Controllable Reasoning Models Are Private Thinkers
| Authors | Haritz Puerto et al. |
| Year | 2026 |
| Field | NLP |
| arXiv | 2602.24210 |
| Download | |
| Categories | cs.CL, cs.AI |
Abstract
AI agents powered by reasoning models require access to sensitive user data. However, their reasoning traces are difficult to control, which can result in the unintended leakage of private information to external parties. We propose training models to follow instructions not only in the final answer, but also in reasoning traces, potentially under different constraints. We hypothesize that improving their instruction following abilities in the reasoning traces can improve their privacy-preservation skills. To demonstrate this, we fine-tune models on a new instruction-following dataset with explicit restrictions on reasoning traces. We further introduce a generation strategy that decouples reasoning and answer generation using separate LoRA adapters. We evaluate our approach on six models from two model families, ranging from 1.7B to 14B parameters, across two instruction-following benchmarks and two privacy benchmarks. Our method yields substantial improvements, achieving gains of up to 20.9 points in instruction-following performance and up to 51.9 percentage points on privacy benchmarks. These improvements, however, can come at the cost of task utility, due to the trade-off between reasoning performance and instruction-following abilities. Overall, our results show that improving instruction-following behavior in reasoning models can significantly enhance privacy, suggesting a promising direction for the development of future privacy-aware agents. Our code and data are available at https://github.com/UKPLab/arxiv2026-controllable-reasoning-models
Engineering Breakdown
Plain English
This paper addresses a critical privacy vulnerability in AI reasoning models: when models use multi-step reasoning to answer questions, their intermediate reasoning traces can leak sensitive user information even when the final answer is carefully controlled. The authors propose fine-tuning models to follow privacy-preserving instructions not just in final outputs but throughout their reasoning process, using a new instruction-following dataset with explicit privacy constraints. They introduce a dual LoRA adapter approach that decouples reasoning generation from answer generation, allowing separate control over each stage. The method is evaluated across six different models, demonstrating that better instruction-following in reasoning traces significantly improves privacy preservation.
Core Technical Contribution
The core novelty is reframing privacy in reasoning models as an instruction-following problem rather than a content-filtering problem. Instead of trying to sanitize reasoning traces after generation, the authors train models to naturally avoid revealing sensitive information during reasoning itself, through explicit instruction tuning on constrained examples. The dual LoRA adapter architecture is the key technical contribution—it uses two separate parameter-efficient adapters to independently control the reasoning phase and answer generation phase, enabling fine-grained privacy constraints without retraining the entire model. This decoupled approach is fundamentally different from prior work that treats reasoning and answering as a monolithic process, and it allows dynamic application of different privacy policies to different stages of inference.
How It Works
The system operates in three stages. First, models are fine-tuned on a new instruction dataset where each example includes explicit restrictions on what information can appear in reasoning traces (e.g., 'reason about this medical case without mentioning the patient's identity'). During training, the model learns to follow these meta-instructions—instructions about how to reason—rather than just learning task-specific outputs. Second, at inference time, the method uses two LoRA adapters: one adapter specializes in generating reasoning traces that respect privacy constraints, while a second adapter specializes in generating final answers given the reasoned output. The decoupling works by having the first adapter condition the reasoning generation with privacy instructions, then freezing those hidden states and applying the second adapter only to the final answer generation. This prevents information leaked during reasoning from being re-emphasized in the answer phase. The generation strategy effectively creates a bottleneck where sensitive information discovered during reasoning cannot be amplified in the output.
Production Impact
This approach directly addresses a production-critical issue: deployed reasoning models (like those used in healthcare, finance, or legal tech) routinely process sensitive data and generate long reasoning chains that could be logged, monitored, or accidentally exposed. By ensuring privacy constraints are baked into model behavior rather than requiring external filtering, you eliminate the attack surface where intermediate computations leak information to monitoring systems or model observers. The practical implementation is straightforward—you'd add a privacy instruction layer to your fine-tuning pipeline and swap LoRA adapters at inference time, adding minimal latency (LoRA inference adds ~5-10% overhead). However, this requires curating a dataset of sensitive reasoning examples with privacy annotations, which is expensive and domain-specific. The trade-off is that privacy becomes a first-class model property rather than a post-hoc mitigation, reducing the need for expensive differential privacy mechanisms or information-theoretic defenses that severely degrade model quality.
Limitations and When Not to Use This
The paper assumes that instruction following in reasoning traces is sufficient for privacy, but adversarial reconstruction attacks on hidden states during generation could still leak information—the approach doesn't provide formal privacy guarantees like differential privacy does. The evaluation is limited to six models (the abstract is truncated), and it's unclear whether the approach generalizes to larger frontier models or multi-agent reasoning scenarios where information flows through multiple model invocations. The method requires creating privacy-annotated instruction datasets, which doesn't scale easily to new domains or new types of sensitive information not covered during training. Additionally, there's an inherent tension: more specific privacy instructions may degrade reasoning quality by preventing the model from exploring certain logical paths, and the paper doesn't thoroughly quantify this accuracy-privacy trade-off across different task types.
Research Context
This work builds on the emerging field of instruction-following research and controllable generation (e.g., work on prompt-based control and adapter-based fine-tuning like LoRA). It addresses a gap identified in recent work on reasoning models' vulnerability to information leakage, particularly as models like o1 and similar chain-of-thought systems become more widely deployed. The paper contributes to the safety and interpretability literature by treating reasoning transparency not as something to debug but as something to actively control via training. It opens a research direction toward 'instruction-based privacy'—the idea that privacy properties can be learned like any other instruction-following capability—which contrasts with prior work that treats privacy and capability as orthogonal concerns.
:::tip Subscribe Get weekly breakdowns of papers like this in AI Letters - the newsletter for engineers building production AI systems. :::