Controllable Reasoning Models Are Private Thinkers

Paper: 2602.24210 Authors: Haritz Puerto, Haonan Li, Xudong Han, Timothy Baldwin, Iryna Gurevych Categories: cs.CL, cs.AI

Abstract

This paper addresses a critical privacy concern in AI reasoning models: the unintended leakage of sensitive information through reasoning traces. The authors propose a novel training approach that teaches models to follow instructions not only in their final outputs but also throughout their reasoning processes. By fine-tuning models on a specially designed instruction-following dataset with explicit reasoning constraints and introducing a decoupled generation strategy using separate LoRA adapters, they achieve substantial improvements across privacy and instruction-following benchmarks. Testing on six models ranging from 1.7B to 14B parameters, the method demonstrates gains of up to 20.9 points in instruction-following and 51.9 percentage points in privacy preservation, though with some trade-offs in task utility.

Key Contributions

• Introduction of a training paradigm that extends instruction-following capabilities to reasoning traces, not just final answers
• Creation of a new instruction-following dataset with explicit constraints on reasoning behavior
• Development of a decoupled generation strategy using separate LoRA adapters for reasoning and answer generation
• Comprehensive evaluation across six models from two families (1.7B-14B parameters) on both instruction-following and privacy benchmarks
• Demonstration of significant privacy improvements (up to 51.9 percentage points) while maintaining reasonable task performance

Methodology and Technical Approach

The core innovation lies in treating reasoning traces as controllable outputs subject to instruction constraints. Traditional reasoning models generate chain-of-thought explanations that may inadvertently expose private information, even when the final answer is sanitized. The authors address this by:

Instruction-Following Dataset: They construct a dataset where reasoning traces must adhere to specific constraints (e.g., “do not mention personal names in your reasoning”). This creates training examples where models learn to self-censor during the thinking process itself.

Decoupled Generation Architecture: The method employs separate LoRA adapters for two distinct phases:

• A reasoning adapter that generates privacy-aware intermediate thoughts
• An answer adapter that produces the final response

This architectural separation allows the model to maintain different behavioral patterns for internal reasoning versus external communication, similar to how humans might think through sensitive information privately before formulating a public response.

Training Objective: The fine-tuning process optimizes for both instruction adherence in reasoning traces and answer quality, creating a multi-objective learning problem that balances privacy preservation with task utility.

Experimental Results and Analysis

The evaluation spans two model families with varying scales, tested on instruction-following benchmarks (IFEval, FollowBench) and privacy benchmarks (PrivQA, Confaide). Key findings include:

Privacy Gains: Models show dramatic improvements in privacy preservation, with the best results achieving 51.9 percentage point increases. This suggests that explicit training on reasoning-level constraints can effectively prevent information leakage that occurs during the thinking process.

Instruction-Following: Improvements of up to 20.9 points demonstrate that the approach successfully teaches models to respect constraints throughout their generation process, not just in final outputs.

Performance Trade-offs: The authors honestly report that enhanced privacy control can reduce task utility. This reflects a fundamental tension: overly restrictive reasoning may limit the model’s ability to fully process information needed for optimal task performance. The trade-off varies by model size and task complexity.

Scaling Behavior: Results across the 1.7B to 14B parameter range reveal how model capacity affects the ability to simultaneously maintain privacy constraints and task performance, with larger models generally handling the dual objectives more effectively.

Implications for Privacy-Aware AI Systems

This work opens important directions for developing AI agents that can be trusted with sensitive data. The key insight—that reasoning traces are controllable through instruction-following training—challenges the assumption that model internals are inherently opaque and unmanageable.

For AI Safety: The decoupled architecture provides a mechanism for implementing differential privacy policies at different stages of generation, potentially enabling fine-grained control over information flow.

For Practical Deployment: Organizations deploying reasoning models in privacy-sensitive contexts (healthcare, finance, legal) can leverage these techniques to reduce liability while maintaining functionality.

Research Directions: The observed trade-offs between privacy and utility suggest fertile ground for future work on optimization strategies that better balance these competing objectives, perhaps through multi-task learning or adaptive constraint mechanisms.

The availability of code and data at the provided GitHub repository enables reproducibility and further exploration of controllable reasoning for privacy preservation.

Takeaways

1. Reasoning traces in language models can be trained to follow explicit privacy constraints, not just final answers
2. Decoupling reasoning and answer generation through separate LoRA adapters enables better control over information flow
3. Significant privacy improvements (up to 51.9 percentage points) are achievable through instruction-following training on reasoning traces
4. There exists a trade-off between privacy preservation and task utility that varies with model size and task complexity
5. Improving instruction-following capabilities in reasoning processes represents a promising direction for building privacy-aware AI agents
6. The approach generalizes across multiple model families and scales (1.7B-14B parameters)
7. Future privacy-preserving AI systems should consider controllability at all stages of generation, not just final outputs