LEMUR: Latent Entropy-aware Multimodal Unlearning via Visual-anchored Reasoning Redirection

Based on the provided paper, here is a detailed technical summary of LEMUR: Latent Entropy-aware Multimodal Unlearning via Visual-anchored Reasoning Redirection.

Problem Definition

Reinforcement Learning (RL) post-training has significantly enhanced the visual reasoning capabilities of Multimodal Large Reasoning Models (MLRMs) by enabling them to emit explicit "chains of thought" (CoT) before answering. However, this capability introduces a distinct privacy vulnerability: while existing machine unlearning methods can successfully remove sensitive facts from a model's final answer, they often fail to prevent the model from reciting those same facts within its internal reasoning trace.

The authors identify that this "reasoning-trace leakage" is substantially more pronounced in RL-trained MLRMs than in their non-reasoning base models. Existing unlearning approaches, which typically focus on fine-tuning weights or intervening at the final answer level, are ill-equipped to handle this. They either fail to monitor the diverse, exploratory trajectories induced by RL or degrade the model's reasoning capabilities when attempting to perturb the trace.

Key Observation: The Entropy Signature

The core insight driving this work is the discovery of a distinctive token-level entropy signature associated with the recitation of memorized sensitive content in RL-trained models.

• Two-Stage Pattern: When an RL-trained model recalls a sensitive attribute, it exhibits a characteristic rise-and-collapse pattern in token-level entropy ($H_t(v)$).
  1. Deliberation Stage: The model hesitates among candidate values, causing entropy to spike as multiple candidates compete.
  2. Commitment Stage: Once the model commits to the memorized span, entropy collapses to near-zero as it deterministically recites the attribute.
• This signature is largely absent in non-reasoning base models, where entropy distributions are more chaotic. This dynamic provides a reliable, training-free signal to detect when sensitive reasoning begins and ends.

Methodology: LEMUR

LEMUR is a fully training-free, inference-time unlearning framework designed specifically for natively RL-trained multimodal models. It operates by monitoring the decoding process and intervening only when sensitive content is detected. The method consists of three primary components:

1. Entropy-Augmented Sensitivity Switching:

   • LEMUR combines a lexical check (forbidden token sets) with the entropy signature to trigger a "sensitive mode."
   • The trigger condition ($g_t$) activates if either a high mass of forbidden tokens is detected (committed recital) OR if high entropy is detected alongside a lower threshold of forbidden mass (deliberation stage). This ensures intervention starts at the very beginning of the sensitive span, not just after the model has committed to the wrong answer.

2. Entropy-Aware Visual Anchor Injection:

   • Once in sensitive mode, LEMUR switches from standard autoregressive decoding to a latent decoding regime.
   • Instead of feeding back a discrete token, the model receives a continuous embedding constructed via Constrained Latent Feedback (renormalizing the distribution to exclude forbidden tokens) and Visual Redirection Anchors.
   • The anchors consist of a Visual Anchor (averaged embedding of visual special tokens to re-ground reasoning in the image) and a Safe-Answer Anchor (embeddings of refusal/uncertainty templates).
   • Entropy-Controlled Injection: The strength of injecting these anchors ($\gamma_t$) is dynamically modulated by the current token entropy. High entropy (deliberation) receives strong steering; low entropy (committed text) receives weaker steering to preserve fluency.

3. Dynamic Entropy-Controlled Phase Duration:

   • To prevent the intervention from persisting too long (degrading fluency) or ending too soon (allowing leakage), LEMUR uses an adaptive exit mechanism.
   • It tracks the model's baseline entropy on normal text and terminates the latent phase only when the entropy recovers above an adaptive threshold ($\kappa \bar{H}_t$) and the forbidden mass clears.
   • A "refractory cooldown" prevents rapid oscillation between discrete and latent modes, ensuring the coherence of the surrounding reasoning.

Experimental Results

The authors evaluated LEMUR on RL-trained MLRMs (R1-Onevision-7B and Vision-R1-7B) using a reconstructed dataset based on MLLMU-Bench, which includes fictitious subjects with private attributes.

• Leakage Suppression: LEMUR significantly outperformed both training-based baselines (e.g., Gradient Ascent, NPO) and training-free baselines (e.g., R-MUSE). It achieved the lowest Subject-Level Reasoning Leakage (SRL), effectively erasing sensitive facts from both the reasoning trace and the final answer.
• Utility Preservation: Unlike training-based methods that often degrade general capabilities, LEMUR preserved performance on non-forget data (Retain and Celebrity splits) across classification, fill-in-the-blank, and generation tasks.
• Fluency: The Reasoning Retention Ability (RRA) metric showed that LEMUR maintained fluent, well-formed reasoning, whereas aggressive baselines often caused the model to collapse into repetitive or degenerate text.
• Generalization: The method was also tested on non-RL models (Qwen2.5-VL) and general visual reasoning corpora (VQAv2), demonstrating that while the entropy signal is strongest in RL models, the framework remains effective and transferable.

Significance and Claims

The paper claims to be the first unlearning method designed specifically for natively RL-trained multimodal reasoning models. Its primary contributions are:

1. Identifying a Privacy Risk: Demonstrating that RL-induced exploration creates a unique privacy vulnerability where reasoning traces leak sensitive data even when answers are clean.
2. Exploiting Entropy Dynamics: Showing that the token-level entropy signature of memorized recall provides a reliable, training-free signal for detecting and intercepting leakage during decoding.
3. Effective Training-Free Unlearning: Proposing LEMUR, which achieves state-of-the-art unlearning performance without retraining, by steering the decoding trajectory through entropy-modulated visual anchoring.

The authors conclude that decoding-time entropy dynamics offer a promising foundation for privacy control in reasoning-capable models, suggesting that future safety objectives could be addressed by exploiting these internal signals rather than relying solely on weight updates.