STaR: Sensitive Trajectory Regulation for Unlearning in Large Reasoning Models

TL;DR

Large reasoning models embed sensitive information across multi-step chain-of-thought trajectories, creating privacy risks that are not addressed by final-answer unlearning. The authors propose Sensitive Trajectory Regulation (STaR), a parameter-free, inference-time framework with four components—Sensitive Content Identification, Secure Prompt Prefix, Trajectory-Aware Suppression Learning, and Token-level Adaptive Filtering—to enforce privacy throughout reasoning across all decoding strategies. They also introduce two decoding-aware evaluation metrics, Multi-Decoding Consistency Score ($MCS$) and Multi-Granularity Membership Inference Attack ($MIA$), and demonstrate, on the R-TOFU benchmark, that STaR achieves robust forgetting with minimal utility loss and substantially reduced privacy leakage compared to baselines. The work advances practical privacy-preserving reasoning in LRMs and provides a decoding-robust blueprint for safe deployment of CoT-enabled models.

Abstract

Large Reasoning Models (LRMs) have advanced automated multi-step reasoning, but their ability to generate complex Chain-of-Thought (CoT) trajectories introduces severe privacy risks, as sensitive information may be deeply embedded throughout the reasoning process. Existing Large Language Models (LLMs) unlearning approaches that typically focus on modifying only final answers are insufficient for LRMs, as they fail to remove sensitive content from intermediate steps, leading to persistent privacy leakage and degraded security. To address these challenges, we propose Sensitive Trajectory Regulation (STaR), a parameter-free, inference-time unlearning framework that achieves robust privacy protection throughout the reasoning process. Specifically, we first identify sensitive content via semantic-aware detection. Then, we inject global safety constraints through secure prompt prefix. Next, we perform trajectory-aware suppression to dynamically block sensitive content across the entire reasoning chain. Finally, we apply token-level adaptive filtering to prevent both exact and paraphrased sensitive tokens during generation. Furthermore, to overcome the inadequacies of existing evaluation protocols, we introduce two metrics: Multi-Decoding Consistency Assessment (MCS), which measures the consistency of unlearning across diverse decoding strategies, and Multi-Granularity Membership Inference Attack (MIA) Evaluation, which quantifies privacy protection at both answer and reasoning-chain levels. Experiments on the R-TOFU benchmark demonstrate that STaR achieves comprehensive and stable unlearning with minimal utility loss, setting a new standard for privacy-preserving reasoning in LRMs.

Figures (2)

• Figure 1: (a) Illustration of the effect of unlearning in LLMs. (b) Trajectory-Aware Suppression Learning detects sensitivity and evaluates fluency at each reasoning step to adaptively suppress sensitive information throughout the reasoning trajectory.
• Figure 2: Architecture of the STaR framework. The pipeline consists of Sensitive Content Identification, Secure Prompt Prefix, Trajectory-Aware Suppression Learning, and Token-level Adaptive Filtering.