{"id":"f91ce833-a2d6-4b5f-b838-05f0eccfcea7","arxiv_id":"2602.24210","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":1,"one_line_summary":"Training large reasoning models to follow instructions inside their reasoning traces, plus switching adapters mid-generation, significantly reduces privacy leaks in their hidden thoughts.","lead":"This paper trains reasoning models to obey instructions inside their hidden thinking steps, then switches between two lightweight adapters to keep both thinking and final answers compliant. In tests on six models it cut leakage of passwords and private names by up to 51.9 percentage points, sometimes at the cost of solving the task correctly.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Privacy gains are measured by exact string matching; paraphrased or partial disclosure is scored as private, so reported privacy improvements may overstate real-world leakage.","rationale":"The reader’s weakest assumption—that privacy leakage is adequately measured by exact string matching—is also the most load-bearing concern in my reading. The paper’s own Limitations section asserts this assumption as if it were self-evident, but it is precisely where real-world privacy could diverge from the reported scores. This is not an internal inconsistency or an authorship issue; it is a measurement-validity risk. If the concern lands, the central claim that improved instruction-following yields genuine privacy gains is overstated; if it does not land, the claim is well-supported by the consistent IF and privacy improvements across six models. Either way, the right verdict is conditional until the metric is stress-tested against paraphrase/obfuscation. The reader already identified this weakness, so my recommendation does not change their conditional verdict.","tokens_in":22185,"tokens_out":5345,"duration_ms":61762,"concrete_test":"Sample ~200 outputs per condition from Staged Decoding and the baseline on PasswordEval and PEEP. Recompute leak rates with three detectors: (1) normalized matching (case-insensitive, whitespace/punctuation stripped), (2) fuzzy/partial matching (edit distance ≤1, character-split detection, substring matches of length ≥5), and (3) an LLM judge asked to detect any paraphrase, encoding, or indirect reference to the secret. If the Staged Decoding vs baseline privacy gap shrinks materially (e.g., >10 points) or if Staged Decoding shows more paraphrased leaks, the reported gains are artifacts of exact matching; if not, the concern is refuted. Also apply the same detectors to the RANA upper bound.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that improving instruction-following enhances privacy rests on the privacy metric defined in §4.2.2: privacy score = 1 − leak rate, where a leak is scored only when the exact secret string (password or confidential name) appears verbatim in the reasoning trace or final answer. A model that outputs “the password is H e r i t a g e R e v i v e”, “Heritage-Revive”, or “the secret starts with H and ends with e” is counted as private even though the information is disclosed and usable. The Limitations section explicitly asserts this assumption: leakage “can be identified and measured with absolute precision (i.e., via string matching).” But this conflates string identity with information disclosure. Prompt-injection exfiltration does not require verbatim reproduction, and the RANA upper bound also uses exact-string removal, so the same blind spot affects the baseline comparison. The reported average privacy gains of 21.65 (PasswordEval) and 22.69 (PEEP) may partly reflect a shift from verbatim disclosure to paraphrased/partial disclosure, which is not true privacy improvement. Thus the empirical support for “improving IF significantly enhances privacy” is only as strong as the untested assumption that exact string matching captures the relevant leakage.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes that privacy leakage in large reasoning models (LRMs) can be reduced by improving instruction-following (IF) inside the reasoning trace. It introduces an SFT dataset of trace-specific instructions (format, style, reasoning type), trains LoRA adapters for IF in the trace and in the final answer, and proposes Staged Decoding, which switches adapters at the trace/answer boundary. Experiments on six Qwen3/Phi-4 models (1.7B–14B) across IFEval, MathIF, PasswordEval, and PEEP report large IF gains (up to 20.9 points) and large privacy gains (up to 51.9 points), at a cost in task utility on MathIF. The paper concludes that improving IF in LRMs can significantly enhance privacy.","tokens_in":22477,"tokens_out":4582,"duration_ms":45877,"significance":"If the empirical claim holds, the paper provides a practical, adapter-based route to privacy-aware reasoning agents, which is more accessible than full retraining. The evaluation is broad (six models, two families, two privacy benchmarks), the method is simple and reproducible, code is released, and the training/evaluation data are independent. The comparison to the RANA anonymization upper bound is useful. However, the central privacy result rests on an exact-string-match leakage metric, which is explicitly defended in the Limitations section as measuring leakage with 'absolute precision.' This assumption is not safe: paraphrased, segmented, or partial disclosure of a secret is scored as non-leakage, so the reported privacy gains may substantially overstate real-world protection. The claim of consistent gains is also contradicted by at least one clear regression in Table 2.","major_comments":[{"comment":"The privacy score is defined as 1 − leak rate, where a leak is scored only when the exact secret string appears verbatim in the trace or final answer. The Limitations section asserts that leakage 'can be identified and measured with absolute precision (i.e., via string matching).' This conflates verbatim reproduction with information disclosure. A model that outputs 'Heritage-Revive', 'H e r i t a g e R e v i v e', or 'the keyword starts with H and ends with e' is counted as private even though the secret is disclosed and usable for exfiltration. Prompt-injection exfiltration does not require verbatim reproduction. The same blind spot affects the RANA comparison in §5.4, since RANA removes strings by exact matching. The reported average privacy gains of 21.65 and 22.69 points may therefore reflect a shift from verbatim to paraphrased or partial disclosure rather than a genuine privacy im","section":"§4.2.2, Limitations"},{"comment":"The paper claims Staged Decoding yields 'consistent' privacy gains, but Qwen3-1.7B on PasswordEval is a clear counterexample: baseline total privacy is 42.13, while Staged Decoding is 22.60, with RT privacy 22.25 vs. 26.10 and FA privacy 23.30 vs. 74.17. This is a large regression, not a marginal one. Phi-4 3.8B also shows FA privacy dropping from 58.06 to 46.22 on PasswordEval. The reported averages and t-tests across models mask this failure case. The paper should explicitly acknowledge and analyze these regressions, and the claim that improved IF 'significantly enhances privacy' should be qualified to exclude or explain them.","section":"Table 2, §5.2"},{"comment":"The utility cost on MathIF is severe and uniform: all six models drop substantially (e.g., Qwen3-8B from 40.96 to 22.89; Phi4-14B from 40.66 to 25.75). The paper attributes this to an inherent IF–utility trade-off, but the magnitude raises a practical concern for the proposed approach as a privacy intervention. The utility drop may also be partly attributable to the 4-bit quantization and malformed outputs documented in Appendix D; the paper does not disentangle these causes. Since the paper's motivation is building privacy-aware agents, the utility loss should be analyzed more carefully rather than only cited as a known trade-off.","section":"§5.3, Table 3"}],"minor_comments":[{"comment":"The model name 'gptoss-120B' appears to be a typo or placeholder; please clarify the actual model used for rewriting reasoning traces.","section":"§3.1"},{"comment":"The text says Staged Decoding 'maximizes' IF-RT and IF-FA, but in several rows Staged Decoding's IF-FA is below the baseline (e.g., Qwen3-1.7B IFEval: 63.67 vs. 70.26). It maximizes the average, not each component. Rephrase to avoid overclaiming.","section":"§4.1 / Table 1"},{"comment":"The one-tailed t-test is reported with p-values but no test details. With six models and two seeds, state what the units of analysis are and the degrees of freedom; otherwise the significance claim is hard to interpret.","section":"§5.2"},{"comment":"The PEEP utility judge is validated on only 10 sampled responses, with 4 judged imperfect. This is a small validation; a sentence acknowledging the limitation of the utility metric would be appropriate.","section":"Appendix F"},{"comment":"The benchmark name is written inconsistently as 'Math-IF' and 'MathIF'; please standardize. Also, the abstract states 'up to 20.9 IF points' but the gains are sometimes negative; the 'up to' phrasing should be accompanied by a range or caveat.","section":"General"}],"recommendation":"major_revision","confidential_remarks":"The paper addresses a timely and important problem, and the staged-decoding idea is simple and likely useful. The main reason for major revision is not the method but the validity of the privacy metric. The exact-string-match metric is explicitly defended in the Limitations section as 'absolute precision,' which is a strong claim that is not justified and is load-bearing for the paper's central conclusion. The Qwen3-1.7B PasswordEval regression also needs honest treatment. I do not see a circularity problem with the training data, but the privacy evaluation needs to be strengthened before the paper can be accepted."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Punchline first: the paper introduces a genuinely useful trick—training reasoning models to obey RT-specific instructions and switching LoRA adapters mid-generation—but the privacy results rest on a metric that only catches verbatim leaks. The reported gains are real, but they're smaller in practice than the numbers suggest.\n\nWhat's new and good: an SFT dataset with formatting, style, and reasoning-type instructions for the thinking trace, and Staged Decoding, which swaps between an IF-RT adapter and an IF-FA adapter at the end of the thinking phase. The idea is simple, cheap, and the IF gains are consistent across six models. The privacy improvements—up to 51.9 points—are large, and the paper is honest about utility trade-offs, especially on MathIF. The Limitations section is candid about the setup's limits. That's real credit.\n\nThe soft spots: the privacy metric is exact string matching. The Limitations section claims leakage can be measured with 'absolute precision' because it's string matching. That's not right. The stress-test examples land: a model that outputs 'H e r i t a g e R e v i v e' or 'the secret starts with H' is scored as private, but the information is disclosed. So the privacy scores—and the RANA upper bound—share a blind spot. Part of the gain may be the model learning to paraphrase rather than withhold. That weakens the central claim that better IF causes better privacy. Second, the training dataset isn't linked, so the key contribution isn't reproducible. Third, the causal interpretation isn't isolated from SFT side-effects; a generic math SFT might also change behavior. Fourth, utility drops on MathIF are steep, and the correlation between IF-RT and utility is negative and significant.\n\nWho it's for: people working on privacy for agentic reasoning models, and anyone thinking about instruction following beyond final answers. The method is a useful baseline.\n\nRecommendation: send it to review. It deserves referee time. The novelty is real and the method is easy to re-implement. But the privacy evaluation needs a paraphrase-aware or embedding-based leakage metric, and the dataset should be released. With those changes, it could be a solid contribution.","headline":"Genuinely useful idea—RT-specific IF training with mid-response LoRA switching—but the privacy metric only catches verbatim leaks, so the central claim is weaker than the numbers suggest.","tokens_in":22941,"tokens_out":2696,"would_cite":true,"duration_ms":27705,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Improving instruction-following in reasoning traces substantially improves privacy, at some cost to task accuracy.","keywords":["privacy","reasoning traces","instruction following","Staged Decoding","LoRA adapters","contextual privacy","large reasoning models","prompt injection"],"falsifier":"Run an evaluation where a human or a semantic-leakage classifier checks whether models trained with this method ever reveal confidential information through paraphrases or indirect references (e.g., describing the password's characters or using synonyms) while the string-matching metric reports no leak; if such cases are common, the reported privacy gains overstate real-world protection.","tokens_in":22093,"feed_emoji":"🔒","tokens_out":3502,"duration_ms":34588,"temperature":0.7,"pith_summary":"The paper argues that privacy leaks in large reasoning models are essentially an instruction-following problem: models violate explicit privacy directives inside their reasoning traces, and those traces can be exposed through prompt injection. The authors show that if you fine-tune models to follow instructions about how to reason, and generate the reasoning and final answer with separate specialized adapters, you can sharply reduce private-data leakage. Across six models, they report gains of up to 20.9 points on instruction-following benchmarks and up to 51.9 percentage points on privacy benchmarks. The central trade-off is that these gains can come at the cost of task utility, especially on math reasoning, because instruction-following and reasoning performance pull against each other. The paper's contribution is a path toward privacy-aware agents built with small adapters rather than full retraining.","feed_headline":"Reasoning models leak less when their thoughts follow instructions","feed_subtitle":"A small fine-tuning recipe plus a two-adapter decoding trick lifts privacy by up to 52 points on benchmark tests.","key_machinery":"Staged Decoding: a decoding-time strategy that stops at the end-of-thinking token, unloads the low-rank adapter (LoRA) used for the reasoning trace, loads a different LoRA adapter optimized for final-answer instruction-following, and resumes generation. The reasoning-trace adapter is trained on a new SFT dataset of instructions that constrain only the reasoning trace — formatting, style, and reasoning-type constraints — plus progressively broader datasets that also target final-answer and joint constraints. This makes it possible to optimize instruction-following in each output component separately, with negligible computational overhead.","core_discovery":"The authors claim that improving instruction-following within reasoning traces directly translates into better contextual privacy: models trained on a new supervised dataset of reasoning-trace instructions (formatting, style, and reasoning-type constraints) leak far less private information in both their reasoning traces and final answers. They introduce Staged Decoding, which generates the reasoning trace with one LoRA adapter tuned for reasoning-trace instruction-following, then swaps in a second LoRA adapter tuned for final-answer instruction-following before generating the answer. This decoupling consistently maximizes both instruction-following scores and privacy scores, with the larges","pith_inferences":["Because leakage is measured by exact string matching, the method might be learning to avoid repeating secrets verbatim while still revealing them through paraphrase or indirect reference; a semantic-leakage evaluation would test whether the privacy gains hold up.","The two-adapter staged-decoding idea is generalizable beyond privacy—it could control other reasoning-trace properties like language, length, or format by decoupling per-component optimization.","The observed utility drop likely stems from the small GSM8K-only training set; training on more diverse, task-relevant data could preserve privacy gains while recovering utility.","Combining Staged Decoding with post-hoc anonymization of reasoning traces may approach the privacy ceiling of full anonymization while retaining more task utility, since the method already beats such anonymizers in utility on several models."],"forward_implications":["Privacy-aware reasoning agents can be built without full retraining: small LoRA adapters plus Staged Decoding produce large privacy gains across model families and sizes.","Staged Decoding yields the best of both worlds for instruction-following: it preserves the high reasoning-trace IF of the RT-optimized checkpoint while improving final-answer IF, beating baselines in 9 of 12 average-IF comparisons.","Improved instruction-following in reasoning traces is a practical lever for contextual privacy, with statistically significant privacy gains on both PasswordEval and PEEP in the paper's evaluation.","There is a real but task-dependent trade-off between privacy/instruction-following and utility; privacy benchmarks show a milder trade-off than math reasoning, and the paper suggests scaling training data could narrow the gap.","The method's success implies that privacy directives in system prompts are best treated as instructions to follow during reasoning, not just in the final answer."],"fun_headline_variants":["Teaching reasoning models to obey instructions reduces privacy leaks","Two-adapter decoding keeps reasoning traces from leaking private data","Instruction-following fine-tuning boosts privacy in reasoning models","SFT dataset and staged decoding cut privacy leaks by up to 52 points","Reasoning models leak less when their thoughts follow rules"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The privacy scores assume that leakage is identifiable with absolute precision via exact string matching; if a model paraphrases, encodes, or indirectly references the confidential token, it is scored as private even though the information still leaks.","fun_headline_variants_meta":{"raw":{"variants":["Teaching reasoning models to obey instructions reduces privacy leaks","Two-adapter decoding keeps reasoning traces from leaking private data","Instruction-following fine-tuning boosts privacy in reasoning models","SFT dataset and staged decoding cut privacy leaks by up to 52 points","Reasoning models leak less when their thoughts follow rules"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000267,"raw_usage":{"total_tokens":1461,"prompt_tokens":762,"completion_tokens":699,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":506,"completion_tokens_details":{"reasoning_tokens":617}},"tokens_in":506,"tokens_out":699,"duration_ms":8176,"temperature":1.0,"reasoning_tokens":617,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-02T20:00:24.415959+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run an evaluation where a human or a semantic-leakage classifier checks whether models trained with this method ever reveal confidential information through paraphrases or indirect references (e.g., describing the password's characters or using synonyms) while the string-matching metric reports no leak; if such cases are common, the reported privacy gains overstate real-world protection.","supporting_citations":[],"review_version":1}