization Setup

#### Training dynamics\.

To preserve the retrieval geometry of the pre\-trained dense retriever, we freeze the encoder parameters throughout ACR training\. Optimization is restricted to the atom bank𝒜\\mathcal\{A\}and the lightweight projection head\. We use AdamW with a batch size of3232and an initial learning rate of10−310^\{\-3\}, aReduceLROnPlateauscheduler \(factor0\.50\.5, patience one epoch\), a90/1090/10train\-validation split, and early stopping within a small epoch budget\.

#### Hyperparameter configuration\.

The reported training setup uses alignment penalty weightλalign=1\.0\\lambda\_\{\\mathrm\{align\}\}=1\.0, entropy regularization weightλent=0\.02\\lambda\_\{\\mathrm\{ent\}\}=0\.02, retrieval marginmr=0\.3m\_\{r\}=0\.3, and scoring temperatureτ=0\.1\\tau=0\.1\. Bank dimensions vary as specified in[SectionA\.1](https://arxiv.org/html/2610.29223#A1.SS1.SSS0.Px4); the locked reproduction probe establishes bit\-identical recovery of its MNLI/MiniLM/seed\-1 checkpoint, not one universal checkpoint or bank size for all units\.

#### Training objective \(ACR\)\.

We freeze the transformer encoder and optimize only the atom bank and a lightweight projection head\. For each triplet\(q,d\+,d−\)\(q,d^\{\+\},d^\{\-\}\), ACR outputs a composed Euclidean embeddingexacre^\{\\mathrm\{acr\}\}\_\{x\}and atom weightswx∈Δ\|𝒜\|−1w\_\{x\}\\in\\Delta^\{\|\\mathcal\{A\}\|\-1\}forx∈\{q,d\+,d−\}x\\in\\\{q,d^\{\+\},d^\{\-\}\\\}\. WeL2L\_\{2\}\-normalize the composed embeddings and compute cosine similarities by dot product:

zx=exacr‖exacr‖2\+ε,cos⁡\(za,zb\)=za⊤​zb\.z\_\{x\}=\\frac\{e^\{\\mathrm\{acr\}\}\_\{x\}\}\{\\\|e^\{\\mathrm\{acr\}\}\_\{x\}\\\|\_\{2\}\+\\varepsilon\},\\qquad\\cos\(z\_\{a\},z\_\{b\}\)=z\_\{a\}^\{\\top\}z\_\{b\}\.Letexbasee^\{\\mathrm\{base\}\}\_\{x\}denote the frozen dense retriever embedding for inputxx, and lete¯xbase=exbase/\(‖exbase‖2\+ε\)\\bar\{e\}^\{\\mathrm\{base\}\}\_\{x\}=e^\{\\mathrm\{base\}\}\_\{x\}/\(\\\|e^\{\\mathrm\{base\}\}\_\{x\}\\\|\_\{2\}\+\\varepsilon\)\. The total loss is:

ℒ=ℒtri\+λalign​ℒalign\+λent​ℒent,\\mathcal\{L\}=\\mathcal\{L\}\_\{\\mathrm\{tri\}\}\+\\lambda\_\{\\mathrm\{align\}\}\\mathcal\{L\}\_\{\\mathrm\{align\}\}\+\\lambda\_\{\\mathrm\{ent\}\}\\mathcal\{L\}\_\{\\mathrm\{ent\}\},where:

\(i\) Cosine triplet retrieval loss\.

ℒtri=max\(0,mr−cos⁡\(zq,zd\+\)OPEN\+cos⁡\(zq,zd−\)\)\.\\begin\{split\}\\mathcal\{L\}\_\{\\mathrm\{tri\}\}=\\max\\bigl\(0,\\;&m\_\{r\}\-\\cos\(z\_\{q\},z\_\{d^\{\+\}\}\)\\\\ &\{\}\+\\cos\(z\_\{q\},z\_\{d^\{\-\}\}\)\\bigr\)\.\\end\{split\}
\(ii\) Cosine alignment loss\.We encourage each ACR\-composed embedding to remain close to the corresponding frozen retriever embedding:

ℒalign=∑x∈\{q,d\+,d−\}\(1−cos⁡\(zx,e¯xbase\)\)\.\\mathcal\{L\}\_\{\\mathrm\{align\}\}=\\sum\_\{x\\in\\\{q,d^\{\+\},d^\{\-\}\\\}\}\\Bigl\(1\-\\cos\(z\_\{x\},\\bar\{e\}^\{\\mathrm\{base\}\}\_\{x\}\)\\Bigr\)\.
\(iii\) Entropy penalty on atom weights\.To obtain sharper training\-weight distributions, we penalize entropy; this does not imply sparsity of the deployed least\-squares coefficient edit:

ℒent=∑x∈\{q,d\+,d−\}\(−∑k=1\|𝒜\|wx,klog\(wx,k\+ϵ\)\)\.\\mathcal\{L\}\_\{\\mathrm\{ent\}\}=\\sum\_\{x\\in\\\{q,d^\{\+\},d^\{\-\}\\\}\}\\Bigl\(\-\\sum\_\{k=1\}^\{\|\\mathcal\{A\}\|\}w\_\{x,k\}\\log\(w\_\{x,k\}\+\\epsilon\)\\Bigr\)\.Here,mr\>0m\_\{r\}\>0is the triplet margin, andλalign,λent\>0\\lambda\_\{\\mathrm\{align\}\},\\lambda\_\{\\mathrm\{ent\}\}\>0are scalar weights\.

### A\.5Historical Profile Subtraction \(Not the Deployed Edit\)

The historical formulation averages the weights of2020profile documents and normalizes their non\-negative mass:

π~c=ReLU⁡\(𝔼x∈𝒟c​\[wx\]\),πc=π~c/∑iπ~c​\[i\]\.\\tilde\{\\pi\}\_\{c\}=\\operatorname\{ReLU\}\(\\mathbb\{E\}\_\{x\\in\\mathcal\{D\}\_\{c\}\}\[w\_\{x\}\]\),\\qquad\\pi\_\{c\}=\\tilde\{\\pi\}\_\{c\}/\\textstyle\\sum\_\{i\}\\tilde\{\\pi\}\_\{c\}\[i\]\.\(14\)It retains the topKatom=30K\_\{\\rm atom\}=30coordinates and renormalizes\. The original exposition used an atom\-cosine activity

αx=max⁡\(0,cos⁡\(w^x,π^c\)\),\\alpha\_\{x\}=\\max\(0,\\cos\(\\hat\{w\}\_\{x\},\\hat\{\\pi\}\_\{c\}\)\),\(15\)followed by

wx′∝ReLU⁡\(wx−λ​αx​πc\)\.w^\{\\prime\}\_\{x\}\\propto\\operatorname\{ReLU\}\(w\_\{x\}\-\\lambda\\alpha\_\{x\}\\pi\_\{c\}\)\.\(16\)The tested subtraction family includes native/hybrid weight normalizations; these historical expressions do not specify the selected additive operator\. In particular,αx\\alpha\_\{x\}is not an input to the deployed gate, and its vanishing is not the deployed identity condition\. Under the locked bank and deployed runtime the measured subtraction variants are exact inactive identities, with approximately2×10−52\\times 10^\{\-5\}rad in the diagnostic angular readout\. That mechanism finding does not prove every subtraction method must fail\.

### A\.6Numerical Details and Validation\-Only Mechanism Probes

#### Diagonal\-O2 and G0\.

The runtime names map onto the main\-text terms: the negative diagonal\-O2 direction is the diagonally preconditioned direction, the continuous G1 ramp with its conservative G0 fallback is the calibrated gate, and the delta exit is the raw\-query trust\-region update\. For normalized controlsxx, letmi=𝔼c​\[xi2\]m\_\{i\}=\\mathbb\{E\}\_\{c\}\[x\_\{i\}^\{2\}\]andm¯=d−1​∑imi\\bar\{m\}=d^\{\-1\}\\sum\_\{i\}m\_\{i\}\. The diagonal usesDi​i=0\.9​mi\+0\.1​m¯\+0\.001D\_\{ii\}=0\.9m\_\{i\}\+0\.1\\bar\{m\}\+0\.001, with an implementation denominator floor\. The runtime first formsv=normalize⁡\(μt−μc\)v=\\operatorname\{normalize\}\(\\mu\_\{t\}\-\\mu\_\{c\}\)and−0\.1D−1v/\(v⊤D−1v\)\-0\.1D^\{\-1\}v/\(v^\{\\top\}D^\{\-1\}v\), then normalizes this negative vector for least\-squares routing\. The means are not separately normalized for this direction; they are separately normalized only for the gate score\. Non\-finite or degenerate directions fail closed\. When G1 quantiles are non\-finite or not increasing, G0 uses a conservative calibration order\-statistic threshold with declared control false\-positive rate0\.020\.02; equality is ineligible\. The median\-to\-9595th\-percentile G1 ramp is otherwise continuous\.

#### Least squares and numerical branches\.

The solve uses true least squares on𝒜⊤\\mathcal\{A\}^\{\\top\}in float64\. Above the residual threshold,hβ=p\+β​eh\_\{\\beta\}=p\+\\beta e; below10−610^\{\-6\}the appended row is normalizedppand its coefficient is zero\. A degenerate projected vector also fails closed rather than dividing by zero\. The fallback row is bookkeeping, not a new independent direction\. Exact in\-spanggis recovered by its projected coefficients; a small nonzero omitted residual causes truncation, and coefficient/bank rounding adds numerical error\. The angular scale uses the unit direction ofhβh\_\{\\beta\}, but multiplies the original coefficient vector\. Gate\-off, zero\-angle, and non\-positive\-denominator branches produce zero scale\. FP32 subtraction is performed after constructing and casting padded and steered weights\. The exit checkscos⁡\(float32⁡\(θcap\)\)\\cos\(\\operatorname\{float32\}\(\\theta\_\{\\rm cap\}\)\)against the floor, triesη=1\\eta=1, and otherwise keeps the feasible lower bisection endpoint in\[0,1\]\[0,1\]\. Inactive rows are copied from the original query array\. Finite bisection does not guarantee the exact real\-valued boundary point\.

#### Coverage and selected residual coefficient\.

Across120120diagnostic validation units, true least\-squares projection ratio averages0\.8950\.895, with96/12096/120directions recorded as fully covered\. Coverage is not suppression and is not evidence of atom necessity\. The residual\-coefficient ladderβ∈\{1,0\.5,0\.25\}\\beta\\in\\\{1,0\.5,0\.25\\\}selectsβ=1\\beta=1: confirmation primary H5\+0\.0644\+0\.0644, CI95\[\+0\.0467,\+0\.0864\]\[\+0\.0467,\+0\.0864\], with3/33/3seeds and4/44/4encoders positive\. This validation endpoint is distinct from the posthoc test pooled value\. Loweringβ\\betachanges only the residual contribution, not the whole edit\. The runtime rejectsβ=0\\beta=0; algebraically setting it to zero would still retain the projected component and would not generally yield identity\.

#### Operating\-point sweep: negative result\.

Defaultcos⁡\(0\.2\)=0\.9800665778\>0\.98\\cos\(0\.2\)=0\.9800665778\>0\.98, so cap0\.20\.2is tighter than the floor\. Only caps abovearccos⁡\(0\.98\)=0\.2003348423​…\\arccos\(0\.98\)=0\.2003348423\\ldotsrad are floor\-limited\. Theβ=1\\beta=1settings at caps0\.3,0\.5,1\.00\.3,0\.5,1\.0tie reference primary H5\+0\.049444\+0\.049444\(five\-dataset pooled\+0\.033000\+0\.033000\), while target\-cosine values still change slightly\. This observed metric tie is not geometric identity with cap0\.20\.2\. Atβ=0\.5\\beta=0\.5, cap0\.50\.5, primary H5 falls to\+0\.043056\+0\.043056\(five\-dataset pooled\+0\.029167\+0\.029167\)\. Every setting, including the reference, is ineligible under this sweep because TOFU CN is\+0\.000278\>0\+10−9\+0\.000278\>0\+10^\{\-9\}\. A reference\-only confirmation replay reproduces the locked480480unit\-metrics exactly\. The existing selected configuration stands; the sweep authorizes no new successful operating point\. Reference cap saturation is0\.58130\.5813in validation and80\.7%80\.7\\%/61\.9%61\.9\\%of active target/control edits at test; default saturation is at the nominal cap, not atarccos⁡\(0\.98\)\\arccos\(0\.98\)\.

#### Subtraction revival probes: both NO\-GO\.

Frozen query\-weight overlap with the top\-3030profile is approximately0\.00110\.0011under the v1 operationalization\. Four knob\-only bank configurations \(reproduction,15361536atoms, ten epochs, and their combination, with the reproduction baseline corrected to one epoch\) fail the revival criterion: subtraction’s applied\-angle diagnostic stays near2×10−52\\times 10^\{\-5\}rad and its runtime output stays inactive\. The reproduction checkpoint is bitwise identical; augmented H5 is unchanged\. The probe’s mean\-weight cosine near0\.9980\.998is a different statistic, not a substitute for applied\-angle evidence\. A second probe adds an off\-diagonal orthogonality loss with weights11and1010: the bank moves, but augmented H5/CN/TE remain unchanged and subtraction stays inactive\. Both decisions are NO\-GO; neither conditional full arm triggers\. These bounded interventions do not exhaust possible losses or establish a general impossibility theorem\.

### A\.7Compute Environment

The original training and evaluation ran on a single GPU of a workstation with 4 NVIDIA RTX 6000 Ada Generation GPUs \(no distributed training\); the locked re\-evaluation reported here ran on a single NVIDIA L20 GPU\. C2U does not train a large language model, fine\-tune a generator, or require retriever\-index rebuilding during concept unlearning; optimization is restricted to the atom bank and lightweight projection/composition modules\. Legacy wall\-clock latency, peak\-memory, and checkpoint\-size figures from the original pipeline are not artifact\-proven under the locked protocol and are therefore not reported\.

## Appendix BDataset Details

We evaluate across five datasets covering scientific literature, fictional biographies, product reviews, movie reviews, and logical inference\. For each dataset, we define theTarget Conceptto be suppressed and theControl Attributeto be preserved\.[Table5](https://arxiv.org/html/2610.29223#A2.T5)summarizes the definitions\.

DatasetDomainTarget Concept \(tt\)Control Attribute \(yy\)Query SourceArXivScientific PapersSpecific TopicArXiv CategoryTitle / AbstractTOFUFictional QASensitive TopicAuthor IdentityNatural QuestionAmazonProduct ReviewsSentimentProduct CategoryReview TitleIMDBMovie ReviewsMovie GenreSentimentSynthetic TemplateMNLILogic InferenceText GenreLogic LabelHypothesisTable 5:Overview of datasets used in evaluation\. The Target Concept represents the semantic information to be suppressed, while the Control Attribute represents the utility signal to be maintained\.#### Why these datasets\.

We select these datasets to stress\-test concept suppression under heterogeneous retrieval conditions: \(i\) domain\-specific terminology and hierarchical labels \(ArXiv\), \(ii\) identity\-linked fictional knowledge where topic\-level suppression can interact with author identity \(TOFU\), \(iii\) real\-world sentiment versus topical content confounding \(Amazon\), \(iv\) an adversarial query formulation that explicitly mentions the target concept \(IMDB\), and \(v\) logic\-conditioned matching where the control signal is relational rather than topical \(MNLI\)\. Together, they cover both natural and synthetic queries, multiple domains, and distinct target/control factorization patterns\.

### B\.1Hierarchical Scientific Knowledge \(ArXiv\)

We construct a hierarchical dataset using theCornell\-University/arxivcorpus \(Kaggle:[https://www\.kaggle\.com/dsv/7548853](https://www.kaggle.com/dsv/7548853), accessed Jan\. 28, 2026\) to simulate concept suppression in specialized domains\. The dataset uses the arXiv taxonomy, where theControl Attributeis defined as the primary category \(L1, e\.g\.,cs\.CR,cs\.CV\)\. TheTarget Concept\(L2\) is derived via heuristic keyword matching within the abstract, such as mapping terms like “attack” or “malware” to the conceptSystem Attackswithin thecs\.CRdomain\.

For the retrieval task, each documentddconsists of the concatenated paper title and abstract\. Each queryqqis generated using a stochastic strategy:50%50\\%of queries use the exact paper title to simulate navigational search, while the remaining50%50\\%use the first sentence of the abstract to simulate semantic search\. The locked protocol evaluates the L2 conceptSystem Attacksunder a relaxed global control \(the matched\-L1 control pool is capacity\-deficient\), and this label is preserved in every table\.

### B\.2Fictional Knowledge Unlearning \(TOFU\)

TheTOFU\(Task of Fictional Unlearning\) dataset\([Maini et al\., 2024](https://arxiv.org/html/2610.29223#bib.bib18)\)consists of question\-answer pairs about fictional authors, designed for unlearning tasks\. We adapt this dataset for retrieval by treating the answer as the document source\. TheControl Attributeis the Author ID, representing the identity that should be preserved\. TheTarget Conceptis the semantic topic of the fact, such asFamily,Location, orWork, which is classified via keyword matching on the question text\.

The retrieval setup involves documents formatted as biography records and queries taken directly from the dataset questions\. This structure tests whether the retrieval system can suppress topic\-level evidence while preserving author\-linked retrieval utility\. TOFU remains an entity\-centric regime: target and non\-target facts are tightly coupled around author identifiers, which is why conservative, trust\-region\-bounded steering is appropriate here\.

### B\.3Classification and Inference Tasks

#### Product Reviews \(Amazon\)\.

Adapted from theamazon\_polaritydataset, which is derived from the Amazon Reviews corpus\([McAuley & Leskovec, 2013](https://arxiv.org/html/2610.29223#bib.bib19)\)and is also included in text\-embedding benchmarks such as MTEB/MMTEB\([Muennighoff et al\., 2023](https://arxiv.org/html/2610.29223#bib.bib20);[Enevoldsen et al\., 2025](https://arxiv.org/html/2610.29223#bib.bib7)\), this task aims to suppress sentiment information while preserving product categorization\. TheTarget Conceptis sentiment \(Positive/Negative\), and theControl Attributeis product category, such asBooksorElectronics, extracted via keyword filtering\. Queries are derived from review titles, while documents contain full review content\.

#### Movie Reviews \(IMDB\)\.

In contrast to the Amazon dataset, theIMDBdataset\([Bahraminasr & Vafaei\-Sadr, 2020](https://arxiv.org/html/2610.29223#bib.bib3)\)inverts the roles of sentiment and content\. Here, theTarget Conceptis movie genre, such asSci\-FiorRomance, and theControl Attributeis sentiment\. Since the original dataset lacks titles, we generate synthetic queries using templates that explicitly mention the target concept, such as “Find a Positive review about a Sci\-Fi movie”\. This presents a challenging setting where the query explicitly seeks the concept intended for suppression\. Under the locked split, the IMDB evaluation rows collapse to one unique target and one unique control query text; we retain the row with its*duplicate\-template diagnostic*label and treat its zero\-variance metrics as a diagnostic, not as high\-confidence evidence\.

#### Logical Inference \(MNLI\)\.

Adapted from themulti\_nlidataset\([Williams et al\., 2018](https://arxiv.org/html/2610.29223#bib.bib26)\), this task evaluates concept suppression in logical inference contexts\. TheTarget Conceptis the source text genre, such asGovernmentorFiction, and theControl Attributeis the NLI label \(Entailment,Neutral, orContradiction\)\. The retrieval task is formulated such that the query is the hypothesis and the document is the premise\.

## Appendix CBaseline Implementation Details

All baselines are evaluated under the same locked pipeline: the same per\-unit raw\-base index, the same query IDs and seeds, and the same metric definitions\. Access\-class labels are part of each method’s identity and appear in every table\.

### C\.1Linear Concept Erasure Methods

#### INLP \(Iterative Nullspace Projection\)\.

Proposed by[Ravfogel et al\. \(2020\)](https://arxiv.org/html/2610.29223#bib.bib23), INLP iteratively trains linear probes to predict the target concept and projects representations onto the nullspace of the probe weights\. In the locked protocol INLP fits on the400400labeled calibration rows of each unit, placing it in the*profile\-only \+ labeled calibration fit*access class\.

#### LEACE \(Least\-Squares Concept Erasure\)\.

[Belrose et al\. \(2023\)](https://arxiv.org/html/2610.29223#bib.bib4)introduced LEACE as a closed\-form erasure transform minimizing dependence between representations and concept labels\. It uses the same labeled calibration fit as INLP, and the runner fails closed when the erasure library is missing, unversioned, fails fitting, or returns an empty eraser\.

### C\.2Model Editing Baselines \(Diagnostic Adaptations\)

#### PISCES\.

PISCES\([Gur\-Arieh et al\., 2025](https://arxiv.org/html/2610.29223#bib.bib11)\)was proposed for generative safety in LLMs\. Our in\-house adaptation treats the output projection layer of the retriever as the editable component, identifies directions with high cosine similarity to the target concept centroid, and masks them\.

#### DARE\-GRL\.

We construct a training\-based baseline combining Gradient Reversal Layers\([Ganin & Lempitsky, 2015](https://arxiv.org/html/2610.29223#bib.bib10)\)with DARE\-style model merging\([Yu et al\., 2024a](https://arxiv.org/html/2610.29223#bib.bib29)\): a lightweight mapper is trained with a GRL objective against a concept adversary, and the delta weights are sparsified and rescaled before merging\. The port to the retrieval encoder is our in\-house adaptation\.

### C\.3Recent Embedding\-Space Baselines \(Diagnostic Adaptations\)

#### CURE\.

CURE\([Kocak et al\., 2025](https://arxiv.org/html/2610.29223#bib.bib15)\)extracts concept\-irrelevant content through a frozen pretrained encoder with GPT\-4o concept labels and a task classifier, then reconstructs a controlled, debiased representation\. The faithful pipeline requires raw text, concept/task supervision, and a downstream classifier, none of which the frozen query\-only retrieval contract exposes; our in\-house adaptation fits a content/reversal\-inspired projection on the frozen calibration vectors of each unit, using the same400400labeled calibration examples as INLP and LEACE, transforms queries only, and preserves the raw document index\. Under the preregistered utility gate the adapted adapter is locked to strength zero, so every reported CURE cell is an exact identity operation\.

#### RAG Embedder Control\.

[Kim et al\. \(2025\)](https://arxiv.org/html/2610.29223#bib.bib14)debias a RAG embedder with SimCSE\-style contrastive reverse\-bias training \(PEFT/WiSE\-FT\)\. Full fidelity requires trainable embedder weights and corpus\-side re\-encoding, which the frozen offline vector cache does not authorize; our portable adaptation fits a deterministic reverse\-bias linear adapter on the frozen calibration vectors and labels of each unit \(400400labeled calibration examples\), transforms queries only, and keeps the raw fixed document index\. It is a portable adaptation, not an official full\-embedder reproduction\.

### C\.4Other Query\-Side and Stronger\-Access References

#### Raw\.

The identity \(no\-edit\) transform; the per\-query paired reference for the attack arm \(its relative metrics are exactly zero by construction\)\.

#### Delta\-Edit\.

A fidelity\-preserving delta variant that adds an FP32 edited\-minus\-original atom delta to the raw query; at the locked operating point it is a near\-identity control\.

#### Filter\-and\-Refill\.

Removes target documents from the candidate set and refills the top\-KKfrom the remainder; it consumes candidate/document membership and is reported only as a stronger\-access reference\.

#### Rank\-Router\.

A relaxed boundary router that consumes target\-document membership labels; it is a label\-assisted benchmark router, not an unlabeled query\-only deployment method, and is reported only as a reference\.

#### Random Perturbation\.

Isotropic Gaussian noiseϵ∼𝒩⁡\(𝟎,σ2​𝐈\)\\epsilon\\sim\\mathcal\{N\}\(\\mathbf\{0\},\\sigma^\{2\}\\mathbf\{I\}\)added to query embeddings, withσ\\sigmacalibrated to match the average edit norm of C2U, controlling for generic representation degradation\.

## Appendix DCase Study: Target\-Suppression Flips

Table 6:Case study: target\-suppression flips under C2U\.One locked test\-stage target query per dataset, selected by the pre\-registered rule \(base Hit@5=1→=1\\tomethod Hit@5=0=0flips only; maximum target\-cosine drop; deterministic tie\-breaks\), frozen before any query text was read\. Top\-5 columns list the retrieved document labels\. Illustrative only; drawn from the locked posthoc extension of the frozen test units \(evaluated exactly once, no test\-time tuning\)\.DatasetQueryTargetBase top\-5 labelsMethod top\-5 labelsTC dropAngleAmazonWORTH THE MONEYPositiveNegative, Positive, Negative, Negative, PositiveNegative, Negative, Negative, Negative, Negative\+0\.1010\.196ArXivResearch about AI\-based code generators have gained a fundamental role in assisting developers in writing software starting from natural language \(NL\)System AttacksSoftware Engineering, Software Engineering, Software Engineering, System Attacks, Artificial IntelligenceSoftware Engineering, Software Engineering, Artificial Intelligence, Software Engineering, Machine Translation\+0\.1660\.200IMDBPositive feedback on Horror cinemaHorrorRomance, Action, Romance, Sci\-Fi, HorrorAction, Sci\-Fi, Romance, Sci\-Fi, Sci\-Fi\+0\.1030\.200MNLIThe marauders rounded up the villagers\.fictiontravel, travel, travel, travel, fictiontravel, travel, travel, travel, travel\+0\.1140\.200TOFUWho is the person described in the text: ’In Luka Khachidze’s works, readers can expect a diverse range of characters, but predominantly they are male leads exploring their love interests and overcom…WorkGeneral, General, General, Work, WorkGeneral, General, General, General, Family\+0\.1230\.200

[Table6](https://arxiv.org/html/2610.29223#A4.T6)shows one locked test\-stage target query per dataset where the base retriever returns the target in the top\-5 and C2U removes it entirely\. The selection rule was frozen before any query text was read: among target rows with a base hit and a method miss and non\-zero applied angle, choose the maximum target\-cosine drop with deterministic tie\-breaks\. Query texts were joined from the source parquets only after the rule was frozen\. These success\-selected examples illustrate target\-label removal under a small, trust\-region\-bounded rotation \(≈0\.2\\approx 0\.2rad, at the cap\)\. They are not representative\-frequency estimates and do not establish unchanged control neighborhoods; aggregate CN and TE measure those separate outcomes\.

#### Selection mechanics\.

The rule behind[Table6](https://arxiv.org/html/2610.29223#A4.T6)is a deterministic function of locked per\-query rows: among posthoc\-extension target rows with a base top\-five target hit, a method miss, and a non\-zero applied angle, it takes the maximum target\-cosine drop under deterministic tie\-breaks\. Ties depend on row content alone, never on judgments made after reading the queries\. Re\-running it on the same locked rows therefore returns the same five queries: reproducible selections, not hand\-picked anecdotes\.

#### Reading the rows\.

In each row the base top five carries exactly one target\-labeled document and the edited list carries none—the flip the rule selects for\. The vacated slot is refilled by the next non\-target candidates, so the list stays full while the target label disappears\. The rotation behind each flip stays inside the trust region \(≈0\.2\\approx 0\.2rad, at the cap\), and the target\-cosine drop is positive on all five datasets, matching the pooled Hit@5 Drop of[Table2](https://arxiv.org/html/2610.29223#S4.T2)\. The five rows span one query per dataset, so the illustration covers every corpus rather than a single favorable one\.

#### Scope of the examples\.

The flips give the pooled effect a concrete shape: C2U can remove a target document from the top five through one bounded, query\-side rotation while the raw index and the control population stay fixed\. They say nothing about how often such removals occur—frequency is the pooled tables’ question—and nothing about control neighborhoods, which aggregate CN and TE measure separately \([Tables11](https://arxiv.org/html/2610.29223#A5.T11)and[12](https://arxiv.org/html/2610.29223#A5.T12)\)\. Nor do they isolate why a particular document leaves the list: the edited query moves every score within the drift bound, and the flip is an outcome of the full ranking, not of a per\-document operation\. Drawn from the same locked test units as those tables and evaluated exactly once with no test tuning, the five examples carry the posthoc\-extension label of[AppendixH](https://arxiv.org/html/2610.29223#A8), not an untouched\-test claim\.

### D\.1Legacy Qualitative Atom Examples

The following table from the original appendix is retained as qualitative context for the flips above; its numbers are paper\-reported from the original evaluation pipeline and have no locked counterpart\.

> \[Paper\-reported, original evaluation pipeline\] Table 7:Representative high\-usage atoms on ArXiv \(paper\-reported, original pipeline\)\.Labels are post\-hoc summaries of high\-activation documents and are used only for qualitative interpretation\.Atom IDPost\-hoc LabelPurityRepresentative Keywords492Genomics0\.60assembly, datasets, single485Biomolecules0\.50protein, network, security901GR and Cosmology0\.50structures, field, nucleat564Biomolecules0\.40domain, learning, neto2475Crypto and Security0\.30vulnerabilities, software

## Appendix EFull Dataset–Method and Dataset–Encoder Results

Table 8:RAG retrieval unlearning under the locked unified protocol\.Test\-stage behaviour of the validation\-selected configuration on the 60 frozen units \(24,000 queries\)\. Bold and underline are computed only inside the profile\-only access group; no cross\-access\-group dominance is claimed\. The Pooled block pools all twenty dataset×\\timesencoder cells per method\.MethodHit@5Drop↑\\uparrowTargetCos\.↑\\uparrowCtrl\./Neigh\.Δ\\Delta↓\\downarrowTarget Exp\.Δ\\Delta↓\\downarrowAmazonC2U0\.06330\.0565\-0\.0064\-0\.1244Raw0\.00000\.00000\.00000\.0000Delta\-Edit0\.00000\.00150\.0000\-0\.0008PISCES\-0\.00330\.0014\-0\.00250\.0269Random0\.01170\.2226\-0\.00170\.0300INLP0\.12170\.0394\-0\.00500\.1886LEACE0\.36580\.0386\-0\.0061\-0\.0083RAG\-Emb\-Ctrl0\.68830\.0874\-0\.0069\-0\.3353CURE0\.00000\.00000\.00000\.0000DARE\-GRL0\.22500\.5455\-0\.00110\.3853Filter\-and\-Refill‡0\.00920\.0000\-0\.0056\-0\.0414Rank\-Router§0\.07000\.0541\-0\.0064\-0\.1383ArXivC2U0\.05670\.0859\-0\.0125\-0\.0764Raw0\.00000\.00000\.00000\.0000Delta\-Edit0\.00000\.00250\.00030\.0000PISCES\-0\.00170\.0152\-0\.00250\.0133Random0\.01080\.24340\.04920\.0631INLP0\.05920\.13870\.05000\.0889LEACE0\.01000\.06270\.02190\.1619RAG\-Emb\-Ctrl0\.69500\.22170\.0556\-0\.2103CURE0\.00000\.00000\.00000\.0000DARE\-GRL0\.22670\.57460\.68580\.5861Filter\-and\-Refill‡0\.38330\.0000\-0\.0197\-0\.1806Rank\-Router§0\.05670\.0838\-0\.0108\-0\.0764IMDBC2U0\.02580\.07660\.00000\.0000Raw0\.00000\.00000\.00000\.0000Delta\-Edit0\.00000\.00160\.00000\.0000PISCES0\.01830\.00170\.00000\.0000Random0\.02420\.26430\.02030\.2311INLP0\.00000\.08050\.00000\.1667LEACE0\.01830\.01460\.00000\.0833RAG\-Emb\-Ctrl0\.30750\.06950\.00000\.2500CURE0\.00000\.00000\.00000\.0000DARE\-GRL0\.34080\.65270\.25000\.5833Filter\-and\-Refill‡0\.00000\.00000\.00000\.0000Rank\-Router§0\.02580\.07490\.00000\.0000
MethodHit@5Drop↑\\uparrowTargetCos\.↑\\uparrowCtrl\./Neigh\.Δ\\Delta↓\\downarrowTarget Exp\.Δ\\Delta↓\\downarrowMNLIC2U0\.03420\.0531\-0\.0108\-0\.0603Raw0\.00000\.00000\.00000\.0000Delta\-Edit0\.00000\.00070\.00030\.0003PISCES\-0\.00250\.0099\-0\.00080\.0042Random0\.01580\.22600\.02670\.0367INLP0\.04000\.10600\.00220\.0583LEACE0\.01250\.03010\.00060\.0794RAG\-Emb\-Ctrl0\.42580\.16800\.0133\-0\.3425CURE0\.00000\.00000\.00000\.0000DARE\-GRL0\.35420\.54460\.27720\.1450Filter\-and\-Refill‡0\.10500\.0000\-0\.0194\-0\.1183Rank\-Router§0\.03830\.0506\-0\.0122\-0\.0636TOFUC2U0\.03250\.0592\-0\.0044\-0\.0214Raw0\.00000\.00000\.00000\.0000Delta\-Edit0\.00000\.00030\.00000\.0003PISCES0\.00420\.00160\.00080\.0053Random\-0\.00920\.22930\.00940\.0092INLP0\.06420\.04310\.06470\.0900LEACE0\.04920\.0048\-0\.00080\.0058RAG\-Emb\-Ctrl0\.28920\.0315\-0\.0119\-0\.2378CURE0\.00000\.00000\.00000\.0000DARE\-GRL0\.11330\.55470\.24580\.1172Filter\-and\-Refill‡0\.04000\.0000\-0\.0119\-0\.0731Rank\-Router§0\.04580\.0497\-0\.0042\-0\.0267PooledC2U0\.04250\.0662\-0\.0068\-0\.0565Raw0\.00000\.00000\.00000\.0000Delta\-Edit0\.00000\.00130\.0001\-0\.0001PISCES0\.00300\.0060\-0\.00100\.0099Random0\.01070\.23710\.02080\.0740INLP0\.05700\.08160\.02240\.1185LEACE0\.09120\.03020\.00310\.0644RAG\-Emb\-Ctrl0\.48120\.11560\.0100\-0\.1752CURE0\.00000\.00000\.00000\.0000DARE\-GRL0\.25200\.57440\.29160\.3634Filter\-and\-Refill‡0\.10750\.0000\-0\.0113\-0\.0827Rank\-Router§0\.04730\.0626\-0\.0067\-0\.0610
Note:Values pool the four encoder cells per dataset\.‡candidate/document\-access method\.§target\-membership label\-assisted relaxed boundary router\. Raw is the identity \(no\-edit\) reference\. CURE and RAG\-Emb\-Ctrl are adapted recent baselines evaluated as a posthoc extension under the same locked protocol and frozen units\. ArXiv uses a relaxed global control; IMDB carries the duplicate\-template diagnostic label\. Row tints encode the locked access class \(same colors as[Figure5](https://arxiv.org/html/2610.29223#A6.F5)\); the C2U row is highlighted\.

Table 9:Hit@5 Drop for every dataset×\\timesencoder cell\(locked test stage; per\-cell mean over seeds 1–3\)\. Higher values indicate stronger target suppression\. Bold and underline mark the best and second\-best values inside the exact profile\-only access class of each row; no cross\-access\-class dominance is claimed\.DatasetEncoderC2URawINLPLEACERAG\-Emb\-CtrlCUREPISCESDARE\-GRLRandomDelta\-EditFilter\-and\-Refill‡Rank\-Router§Amazonminilm0\.06330\.00000\.07330\.13670\.48670\.0000\-0\.0100\-0\.0167\-0\.01000\.00000\.00330\.0900bge0\.02000\.00000\.01000\.63000\.98000\.00000\.00000\.47000\.00000\.00000\.02330\.0200e50\.14000\.00000\.15670\.48670\.47670\.00000\.00000\.33330\.03330\.00000\.00000\.1400qwen30\.03000\.00000\.24670\.21000\.81000\.0000\-0\.00330\.11330\.02330\.00000\.01000\.0300ArXivminilm0\.05000\.00000\.04670\.00330\.96000\.00000\.00000\.21330\.02000\.00000\.58330\.0500bge0\.08000\.00000\.09000\.00670\.50000\.00000\.00000\.31670\.01000\.00000\.25670\.0800e50\.05330\.00000\.07330\.02000\.44000\.0000\-0\.0033\-0\.03000\.01000\.00000\.18000\.0533qwen30\.04330\.00000\.02670\.01000\.88000\.0000\-0\.00330\.40670\.00330\.00000\.51330\.0433IMDBminilm0\.00000\.00000\.00000\.00000\.00000\.00000\.00000\.00000\.00330\.00000\.00000\.0000bge0\.10330\.00000\.00000\.00000\.57670\.00000\.00000\.33330\.04330\.00000\.00000\.1033e50\.00000\.00000\.00000\.07330\.39330\.00000\.07330\.66670\.02670\.00000\.00000\.0000qwen30\.00000\.00000\.00000\.00000\.26000\.00000\.00000\.36330\.02330\.00000\.00000\.0000MNLIminilm0\.02670\.00000\.06670\.02670\.73000\.00000\.00330\.53330\.01000\.00000\.18330\.0333bge0\.02670\.00000\.04000\.03000\.31330\.00000\.00000\.30000\.00330\.00000\.08000\.0300e50\.06670\.0000\-0\.00670\.00330\.27670\.0000\-0\.01330\.24330\.04330\.00000\.14000\.0733qwen30\.01670\.00000\.0600\-0\.01000\.38330\.00000\.00000\.34000\.00670\.00000\.01670\.0167TOFUminilm0\.04330\.00000\.04670\.02000\.19670\.00000\.00000\.3933\-0\.00670\.00000\.05670\.0500bge0\.02330\.00000\.06670\.06000\.27330\.0000\-0\.00330\.18330\.01330\.00000\.02670\.0467e50\.05000\.00000\.05000\.10000\.29330\.00000\.0100\-0\.1133\-0\.01330\.00000\.04330\.0600qwen30\.01330\.00000\.09330\.01670\.39330\.00000\.0100\-0\.0100\-0\.03000\.00000\.03330\.0267
Notes:Each cell is the mean over the three locked seeds \(1–3\)\. Encoders: minilm = all\-MiniLM\-L6\-v2, bge = bge\-base\-en\-v1\.5, e5 = e5\-base\-v2, qwen3 = Qwen3\-Embedding\-0\.6B \(pinned revisions\)\. Raw is the identity \(no\-edit\) reference\. Marking scope per row is the exact profile\-only access class \(C2U, Raw, PISCES, Random, Delta\-Edit\); INLP and LEACE \(400 labeled calibration examples per unit\), CURE and RAG\-Emb\-Ctrl \(400 labeled calibration examples per unit; posthoc adapted\-baseline extensions under the same locked protocol\), DARE\-GRL \(training\-based\),‡\(candidate/document access\), and§\(target\-membership label\-assisted\) are shown unmarked\. Utility\-clean requires CN≤10−9\\leq 10^\{\-9\}and TE≤10−9\\leq 10^\{\-9\}, and no cross\-access\-class dominance is claimed\. ArXiv uses a relaxed global control; IMDB carries the duplicate\-template diagnostic label\. Column tints encode the locked access class \(same colors as[Figure5](https://arxiv.org/html/2610.29223#A6.F5)\); the C2U column is highlighted\.

Table 10:Target Cosine Drop for every dataset×\\timesencoder cell\(locked test stage; per\-cell mean over seeds 1–3\)\. Higher values indicate stronger reduction of the target\-centroid cosine\. Marking as in Table[9](https://arxiv.org/html/2610.29223#A5.T9)\.DatasetEncoderC2URawINLPLEACERAG\-Emb\-CtrlCUREPISCESDARE\-GRLRandomDelta\-EditFilter\-and\-Refill‡Rank\-Router§Amazonminilm0\.02790\.00000\.06040\.07170\.08610\.00000\.00030\.32980\.0818\-0\.00000\.00000\.0245bge0\.05550\.00000\.03840\.05250\.17020\.00000\.00300\.66100\.27860\.00250\.00000\.0555e50\.05050\.00000\.01740\.00570\.00990\.0000\-0\.00230\.82290\.34860\.00090\.00000\.0481qwen30\.09210\.00000\.04150\.02460\.08320\.00000\.00470\.36830\.18120\.00250\.00000\.0884ArXivminilm0\.13170\.00000\.22840\.11240\.46390\.00000\.03000\.31870\.09940\.00360\.00000\.1286bge0\.07100\.00000\.09220\.03400\.08620\.00000\.00810\.66180\.29130\.00310\.00000\.0681e50\.04980\.00000\.06390\.01240\.03300\.00000\.00120\.82200\.35000\.00070\.00000\.0490qwen30\.09100\.00000\.17050\.09200\.30380\.00000\.02160\.49590\.23310\.00250\.00000\.0896IMDBminilm0\.08080\.00000\.17240\.05180\.04350\.00000\.00360\.63190\.17970\.00120\.00000\.0808bge0\.07950\.00000\.0438\-0\.00650\.14670\.00000\.00120\.62630\.27380\.00240\.00000\.0726e50\.06200\.00000\.02400\.00290\.01540\.00000\.00210\.84810\.35810\.00130\.00000\.0620qwen30\.08410\.00000\.08170\.01040\.07250\.0000\-0\.00000\.50460\.24580\.00150\.00000\.0841MNLIminilm0\.08500\.00000\.15810\.07300\.41720\.00000\.02040\.29800\.08690\.00120\.00000\.0810bge0\.02990\.00000\.08990\.02300\.08900\.00000\.00680\.62970\.26280\.00070\.00000\.0284e50\.02470\.00000\.03170\.00460\.03640\.00000\.00040\.80940\.34590\.00030\.00000\.0226qwen30\.07260\.00000\.14440\.02000\.12950\.00000\.01180\.44130\.20830\.00070\.00000\.0703TOFUminilm0\.06770\.00000\.02910\.00710\.03250\.00000\.00130\.44270\.13720\.00030\.00000\.0529bge0\.04410\.00000\.0373\-0\.00010\.01810\.00000\.00020\.60420\.25390\.00020\.00000\.0372e50\.03660\.00000\.06790\.00240\.00930\.00000\.00060\.76990\.33520\.00000\.00000\.0332qwen30\.08830\.00000\.03800\.00990\.06590\.00000\.00400\.40190\.19090\.00070\.00000\.0757
Notes:Each cell is the mean over the three locked seeds \(1–3\)\. Encoders: minilm = all\-MiniLM\-L6\-v2, bge = bge\-base\-en\-v1\.5, e5 = e5\-base\-v2, qwen3 = Qwen3\-Embedding\-0\.6B \(pinned revisions\)\. Raw is the identity \(no\-edit\) reference\. Marking scope per row is the exact profile\-only access class \(C2U, Raw, PISCES, Random, Delta\-Edit\); INLP and LEACE \(400 labeled calibration examples per unit\), CURE and RAG\-Emb\-Ctrl \(400 labeled calibration examples per unit; posthoc adapted\-baseline extensions under the same locked protocol\), DARE\-GRL \(training\-based\),‡\(candidate/document access\), and§\(target\-membership label\-assisted\) are shown unmarked\. Utility\-clean requires CN≤10−9\\leq 10^\{\-9\}and TE≤10−9\\leq 10^\{\-9\}, and no cross\-access\-class dominance is claimed\. ArXiv uses a relaxed global control; IMDB carries the duplicate\-template diagnostic label\. Column tints encode the locked access class \(same colors as[Figure5](https://arxiv.org/html/2610.29223#A6.F5)\); the C2U column is highlighted\.

Table 11:Control/NeighborΔ\\Deltafor every dataset×\\timesencoder cell\(locked test stage; per\-cell mean over seeds 1–3\)\. Lower values indicate less non\-target degradation; the utility\-clean gate requires CN≤10−9\\leq 10^\{\-9\}\. Marking as in Table[9](https://arxiv.org/html/2610.29223#A5.T9)\.DatasetEncoderC2URawINLPLEACERAG\-Emb\-CtrlCUREPISCESDARE\-GRLRandomDelta\-EditFilter\-and\-Refill‡Rank\-Router§Amazonminilm\-0\.00110\.00000\.0000\-0\.0011\-0\.00110\.00000\.0000\-0\.00110\.00000\.00000\.0011\-0\.0011bge\-0\.01670\.0000\-0\.0144\-0\.0178\-0\.01780\.0000\-0\.00670\.0056\-0\.00560\.0000\-0\.0167\-0\.0167e5\-0\.00330\.0000\-0\.0011\-0\.0022\-0\.00330\.0000\-0\.0011\-0\.00330\.00000\.0000\-0\.0033\-0\.0033qwen3\-0\.00440\.0000\-0\.0044\-0\.0033\-0\.00560\.0000\-0\.0022\-0\.0056\-0\.00110\.0000\-0\.0033\-0\.0044ArXivminilm\-0\.01220\.00000\.01780\.02330\.09780\.0000\-0\.00440\.65440\.00440\.0000\-0\.0167\-0\.0089bge\-0\.00780\.00000\.04220\.02560\.01000\.0000\-0\.00110\.72440\.01560\.0000\-0\.0189\-0\.0111e5\-0\.01440\.00000\.11890\.01780\.04780\.0000\-0\.00220\.62110\.14670\.0000\-0\.0200\-0\.0067qwen3\-0\.01560\.00000\.02110\.02110\.06670\.0000\-0\.00220\.74330\.03000\.0011\-0\.0233\-0\.0167IMDBminilm0\.00000\.00000\.00000\.00000\.00000\.00000\.00000\.33330\.05780\.00000\.00000\.0000bge0\.00000\.00000\.00000\.00000\.00000\.00000\.00000\.33330\.00220\.00000\.00000\.0000e50\.00000\.00000\.00000\.00000\.00000\.00000\.00000\.00000\.02110\.00000\.00000\.0000qwen30\.00000\.00000\.00000\.00000\.00000\.00000\.00000\.33330\.00000\.00000\.00000\.0000MNLIminilm\-0\.02440\.0000\-0\.0256\-0\.00670\.03890\.0000\-0\.00780\.23220\.01670\.0011\-0\.0422\-0\.0256bge\-0\.01000\.0000\-0\.0211\-0\.00330\.00780\.0000\-0\.00220\.25780\.02560\.0000\-0\.0211\-0\.0078e5\-0\.01560\.00000\.03560\.0000\-0\.01000\.00000\.00000\.32780\.03560\.0000\-0\.0178\-0\.0200qwen30\.00670\.00000\.02000\.01220\.01670\.00000\.00670\.29110\.02890\.00000\.00330\.0044TOFUminilm\-0\.00670\.00000\.0278\-0\.0000\-0\.01330\.00000\.00110\.1833\-0\.00330\.0000\-0\.0078\-0\.0067bge\-0\.00110\.00000\.04670\.0000\-0\.00670\.00000\.00110\.24000\.01220\.0000\-0\.0067\-0\.0011e5\-0\.00110\.00000\.1122\-0\.0067\-0\.01560\.0000\-0\.00110\.25670\.02330\.0000\-0\.0089\-0\.0011qwen3\-0\.00890\.00000\.07220\.0033\-0\.01220\.00000\.00220\.30330\.00560\.0000\-0\.0244\-0\.0078
Notes:Each cell is the mean over the three locked seeds \(1–3\)\. Encoders: minilm = all\-MiniLM\-L6\-v2, bge = bge\-base\-en\-v1\.5, e5 = e5\-base\-v2, qwen3 = Qwen3\-Embedding\-0\.6B \(pinned revisions\)\. Raw is the identity \(no\-edit\) reference\. Marking scope per row is the exact profile\-only access class \(C2U, Raw, PISCES, Random, Delta\-Edit\); INLP and LEACE \(400 labeled calibration examples per unit\), CURE and RAG\-Emb\-Ctrl \(400 labeled calibration examples per unit; posthoc adapted\-baseline extensions under the same locked protocol\), DARE\-GRL \(training\-based\),‡\(candidate/document access\), and§\(target\-membership label\-assisted\) are shown unmarked\. Utility\-clean requires CN≤10−9\\leq 10^\{\-9\}and TE≤10−9\\leq 10^\{\-9\}, and no cross\-access\-class dominance is claimed\. ArXiv uses a relaxed global control; IMDB carries the duplicate\-template diagnostic label\. Column tints encode the locked access class \(same colors as[Figure5](https://arxiv.org/html/2610.29223#A6.F5)\); the C2U column is highlighted\.

Table 12:Target ExposureΔ\\Deltafor every dataset×\\timesencoder cell\(locked test stage; per\-cell mean over seeds 1–3\)\. Lower values indicate less false\-positive retrieval of target documents by control queries; the utility\-clean gate requires TE≤10−9\\leq 10^\{\-9\}\. Marking as in Table[9](https://arxiv.org/html/2610.29223#A5.T9)\.DatasetEncoderC2URawINLPLEACERAG\-Emb\-CtrlCUREPISCESDARE\-GRLRandomDelta\-EditFilter\-and\-Refill‡Rank\-Router§Amazonminilm\-0\.07000\.00000\.08110\.0178\-0\.35330\.00000\.00670\.36780\.0189\-0\.0011\-0\.0100\-0\.1011bge\-0\.13560\.00000\.2922\-0\.0611\-0\.26440\.00000\.01110\.39560\.02000\.0000\-0\.0933\-0\.1411e5\-0\.18000\.00000\.2733\-0\.0267\-0\.25560\.00000\.06440\.37780\.06000\.0000\-0\.0256\-0\.1833qwen3\-0\.11220\.00000\.10780\.0367\-0\.46780\.00000\.02560\.40000\.0211\-0\.0022\-0\.0367\-0\.1278ArXivminilm\-0\.03890\.00000\.05670\.1922\-0\.17560\.0000\-0\.00330\.50670\.02110\.0000\-0\.1467\-0\.0389bge\-0\.08780\.00000\.05000\.1789\-0\.17890\.00000\.00780\.47000\.03330\.0000\-0\.1478\-0\.0878e5\-0\.10890\.00000\.19000\.1422\-0\.25780\.00000\.04000\.70560\.14890\.0000\-0\.2156\-0\.1089qwen3\-0\.07000\.00000\.05890\.1344\-0\.22890\.00000\.00890\.66220\.04890\.0000\-0\.2122\-0\.0700IMDBminilm0\.00000\.00000\.66670\.33330\.00000\.00000\.00001\.00000\.28220\.00000\.00000\.0000bge0\.00000\.00000\.00000\.00000\.33330\.00000\.00000\.66670\.09440\.00000\.00000\.0000e50\.00000\.00000\.00000\.00000\.33330\.00000\.00000\.33330\.31670\.00000\.00000\.0000qwen30\.00000\.00000\.00000\.00000\.33330\.00000\.00000\.33330\.23110\.00000\.00000\.0000MNLIminilm\-0\.05560\.00000\.03780\.0433\-0\.37890\.0000\-0\.0078\-0\.1211\-0\.00440\.0000\-0\.1411\-0\.0578bge\-0\.06110\.00000\.01110\.0433\-0\.38330\.0000\-0\.00110\.07220\.01670\.0000\-0\.1544\-0\.0644e5\-0\.09110\.00000\.14000\.1333\-0\.30110\.00000\.02110\.25000\.07560\.0000\-0\.1456\-0\.0978qwen3\-0\.03330\.00000\.04440\.0978\-0\.30670\.00000\.00440\.37890\.05890\.0011\-0\.0322\-0\.0344TOFUminilm\-0\.02000\.00000\.06330\.0211\-0\.18440\.00000\.0022\-0\.23780\.01000\.0000\-0\.0611\-0\.0278bge\-0\.02440\.00000\.11110\.0167\-0\.24330\.00000\.01440\.08110\.01000\.0011\-0\.0433\-0\.0267e5\-0\.01670\.00000\.1122\-0\.0233\-0\.21330\.00000\.00560\.33560\.02220\.0000\-0\.0811\-0\.0244qwen3\-0\.02440\.00000\.07330\.0089\-0\.31000\.0000\-0\.00110\.2900\-0\.00560\.0000\-0\.1067\-0\.0278
Notes:Each cell is the mean over the three locked seeds \(1–3\)\. Encoders: minilm = all\-MiniLM\-L6\-v2, bge = bge\-base\-en\-v1\.5, e5 = e5\-base\-v2, qwen3 = Qwen3\-Embedding\-0\.6B \(pinned revisions\)\. Raw is the identity \(no\-edit\) reference\. Marking scope per row is the exact profile\-only access class \(C2U, Raw, PISCES, Random, Delta\-Edit\); INLP and LEACE \(400 labeled calibration examples per unit\), CURE and RAG\-Emb\-Ctrl \(400 labeled calibration examples per unit; posthoc adapted\-baseline extensions under the same locked protocol\), DARE\-GRL \(training\-based\),‡\(candidate/document access\), and§\(target\-membership label\-assisted\) are shown unmarked\. Utility\-clean requires CN≤10−9\\leq 10^\{\-9\}and TE≤10−9\\leq 10^\{\-9\}, and no cross\-access\-class dominance is claimed\. ArXiv uses a relaxed global control; IMDB carries the duplicate\-template diagnostic label\. Column tints encode the locked access class \(same colors as[Figure5](https://arxiv.org/html/2610.29223#A6.F5)\); the C2U column is highlighted\.

[Table8](https://arxiv.org/html/2610.29223#A5.T8)retains the complete dataset–method rendering\.

[Tables9](https://arxiv.org/html/2610.29223#A5.T9),[10](https://arxiv.org/html/2610.29223#A5.T10),[11](https://arxiv.org/html/2610.29223#A5.T11)and[12](https://arxiv.org/html/2610.29223#A5.T12)report the complete dataset×\\timesencoder decomposition behind the pooled cells of[Table2](https://arxiv.org/html/2610.29223#S4.T2), one grid per metric; every cell is the mean over the three locked seeds, and the per\-seed rows are retained in the locked artifact\. Utility\-clean status and the marking rule follow the pre\-registered Pareto criterion of[Section4\.2](https://arxiv.org/html/2610.29223#S4.SS2): CN≤10−9\\leq 10^\{\-9\}and TE≤10−9\\leq 10^\{\-9\}, H5 Drop compared only inside the exact profile\-only class, and no cross\-class dominance; bold and underline mark the best and second\-best values inside the profile\-only access class of each row\. ArXiv carries the*relaxed global control*label and IMDB the*duplicate\-template diagnostic*label throughout\.

## Appendix FVisual Diagnostics

The five panels in this section are descriptive renderings of locked outcomes under the unified figure standard of this paper: they recompute or replot rows that the locked chains already contain, and they add no new evidence\. Each caption states its populations, denominators, and provenance\. The paragraphs below connect each panel to the main\-text claim it supports and state what the panel does not show\.

Figure 5:Full suppression–utility Pareto view\.All twelve displayed methods on every dataset, pooled over four encoders and three seeds, with access\-class colors\. CURE coincides with Raw because its utility gate locks it to identity\. Stronger suppression and its costs remain visible\.#### Pareto view\.

[Figure5](https://arxiv.org/html/2610.29223#A6.F5)plots every displayed method’s pooled suppression against its pooled utility cost, one point per method and dataset, pooled over four encoders and three seeds, with colors marking the locked access classes\. CURE coincides with Raw because its utility gate locks it to a zero\-strength identity, and DARE\-GRL’s larger suppression sits together with its large positive CN and TE costs\.

\(a\)Target\-cosine distributions before and after steering\(locked test rows\)\. The steered distribution shifts left of base in every dataset;[Figure7\(b\)](https://arxiv.org/html/2610.29223#A6.F7.sf2)adds the control distribution\.\(b\)Applied\-angle distribution under the delta\-exit trust region\(locked test rows\)\. Active edits concentrate at the default0\.20\.2\-rad cap, slightly tighter thanarccos⁡\(0\.98\)\\arccos\(0\.98\); among edited queries,80\.7%80\.7\\%of the5,6815\{,\}681target edits and61\.9%61\.9\\%of the12,87612\{,\}876control edits sit at the cap, whereas[Figure3](https://arxiv.org/html/2610.29223#S4.F3)uses all queries of each group as denominator\. Gate\-off rows are zero\. Rows denote query role and columns dataset\. These are descriptive locked\-outcome distributions\.

#### Target\-cosine shift\.

[Figure6\(a\)](https://arxiv.org/html/2610.29223#A6.F6.sf1)shows per\-query cosines to the target\-document centroid on locked test rows, base versus steered, one panel per dataset\. The steered target distribution shifts left of base in every dataset: queries move away from the target centroid, which is the geometric reading of the Hit@5 drops in[Table2](https://arxiv.org/html/2610.29223#S4.T2)\. The figure shows target rows only;[Figure7\(b\)](https://arxiv.org/html/2610.29223#A6.F7.sf2)adds the control distribution, and the main\-text[Figure3](https://arxiv.org/html/2610.29223#S4.F3)is the pooled three\-population companion\.

#### Applied\-angle readout\.

[Figure6\(b\)](https://arxiv.org/html/2610.29223#A6.F6.sf2)is the trust region’s readout: the angle the deployed edit actually applies to each locked test query\. Gate\-off rows are exactly zero, since a closed gate is an exact identity\. Active edits concentrate at the0\.20\.2\-rad cap, slightly tighter thanarccos⁡\(0\.98\)\\arccos\(0\.98\); among edited queries,80\.7%80\.7\\%of the5,6815\{,\}681target edits and61\.9%61\.9\\%of the12,87612\{,\}876control edits sit at the cap, whereas the main\-text[Figure3](https://arxiv.org/html/2610.29223#S4.F3)uses all queries of each group as denominator \(76\.5%76\.5\\%and44\.3%44\.3\\%\)\. Saturation at the cap is what the operating\-point sweep of[SectionA\.6](https://arxiv.org/html/2610.29223#A1.SS6)stress\-tests\.

\(a\)Concept\-profile sharpness across datasets\(locked validation assets\)\. Each curve is the median over a dataset’s 12 locked validation units of the sorted, max\-normalized mean profile\-weight vector, against atom\-rank fraction\. ArXiv uses6464atoms for every encoder; the other datasets use768768/1,5361\{,\}536/2,0482\{,\}048for MiniLM/bge\+e5/Qwen3\. Sharper drop\-offs indicate concentrated profile weights, not sparse deployed edits\. One per\-concept row is appended at deployment \([Section3](https://arxiv.org/html/2610.29223#S3)\)\.\(b\)Projection\-score separability before and after steering\(locked test outcomes\)\. Per\-dataset kernel densities of each query’s cosine to the target centroid of the unchanged base index: target at base, target after steering, and control \(recomputed from the locked per\-unit tensors; the same recomputation reproduces the locked target rows to2\.8×10−82\.8\\times 10^\{\-8\}\)\. A steered target distribution shifting toward the control distribution indicates suppression of concept expression\.

#### Profile sharpness\.

[Figure7\(a\)](https://arxiv.org/html/2610.29223#A6.F7.sf1)measures how concentrated each dataset’s concept profiles are in atom coordinates: each curve is the median over a dataset’s1212locked validation units of the sorted, max\-normalized mean profile\-weight vector, plotted against atom\-rank fraction\. ArXiv uses6464atoms for every encoder; the other datasets use768768/1,5361\{,\}536/2,0482\{,\}048for MiniLM/bge\+e5/Qwen3\. Sharper drop\-offs mean that profile mass concentrates on a few atoms, which is why one per\-concept residual row appended at deployment can represent the profile direction in bank coordinates \([Section3](https://arxiv.org/html/2610.29223#S3)\)\. Concentrated profiles do not by themselves imply sparse deployed edits\.

#### Projection separability\.

[Figure7\(b\)](https://arxiv.org/html/2610.29223#A6.F7.sf2)plots kernel densities of each query’s cosine to the target centroid of the unchanged base index for three populations: target at base, target after steering, and control, recomputed from the locked per\-unit tensors \(the same recomputation reproduces the locked target rows to2\.8×10−82\.8\\times 10^\{\-8\}\)\. A steered target distribution that moves toward the control distribution reads as suppressed concept expression\. Cosine to a single centroid is one direction only, so the panel corroborates the hit\-based outcomes rather than certifying suppression by itself\.

## Appendix GMulti\-Concept Composition Ladder

[Table13](https://arxiv.org/html/2610.29223#A7.T13)retains the four\-arm history\. Only the expanded ArXivK=4K=4arm is a pass; itsK=2K=2design and the earlier arms are validation\-only or failures and cannot be presented as passes\. Each concept has a separate raw\-space G1/G0 gate and coefficient vector\. Ifscs\_\{c\}are gates, start withtc=0\.3​sct\_\{c\}=0\.3s\_\{c\}and setBq=min⁡\(0\.3​maxc​sc,0\.2\)B\_\{q\}=\\min\(0\.3\\max\_\{c\}s\_\{c\},0\.2\)\. For positive total request allocatet~c=tc​min⁡\(1,Bq/∑ℓtℓ\)\\tilde\{t\}\_\{c\}=t\_\{c\}\\min\(1,B\_\{q\}/\\sum\_\{\\ell\}t\_\{\\ell\}\); if all gates vanish all allocations are zero\. Per\-concept angular feasibility and sine\-ratio scaling precede additive delta composition and the shared trust exit\. The comparator uses a normalized average of unit O2 directions with a single max gate\. The endpoint takes minima of per\-concept H5 within each method and unit, then differences them and averages units, as in equation[6](https://arxiv.org/html/2610.29223#S4.E6); it does not minimize paired conceptwise differences or use a min gate\.

Table 13:Multi\-concept composition ladder\.Primary endpoint: paired per\-unit difference of min\-concept Hit@5 Drop, GR\-C2U\-ACR\-compose minus the internal ablation GR\-C2U\-Fixed\-m3\-multi \(positive favors compose\)\. v1 \(original pools\) passes validation only; v2 \(new pools\) fails selection and carries a registered split\-overlap construction defect; v3 \(cursor\-disjoint\) is scope\-limited to ArXiv and fails selection on both designs; v1–v3 touch no test rows and their test stages stay hard\-closed\. v4 \(cursor\-disjoint tier\-T3 capacity expansion on fresh rows\) fails selection atK=2K\{=\}2but passes selection, confirmation, and the hard\-gated test stage atK=4K\{=\}4\. F&R\-multi is a document\-membership oracle upper reference, non\-gating\.ArmPoolsDesignSelectionΔ\\Delta\[CI95\]ConfirmationΔ\\Delta\[CI95\]TestΔ\\Delta\[CI95\]Verdictv1originalMNLIK=4K\{=\}4;ArXivK=4K\{=\}4\+0\.0300\[\+0\.0167, \+0\.0450\]\+0\.0250\[\+0\.0050, \+0\.0467\]—PASSvv2newdAmazonK=4K\{=\}4;ArXivK=8K\{=\}8;MNLIK=3K\{=\}3\+0\.0244\[\+0\.0122, \+0\.0389\]\-0\.0044c—FAILdv3cursor\-disjointArXivK=2K\{=2\}e\+0\.0100g—f—FAILdv3cursor\-disjointArXivK=4K\{=4\}e\+0\.0067g—f—FAILdv4cursor\-disjointArXivK=2K\{=\}2e\-0\.0008\[\-0\.0075, \+0\.0058\]—f—FAILdv4cursor\-disjointArXivK=4K\{=\}4e\+0\.0425\[\+0\.0279, \+0\.0575\]\+0\.0517\[\+0\.0375, \+0\.0663\]\+0\.0412\[\+0\.0325, \+0\.0506\]PASSt
Notes:vvalidation\-only acceptance; not a test claim\.ddiagnostic\-only; the test runner refuses unless the method lock is PASS\.cv2 confirmation CI95 straddles zero per dataset: Amazon \[\-0\.0233, \+0\.0033\]; ArXiv \[\-0\.0100, \+0\.0100\]; MNLI \[\-0\.0100, \+0\.0000\]; v2 selection per\-concept compose Hit@5 Drop on Amazon L1 is negative for Books \(\-0\.0133\) and Electronics \(\-0\.0267\), failing the per\-concept gate\. Granularity: the v2 Amazon cells use L1; all ArXiv cells \(v2, v3, v4\) use L2\.eConcepts \(pre\-registered free\-row ranking; v4 re\-ranked after v3 consumption\): v3K=2K\{=\}2: \{Artificial Intelligence, Software Engineering\};K=4K\{=\}4: \{Artificial Intelligence, Genomics, Neurons and Cognition, Software Engineering\}; v4K=2K\{=\}2: \{Software Engineering, Artificial Intelligence\};K=4K\{=\}4: \{Software Engineering, Artificial Intelligence, Neurons and Cognition, Number Theory\}\.fconfirmation never ran: no design passed selection\.gv3 gates failed \(CI95 lower bound≤0\\leq 0;K=2K\{=\}2: seeds 2/3, encoders 3/4;K=4K\{=\}4: seeds 2/3, encoders 1/4\); v4K=2K\{=\}2fails the CI\-lower\-bound, all\-seeds, and encoder gates \(seeds 1/3, encoders 2/4 positive\)\.ttest\-stage acceptance on freshly allocated, never\-before\-used test rows \(the first use of these test rows in any experiment, evaluated exactly once with no test\-time tuning\); the refusal path was exercised and evidenced before the PASS method lock existed\. v4 tier T3 \(pre\-registered before any v4 outcome\): 200/200 selection/confirmation and 400 test target queries per concept, 1,200 control rows per split; v4K=4K\{=\}4test gates: seeds 3/3, encoders 4/4 positive\. Filter\-and\-Refill\-multi \(document\-membership oracle, non\-gating upper reference\) min\-concept Hit@5 Drop on the same units: v2 confirmation Amazon \+0\.6967, ArXiv \+0\.9333, MNLI \+0\.8867; v3 selectionK=2K\{=\}2\+0\.9433,K=4K\{=\}4\+0\.8967; v4 selectionK=2K\{=\}2\+0\.7683,K=4K\{=\}4\+0\.7662; v4 testK=4K\{=\}4\+0\.7181\. v3/v4 scope: MNLI/IMDB/TOFU excluded by capacity \(best\-case free control rows MNLI 395, IMDB 565, TOFU 428 vs 1,200 required\), Amazon by mechanism \(v2\-measured L1\-granularity retrieval\-level ineffectiveness; L2 offers no non\-target control\)\.

#### Original pools \(v1\): validation\-only pass\.

Pooled over MNLI and ArXivK=4K=4, the paired acceptance claim passes selection \(\+0\.0300\+0\.0300, CI95\[\+0\.0167,\+0\.0450\]\[\+0\.0167,\+0\.0450\]\) and independent confirmation \(\+0\.0250\+0\.0250, CI95\[\+0\.0050,\+0\.0467\]\[\+0\.0050,\+0\.0467\]\)\. All eight dataset–concept compose H5 cells are positive\. Other datasets are capacity\-blocked, not zeros; this pass authorizes no test by itself\.

#### New pools \(v2\): failed acceptance with a registered defect\.

Amazon L1K=4K=4, ArXiv L2K=8K=8, and MNLIK=3K=3have a positive selection paired endpoint \(\+0\.0244\+0\.0244\), but selection acceptance fails: Amazon Books and Electronics have compose H5−0\.0133\-0\.0133and−0\.0267\-0\.0267\. Confirmation does not replicate \(−0\.0044\-0\.0044\)\. The builder restarts allocation cursors across role kinds, contaminating selection with profile rows and creating corpus/query overlap\. Confirmation is disjoint from profiles, and its independent failure supports the negative verdict; test rows are disjoint from other slices and never accessed\. The overlap remains an additional blocker, not an excused positive result\. IMDB/TOFU control capacity is insufficient\. The diagnostic ArXivK=2/4/8K=2/4/8sweep is also negative and carries the defect label\.

#### Cursor\-disjoint rebuild \(v3\): failed selection\.

The repaired builder uses advancing cross\-role cursors and true overlap checks\. Pre\-outcome capacity/mechanism rules restrict it to ArXiv: MNLI/IMDB/TOFU lack controls, while Amazon is excluded after ineffective L1 retrieval suppression and lacks suitable L2 controls\. Both pre\-registeredK=2K=2andK=4K=4designs fail selection\. Confirmation never runs and test refusal is exercised; no test rows are touched\.

#### Capacity expansion \(v4\): ArXivK=4K=4passes\.

Earlier locked validation differences inform a budget design, not a causal diagnosis of quantization noise\. The T1/T2/T3 ladder is frozen before v4 outcomes; all tiers fail the predeclared0\.80\.8power criterion\. The adjudicated fallback selects the largest feasible T3:200200selection,200200confirmation, and400400test target queries per concept, with1,2001\{,\}200controls per split\. Profiles remain2020documents per concept; the index uses2525target documents per concept and300300controls\. Cursor\-disjoint allocation requires845845rows per concept and4,8004\{,\}800control rows overall\. Method configuration and the atom bank are unchanged, but evaluation pools and budgets differ\.

Concepts are frozen by free\-row ranking after prior consumption: Software Engineering, Artificial Intelligence, Neurons and Cognition, Number Theory;K=2K=2is the prefix\.K=2K=2fails selection \(−0\.0008\-0\.0008, CI95\[−0\.0075,\+0\.0058\]\[\-0\.0075,\+0\.0058\], only one of three seeds positive\)\.K=4K=4passes selection \(\+0\.0425\+0\.0425, CI95\[\+0\.0279,\+0\.0575\]\[\+0\.0279,\+0\.0575\]\) and independent confirmation \(\+0\.0517\+0\.0517, CI95\[\+0\.0375,\+0\.0663\]\[\+0\.0375,\+0\.0663\]\)\. Its hard\-gated test endpoint is\+0\.04125\+0\.04125, CI95\[\+0\.0325,\+0\.050625\]\[\+0\.0325,\+0\.050625\]from4,0004\{,\}000bootstraps of twelve paired unit differences; all four concept cells, three seeds, and four encoders are positive\. The retained table rounds these to\+0\.0412\+0\.0412and\[\+0\.0325,\+0\.0506\]\[\+0\.0325,\+0\.0506\]\. These are previously unused multi\-concept test rows, first evaluated without tuning after the passing lock; refusal was exercised before that lock existed\. This untouched\-test scope is separate from the posthoc single\-concept/attack cohorts\. The document\-membership oracle Filter\-and\-Refill\-multi is a non\-gating upper reference \(\+0\.7181\+0\.7181\), not an access\-matched competitor\.

The ladder supports a scoped improvement over the averaged\-direction comparator on ArXivK=4K=4\. It does not prove that larger budgets remove interference, that noise caused earlier failures, or that atom representation alone causes the gain\.

![Refer to caption](https://arxiv.org/html/2610.29223v1/concept_composition_viz.png)Figure 8:Descriptive composition view of locked ArXivK=4K=4outcomes\.\(a,b\) Raw and edited queries in one deterministic PCA basis on the pre\-registered bge/seed\-1 illustration \(variance share0\.1570\.157\); centroid shifts are0\.0220\.022for controls and0\.0580\.058–0\.1180\.118for targets\. \(c\) Residual\-atom cosines, not the Gram matrix of full O2 edit directions: SE–NT0\.0220\.022, NC–NT0\.0150\.015, SE–AI0\.5600\.560\. \(d\) Paired per\-concept H5 differences; AI is smallest \(\+0\.0142\+0\.0142\)\. Selection/confirmation/test endpoints are\+0\.0425/0\.0517/0\.0412\+0\.0425/0\.0517/0\.0412\(test CI95\[\+0\.0325,\+0\.0506\]\[\+0\.0325,\+0\.0506\]\); oracle refill is\+0\.7181\+0\.7181\.K=2K=2failed selection and never entered test\. This preserves the first\-use, no\-test\-tuning scope of the lockedK=4K=4test\.
#### Composition view\.

[Figure8](https://arxiv.org/html/2610.29223#A7.F8)is a descriptive view of the locked ArXivK=4K=4outcomes, not new evidence\. Panels \(a,b\) place raw and compose\-edited queries in one deterministic PCA basis on the pre\-registered bge/seed\-1 illustration \(variance share0\.1570\.157\): control centroids shift by0\.0220\.022, target centroids by0\.0580\.058–0\.1180\.118\. Panel \(c\) reports residual\-atom cosines—SE–NT0\.0220\.022, NC–NT0\.0150\.015, SE–AI0\.5600\.560—not the Gram matrix of full O2 edit directions\. Panel \(d\) shows paired per\-concept H5 differences, with Artificial Intelligence smallest \(\+0\.0142\+0\.0142\): every concept contributes positively, which is what the min\-concept endpoint of equation[6](https://arxiv.org/html/2610.29223#S4.E6)rewards\.K=2K=2failed selection and never entered test\.

## Appendix HQuery\-Transform Evaluation and Full Results

Table 14:Cross\-condition behavior over the fifteen dataset–condition cells\.Suppressing: densityΔ<0\\Delta<0; divergent: suppressing with CERΔ\>0\\Delta\>0; worst values are signed maxima over the fifteen cells \(pp\)\. Counts use unrounded values; the per\-condition cells are in Table[15](https://arxiv.org/html/2610.29223#A8.T15)\.MethodSuppressing/15Divergent/15WorstCERΔ\\DeltaWorstutility lossC2U15/150/150\.0\+2\.6PISCES14/1511/15\+4\.9\+0\.1Random12/1511/15\+22\.3\+5\.7INLP15/1513/15\+25\.0\+5\.4LEACE15/1513/15\+12\.5\+3\.4RAG\-Emb\-Ctrl15/153/15\+16\.7\+14\.0CURE0/150/150\.00\.0DARE\-GRL11/1511/15\+50\.9\+66\.3[Table15](https://arxiv.org/html/2610.29223#A8.T15)retains every dataset–condition value and the Mean columns;[Table14](https://arxiv.org/html/2610.29223#A8.T14)summarizes the same cells as counts and signed worst values\. The original arm covers55datasets×4\\times 4encoders×3\\times 3seeds×3\\times 3conditions×7\\times 7methods, including Raw:504,000504\{,\}000per\-query rows\. A separate additive arm supplies the two recent adaptations; the original count is not the combined\-arm count\. Both are posthoc extensions of frozen single\-concept units, with no test tuning and no untouched\-test claim\. The main table omits Raw’s construction\-zero row, not its role as the paired reference\. Candidate/document\-access Filter\-and\-Refill, membership\-assisted Rank\-Router, and Delta\-Edit are predeclared attack exclusions\.

Table 15:Retrieval under standard and transformed queries\.Per\-query paired percentage\-point changes relative to the Raw reference under the*same*condition;Target densityΔ\\Delta,CERΔ\\Deltaon control queries \(context budgetB=512B\{=\}512, at most5050documents\), andcontrol own\-label Hit@10 lossare all lower\-is\-better\. Bold/underline are computed only inside the exact profile\-only group \(C2U, PISCES, Random\), excluding the Raw reference; no cross\-access\-group dominance is claimed\. The Mean columns pool the three query conditions per dataset\.Standard\(no attack\)InjectionZou\-noiseMeanMethodTargetdensityΔ\\DeltaControlCERΔ\\DeltaHit@10loss↓\\downarrowTargetdensityΔ\\DeltaControlCERΔ\\DeltaHit@10loss↓\\downarrowTargetdensityΔ\\DeltaControlCERΔ\\DeltaHit@10loss↓\\downarrowTargetdensityΔ\\DeltaControlCERΔ\\DeltaHit@10loss↓\\downarrowAmazonC2U\-18\.0\-12\.2\-0\.1\-14\.3\-16\.70\.0\-16\.7\-12\.40\.0\-16\.4\-13\.70\.0PISCES\-3\.5\+3\.4\-0\.1\+0\.2\+4\.90\.0\-0\.5\+4\.60\.0\-1\.2\+4\.30\.0Random\-5\.7\+2\.20\.0\+2\.5\+11\.20\.0\+2\.1\+5\.70\.0\-0\.4\+6\.40\.0INLP\-31\.2\+20\.1\-0\.1\-5\.4\+16\.90\.0\-10\.7\+15\.80\.0\-15\.8\+17\.60\.0LEACE\-45\.20\.0\-0\.1\-6\.2\+3\.20\.0\-14\.3\+4\.10\.0\-21\.9\+2\.40\.0RAG\-Emb\-Ctrl\-59\.7\-34\.6\-0\.1\-19\.3\-28\.60\.0\-25\.1\-30\.80\.0\-34\.7\-31\.40\.0CURE0\.00\.00\.00\.00\.00\.00\.00\.00\.00\.00\.00\.0DARE\-GRL\-38\.4\+36\.3\-0\.1\+9\.5\+50\.70\.0\+1\.3\+50\.90\.0\-9\.2\+46\.00\.0ArXivC2U\-14\.6\-6\.1\-0\.8\-20\.1\-21\.9\-5\.2\-18\.4\-7\.1\-0\.8\-17\.7\-11\.7\-2\.2PISCES\-2\.1\+1\.1\-0\.2\-2\.0\-0\.4\-0\.2\-2\.0\+1\.0\-0\.2\-2\.0\+0\.6\-0\.2Random\-4\.8\+4\.8\+3\.6\-6\.0\+3\.9\+5\.7\-6\.0\+5\.1\+4\.7\-5\.6\+4\.6\+4\.7INLP\-33\.0\+3\.7\+4\.6\-35\.0\-3\.3\+2\.3\-34\.4\+5\.6\+5\.4\-34\.1\+2\.0\+4\.1LEACE\-14\.8\+10\.6\+1\.6\-11\.8\+12\.5\+3\.4\-15\.4\+12\.3\+1\.7\-14\.0\+11\.8\+2\.2RAG\-Emb\-Ctrl\-68\.2\-14\.0\+5\.6\-76\.3\-34\.9\+3\.3\-72\.7\-16\.8\+6\.9\-72\.4\-21\.9\+5\.3CURE0\.00\.00\.00\.00\.00\.00\.00\.00\.00\.00\.00\.0DARE\-GRL\-51\.4\+41\.5\+66\.3\-50\.5\+19\.6\+60\.0\-50\.4\+40\.2\+64\.6\-50\.7\+33\.8\+63\.6IMDBC2U\-10\.90\.00\.0\-14\.50\.00\.0\-7\.9\-2\.3\-0\.1\-11\.1\-0\.80\.0PISCES0\.00\.00\.0\-0\.40\.00\.0\-1\.4\+0\.7\+0\.1\-0\.6\+0\.20\.0Random\-8\.1\+8\.2\+0\.1\-1\.1\+22\.3\+1\.7\-7\.0\+13\.6\+0\.3\-5\.4\+14\.7\+0\.7INLP\-18\.60\.00\.0\-11\.8\+25\.00\.0\-19\.6\+5\.3\-0\.2\-16\.7\+10\.1\-0\.1LEACE\-4\.7\+8\.30\.0\-7\.20\.00\.0\-5\.0\+8\.9\+0\.4\-5\.6\+5\.7\+0\.1RAG\-Emb\-Ctrl\-35\.5\+8\.30\.0\-31\.0\+16\.70\.0\-36\.3\+1\.6\-0\.2\-34\.3\+8\.9\-0\.1CURE0\.00\.00\.00\.00\.00\.00\.00\.00\.00\.00\.00\.0DARE\-GRL\-38\.3\+25\.00\.0\-15\.4\+33\.30\.0\-34\.4\+25\.30\.0\-29\.4\+27\.90\.0MNLIC2U\-11\.4\-3\.4\-0\.5\-19\.8\-8\.8\+2\.6\-13\.5\-8\.1\-1\.1\-14\.9\-6\.8\+0\.3PISCES\-2\.0\+0\.9\-0\.2\-2\.0\+0\.4\-0\.2\-2\.8\+0\.1\-0\.3\-2\.3\+0\.4\-0\.2Random\-4\.8\+2\.9\+1\.0\-3\.5\-0\.3\+1\.4\-3\.2\+0\.9\+1\.3\-3\.9\+1\.2\+1\.2INLP\-16\.9\+9\.0\-0\.9\-14\.8\+3\.0\-1\.5\-21\.2\+2\.3\-0\.3\-17\.7\+4\.8\-0\.9LEACE\-8\.0\+6\.6\-0\.4\-7\.5\+1\.1\+0\.1\-9\.6\+2\.2\-0\.7\-8\.4\+3\.3\-0\.3RAG\-Emb\-Ctrl\-43\.1\-45\.1\+0\.6\-37\.8\-51\.8\+14\.0\-40\.7\-45\.5\+2\.6\-40\.6\-47\.5\+5\.7CURE0\.00\.00\.00\.00\.00\.00\.00\.00\.00\.00\.00\.0DARE\-GRL\-37\.5\+13\.1\+10\.0\-21\.9\+2\.3\+0\.3\-30\.0\+4\.3\+10\.4\-29\.8\+6\.6\+6\.9TOFUC2U\-2\.9\-1\.6\-0\.1\-5\.7\-6\.10\.0\-4\.4\-5\.8\-0\.3\-4\.4\-4\.5\-0\.1PISCES\-0\.9\+1\.1\+0\.1\-0\.8\+1\.3\-0\.1\-0\.3\+1\.7\+0\.1\-0\.6\+1\.3\+0\.1Random\-0\.1\+1\.1\+0\.9\-0\.5\+2\.2\+1\.0\+0\.2\+1\.4\+0\.8\-0\.1\+1\.5\+0\.9INLP\-7\.0\+11\.4\+1\.8\-5\.7\+14\.4\+2\.6\-4\.2\+16\.3\+2\.1\-5\.6\+14\.0\+2\.2LEACE\-5\.7\+1\.4\-0\.3\-5\.5\+3\.9\+0\.2\-4\.2\+4\.4\+0\.1\-5\.1\+3\.20\.0RAG\-Emb\-Ctrl\-18\.3\-27\.4\-0\.4\-22\.8\-34\.7\+1\.9\-18\.9\-29\.8\-0\.4\-20\.0\-30\.6\+0\.4CURE0\.00\.00\.00\.00\.00\.00\.00\.00\.00\.00\.00\.0DARE\-GRL\-1\.2\+15\.3\+13\.3\+0\.3\+20\.2\+13\.6\+0\.2\+19\.7\+14\.6\-0\.3\+18\.4\+13\.8
Note:Filter\-and\-Refill and Rank\-Router are excluded on access\-class mismatch \(candidate/document and membership\-label access versus this arm’s query\-only contract\)\. Raw \(ref\) is exactly zero by construction \(method minus itself\); its all\-zero reference rows are omitted from the display\. This arm is a posthoc extension of the frozen test units, evaluated exactly once with no test\-time tuning; no untouched\-test claim is made\. CURE’s all\-zero cells are its locked zero\-strength utility\-gate identity, verified by execution\. Row tints encode the locked access class \(same colors as[Figure5](https://arxiv.org/html/2610.29223#A6.F5)\); the C2U row is highlighted\.

Transforms are bitwise\-equal reimplementations of the original pure functions; the recent\-baseline arm replays its standard\-condition runs unchanged, and CURE’s all\-zero cells are its locked zero\-strength identity\. Aggregates use4,0004\{,\}000paired bootstrap samples\. CER is averaged over control queries with the512512\-token/5050\-document packing rule; the legacy attack “Hit” heading is clarified as target density without changing values\. Main[Table3](https://arxiv.org/html/2610.29223#S4.T3)summarizes equal\-weight cell means, and[Table14](https://arxiv.org/html/2610.29223#A8.T14)the unrounded suppression/divergence signs and signed worst values; neither is significance or adaptive\-attack certification\.

#### Reading the full matrix\.

[Table15](https://arxiv.org/html/2610.29223#A8.T15)expands every summary cell into per\-condition values\. Each dataset block lists the eight evaluated methods in the main table’s order with locked access\-class tints and the C2U row highlighted; each condition group pairs target densityΔ\\Deltaon target queries with CERΔ\\Deltaand own\-label Hit@10 loss on control queries, and the Mean group reproduces the main table’s per\-dataset cells\. Marks compare only the exact profile\-only group \(C2U, PISCES, Random\)\.

#### Condition\-level patterns\.

Read per condition, the counts in[Table14](https://arxiv.org/html/2610.29223#A8.T14)are not artifacts of Mean pooling\. C2U lowers target density in all1515cells and never raises control exposure, with attack utility between−5\.2\-5\.2and\+2\.6\+2\.6pp; its remaining variation is condition mix, not sign\. INLP’s Amazon pair—density down15\.815\.8pp, exposure up17\.617\.6pp on Mean—repeats under every condition, the displacement pattern behind the13/1513/15divergent cells it shares with LEACE\. RAG\-Emb\-Ctrl suppresses most strongly on ArXiv \(−72\.4\-72\.4density,−21\.9\-21\.9exposure\) yet diverges in the three IMDB cells, worst\+16\.7\+16\.7pp under injection, and costs utility on ArXiv \(\+5\.3\+5\.3pp\) and MNLI \(\+5\.7\+5\.7\); the duplicate\-template limitation applies\. CURE’s all\-zero matrix is its locked zero\-strength identity, so its0/150/15divergence count is trivial\. PISCES, Random, and DARE\-GRL diverge in11/1511/15cells\.

## Appendix IReproducibility and Source Record

Frozen experimental packages retain per\-arm protocols, configuration/input/method locks, encoder/environment records, per\-query outputs, aggregation rules, and independent checks\. Bootstrap units differ: main per\-dataset H5 intervals reuse the standard replay’s paired\-row bootstrap, whereas the multi\-concept test resamples twelve unit differences\. Recent\-baseline provenance replay is explicitly retrospective\. Unknown legacy resource measurements remain unavailable, not estimated\.

The ARR manuscript uses the official ACL template and a lightweight single\-JSON conversion/source record,CONVERSION\_PROVENANCE\.json\. That record is distinct from frozen experimental audit chains; ARR has no ICLR\-style closure\-manifest claim\. The restructuring introduces no experiments or test\-time selection\. Full matrices, negative probes, and descriptive views distinguish evidence reuse from new inference\. Generated summaries derive from existing locked aggregates rather than newly accessed raw test queries\.

## Appendix JTheoretical Analysis of the Deployed Edit Operator

We distinguish exact real\-arithmetic identities from the finite\-precision, thresholded implementation in[Section3](https://arxiv.org/html/2610.29223#S3)\. No theorem below proves retrieval benefit, atom necessity, or absence of multi\-concept interference\. Throughout,𝕊d−1\\mathbb\{S\}^\{d\-1\}is the unit sphere ofℝd\\mathbb\{R\}^\{d\},ggdenotes the negative diagonal\-O2 unit direction, anddddenotes ambient dimension\. Unit queries and documents are assumed where stated\. Numerical branches are specified separately in[SectionA\.6](https://arxiv.org/html/2610.29223#A1.SS6)\.

### J\.1Trust\-Region Geometry of the Delta Exit

###### Definition J\.1\(Edit segment and ideal trust region\)\.

Forq∈𝕊d−1q\\in\\mathbb\{S\}^\{d\-1\}and finiteδ≠0\\delta\\neq 0, define

Eη​\(q\)=q\+η​δ‖q\+η​δ‖2,η∈\[0,1\],E\_\{\\eta\}\(q\)=\\frac\{q\+\\eta\\delta\}\{\\\|q\+\\eta\\delta\\\|\_\{2\}\},\\qquad\\eta\\in\[0,1\],\(17\)where the denominator is nonzero\. For0<γfloor<10<\\gamma\_\{\\rm floor\}<1and0<θcap≤π0<\\theta\_\{\\rm cap\}\\leq\\pi, define

γ=max⁡\(cos⁡θcap,γfloor\),𝒯γ​\(q\)=\{u∈𝕊d−1:⟨u,q⟩≥γ\}\.\\begin\{gathered\}\\gamma=\\max\(\\cos\\theta\_\{\\rm cap\},\\gamma\_\{\\rm floor\}\),\\\\ \\mathcal\{T\}\_\{\\gamma\}\(q\)=\\\{u\\in\\mathbb\{S\}^\{d\-1\}:\\langle u,q\\rangle\\geq\\gamma\\\}\.\\end\{gathered\}\(18\)Thenθmax=arccos⁡γ=min⁡\(θcap,arccos⁡γfloor\)\\theta\_\{\\max\}=\\arccos\\gamma=\\min\(\\theta\_\{\\rm cap\},\\arccos\\gamma\_\{\\rm floor\}\)\. The angular request is already incorporated intoδ\\delta; the exit never increases its step above one\. On a nonsingular segment the ideal exit chooses the largest feasible step in\[0,1\]\[0,1\]\. Finite bisection need not return that exact real\-valued endpoint\.

###### Lemma J\.2\(Monotone exit on a bounded segment\)\.

Ifδ\\deltais not parallel toqq, seta=⟨δ,q⟩a=\\langle\\delta,q\\rangleandb=‖δ‖2b=\\\|\\delta\\\|^\{2\}\. Thenφ​\(η\)=⟨Eη​\(q\),q⟩\\varphi\(\\eta\)=\\langle E\_\{\\eta\}\(q\),q\\rangleis continuous on\[0,1\]\[0,1\]and strictly decreasing for positive steps\. Ifφ​\(1\)≥γ\\varphi\(1\)\\geq\\gamma, the full step is feasible\. Otherwise a uniqueη∗∈\(0,1\)\\eta\_\{\*\}\\in\(0,1\)satisfiesφ​\(η∗\)=γ\\varphi\(\\eta\_\{\*\}\)=\\gamma; exact\-arithmetic bisection brackets it, with feasible lower endpoints converging toη∗\\eta\_\{\*\}\.

###### Proof\.

Non\-parallelism givesb−a2\>0b\-a^\{2\}\>0, soq\+η​δq\+\\eta\\deltacannot vanish\. Direct differentiation gives

φ​\(η\)=1\+η​a1\+2​η​a\+η2​b,φ′​\(η\)=−η​\(b−a2\)\(1\+2​η​a\+η2​b\)3/2\.\\begin\{gathered\}\\varphi\(\\eta\)=\\frac\{1\+\\eta a\}\{\\sqrt\{1\+2\\eta a\+\\eta^\{2\}b\}\},\\\\ \\varphi^\{\\prime\}\(\\eta\)=\\frac\{\-\\eta\(b\-a^\{2\}\)\}\{\(1\+2\\eta a\+\\eta^\{2\}b\)^\{3/2\}\}\.\\end\{gathered\}\(19\)The derivative is negative forη\>0\\eta\>0, andφ​\(0\)=1\>γ\\varphi\(0\)=1\>\\gamma\. Continuity gives the unique crossing whenφ​\(1\)<γ\\varphi\(1\)<\\gamma\. Maintaining feasible lower and infeasible upper endpoints gives the bisection claim\. ∎

###### Proposition J\.4\(Uniform worst\-case drift bound\)\.

Assumeq,q′∈𝕊d−1q,q^\{\\prime\}\\in\\mathbb\{S\}^\{d\-1\}andq′∈𝒯γ​\(q\)q^\{\\prime\}\\in\\mathcal\{T\}\_\{\\gamma\}\(q\)\. For every unit vectoru∈𝕊d−1u\\in\\mathbb\{S\}^\{d\-1\}, in particular every frozen document embedding,

\|⟨q′,u⟩−⟨q,u⟩\|≤‖q′−q‖2=2​sin⁡∠⁡\(q′,q\)2≤2​sin⁡θmax2\.\\begin\{gathered\}\\bigl\|\\langle q^\{\\prime\},u\\rangle\-\\langle q,u\\rangle\\bigr\|\\;\\leq\\;\\\|q^\{\\prime\}\-q\\\|\_\{2\}\\\\ \\;=\\;2\\sin\\frac\{\\angle\(q^\{\\prime\},q\)\}\{2\}\\;\\leq\\;2\\sin\\frac\{\\theta\_\{\\max\}\}\{2\}\.\\end\{gathered\}\(20\)

###### Proof\.

The inequality\|⟨q′−q,u⟩\|≤‖q′−q‖2​‖u‖2=‖q′−q‖2\|\\langle q^\{\\prime\}\-q,u\\rangle\|\\leq\\\|q^\{\\prime\}\-q\\\|\_\{2\}\\\|u\\\|\_\{2\}=\\\|q^\{\\prime\}\-q\\\|\_\{2\}is Cauchy–Schwarz\. For two unit vectors separated by angleθ\\theta, the chord length is‖q′−q‖2=2−2​cos⁡θ=2​sin⁡\(θ/2\)\\\|q^\{\\prime\}\-q\\\|\_\{2\}=\\sqrt\{2\-2\\cos\\theta\}=2\\sin\(\\theta/2\), andθ≤θmax\\theta\\leq\\theta\_\{\\max\}holds becauseq′∈𝒯γ​\(q\)q^\{\\prime\}\\in\\mathcal\{T\}\_\{\\gamma\}\(q\)by construction; sine is increasing on\[0,π/2\]\[0,\\pi/2\], which containsθmax\\theta\_\{\\max\}sinceγ\>0\\gamma\>0\. ∎

###### Corollary J\.5\(Margin stability of the top\-ranked document\)\.

Under the hypotheses of[PropositionJ\.4](https://arxiv.org/html/2610.29223#A10.Thmtheorem4), let the fixed index contain at least two unit document vectors, withu1,u2u\_\{1\},u\_\{2\}ranked first and second forqq\. Setm=⟨q,u1⟩−⟨q,u2⟩m=\\langle q,u\_\{1\}\\rangle\-\\langle q,u\_\{2\}\\rangle\. Ifm\>4​sin⁡\(θmax/2\)m\>4\\sin\(\\theta\_\{\\max\}/2\), thenu1u\_\{1\}remains uniquely top\-ranked after editing\.

###### Proof\.

By[PropositionJ\.4](https://arxiv.org/html/2610.29223#A10.Thmtheorem4)each score moves by at most2​sin⁡\(θmax/2\)2\\sin\(\\theta\_\{\\max\}/2\), so the post\-edit gap is at leastm−4​sin⁡\(θmax/2\)\>0m\-4\\sin\(\\theta\_\{\\max\}/2\)\>0\. ∎

### J\.2Exact Direction Routing through the Residual Atom

###### Definition J\.7\(Bank projection and completed coordinates\)\.

For𝒜∈ℝN×d\\mathcal\{A\}\\in\\mathbb\{R\}^\{N\\times d\}and nonzerogg, let

a=\(𝒜⊤\)\+g,P=𝒜⊤\(𝒜⊤\)\+,p=Pg,e=\(I−P\)g\.\\begin\{gathered\}a=\(\\mathcal\{A\}^\{\\top\}\)^\{\+\}g,\\quad P=\\mathcal\{A\}^\{\\top\}\(\\mathcal\{A\}^\{\\top\}\)^\{\+\},\\\\ p=Pg,\\qquad e=\(I\-P\)g\.\\end\{gathered\}\(21\)HereM\+M^\{\+\}is the Moore–Penrose pseudoinverse\. Ife≠0e\\neq 0, appendr=e/‖e‖r=e/\\\|e\\\|and usebβ=\[a;β​‖e‖\]b\_\{\\beta\}=\[a;\\beta\\\|e\\\|\]\. Ife=0e=0, thenp=g≠0p=g\\neq 0: appendr=p/‖p‖r=p/\\\|p\\\|and usebβ=\[a;0\]b\_\{\\beta\}=\[a;0\]\. In both cases𝒜′=\[𝒜;r\]\\mathcal\{A\}^\{\\prime\}=\[\\mathcal\{A\};r\]is defined\.

###### Proposition J\.8\(Projected plus residual recovers the full direction\)\.

In exact arithmetic,eeis orthogonal to the row span of𝒜\\mathcal\{A\}and

𝒜′⁣⊤​bβ=p\+β​e\.\\mathcal\{A\}^\{\\prime\\top\}b\_\{\\beta\}=p\+\\beta e\.\(22\)Forβ=1\\beta=1this is fullgg, including whenggis in span\. The projected coefficientsaaare the minimum\-norm preimage ofpp\. Appendingrrraises rank by one exactly whene≠0e\\neq 0; in the in\-span branch it adds no rank\.

###### Proof\.

PPis the orthogonal projector ontorange⁡\(𝒜⊤\)\\operatorname\{range\}\(\\mathcal\{A\}^\{\\top\}\), hencep⟂ep\\perp eand𝒜⊤​a=p\\mathcal\{A\}^\{\\top\}a=p\. Ife≠0e\\neq 0, the last row contributesβ​‖e‖​r=β​e\\beta\\\|e\\\|r=\\beta e, so the sum isp\+β​ep\+\\beta e; atβ=1\\beta=1,p\+e=gp\+e=g\. Ife=0e=0, the last coefficient is zero andp=gp=g\. Pseudoinverse identities give the minimum\-norm preimage property\. A nonzero orthogonal row raises rank by one, whereas normalizedppis already in the row span\. ∎

#### Angular scale\.

For unit directionhh,q⊤​h=cos⁡ϕq^\{\\top\}h=\\cos\\phiwith0<ϕ<π0<\\phi<\\pi, and0≤θ<ϕ0\\leq\\theta<\\phi, solving for a turn ofθ\\thetaalongq\+k​hq\+khgivesk=sin⁡θ/sin⁡\(ϕ−θ\)k=\\sin\\theta/\\sin\(\\phi\-\\theta\)\. Writeh=cos⁡ϕ​q\+sin⁡ϕ​v⟂h=\\cos\\phi\\,q\+\\sin\\phi\\,v\_\{\\perp\}and resolve the angle to obtaink​sin⁡\(ϕ−θ\)=sin⁡θk\\sin\(\\phi\-\\theta\)=\\sin\\theta\. The runtime uses this scale with unnormalized routed coefficients\. Atβ=1\\beta=1their ideal dense direction has unit norm; for generalβ\\beta,‖p\+β​e‖\\\|p\+\\beta e\\\|need not be one, so the same coefficient scale need not realize precisely the requested angle\. The trust exit acts afterward in either case\.

### J\.3Coherence Bounds for Multi\-Concept Composition

For simultaneous suppression ofK≥2K\\geq 2target concepts \([Section4\.5](https://arxiv.org/html/2610.29223#S4.SS5)\), letδ1,…,δK∈𝕊d−1\\delta\_\{1\},\\dots,\\delta\_\{K\}\\in\\mathbb\{S\}^\{d\-1\}be the unit full per\-concept edit directions and writeΔ=∑k=1Kηk​δk\\Delta=\\sum\_\{k=1\}^\{K\}\\eta\_\{k\}\\delta\_\{k\}for nonnegative coefficients\. Hereηk\\eta\_\{k\}denotes each pre\-exit dense magnitude after angular allocation, not the exit stepη\\etaor the allocated angle itself\. The following is an exact\-arithmetic bound on this sum\.

###### Definition J\.10\(Mutual coherence\)\.

The*Gram matrix*of the concept directions isG∈ℝK×KG\\in\\mathbb\{R\}^\{K\\times K\},Gk​ℓ=⟨δk,δℓ⟩G\_\{k\\ell\}=\\langle\\delta\_\{k\},\\delta\_\{\\ell\}\\rangle, and the*mutual coherence*isμ=maxk≠ℓ⁡\|Gk​ℓ\|\\mu=\\max\_\{k\\neq\\ell\}\|G\_\{k\\ell\}\|\.

###### Proposition J\.11\(Cross\-talk and spectral sandwich\)\.

With the notation above:

1. \(a\)each concept direction retains alignment⟨Δ,δk⟩≥ηk−μ​∑ℓ≠kηℓ\\langle\\Delta,\\delta\_\{k\}\\rangle\\geq\\eta\_\{k\}\-\\mu\\sum\_\{\\ell\\neq k\}\\eta\_\{\\ell\};
2. \(b\)every eigenvalueλ\\lambdaofGGlies in\[1−\(K−1\)​μ,1\+\(K−1\)​μ\]\\bigl\[\\,1\-\(K\-1\)\\,\\mu,\\;1\+\(K\-1\)\\,\\mu\\,\\bigr\], and therefore max⁡\(0,1−\(K−1\)​μ\)​‖η‖22≤‖Δ‖22=η⊤​G​η≤\(1\+\(K−1\)​μ\)​‖η‖22;\\begin\{gathered\}\\max\\bigl\(0,\\,1\-\(K\-1\)\\,\\mu\\bigr\)\\,\\\|\\eta\\\|\_\{2\}^\{2\}\\\\ \\;\\leq\\;\\\|\\Delta\\\|\_\{2\}^\{2\}=\\eta^\{\\top\}G\\,\\eta\\\\ \\;\\leq\\;\\bigl\(1\+\(K\-1\)\\,\\mu\\bigr\)\\,\\\|\\eta\\\|\_\{2\}^\{2\};\\end\{gathered\}\(23\)
3. \(c\)in the equal\-strength caseηk=η\>0\\eta\_\{k\}=\\eta\>0, the conditionμ<1K−1\\mu<\\frac\{1\}\{K\-1\}suffices for the composite edit to keep positive alignment with every concept direction\.

###### Proof\.

\(a\)⟨Δ,δk⟩=ηk\+∑ℓ≠kηℓ​⟨δℓ,δk⟩≥ηk−μ​∑ℓ≠kηℓ\\langle\\Delta,\\delta\_\{k\}\\rangle=\\eta\_\{k\}\+\\sum\_\{\\ell\\neq k\}\\eta\_\{\\ell\}\\langle\\delta\_\{\\ell\},\\delta\_\{k\}\\rangle\\geq\\eta\_\{k\}\-\\mu\\sum\_\{\\ell\\neq k\}\\eta\_\{\\ell\}, using⟨δℓ,δk⟩≥−μ\\langle\\delta\_\{\\ell\},\\delta\_\{k\}\\rangle\\geq\-\\muandηℓ≥0\\eta\_\{\\ell\}\\geq 0\. \(b\)GGhas unit diagonal and off\-diagonal entries bounded byμ\\muin absolute value, so each Gershgorin disc ofGGis centered at11with radius∑ℓ≠k\|Gk​ℓ\|≤\(K−1\)​μ\\sum\_\{\\ell\\neq k\}\|G\_\{k\\ell\}\|\\leq\(K\-1\)\\,\\mu; sinceGGis symmetric, its eigenvalues are real and lie in the union of these discs\. The Rayleigh\-quotient sandwichλmin​\(G\)​‖η‖22≤η⊤​G​η≤λmax​\(G\)​‖η‖22\\lambda\_\{\\min\}\(G\)\\\|\\eta\\\|\_\{2\}^\{2\}\\leq\\eta^\{\\top\}G\\eta\\leq\\lambda\_\{\\max\}\(G\)\\\|\\eta\\\|\_\{2\}^\{2\}withλmin​\(G\)≥max⁡\(0,1−\(K−1\)​μ\)\\lambda\_\{\\min\}\(G\)\\geq\\max\(0,1\-\(K\-1\)\\mu\)\(the Gram matrix is positive semidefinite\) andη⊤​G​η=‖∑kηk​δk‖22\\eta^\{\\top\}G\\eta=\\bigl\\\|\\sum\_\{k\}\\eta\_\{k\}\\delta\_\{k\}\\bigr\\\|\_\{2\}^\{2\}gives the claim\. \(c\) Plugηk=η\\eta\_\{k\}=\\etainto \(a\):⟨Δ,δk⟩≥η​\(1−\(K−1\)​μ\)\>0\\langle\\Delta,\\delta\_\{k\}\\rangle\\geq\\eta\\bigl\(1\-\(K\-1\)\\,\\mu\\bigr\)\>0for everykk\. ∎

### J\.4Weight Concentration and Gate\-Off Identity

The weight generator assignswx,i∝exp⁡\(sim⁡\(hx,ai\)/τ\)w\_\{x,i\}\\propto\\exp\(\\operatorname\{sim\}\(h\_\{x\},a\_\{i\}\)/\\tau\)over theNNatoms \([SectionA\.3](https://arxiv.org/html/2610.29223#A1.SS3)\)\. The next lemma describes input\-weight concentration, not locality of the deployed edit: least\-squares coefficients can be dense regardless of the support or peakedness ofwxw\_\{x\}\.

###### Lemma J\.13\(Temperature concentration of the atom weights\)\.

ForN≥2N\\geq 2finite real scoressi=sim⁡\(hx,ai\)s\_\{i\}=\\operatorname\{sim\}\(h\_\{x\},a\_\{i\}\)and temperatureτ\>0\\tau\>0, orders\(1\)≥s\(2\)≥⋯≥s\(N\)s\_\{\(1\)\}\\geq s\_\{\(2\)\}\\geq\\cdots\\geq s\_\{\(N\)\}\. LetΔi=s\(1\)−s\(i\)\\Delta\_\{i\}=s\_\{\(1\)\}\-s\_\{\(i\)\}andΔ=mini≥2⁡Δi\\Delta=\\min\_\{i\\geq 2\}\\Delta\_\{i\}be the top\-gap\. Then

w\(1\)≥11\+∑i≥2e−Δi/τ≥11\+\(N−1\)e−Δ/τ,∑i≥2w\(i\)≤\(N−1\)e−Δ/τ\.\\begin\{gathered\}w\_\{\(1\)\}\\;\\geq\\;\\frac\{1\}\{1\+\\sum\_\{i\\geq 2\}e^\{\-\\Delta\_\{i\}/\\tau\}\}\\\\ \\;\\geq\\;\\frac\{1\}\{1\+\(N\-1\)\\,e^\{\-\\Delta/\\tau\}\},\\\\ \\sum\_\{i\\geq 2\}w\_\{\(i\)\}\\;\\leq\\;\(N\-1\)\\,e^\{\-\\Delta/\\tau\}\.\\end\{gathered\}\(24\)
In particular, at fixed positive top\-gap the weights converge to the one\-hot argmax at an exponential rate asτ→0\+\\tau\\to 0^\{\+\}\.

###### Proof\.

Divide numerator and denominator ofw\(1\)w\_\{\(1\)\}byes\(1\)/τe^\{s\_\{\(1\)\}/\\tau\}to getw\(1\)=\(1\+∑i≥2e−Δi/τ\)−1w\_\{\(1\)\}=\\bigl\(1\+\\sum\_\{i\\geq 2\}e^\{\-\\Delta\_\{i\}/\\tau\}\\bigr\)^\{\-1\}, then bound eachΔi≥Δ\\Delta\_\{i\}\\geq\\Deltaand sum theN−1N\-1identical terms; the tail mass is∑i≥2w\(i\)=1−w\(1\)≤\(N−1\)e−Δ/τ1\+\(N−1\)e−Δ/τ≤\(N−1\)e−Δ/τ\\sum\_\{i\\geq 2\}w\_\{\(i\)\}=1\-w\_\{\(1\)\}\\leq\\frac\{\(N\-1\)e^\{\-\\Delta/\\tau\}\}\{1\+\(N\-1\)e^\{\-\\Delta/\\tau\}\}\\leq\(N\-1\)\\,e^\{\-\\Delta/\\tau\}\. ∎

###### Proposition J\.14\(Gate\-off exactness of the implementation branch\)\.

Under the validated finite\-input contract, if the deployed single\-concept gate is zero, or its resulting dense delta is zero, the runtime returns the original query row without modification\. For multi\-concept composition, all per\-concept gates zero likewise imply an unchanged row\.

###### Proof\.

A zero gate gives zero angle and coefficient scale; identical padded and steered weights produce zero delta\. The exit’s active mask requires both a positive gate and a delta norm above its numerical inactivity threshold\. For inactive rows it explicitly copies the original source query, bypassing normalization\. With every multi\-concept gate zero, all allocations and scales vanish and the same copy branch applies\. This is bit\-exact copying of the input representation, not a consequence of ideal normalization algebra\. Historicalαx\\alpha\_\{x\}is absent from this argument and from the deployed operator\. ∎