PaperlayerView exact revision on arXiv

Source-linked AI summary

C$^2$U in RAG: Compositional Concept Unlearning in Retrieval-Augmented Generation

Yiyang Duan, Fan Wu, Tiantong Wu, Che Wang, Zhiren Gong, Wei Guo, Yang Cao, Wei Yang Bryan Lim

arXiv:2610.29223v1cs.CL

TL;DR

RAG can expose unwanted concepts through retrieved evidence even when a generator is moderated, while document deletion can remove useful content alongside the target. C2U routes a profile-derived direction through atom coordinates and applies a bounded delta to the raw query with a fixed encoder and index. The validation-selected configuration lowers pooled target Hit@5 by 4.25 pp with non-positive control costs, and the paper reports bounded suppression rather than concept removal.

  • Problem

    RAG can place unwanted evidence in a model’s context, while output moderation does not change that retrieval pathway and document deletion can remove useful content.

    Source: §1 · p. 1

  • Method

    C2U uses a calibrated gate and profile-derived direction carried through atom coordinates, returning a bounded weight-difference update to the raw query while leaving the encoder and index fixed.

    Source: §3 · p. 4

  • Results

    4.25 pp: pooled binary target Hit@5 decreases from 94.7333% to 90.4833%, with positive H5 Drop and non-positive CN and TE on every dataset.

    Source: §4.2 · pp. 6–7

  • Takeaways & Limitations

    C2U is suited to fixed-index retrievers that can tolerate partial, bounded suppression rather than concept removal.

    Source: §5 · p. 10

    The evaluation covers five English datasets and four encoders, evaluates retrieval rather than generated-output safety, and tests untouched multi-concept composition only on ArXiv K = 4.

    Source: Limitations · p. 10

Abstract

from arXiv · show

Retrieval-augmented generation can expose unwanted concepts through retrieved evidence even when the generator is moderated. We study query-side concept suppression with a fixed encoder and document index. Compositional Concept Unlearning (C$^2$U) routes a profile-derived direction through an augmented atom bank, adding only a bounded edited-minus-original delta to the raw query. Across five datasets, four encoders, and three seeds, the validation-selected configuration reduces pooled binary target Hit@5 by 4.25 percentage points with non-positive control degradation and target-exposure changes. Under the evaluated query transforms, it suppresses target density without increasing budgeted control-query exposure. Separately, ArXiv four-concept composition improves over an averaged-direction comparator after independent validation gates and first-use test evaluation.

1 Introduction

RAG can expose unwanted evidence through retrieval, while moderation and document deletion do not address that pathway without trade-offs. The paper proposes bounded query-side suppression on a fixed encoder and index, then evaluates suppression, utility, exposure, and concept composition.

Motivation

  • RAG can place private, unwanted, or policy-restricted evidence in a model’s context; moderation may reject outputs without changing retrieval, while deleting documents can also remove useful content.The proposed intervention suppresses concept-bearing retrieval while leaving the encoder and indexed corpus unchanged; “unlearning” here is not certified parameter deletion or a guarantee about generated answers.Source: §1 · p. 1

Problem scope

  • The problem requires profile-guided bounded edits on a fixed-index retriever, evaluation under ordinary and transformed queries, and a shared editing budget for multiple concepts.The evaluation distinguishes methods by the information available to them because lowering target retrieval need not lower exposure under context packing, and query transforms cannot inspect and remove target documents like membership-aware filters.Source: §1 · p. 1

Approach

  • C2U combines an Atomic Compositional Representation with a raw-query bypass, using target profiles and calibration controls to determine a negative, preconditioned direction and calibrated gate.Least-squares coefficients and an appended residual atom carry the direction through the frozen atom bank; only the weight difference returns to the raw query, with a trust region limiting the update.Source: §1 · pp. 1–2

Evaluation

  • The paper evaluates suppression and its limits against stronger-access methods and methods with larger utility costs, and tests whether query transforms increase context exposure.Separately, ArXiv four-concept composition passes selection, independent confirmation, and first-use test evaluation, while the two-concept design fails selection.Source: §1 · p. 2

Contributions

  • The contributions are bounded query editing with calibrated gating, residual completion, and a raw-query trust region; joint retrieval and exposure comparisons; and separate-gate concept composition against averaged-direction steering.The operator has gate-off exact identity, and the evaluations span datasets, encoders, and query conditions with explicit access classes and evidence scope.Source: §1 · p. 2

2 Related Work and Problem

Prior work addresses retrieval quality, output moderation, parameter unlearning, and representation control, but does not establish the behavior of bounded query-side editing in fixed-index retrieval. This paper formalizes suppression, control retrieval, and exposure as distinct outcomes for an operator that does not observe query roles or target-document membership.

Retrieval and safety

  • RAG retrieval and safety work, output moderation, and database redaction address related but distinct parts of the problem; this intervention preserves the raw document index searched by retrieval.Retrieved sources can introduce unsafe content or poisoning, and output defenses alone therefore need evaluation in this setting.Source: §2 · p. 2

Unlearning and representation control

  • Parameter-updating unlearning and representation-control methods motivate selective interventions, but do not establish fixed-index retrieval behavior; this work focuses on a bounded query-side operator and its composition rule.The comparisons include INLP, LEACE, CURE, and RAG Embedder Control.Source: §2 · p. 2

Problem formulation

  • The formal problem edits a normalized frozen-encoder query to reduce target retrieval while preserving control-label retrieval and avoiding extra target exposure on control queries.Query-role and target-document membership labels are evaluation inputs, not inputs to deployed C2U; the index vectors remain unchanged and retrieval ranks queries by their inner products with those vectors.Source: §2 · p. 3

Deployment information

  • A target profile guides suppression through examples rather than a runtime list of forbidden document IDs, while calibration controls set the gate before evaluation.The same operator processes target and control queries without observing their roles, so target suppression and control-query exposure are evaluated separately.Source: §2 · p. 3

3 Deployed Query Editing

C2U trains an atom bank and projection head while keeping the encoder frozen, then edits raw queries by transferring a profile-derived direction through atom coordinates. A calibrated gate and angular trust region bound the update; the paper also reports why profile subtraction is inactive under its locked bank and runtime.

Atomic representation

  • The atom bank is a learned dictionary of unlabeled unit directions; a projection head scores encoded text against its rows, and temperature-scaled softmax weights combine the atoms to reconstruct the representation.The encoder remains frozen during bank-and-head training, and the reconstruction is a training device rather than the deployed query.Source: §3 · p. 3

Design rationale

  • The deployed edit transfers a profile direction into atom-coordinate weight changes, but returns only the weight-difference delta to the raw encoder query rather than substituting its reconstruction.The index stores raw encoder vectors, so replacing the query with the reconstruction would define a different method and break identity with the unchanged-index deployment.Source: §3 · pp. 3–4

Residual completion

  • Residual completion appends an atom for the profile direction’s out-of-span component, allowing the selected β = 1 setting to recover the full direction in exact arithmetic.For zero or small residuals, the method instead uses an in-span projection; the bank and weight-generating head are frozen after training.Source: §3 · p. 4

Raw-query trust region

  • The raw-query update takes a full step when feasible or reduces its step size to satisfy the trust-region constraint; gate-off and zero-delta rows return the input directly.The 0.2-rad cap is tighter than the 0.98 cosine floor and can further reduce the realized angle.Source: §3 · p. 4

Design rationale

  • The trust region bounds query motion, not retrieval damage; for ideal unit queries, each unit document’s score changes by at most 2 sin(θmax/2).The raw-query bypass and trust region keep the deployed operator query-side and index-preserving.Source: §3 · p. 4

Direction and calibrated gate

  • The calibrated gate decides whether to edit using the profile and unlabeled calibration controls alone, without candidate labels or ranks, and passes concept-distant queries through as an exact identity.The direction is negative and diagonally preconditioned; calibration uses a separate raw-space score, with a conservative fallback for degenerate calibration.Source: §3 · pp. 3–4

Design rationale

  • For multiple concepts, separate gates allocate one shared angular budget before their deltas are added, preventing active gates from compounding into unbounded motion.This keeps the composed operator bounded, query-side, and index-preserving.Source: §3 · p. 4

Why not profile subtraction

  • Under the locked bank and deployed runtime, measured profile-subtraction variants are exact inactive identities, with top-30 profile overlap of only ≈0.0011 and applied angle near 2 × 10^-5 rad.Validation-only bank-retraining and off-diagonal-loss probes did not revive subtraction; the authors attribute the result to nearly disjoint query and profile weight coordinates and do not rule out subtraction under other banks or objectives.Source: §3 · pp. 4–5

4 Evaluation

Across five datasets, C2U is evaluated as a bounded query-side intervention under single-concept, transformed-query, and multi-concept settings. Results show partial target suppression, with utility and exposure outcomes depending on the comparison and evaluation condition.

4.1 Setup and Evidence Scope

  • The single-concept evaluation uses five datasets, four frozen encoders, three seeds, and 60 units with disjoint profile, selection, confirmation, and final-evaluation allocations.ArXiv controls are relaxed global controls, and IMDB uses one synthetic template per role; single-concept and attack evaluations are posthoc extensions of test units.Source: §4.1 · p. 5

4.2 Single-Concept Results

  • Pooled binary target Hit@5 falls from 94.7333% to 90.4833%, a 4.25 pp drop, with non-positive CN and TE on every dataset.Pooled CN is −0.68 pp and TE −5.65 pp; the reduction is not near-complete removal.Source: Table 2 · p. 6, §4.2 · pp. 6–7

4.3 Analysis of Bounded Editing

  • The gate edits 94.7% of target and 71.5% of control queries, with 76.5% and 44.3%, respectively, at the 0.2 rad cap.After-edit target queries have lower target-centroid cosine; the figure’s raw-control state is unedited, unlike most control queries in the experiment.Source: Figure 3 · p. 7, §4.3 · p. 7

4.2 Single-Concept Results

  • Stronger-access Filter-and-Refill and Rank-Router exceed C2U with utility-clean outcomes, while other methods show larger suppression alongside utility or exposure costs.RAG-Emb-Ctrl has pooled H5 Drop +48.12 pp and IMDB TE +25.00 pp; DARE-GRL has pooled H5 Drop +25.20 pp, CN +29.16 pp, and TE +36.34 pp.Source: §4.2 · p. 7
  • Encoder-level effects vary: C2U’s Amazon H5 Drop ranges from 2.0 pp with bge to 14.0 pp with e5, while only bge shows an IMDB drop.CN is non-positive in 19 of 20 dataset–encoder cells and TE in all 20.Source: §4.2 · p. 7

4.4 Suppression and Exposure under Query Transforms

  • C2U suppresses target density in all 15 dataset–condition cells with 0/15 divergent, but attack utility changes range from −5.2 to +2.6 pp.Divergence means density decreases while control-context exposure increases; these counts are descriptive signs, not significance tests.Source: Table 3 · p. 8, §4.4 · pp. 8–9

4.5 Multi-Concept Composition

  • ArXiv K = 4 composition achieves a +0.04125 test lift over the averaged-direction comparator, with all four compose concept cells positive.The arm passed selection and independent confirmation before first access to fresh test rows; the expanded budget means this is not a sample-size-only comparison.Source: §4.5 · pp. 9–10, Figure 4 · p. 9
  • In multi-concept editing, independent concept gates allocate requests within a shared budget, shrinking each share when several gates fire.Per-concept lifts are positive but uneven, from +1.4 pp for Artificial Intelligence to +14.2 pp for Number Theory.Source: §4.5 · p. 9

5 Conclusion

C2U applies bounded, profile-derived query edits while leaving the encoder and index unchanged. In the evaluated settings, it reduces target retrieval and exposure, while supporting partial suppression rather than removal.

5 Conclusion

  • C2U applies a calibrated gate and residual-atom direction to rotate the raw query by at most 0.2 rad before retrieval.The encoder and index remain unchanged.Source: §5 · p. 10
  • The selected configuration reduces pooled target Hit@5 by 4.25 pp, with non-positive control costs on every dataset mean.Under evaluated query transforms, density and control exposure changes are non-positive in every dataset–condition cell.Source: §5 · p. 10
  • C2U is suited to fixed-index retrievers that tolerate partial, bounded suppression rather than concept removal.Source: §5 · p. 10

Limitations

The claims are bounded by partial suppression, a narrow data and evaluation scope, and retrieval-only assessment.

Limitations

  • After-edit target Hit@5 remains near 90% pooled, so C2U reduces exposure rather than removing a concept.Source: Limitations · p. 10
  • The evaluation covers five English datasets and four encoders, with specified query-unit limits and dataset-specific constraints.IMDB has one template per role, ArXiv uses relaxed global controls, and the untouched multi-concept claim covers ArXiv K = 4 only.Source: Limitations · p. 10
  • Generated-output safety, multilingual and open-domain corpora, and defense-aware adaptive attackers are untested.Low runtime access also does not establish a measured cost advantage.Source: Limitations · p. 10

Ethical considerations

Retrieval-side suppression may hide legitimate evidence or enforce biased policies, so the paper calls for transparent governance and auditing. Its implementation and evaluation protocol also fixes the encoder and index and uses separately specified budgets and gates.

Ethical considerations

  • Suppression may hide legitimate evidence or enforce biased policies; concept definitions, profile access, and non-target effects require governance and auditing.The method is not a substitute for privacy deletion, consent, output safeguards, or monitoring.Source: Ethical considerations · p. 10

A.1 Implementation and Data Protocol

  • The protocol encodes raw frozen-document embeddings once per unit and shares them bit-identically across methods without mutating the index.Retrieval uses dot products of L2-normalized embeddings.Source: §A.1 · p. 13
  • Single-concept and attack cohorts use 100 target/300 control index documents and queries per unit, with 20 target-profile documents.Selection and independent confirmation precede the single-concept method lock; only expanded ArXiv K = 4 first accesses its allocated test rows after passing its acceptance gate.Source: §A.1 · p. 13

A.2 Evaluation Metrics

The appendix defines the retrieval metrics and documents the training, deployment, and validation choices behind the evaluation. It also specifies the scope of the ArXiv and TOFU tasks.

A.2 Evaluation Metrics

  • H5, TC, and CN are reductions from Base to Method, whereas TE is Method minus Base; binary Hit@5 and exposure use target-label presence, while CN uses control own-label presence.Per-dataset H5 intervals reuse paired-row bootstrap samples; no pooled H5 interval is reported, and IMDB resampling does not represent independent semantic examples.Source: §A.2 · pp. 13–15

A.3 ACR Training and Reconstruction

  • ACR trains atom weights and a reconstruction from frozen representations, but deployment adds only the edited-minus-original weight delta to the raw query.The reconstruction is used by the training objective; replacing the raw query with it would define a different method.Source: §A.3 · p. 15

A.4 Optimization Setup

  • ACR freezes the encoder and optimizes the atom bank and projection head using triplet retrieval, alignment, and atom-weight entropy objectives.The reported setup uses alignment weight 1.0, entropy weight 0.02, retrieval margin 0.3, and temperature 0.1.Source: §A.4 · p. 16

A.5 Historical Profile Subtraction (Not the Deployed Edit)

  • The historical subtraction expressions do not specify the selected additive operator, and the tested subtraction variants are inactive under the locked bank and runtime.The measured applied-angle diagnostic is approximately 2 × 10^-5 rad; this does not establish that every subtraction method must fail.Source: §A.5 · p. 16

A.6 Numerical Details and Validation-Only Mechanism Probes

  • Validation selects β = 1; the tested operating-point alternatives fail the utility gate, while knob-only and orthogonality-loss probes both leave subtraction inactive.These bounded probes do not exhaust possible losses or establish a general impossibility result.Source: §A.6 · pp. 17–18

A.7 Compute Environment

  • The locked re-evaluation ran on one NVIDIA L20 GPU, and C2U does not fine-tune a generator or rebuild the retriever index during unlearning.Legacy latency, peak-memory, and checkpoint-size figures are not reported because they are not artifact-proven under the locked protocol.Source: §A.7 · p. 18

B Dataset Details

  • The five datasets pair a target concept with a control attribute; ArXiv targets L2 System Attacks against a relaxed global control, while TOFU targets fact topics while preserving author identity.ArXiv queries use paper titles or abstract first sentences; TOFU queries come from dataset questions and documents are biography records.Source: B Dataset Details · p. 18, §B.1 · p. 18, §B.2 · p. 19

B.3 Classification and Inference Tasks

The tasks vary which concept is suppressed and which retrieval signal is preserved, while the baselines differ in access and adaptation. A case study illustrates selected target-removal flips and states their limits.

B.3 Classification and Inference Tasks

  • Amazon suppresses sentiment while preserving product category, IMDB suppresses genre while preserving sentiment, and MNLI suppresses source genre while preserving the NLI label.IMDB uses synthetic queries that explicitly mention the target concept; its locked rows reduce to one unique query text per target and control role.Source: §B.3 · p. 19

C Baseline Implementation Details

C.1 Linear Concept Erasure Methods

C.2 Model Editing Baselines (Diagnostic Adaptations)

  • PISCES masks target-centroid directions in an adapted retriever projection, while DARE-GRL trains a lightweight mapper and sparsifies its merged delta.These are in-house adaptations of PISCES (Gur-Arieh et al., 2025) and DARE-style merging (Yu et al., 2024a).Source: §C.2 · p. 20

C.3 Recent Embedding-Space Baselines (Diagnostic Adaptations)

  • The CURE and RAG Embedder Control adaptations fit query-only adapters from labeled calibration vectors and keep the raw document index.CURE is locked to a zero-strength identity by the utility gate; RAG Embedder Control is a portable adaptation, not a full-embedder reproduction.Source: §C.3 · p. 20

C.4 Other Query-Side and Stronger-Access References

  • The references include Raw identity and Delta-Edit query controls, stronger-access filtering and routing methods, and norm-matched random perturbation.Filter-and-Refill uses candidate/document membership, Rank-Router uses target-membership labels, and random noise controls for generic representation degradation.Source: §C.4 · p. 20

D Case Study: Target-Suppression Flips

  • Five locked test examples—one per dataset—show target top-five hits removed after bounded rotations of about 0.2 rad, but they are success-selected rather than frequency estimates.Each base top five contains one target-labeled document and the edited list none; the examples do not establish unchanged control neighborhoods.Source: Table 6 · p. 21, D Case Study: Target-Suppression Flips · p. 21

D.1 Legacy Qualitative Atom Examples

  • Table 7 presents high-usage ArXiv atoms from the original evaluation pipeline, with labels serving only as post-hoc qualitative summaries.The table is retained as qualitative context, not as a locked-pipeline result.Source: Table 7 · p. 22, §D.1 · p. 22

E Full Dataset–Method and Dataset–Encoder Results

The section documents the scope and aggregation of the full results tables, including how utility-clean status and within-class markings are determined.

E Full Dataset–Method and Dataset–Encoder Results

  • Table 8 retains the complete dataset–method rendering, rather than presenting only a subset of the dataset–method rendering.Source: E Full Dataset–Method and… · p. 22
  • Tables 9–12 provide dataset-by-encoder decompositions for four metrics, with each cell averaging three locked seeds.Source: E Full Dataset–Method and… · p. 22
  • Utility-clean status requires CN and TE at or below 10^-9; rankings are marked only within the exact profile-only access class, without cross-class dominance claims.ArXiv retains the relaxed global control label and IMDB the duplicate-template diagnostic label.Source: E Full Dataset–Method and… · p. 22

F Visual Diagnostics

The diagnostics visualize pooled suppression and utility, target-query geometry, applied angles, profile concentration, and target-versus-control density. They replot locked outcomes rather than add new evidence.

F Visual Diagnostics

  • Figure 5 plots pooled suppression against utility cost for methods and datasets, with colors encoding locked access classes; DARE-GRL’s larger suppression coincides with larger positive CN and TE costs.Source: F Visual Diagnostics · p. 22
  • Figure 6a compares target-query cosine to the target-document centroid before and after steering, with steered distributions shifted left in every dataset.The passage describes this as a geometric reading of the Hit@5 drops, not a standalone certification of suppression.Source: F Visual Diagnostics · p. 22
  • Figure 6b reads out the angle actually applied to each test query; gate-off rows are exact identities, and many active edits reach the 0.2-rad cap.Among active edits, 80.7% of target edits and 61.9% of control edits are at the cap.Source: F Visual Diagnostics · pp. 22–23
  • Figure 7a plots median normalized profile weights by atom-rank fraction; sharper drop-offs indicate more concentrated profile mass, not necessarily sparse deployed edits.Source: F Visual Diagnostics · pp. 23–24
  • Table 9 reports locked test-stage Hit@5 Drop by dataset and encoder, with higher values indicating stronger target suppression.Table 8 supplies the broader dataset–method rendering.Source: Table 8 · p. 23, Table 9 · p. 24
  • Figure 7b compares target-at-base, steered-target, and control cosine distributions to the unchanged index’s target centroid; movement toward controls reads as suppressed concept expression but is only one direction.Source: F Visual Diagnostics · p. 24

G Multi-Concept Composition Ladder

After three earlier composition attempts did not authorize a test, the expanded ArXiv four-concept design passed selection and independent confirmation, then improved over the averaged-direction comparator on untouched test rows.

Endpoint and composition design

  • The endpoint compares per-method, per-unit minima of concept Hit@5 before averaging unit differences; it does not minimize paired conceptwise differences.Separate concept gates allocate a shared angular budget before the deltas are added.Source: G Multi-Concept Composition Ladder · p. 24

Original pools (v1)

  • The original-pool pass was validation-only: pooled MNLI and ArXiv K = 4 passed selection and confirmation, but that pass authorized no test.All eight dataset–concept compose H5 cells were positive; other datasets were capacity-blocked, not zeros.Source: G Multi-Concept Composition Ladder · p. 25

New pools (v2)

  • The new-pool design failed acceptance despite a positive selection endpoint; its registered cursor-reset defect contaminated selection, and independent confirmation did not replicate.Test rows remained disjoint from other slices and were never accessed.Source: G Multi-Concept Composition Ladder · p. 25

Cursor-disjoint rebuild (v3)

  • The cursor-disjoint rebuild failed selection for both pre-registered ArXiv K = 2 and K = 4 designs, so confirmation and test were not run.Pre-outcome capacity and mechanism rules restricted this rebuild to ArXiv; the other datasets lacked required controls or suitable suppression conditions.Source: G Multi-Concept Composition Ladder · p. 25

Capacity expansion (v4)

  • All v4 power tiers failed the predeclared 0.8 criterion, so the adjudicated fallback used the largest feasible T3 budget.T3 allocated 200 selection, 200 confirmation, and 400 test target queries per concept, plus 1,200 controls per split; evaluation pools and budgets changed while the method and atom bank remained unchanged.Source: G Multi-Concept Composition Ladder · p. 26
  • +0.04125 was the hard-gated test endpoint for ArXiv K = 4, with all four concept cells, three seeds, and four encoders positive.The 95% CI was [+0.0325, +0.050625]; the retained table rounds the endpoint to +0.0412.Source: G Multi-Concept Composition Ladder · p. 26
  • ArXiv K = 4 passed selection (+0.0425) and independent confirmation (+0.0517), while K = 2 failed selection at −0.0008.The K = 4 test used previously unused rows and was evaluated without tuning after the passing lock.Source: G Multi-Concept Composition Ladder · p. 26

Scope

  • The v4 improvement is scoped to ArXiv K = 4 and does not establish that larger budgets remove interference or that atom representation alone causes the gain.Earlier locked validation differences inform a budget design, not a causal diagnosis of quantization noise.Source: G Multi-Concept Composition Ladder · p. 26

H Query-Transform Evaluation and Full Results

C2U suppresses target density across evaluated query conditions without raising control exposure; separately, ArXiv four-concept composition passes selection, confirmation, and first-use test evaluation.

H Query-Transform Evaluation and Full Results

  • The original arm contains 504,000 per-query rows; recent-baseline and multi-concept evaluations are posthoc extensions, with no test tuning or untouched-test claim.The frozen packages retain per-arm protocols and locks, per-query outputs, aggregation rules, and independent checks.Source: H Query-Transform Evaluation and Full… · pp. 27, 33, I Reproducibility and Source Record · p. 34
  • Under locked test conditions, target-cosine distributions shift left of base in every dataset; 80.7% of target edits and 61.9% of control edits sit at the 0.2-rad cap.The percentages use edited queries as the denominator; gate-off rows are zero.Source: H Query-Transform Evaluation and Full… · p. 29
  • ArXiv K=4 composition passes selection, independent confirmation, and first-use test evaluation, while K=2 fails selection and does not enter test.The locked K=4 test difference is +0.0412, with CI95 [+0.0325, +0.0506]; the oracle-refill reference is +0.7181.Source: Table 13 · p. 31, Figure 8 · p. 32
  • C2U lowers target density in all 15 dataset–condition cells and never raises control exposure, while attack utility ranges from −5.2 to +2.6 pp.Table 15 expands the condition-level values; these are descriptive outcomes, not significance tests or adaptive-attack certification.Source: H Query-Transform Evaluation and Full… · p. 28, Table 15 · p. 33

I Reproducibility and Source Record

  • The reproducibility record distinguishes frozen experimental audit chains from the ARR conversion record, and the restructuring adds no experiments or test-time selection.Generated summaries derive from locked aggregates rather than newly accessed raw test queries.Source: I Reproducibility and Source Record · p. 34

J Theoretical Analysis of the Deployed Edit Operator

  • The theoretical analysis separates exact real-arithmetic identities from the finite-precision, thresholded implementation and proves no retrieval benefit or absence of multi-concept interference.Its assumptions include unit queries and documents where stated.Source: J Theoretical Analysis of the Deployed… · p. 34

J.1 Trust-Region Geometry of the Delta Exit

  • The trust-region exit chooses a feasible step no larger than one, with angular limit min(θcap, arccos γfloor); the drift bound does not cover all numerical outputs.The lemma excludes parallel degeneracies, and finite-precision checks do not establish exact boundary attainment or rounded-cosine monotonicity.Source: §J.1 · pp. 34–35

J.2 Exact Direction Routing through the Residual Atom

  • Residual completion makes the routed direction p + βe and recovers the full direction at β=1, but numerical fallback and rounding can introduce error.The theorem describes ideal routing, not bitwise equality or a retrieval advantage over dense routing.Source: §J.2 · pp. 35–36
Loading 2610.29223v1…