[Paper] Controllable Reasoning Models Are Private Thinkers

Source: arXiv - 2602.24210v1

Overview

Recent advances in large language models (LLMs) have enabled AI agents that can reason step‑by‑step before delivering a final answer. While powerful, these reasoning traces can unintentionally expose sensitive user data, creating privacy risks. The paper introduces a novel approach: train reasoning models to obey explicit instructions both in their final answer and in the intermediate reasoning steps, thereby giving developers finer control over what information is disclosed.

Key Contributions

• Instruction‑following dataset for reasoning traces – a curated collection of prompts with clear constraints on what may (or may not) appear in the model’s chain‑of‑thought.
• Decoupled generation architecture – separate LoRA adapters for reasoning and answer generation, allowing independent control of each stage.
• Comprehensive evaluation – experiments on six LLMs (1.7 B – 14 B parameters) across two standard instruction‑following benchmarks and two privacy‑focused benchmarks.
• Significant privacy gains – up to 51.9 % absolute improvement on privacy metrics, with instruction‑following scores increasing by as much as 20.9 points.
• Open‑source release – code, data, and training scripts made publicly available for reproducibility and community extension.

Methodology

1. Dataset Construction – The authors built an instruction‑following dataset where each example contains:
   • a user query,
   • a reasoning constraint (e.g., “do not mention the user’s email”), and
   • a reference answer that respects the constraint.
2. Model Fine‑tuning with LoRA – Low‑Rank Adaptation (LoRA) layers are added twice to a base LLM:
   • one LoRA module is activated only during the reasoning phase, learning to obey the trace‑level constraints;
   • a second LoRA module is used for the final answer generation, preserving task performance.
     This separation lets the system enforce different instruction sets for the two stages without retraining the entire model.
3. Training Procedure – The model is fine‑tuned on the new dataset using standard supervised learning, with a loss that jointly optimizes reasoning‑trace compliance and answer correctness.
4. Evaluation – Two axes are measured:
   • Instruction‑following ability (how well the model respects the given constraints), using established benchmarks;
   • Privacy leakage (whether private tokens appear in the reasoning trace), using specially designed privacy benchmarks that inject sensitive tokens into prompts.

Results & Findings

• Reasoning compliance improves dramatically; models learn to omit or mask private information in their chain‑of‑thought.
• Privacy metrics show a steep drop in accidental leakage, confirming that controlling the reasoning trace is an effective privacy lever.
• Utility trade‑off: As the models become stricter about trace compliance, some downstream task performance (e.g., answer accuracy) degrades modestly, highlighting a privacy‑utility balance that must be managed per application.

Practical Implications

• Privacy‑by‑Design AI Assistants – Developers can embed trace‑level constraints (e.g., “never echo user identifiers”) into agents that perform complex reasoning, reducing the risk of inadvertent data exposure.
• Regulatory Compliance – The approach offers a concrete technical control that aligns with data‑protection regulations (GDPR, CCPA) by limiting what is logged or transmitted during inference.
• Modular Deployment – Because the reasoning and answer adapters are separate, teams can swap or update one without retraining the other, facilitating rapid iteration on privacy policies.
• Auditability – The explicit instruction set for reasoning traces makes it easier to audit model behavior and produce compliance reports.
• Tooling Integration – The open‑source LoRA‑based framework can be integrated into existing inference pipelines (e.g., LangChain, Llama‑cpp) with minimal overhead.

Limitations & Future Work

• Utility‑Privacy Trade‑off – Stricter trace constraints sometimes hurt answer quality; finding optimal balances for specific domains remains an open challenge.
• Scope of Constraints – The current dataset covers a limited set of constraint types (masking, omission). More nuanced policies (e.g., differential privacy guarantees) need exploration.
• Scalability to Larger Models – Experiments stop at 14 B parameters; it is unclear how the method scales to 70 B+ models where LoRA adapters may behave differently.
• Dynamic Constraints – Future work could enable on‑the‑fly constraint specification (e.g., per‑user privacy settings) rather than static fine‑tuning.

By demonstrating that controllable reasoning traces can dramatically curb privacy leakage, this work opens a practical pathway for building safer, more trustworthy AI agents that still retain the reasoning power developers rely on.

Authors

• Haritz Puerto
• Haonan Li
• Xudong Han
• Timothy Baldwin
• Iryna Gurevych

Paper Information

• arXiv ID: 2602.24210v1
• Categories: cs.CL, cs.AI
• Published: February 27, 2026
• PDF: Download PDF