arXiv:2601.09281cs.AI2026-01AAAI被引 1

让大模型推理过程彻底删除敏感信息,防止隐私泄露。

STaR: Sensitive Trajectory Regulation for Unlearning in Large Reasoning Models

  • 通过语义检测+动态抑制,全程阻断推理链中的敏感内容。
  • 在R-TOFU数据集上实现稳定去学习,答案与推理链均无隐私泄露。
  • 无需训练,适合需高安全性的复杂推理场景应用。

大型推理模型(LRMs)虽提升了多步推理能力,但其生成的复杂思维链(CoT)可能深度嵌入敏感信息,带来严重隐私风险。现有大语言模型去学习方法通常仅修改最终答案,无法清除中间步骤中的敏感内容,导致持续隐私泄露和安全下降。为此,我们提出参数无关、推理时执行的去学习框架STaR,实现推理全过程的鲁棒隐私保护。首先通过语义感知检测识别敏感内容;接着注入全局安全约束于提示前缀;再进行轨迹感知抑制,动态阻断整个推理链中的敏感项;最后采用逐标记自适应过滤,防止敏感词及其改写形式生成。为克服现有评估不足,我们引入两项新指标:多解码一致性评估(MCS),衡量不同解码策略下的去学习一致性;多粒度成员推断攻击评估(MIA),量化答案与推理链层面的隐私保护水平。在R-TOFU基准测试中,STaR实现全面且稳定的去学习,性能损失极小,为LRMs的隐私保护设立新标准。

原文摘要 · Abstract (English)

Large Reasoning Models (LRMs) have advanced automated multi-step reasoning, but their ability to generate complex Chain-of-Thought (CoT) trajectories introduces severe privacy risks, as sensitive information may be deeply embedded throughout the reasoning process. Existing Large Language Models (LLMs) unlearning approaches that typically focus on modifying only final answers are insufficient for LRMs, as they fail to remove sensitive content from intermediate steps, leading to persistent privacy leakage and degraded security. To address these challenges, we propose Sensitive Trajectory Regulation (STaR), a parameter-free, inference-time unlearning framework that achieves robust privacy protection throughout the reasoning process. Specifically, we first identify sensitive content via semantic-aware detection. Then, we inject global safety constraints through secure prompt prefix. Next, we perform trajectory-aware suppression to dynamically block sensitive content across the entire reasoning chain. Finally, we apply token-level adaptive filtering to prevent both exact and paraphrased sensitive tokens during generation. Furthermore, to overcome the inadequacies of existing evaluation protocols, we introduce two metrics: Multi-Decoding Consistency Assessment (MCS), which measures the consistency of unlearning across diverse decoding strategies, and Multi-Granularity Membership Inference Attack (MIA) Evaluation, which quantifies privacy protection at both answer and reasoning-chain levels. Experiments on the R-TOFU benchmark demonstrate that STaR achieves comprehensive and stable unlearning with minimal utility loss, setting a new standard for privacy-preserving reasoning in LRMs.

隐私保护推理模型去学习安全生成

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。