Pith. sign in

REVIEW 4 major objections 6 minor 44 references

LEMUR: Latent Entropy-aware Multimodal Unlearning via Visual-anchored Reasoning Redirection

T0 review · 4 major / 6 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper argues that RL-trained multimodal reasoning models can recite a supposedly unlearned private fact inside their chain of thought, and introduces LEMUR, a training-free inference-time framework that uses a two-stage token-level…

desk verdict Clever entropy-gated decoding method, but the benchmark never shows the model actually memorized the 'private' facts, so the central privacy claim is unproven. read the letter →

arxiv 2608.11691 v1 pith:CQL7WVUF submitted 2026-08-12 cs.LG cs.CL

Xinhao Zhong , Yuxia Qiao , Junhao Li , Hao Fang , Yi Sun , Bin Chen This is my paper · ORCID
classification cs.LGcs.CL
keywords machineunlearningmultimodallargereasoningmodelschain-of-thoughtprivacyleakagetoken-levelentropyinference-timevisualanchorlatentinjectionentropy-augmenteddecodingtraining-free
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Reinforcement-learning post-training makes multimodal models reason out loud, and this paper argues that the same exploration opens a privacy hole: a sensitive fact that has been removed from the final answer can still be recited inside the chain of thought. The paper claims this leakage carries a two-stage token-level entropy signature—high entropy while candidate values compete, then a collapse to near-certainty as the memorized span is recited—that is largely absent from non-reasoning base models. LEMUR exploits that signal to perform unlearning entirely at decoding time, without weight updates: it detects the sensitive span, switches from discrete sampling to a latent decoding regime, and injects an entropy-modulated visual anchor that regrounds the trajectory in the image. Across three RL-trained multimodal reasoning backbones, LEMUR lowers subject-level reasoning leakage well below existing unlearning baselines while keeping non-sensitive accuracy and fluency close to the vanilla model.

What carries the argument

The central object is the two-stage token-level entropy signature of memorized recall, computed as $H_t(v)=-\sum_{v\in\mathcal{V}} p_t(v)\log p_t(v)$, combined with a forbidden-token set $\Phi_s$. The mechanism is a decoding-time mode switch: in ordinary discrete mode the model samples normally; the gate $g_t$ fires when forbidden probability mass crosses $\rho$ (lexical, committed recital) or when entropy exceeds $\tau$ with a smaller forbidden-mass threshold $\rho_{lo}$ (deliberation); in sensitive mode, instead of feeding back the sampled one-hot token, LEMUR feeds the expected embedding of the restricted distribution $\tilde{p}_t$ (forbidden tokens removed and renormalized), interpolated with a composite visual and safe-answer anchor $a=\beta e_{vis}+(1-\beta)e_{safe}$ at strength $\gamma_t\propto H_t(v)/\tau$, and ends the phase when entropy recovers above $\kappa\bar{H}_t$ or a maximum window $W_{max}$ elapses. This machinery lets the model remain unmodified while the reasoning trajectory is redirected away from the memorized attribute and toward image-grounded, non-sensitive content.

What would settle it

Train or fine-tune a small multimodal reasoning model on a known set of private facts about synthetic subjects, then check whether recalling those facts produces the reported rise-then-collapse token-entropy signature. If genuinely learned facts show no such signature, or if LEMUR only swaps correct attributes for confabulated ones on subjects it never memorized, the central privacy mechanism is not demonstrated. A second check is whether leakage persists when the same private attribute is paraphrased or phrased in another language, avoiding the forbidden token set.

Watch

Extended reading notes

Core claim

The central claim is that RL-trained multimodal large reasoning models leak protected attributes in the reasoning trace even when the final answer is clean, that this leak is marked by a two-stage entropy pattern—per-token entropy rising as the model deliberates among candidate values, then collapsing once it commits to the memorized span—and that decoding-time intervention can exploit that pattern to erase the fact on the fly. LEMUR keeps the original weights, identifies the sensitive segment with a lexical forbidden-token mass test augmented by an entropy cue, and inside that segment feeds back a continuous embedding rather than a sampled token: forbidden mass is removed by renormalization, and the latent state is steered by a convex blend of a visual anchor and a safe-answer anchor whose injection strength is proportional to step entropy. The phase is released when entropy recovers above an adaptive threshold, with a cooldown to prevent oscillations. The paper reports that this removes both answer-level and trace-level leakage on R1-Onevision-7B, Vision-R1-7B, and OpenVLThinker-7B while preserving retain- and celebrity-split utility.

Load-bearing premise

The experiments measure leakage against facts in reasoning chains that a teacher model wrote for each image, while the unlearned models were ordinary checkpoints that never trained on those chains, so the reported forgetting could be suppressing attributes the model is inventing from the picture rather than private facts it genuinely memorized.

Editorial extensions

If this is right

  • If LEMUR works as reported, machine unlearning for reasoning models no longer requires retraining or activation steering: the same vanilla RL-trained checkpoint can be sanitized at serve time for a given forget set.
  • Answer-level unlearning metrics are insufficient for RL-trained reasoning models; deployment of such models should also measure subject-level reasoning leakage inside the chain of thought.
  • The entropy signature transfers across backbones: the paper reports that LEMUR remains effective on a non-RL Qwen2.5-VL and on a general visual-reasoning corpus (VQAv2), suggesting the phenomenon is tied to RL post-training rather than to specific private-attribute content.
  • Because LEMUR leaves weights untouched, it can be layered on top of any existing training-based unlearning result, potentially combining global erasure with local decode-time sanitization.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The authors leave implicit that the entropy tripwire depends on the model concentrating probability mass on forbidden tokens; if an attacker paraphrases the private fact or asks in another language, the lexical branch may not fire, and the paper's experiments do not establish how much leakage survives such paraphrasing.
  • The reported forgetting often replaces the true attribute with a plausible but wrong value drawn from the model's prior. A testable consequence is that a post-LEMUR model does not refuse; it confabulates, so downstream factuality judges should expect hallucinations on forgotten subjects rather than silence.
  • A neighboring problem this suggests is that if RL exploration leaves entropy signatures for other memorized content, the same decoder-side gate could be repurposed to detect hallucinations, sycophancy, or jailbroken reasoning before the model commits to a span.
  • One could test the central claim more directly by training a model on known private facts and checking whether recalling those facts produces the same rise-then-collapse entropy signature; if genuinely learned facts show no such signature, the reported phenomenon may be an artifact of teacher-distilled chains.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper claims that reinforcement-learning-trained multimodal large reasoning models (MLRMs) can leak sensitive facts in the chain-of-thought even when the final answer is clean, that this leakage produces a distinctive rise-then-collapse token-level entropy signature, and that LEMUR—a fully training-free, inference-time unlearning method—can suppress both reasoning-trace and answer leakage by switching into a latent decoding mode with entropy-controlled visual-anchor injection. The method is evaluated on a reconstructed MLLMU-Bench corpus with distilled reasoning chains, using R1-Onevision-7B, Vision-R1-7B, OpenVLThinker-7B, and Qwen2.5-VL as backbones, and is reported to outperform training-based and training-free baselines on leakage suppression while preserving utility and fluency.

Significance. If the central phenomenon were established, the paper would address a genuinely important gap: existing unlearning methods target final answers and largely ignore reasoning traces, despite the growing deployment of RL-trained reasoning models. The proposed method is explicit and mechanistically grounded in decoding-time control, and the paper includes useful ablations, multiple backbones, and forget-ratio robustness checks. I also credit the paper for formalizing subject-level unlearning for reasoning traces in Eq. (2) and for providing full qualitative transcripts. However, the significance is conditional: the evaluation does not actually demonstrate that the target models memorized the fictitious private attributes it tries to remove, so the reported leakage and entropy signature may be properties of hallucination rather than of RL-induced memorized recall.

major comments (4)
  1. [§Experiments, Benchmark and models; §Appendix, Reasoning-Chain Distillation] The central claim—that RL-trained MLRMs leak memorized private facts in the reasoning trace with a distinctive entropy signature—is not supported by the evaluation. In §Experiments the authors state that LEMUR is 'applied to the vanilla checkpoint,' and the appendix describes distilling reasoning chains with Qwen3.5-35B-A3B and storing them as Reasoning_Target metadata, but no RL training or fine-tuning step is described that would cause the vanilla R1-Onevision-7B, Vision-R1-7B, or OpenVLThinker-7B checkpoints to memorize the fictitious MLLMU-Bench attributes. Since the subjects are fictitious, a vanilla checkpoint cannot contain their private attributes; the 57–62% vanilla SRL values in Table 1 and the entropy signature of Fig. 2 may therefore characterize confabulation or generic chain-of-thought generation rather than RL-induced recall. The qualitative transcripts (Listings 3–5) corroborate this concern: the unlearned model identifies subject 409 as 'Oliver Hargrove' although the curated identity is Ericson Hyland, and it fabricates attributes such as 'a cat named Whiskers.' To sustain the privacy claim, the authors should either RL-train (or otherwise fine-tune) models on the distilled chains so the attributes are genuinely memorized, or build the benchmark from facts known to be in the model's training data; otherwise the claims must be reduced to the materially weaker statement that LEMUR suppresses hallucinated private-looking content.
  2. [§Appendix, Training-Data Construction; §Experiments] There is an internal contradiction about the role of the distilled chains. The appendix states that the distilled chain 'becomes the supervision target on which the RL-trained MLRM is built and against which LEMUR performs inference-time unlearning,' but the Experiments section specifies that the backbones are used as vanilla checkpoints, and the VQAv2 transfer experiment explicitly 'reuse[s] the original RL-trained MLRM weights without any modification.' No RL-training run or checkpoint incorporating Reasoning_Target is described anywhere. This contradiction is load-bearing because it determines whether the evaluation tests the stated phenomenon at all; it must be resolved with a concrete description of how, if at all, the target models were conditioned on the distilled chains.
  3. [Tables 1, 2, 3, 5, 6] All numerical results are reported as single point estimates, without standard deviations, number of runs, seeds, or significance tests. On a finite fictitious-subject benchmark, SRL and accuracy are sensitive to the particular subjects assigned to the forget split, so the claim that LEMUR 'consistently' outperforms baselines across backbones and forget ratios is not statistically supported. The authors should report mean and standard deviation over at least several seeds and, where appropriate, a paired significance test (e.g., bootstrap or Wilcoxon) on SRL and target recall.
  4. [§Method, Eqs. (5), (9), (11), (12), (13); §Experiments] The method has ten hyperparameters—rho, rho_lo, tau, gamma, gamma_max, beta, eta, kappa, W_max, and C—but none of their values are reported in the main text or the appendix, nor is the construction of the forbidden-token set Phi_s or the exact string-matching protocol for SRL specified. The statement that OpenVLThinker results are obtained 'without any re-tuning' is not verifiable without these values and a sensitivity analysis. Without this information, the method is not reproducible and the claimed cross-backbone generality is not assessable.
minor comments (6)
  1. [Throughout] The backbone is referred to as 'R1-Onevision-7B' in the text and 'Onevision-R1-7B' in Table 1 and several other places; the naming should be made consistent.
  2. [Table 3] The last ablation row is labeled '+DPED' in the table but '+DEPD' in the text and elsewhere; the typo should be corrected.
  3. [§Method, Eq. (7)] Eq. (7) describes the expected embedding as 'gradient-preserving'; since LEMUR operates purely at inference time with no gradient computation, this phrase is misleading, and 'continuous' or 'soft' would be more accurate.
  4. [§Method, Eqs. (10)–(11)] Eq. (10) calls the combination of e_hat_t and the anchor a convex interpolation, which requires gamma_t in [0,1]; the cap gamma_max in Eq. (11) should be explicitly constrained to satisfy gamma_max <= 1, or the interpolation formula should be adjusted accordingly.
  5. [§Appendix, Anti-leakage attribution context] The appendix says the gold answer never appears verbatim in the context, but Listing 2 includes 'Correct answer: {answer}' in the user prompt; the claim should be clarified to refer only to the attribution-context list, not the user prompt as a whole.
  6. [§Experiments, Metrics] The RRA metric is described only as the judgment of Gemini-2.5-Pro; the exact prompt, the number of judged samples, and any reliability or agreement check should be reported.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the unlearning mechanism is derived from independent entropy and token-set signals, and the benchmark-validity concerns are correctness issues, not derivation loops.

full rationale

The derivation chain is self-contained with respect to circularity. LEMUR's components are defined from quantities that are not the target of the paper's core claim: the forbidden token set Phi_s is taken from the dataset's curated attributes (Eq. 4), the entropy signal H_t(v) is measured from the model's own next-token distribution (Eq. 3), and the anchors e_vis and e_safe are fixed embeddings (Eq. 8). The unlearning objective in Eq. 2 is a standard forget/retain formulation, and the SRL metric is the natural measurement of that objective. No parameter is fitted to the SRL numbers and then reported as a prediction; thresholds such as rho, rho_lo, tau, kappa, W_max, and C are method hyperparameters, not learned from the evaluation. The related-work citations to the authors' own diffusion-unlearning papers are not load-bearing; the central entropy-augmented decoding mechanism is presented with its own equations and ablations. The strongest validity concern, that the target checkpoints are vanilla and the MLLMU-Bench subjects are fictitious, so high vanilla SRL may reflect hallucination rather than RL-memorized recall, is a correctness threat to the empirical claim rather than a circularity in the derivation. The paper's appendix asserts that the distilled chains become the supervision targets of the RL-trained MLRM, which, if true, would make the benchmark self-contained. Per the hard rules, that concern does not justify a circularity score.

Assumptions & free parameters 10 free parameters · 5 assumptions · 0 invented entities

LEMUR introduces no new physical or architectural entity, but it relies on several hand-chosen thresholds and on strong domain assumptions. The ten free parameters are not reported with values or sensitivity analysis, which is the most serious ledger gap. The most load-bearing assumptions are the universality of the entropy signature and the validity of teacher-distilled chains as the privacy ground truth. These assumptions, rather than any new entity, carry the method.

free parameters (10)
  • rho (forbidden mass threshold) = not reported
    Used in Eq. (4)-(5) to detect committed recital of forbidden tokens. The value is fixed but not reported in the main text.
  • rho_lo (entropy-augmented low threshold) = not reported
    Used in Eq. (5) to trigger on diffuse synonym mass during the high-entropy deliberation stage.
  • tau (entropy trigger threshold) = not reported
    Reference entropy in Eq. (5) and Eq. (11). Determines both the switching condition and the anchor injection strength.
  • gamma (anchor strength at reference entropy) = not reported
    Base injection strength in Eq. (11), scaled by H_t / tau.
  • gamma_max (anchor strength cap) = not reported
    Upper bound on injection strength in Eq. (11) to keep the feedback on the embedding manifold.
  • beta (visual vs safe anchor balance) = not reported
    Balances the visual anchor and the safe-answer anchor in Eq. (9).
  • eta (EMA decay) = not reported
    Decay for the exponential moving average of discrete-mode entropy in Eq. (12).
  • kappa (adaptive exit multiplier) = not reported
    Multiplier in Eq. (13) that sets the exit threshold relative to the EMA entropy baseline.
  • W_max (maximum phase length) = not reported
    Hard cap on latent-phase duration in Eq. (13).
  • C (cooldown steps) = not reported
    Minimum number of discrete steps required before a new sensitive phase may open, described in the method section.
assumptions (5)
  • domain assumption The two-stage entropy signature (rise then collapse) reliably localizes sensitive spans across subjects, tasks, and backbones.
    This is the central empirical premise of the method. It drives the triggering in Eq. (5) and the exit rule in Eq. (13). The paper shows supporting examples and ablations, but the universality is assumed.
  • domain assumption The per-subject forbidden token set Phi_s is constructible and covers the attributes plus their paraphrases and synonyms.
    The lexical cue in Eq. (4) only works if the protected vocabulary is present in the model's vocabulary and curated in advance. The authors acknowledge semantic paraphrases as a challenge and rely on the entropy-augmented term to aggregate diffuse synonym mass, but only if those synonyms are in Phi_s.
  • ad hoc to paper Feeding expected embeddings and interpolating visual/safe anchors during latent decoding steers the model on-manifold without catastrophic drift.
    The constrained latent feedback in Eq. (6)-(7) and the anchor interpolation in Eq. (9)-(11) are design choices. The paper provides no independent evidence that this steering mechanism preserves coherent generation in general.
  • ad hoc to paper Teacher-distilled reasoning chains are a faithful proxy for the target model's own private knowledge and reasoning distribution.
    The benchmark is reconstructed by distilling chains from Qwen3.5-35B-A3B. These chains define the leakage metric and the supervision target, yet the target MLRMs never trained on them. This assumption is load-bearing for the validity of the measured leakage.
  • ad hoc to paper Averaged visual special token embeddings provide a safe re-grounding direction, and averaged refusal templates pull the output toward benign text.
    The visual anchor e_vis and safe anchor e_safe in Eq. (8) are constructed from fixed embedding averages. No analysis shows that these directions reliably redirect reasoning without distorting non-sensitive content.

how reviews work

0 comments
Cite this review

Pith. "Pith review of LEMUR: Latent Entropy-aware Multimodal Unlearning via Visual-anchored Reasoning Redirection." pith.science (2026). https://pith.science/paper/CQL7WVUF

@misc{pith2026260811691,
  author       = {Pith},
  title        = {Pith review of: LEMUR: Latent Entropy-aware Multimodal Unlearning via Visual-anchored Reasoning Redirection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CQL7WVUF}},
  note         = {Machine review of arXiv:2608.11691}
}
read the original abstract

Reinforcement-learning (RL) post-training equips multimodal large reasoning models (MLRMs) with exploratory chains of thought (CoT), substantially improving visual reasoning. However, we find that this capability introduces a distinct privacy vulnerability: even when a sensitive fact is successfully unlearned from the final answer, the model may still reproduce it in its reasoning trace. This leakage is substantially more pronounced in natively RL-trained MLRMs than in their non -reasoning base models, revealing a privacy risk that existing unlearning methods are not designed to address. We show that RL-induced exploration leaves sensitive content with a distinctive token-level entropy signature that is largely absent from base models. Based on this observation, we propose LEMUR, a fully training-free, inference-time unlearning framework for natively RL-trained multimodal models. LEMUR uses entropy dynamics as a control signal to identify when sensitive reasoning begins and when sanitization should stop. During this interval, it redirects the reasoning trajectory through entropy-modulated visual-anchor latent injection, replacing committed tokens with sanitized, probability-weighted embeddings re-grounded in the input image. Across diverse MLRMs, LEMUR consistently outperforms existing unlearning met hods in suppressing both reasoning-trace and answer leakage, while better preserving non-sensitive utility and output fluency. These results demonstrate that RL-induced entropy dynamics provide a distinctive signal for privacy leakage and that exploiting this signal enables effective training-free unlearning for reasoning-capable multimodal models.

Figures

Figures reproduced from arXiv: 2608.11691 by the authors.

Figure 1
Figure 1. The entropy phenomenon of different MLLMs. We showed the answers from different MLLM models to the same question and image, along with the correspond￾ing token-level entropy. On a base MLLM, the model often shows a fairly chaotic entropy distribution, while an RL￾trained MLLM shows clear jumps and drops in specific out￾put intervals. This calls for machine unlearning, the removal of a des￾ignated subject’s informati… view at source ↗
Figure 2
Figure 2. The two-stage entropy signature of memorized recall. We plot the per-token entropy Ht(v) (Eq. (3)) along an answer, colored from low (blue) to high (orange), and find that at each sensitive attribute the model first deliberates, with Ht(v) spiking as candidate values compete, before commit￾ting to the memorized span and reciting it almost determin￾istically as Ht(v) collapses. This interval is what supports interven… view at source ↗
Figure 3
Figure 3. The overall pipeline of LEMUR. We achieve training-free machine unlearning through a decoding-centric framework that exploits entropy for three purposes: detecting sensitive information cues, adaptively injecting visual anchors in proportion to entropy levels, and dynamically controlling decoding interval lengths to regulate the unlearning process—all without retraining or gradient updates. be drawn toward the prote… view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: The three forget-split subjects used for the qualitative analysis. Each is a fictitious MLLMU-Bench identity from the 5% forget split of R1-Onevision-7B. The same three subjects—(a) 270, (b) 323, (c) 409—are queried across all three tasks (classification, fill-in-the-b…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

44 extracted references · 15 canonical work pages

  1. [1]

    Cheng, J.; and Amiri, H. 2024. Multidelete for multimodal machine unlearning. In European Conference on Computer Vision, 165--184. Springer

    work page 2024

  2. [2]

    Gandikota, R.; Materzynska, J.; Fiotto-Kaufman, J.; and Bau, D. 2023. Erasing concepts from diffusion models. In Proceedings of the IEEE/CVF international conference on computer vision, 2426--2436

    2023

  3. [6]

    Huo, J.; Yan, Y.; Zheng, X.; Lyu, Y.; Zou, X.; Wei, Z.; and Hu, X. 2025. Mmunlearner: Reformulating multimodal machine unlearning in the era of multimodal large language models. In Findings of the Association for Computational Linguistics: ACL 2025, 7190--7206

    work page 2025

  4. [8]

    R.; Liu, S.; and Chang, S

    Ji, J.; Liu, Y.; Zhang, Y.; Liu, G.; Kompella, R. R.; Liu, S.; and Chang, S. 2024. Reversing the forget-retain objectives: An efficient llm unlearning framework from logit difference. Advances in Neural Information Processing Systems, 37: 12581--12611

    2024

  5. [9]

    Li, H.; Yu, M.; Yao, J.; Singh, P.; Li, X.; Wang, D.; and Hu, L. 2026. Towards reasoning-preserving unlearning in multimodal large language models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 10251--10261

    work page 2026

  6. [10]

    Li, J.; Wei, Q.; Zhang, C.; Qi, G.; Du, M.; Chen, Y.; Bi, S.; and Liu, F. 2024. Single image unlearning: Efficient machine unlearning in multimodal large language models. Advances in Neural Information Processing Systems, 37: 35414--35453

    work page 2024

  7. [11]

    Liu, B.; Liu, Q.; and Stone, P. 2022. Continual learning and private unlearning. In Conference on Lifelong Learning Agents, 243--254. PMLR

    2022

  8. [12]

    Y.; Wang, Y.; Flanigan, J.; and Liu, Y

    Liu, C. Y.; Wang, Y.; Flanigan, J.; and Liu, Y. 2024. Large language model unlearning via embedding-corrupted prompts. Advances in Neural Information Processing Systems, 37: 118198--118266

    work page 2024

Show all 44 references
  1. [13]

    Liu, H.; Li, C.; Wu, Q.; and Lee, Y. J. 2023. Visual instruction tuning. Advances in neural information processing systems, 36: 34892--34916

    2023

  2. [14]

    Liu, Z.; Dou, G.; Jia, M.; Tan, Z.; Zeng, Q.; Yuan, Y.; and Jiang, M. 2025 a . Protecting privacy in multimodal large language models with mllmu-bench. In Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics...

    2025

  3. [15]

    Liu, Z.; Dou, G.; Yuan, X.; Zhang, C.; Tan, Z.; and Jiang, M. 2025 b . Modality-aware neuron pruning for unlearning in multimodal large language models. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 5913--5933

    2025

  4. [16]

    P.; Low, B

    Nguyen, Q. P.; Low, B. K. H.; and Jaillet, P. 2020. Variational bayesian unlearning. Advances in Neural Information Processing Systems, 33: 16025--16036

    2020

  5. [20]

    Thudi, A.; Deza, G.; Chandrasekaran, V.; and Papernot, N. 2022. Unrolling sgd: Understanding factors influencing machine unlearning. In 2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P), 303--319. IEEE

    2022

  6. [21]

    Wang, C.; Fan, C.; Zhang, Y.; Jia, J.; Wei, D.; Ram, P.; Baracaldo, N.; and Liu, S. 2025. Reasoning model unlearning: Forgetting traces, not just answers, while preserving reasoning skills. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processi...

    2025

  7. [23]

    Yang, Y.; He, X.; Pan, H.; Jiang, X.; Deng, Y.; Yang, X.; Lu, H.; Yin, D.; Rao, F.; Zhu, M.; et al. 2025. R1-onevision: Advancing generalized multimodal reasoning through cross-modal formalization. In Proceedings of the IEEE/CVF International Conference on Computer Vision, 2376--2385

    2025

  8. [25]

    Zhang, R.; Zhang, B.; Li, Y.; Zhang, H.; Sun, Z.; Gan, Z.; Yang, Y.; Pang, R.; and Yang, Y. 2025. Improve vision language model chain-of-thought reasoning. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 1631--1662

    2025

  9. [28]

    Proceedings of the IEEE/CVF International Conference on Computer Vision , pages=

    R1-onevision: Advancing generalized multimodal reasoning through cross-modal formalization , author=. Proceedings of the IEEE/CVF International Conference on Computer Vision , pages=

  10. [29]

    arXiv preprint arXiv:2503.06749 , year=

    Vision-r1: Incentivizing reasoning capability in multimodal large language models , author=. arXiv preprint arXiv:2503.06749 , year=

    arXiv

  11. [30]

    arXiv preprint arXiv:2409.12191 , year=

    Qwen2-vl: Enhancing vision-language model's perception of the world at any resolution , author=. arXiv preprint arXiv:2409.12191 , year=

    arXiv

  12. [31]

    Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

    Improved baselines with visual instruction tuning , author=. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

  13. [32]

    2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P) , pages=

    Unrolling sgd: Understanding factors influencing machine unlearning , author=. 2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P) , pages=. 2022 , organization=

    2022

  14. [33]

    arXiv preprint arXiv:2404.05868 , year=

    Negative preference optimization: From catastrophic collapse to effective unlearning , author=. arXiv preprint arXiv:2404.05868 , year=

    arXiv

  15. [34]

    Findings of the Association for Computational Linguistics: ACL 2025 , pages=

    Mmunlearner: Reformulating multimodal machine unlearning in the era of multimodal large language models , author=. Findings of the Association for Computational Linguistics: ACL 2025 , pages=

    2025

  16. [35]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

    Towards reasoning-preserving unlearning in multimodal large language models , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

  17. [36]

    Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing , pages=

    Reasoning model unlearning: Forgetting traces, not just answers, while preserving reasoning skills , author=. Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing , pages=

    2025

  18. [37]

    arXiv preprint arXiv:2509.22400 , year=

    Closing the safety gap: Surgical concept erasure in visual autoregressive models , author=. arXiv preprint arXiv:2509.22400 , year=

  19. [38]

    arXiv preprint arXiv:2602.01089 , year=

    Differential Vector Erasure: Unified Training-Free Concept Erasure for Flow Matching Models , author=. arXiv preprint arXiv:2602.01089 , year=

  20. [39]

    arXiv preprint arXiv:2601.00267 , year=

    ActErase: A Training-Free Paradigm for Precise Concept Erasure via Activation Patching , author=. arXiv preprint arXiv:2601.00267 , year=

  21. [40]

    Advances in Neural Information Processing Systems , volume=

    Large language model unlearning via embedding-corrupted prompts , author=. Advances in Neural Information Processing Systems , volume=

  22. [41]

    arXiv preprint arXiv:2404.11045 , year=

    Offset unlearning for large language models , author=. arXiv preprint arXiv:2404.11045 , year=

    arXiv

  23. [42]

    Advances in Neural Information Processing Systems , volume=

    Reversing the forget-retain objectives: An efficient llm unlearning framework from logit difference , author=. Advances in Neural Information Processing Systems , volume=

  24. [43]

    arXiv preprint arXiv:2310.07579 , year=

    In-context unlearning: Language models as few shot unlearners , author=. arXiv preprint arXiv:2310.07579 , year=

    arXiv

  25. [44]

    arXiv preprint arXiv:2403.03329 , year=

    Guardrail baselines for unlearning in llms , author=. arXiv preprint arXiv:2403.03329 , year=

    arXiv

  26. [45]

    arXiv preprint arXiv:2501.12948 , year=

    Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning , author=. arXiv preprint arXiv:2501.12948 , year=

    arXiv

  27. [46]

    arXiv preprint arXiv:2412.16720 , year=

    Openai o1 system card , author=. arXiv preprint arXiv:2412.16720 , year=

    arXiv

  28. [47]

    Advances in neural information processing systems , volume=

    Visual instruction tuning , author=. Advances in neural information processing systems , volume=

  29. [48]

    Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

    Improve vision language model chain-of-thought reasoning , author=. Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

  30. [49]

    Advances in Neural Information Processing Systems , volume=

    Variational bayesian unlearning , author=. Advances in Neural Information Processing Systems , volume=

  31. [50]

    Proceedings of the IEEE/CVF international conference on computer vision , pages=

    Erasing concepts from diffusion models , author=. Proceedings of the IEEE/CVF international conference on computer vision , pages=

  32. [51]

    Advances in Neural Information Processing Systems , volume=

    Single image unlearning: Efficient machine unlearning in multimodal large language models , author=. Advances in Neural Information Processing Systems , volume=

  33. [52]

    European Conference on Computer Vision , pages=

    Multidelete for multimodal machine unlearning , author=. European Conference on Computer Vision , pages=. 2024 , organization=

    2024

  34. [53]

    Conference on Lifelong Learning Agents , pages=

    Continual learning and private unlearning , author=. Conference on Lifelong Learning Agents , pages=. 2022 , organization=

    2022

  35. [54]

    Protecting privacy in multimodal large language models with mllmu-bench , author=. Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers) , pages=

    2025

  36. [55]

    Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

    Modality-aware neuron pruning for unlearning in multimodal large language models , author=. Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.