做模型遗忘审计的团队会发现，思维链泄露可能被误判为权重记忆，这篇论文提供了一个简单有效的 sanity check 方法，值得在评估流程中加上。
该研究审计了推理模型在遗忘后是否仍通过思维链泄露已遗忘内容。使用 DeepSeek-R1-Distill-Qwen-7B 和 LoRA 记忆虚构作者，通过 NPO 遗忘和六 token canary 头条件，发现思维链替换为短非 canary 前缀可显著降低答案率，而 bypass 间隙本身不能可靠指示权重级记忆。不同种子下结果不一致，甚至出现反转。推荐在标准审计外增加解码时模板替换作为廉价检查。
Auditing Reasoning-Trace Memorization Claims after Unlearning with Head-Conditioned Canaries
Evaluations of unlearning on reasoning models sometimes show a bypass pattern. The answer side looks unlearned, but the model's own thinking trace keeps emitting the forgotten content, and the gap is taken as evidence that the weights still remember. We audit this reading on DeepSeek-R1-Distill-Qwen-7B with LoRA-memorized fictional authors and NPO unlearning, conditioned on a six-token canary head. On one seed, swapping the thinking trace for a short non-canary prefill on the same weights drops the answer rate by as much as the bypass gap itself, whether the prefill mimics the training template or not. On a second seed the bypass gap shrinks rather than vanishing, and the prefill swap reverses direction and brings the answer rate to ceiling. A positive parser-split bypass gap thus does not by itself identify hidden weight-level memorization, and does not rule it out either. On a different distillate the same metric flips sign because the parser cannot find the closing tag. We recommend a decode-time template swap as a cheap sanity check alongside the canonical audit.