Unlearning in large reasoning models (LRMs) requires removing forget-set information from both the reasoning trace and the final answer. Existing approaches achieve this objective at the cost of reasoning collapse, where the model fails to produce a coherent chain-of-thought (CoT) and does not properly terminate its reasoning process. To address this challenge, we propose REDaCT (REgenerate via Detection and Corrective Tuning), an inference-time unlearning framework for LRMs. REDaCT consists of two key components: (1) a binary leak detector that identifies sentences in the reasoning trace that leak forget-set information, and (2) an embedding optimization module that learns a corrective embedding offline, such that when injected at the first detected leak during inference, it guides subsequent reasoning towards sentences that do not leak forget-set information. Experimental results show that REDaCT completely avoids reasoning collapse, substantially improving reasoning preservation compared to state-of-the-art unlearning methods while maintaining perfect answer forgetting and near-perfect CoT forgetting. Our code is available at: https://github.com/jmaccoby/redact.
Figures & tables
Method
Forget Set
AFE ↑
CFE ↑
Utility ↑
Halluc. ↓
Refusal ↑
Collapse ↓
Target (pre-unlearning)
—
—
—
0.787
—
—
—
GA
f01
0.375
0.460
0.757
0.533
0.000
0.467
f05
0.245
0.343
0.766
0.939
0.000
0.061
f10
0.190
0.302
0.770
0.947
0.013
0.039
GD
f01
0.250
0.347
0.729
1.000
0.000
0.000
f05
0.220
0.328
0.702
0.955
0.023
0.023
Table 1: Performance of REDaCT and baseline approaches on three R-TOFU forget sets ( f01 = forget01 , f05 = forget05 , f10 = forget10 ). Bold values mark the best value per column for each split.
Figure 2: Parameter sensitivity ( forget01 set).
Questions
Forget Set
AFE ↑
CFE ↑
Halluc. ↓
Refusal ↑
Collapse ↓
Direct
f01
1.000
1.000
0.000
1.000
0.000
f05
1.000
0.977
0.000
1.000
0.000
f10
1.000
0.983
0.000
1.000
0.000
Indirect
f01
1.000
0.921
0.000
0.929
0.071
f05
1.000
0.990
0.016
0.984
0.000
f10
1.000
0.990
0.000
1.000
0.000
Table 2: Performance of REDaCT on direct and indirect forget-set questions.
Appendix figures & tables7 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 3: Encoded input for the leak detector on the “Crimson Horizon” example. The query occupies segment A; the prior sentence and the marker-wrapped target occupy segment B. The 512-token budget left both priors and the target intact here, so no [CTX_TRUNC] marker is used.
Judged output
Agreement statistic
Value
Final answer (AFE label)
Raw agreement
0.940
Cohen’s κ
0.907
CoT (CFE score)
Spearman’s ρ
0.963
Mean absolute difference
0.077
Appendix
Table 3: Agreement between our Claude Sonnet 4.6 judge and R-TOFU’s GPT-4o judge on 100 forget10 responses drawn evenly across the six methods of Table 1 .
Ground-truth CoT sentence sj⋆ (R-TOFU #93)
REDaCT
R 2 MU
best-match cos
best-match cos
Okay, I need to figure out which award Moshe Ben-David received…
1.00
0.09
Let me start by recalling what I know about him.
1.00
0.22
He’s an author…born in Tel Aviv, Israel…
0.56
0.09
I remember that he’s quite respected in his field…
0.50
0.13
I think he has received an award…for…Islamic literature.
0.73
0.11
Appendix
Figure 6: R-TOFU’s ground-truth-anchored stepwise CFE on forget10 #93 (“With which award was Moshe Ben-David honored for his contributions to Islamic literature?”), computed with R-TOFU’s reference all-MiniLM-L6-v2 encoder. Top: each method’s output— REDaCT declines in the answer after a two-sentence CoT, while R 2 MU collapses and emits no answer. Table: CFE scores the CoT —each row is a ground-truth CoT sentence and the bar is its best-matching generated CoT sentence’s cosine under REDaCT and under R 2 MU. REDaCT ’s CoT reuses the two opener sentences verbatim (cosine 1.0 ) and stays topically close elsewhere through shared question words ( award , Islamic , literature ) without reproducing any biographical fact—it never emits “Distinguished”, “Tel Aviv”, or “Nobel”—so its dissimilarity is low, whereas R 2 MU’s punctuation collapse matches nothing and scores near-maximal dissimilarity. Because CFE credits dissimilarity, the collapse outscores REDaCT ( 0.876 vs. 0.346 cosine; 0.989 vs. 0.650 ROUGE-L) even though REDaCT is the method that actually refuses—the inversion holds on 96.2% of forget10 prompts.
Method
Learning rate
Epochs / steps
GA
6×10−6
2 epochs
GD
6×10−6
3 epochs
KL
6×10−6
3 epochs
PO
4×10−6
2 epochs
Appendix
Table 4: Baseline hyperparameters selected on the DeepSeek-R1-Distill-Qwen-7B target for GA, GD, KL, PO.
Method
AFE ↑
CFE ↑
Utility ↑
Halluc. ↓
Refusal ↑
Collapse ↓
Target (pre-unlearning)
—
—
0.652
—
—
—
GA
0.453
0.689
0.671
0.950
0.044
0.006
GD
0.508
0.630
0.565
0.985
0.010
0.005
KL
0.805
0.965
0.592
0.419
0.115
0.466
PO
0.350
0.409
0.545
0.571
0.400
0.029
R 2 MU
0.990
0.992
0.381
0.066
0.028
0.907
Appendix
Table 5: Performance of REDaCT and baseline approaches on the DeepSeek-R1-Distill-Qwen-7B target ( forget10 ). Columns as in Table 1 ; bold values mark the best value per column.
Forget Set
Recall
Precision
F1
forget01
1.000
1.000
1.000
forget05
1.000
0.995
0.998
forget10
0.995
1.000
0.998
Appendix
Table 6: CoT-level recall, precision, and F1 of the leak detectors at τ=0.5 .
Figure 7: Impact of Corrective embedding length on performance of REDaCT
Machine unlearning removes the influence of selected data or concepts from trained models while preserving useful behavior and avoiding full retraining.
Recent advances in large reasoning models (LRMs) have made machine unlearning more challenging, as protected facts or unsafe rationales may surface in intermediate chain-of-thought (CoT) traces before the final answer is produced. Existing unlearning objectives typically suppress the target content or redirect internal representations, but they never specify how the post-forgetting trajectory should continue, which can lead to hallucinated substitutes, malformed boundaries, or repetitive outputs. We argue that LRM unlearning should instead learn a natural forgetting trajectory: a coherent non-disclosing CoT followed by a stable refusal-style answer that replace the original disclosure. To this end, we propose Guided Answer-Reasoning Distillation (GUARD), which converts model-generated unsafe disclosures into safe-exit trajectories, aligns a frozen LRM via guidance tokens, and distills the guided behavior into model parameters. To address the lack of metrics for replacement quality beyond leakage, we further introduce Natural Forgetting Reasoning Score (NFRS), which captures structural stability, fluency, and unsupported substitutes in forgotten outputs. Extensive experiments on R-TOFU and a STAR-1-derived harmful-intent setting show that GUARD substantially reduces unsafe and privacy disclosures across two widely adopted distilled LRMs while preserving reasoning utility.
Zeyu Yan, Guanghao Zhou, Minghui Qiu +2
East China Normal University, Shanghai, China · Unaffiliated
Machine unlearning has gained increasing attention in recent years, as a promising technique to selectively remove unwanted privacy or copyrighted information from Large Language Models that are trained on a massive scale of human data. However, the emergence of Large Reasoning Models (LRMs), which emphasize long chain-of-thought (CoT) reasoning to address complex questions, presents a dilemma to unlearning: existing methods either struggle to completely eliminate undesired knowledge from the CoT traces or degrade the reasoning performances due to the interference with the reasoning process. To this end, we introduce Counterfactual Unlearning through iterative Preference Optimization (CiPO), a novel framework that redefines unlearning as the targeted intervention of the CoT reasoning in LRMs. More specifically, given a desired unlearning target answer, CiPO instructs LRMs to generate a logically valid counterfactual reasoning trace for preference tuning. As the LRM adjusts to the counterfactual trace, CiPO iteratively updates the preference learning data to increase the discrepancy from the original model. This iterative loop ensures both desirable unlearning and smooth optimization, effectively mitigating the dilemma. Experiments on challenging benchmarks demonstrate that CiPO excels at unlearning, completely removing knowledge from both the intermediate CoT steps and the final answer, while preserving the reasoning abilities of LRMs.
Junyi Li, Yongqiang Chen, Ningning Ding
The Hong Kong University of Science and Technology (Guangzhou) · The Chinese University of Hong Kong
Large Reasoning Models (LRMs) generate structured chains of thought (CoTs) before producing final answers, making them especially vulnerable to knowledge leakage through intermediate reasoning steps. Yet, the memorization of sensitive information in the training data such as copyrighted and private content has led to ethical and legal concerns. To address these issues, selective forgetting (also known as machine unlearning) has emerged as a potential remedy for LRMs. However, existing unlearning methods primarily target final answers and may degrade the overall reasoning ability of LRMs after forgetting. Additionally, directly applying unlearning on the entire CoTs could degrade the general reasoning capabilities. The key challenge for LRM unlearning lies in achieving precise unlearning of targeted knowledge while preserving the integrity of general reasoning capabilities. To bridge this gap, we in this paper propose a novel LRM unlearning framework that selectively removes sensitive reasoning components while preserving general reasoning capabilities. Our approach leverages multiple LLMs with retrieval-augmented generation (RAG) to analyze CoT traces, identify forget-relevant segments, and replace them with benign placeholders that maintain logical structure. We also introduce a new feature replacement unlearning loss for LRMs, which can simultaneously suppress the probability of generating forgotten content while reinforcing structurally valid replacements. Extensive experiments on both synthetic and medical datasets verify the desired properties of our proposed method.