C$^2$U in RAG: Compositional Concept Unlearning in Retrieval-Augmented Generation

Introduction

Retrieval-Augmented Generation (RAG) grounds answers in external documents, but also creates a pathway for private, unwanted, or policy-restricted evidence to enter a model’s context. Output moderation can reject a response without changing that evidence pathway. Conversely, deleting whole documents can remove useful content alongside an unwanted concept. We study an intermediate intervention: suppress concept-bearing retrieval through query-side representation editing, leaving the encoder and indexed corpus unchanged. Here, “unlearning” means retrieval-stage suppression, not certified parameter deletion or a guarantee about generated answers.

The problem has four aspects: intervention happens on a fixed-index retriever, a small profile must guide bounded query edits, suppression–utility trade-offs must hold under ordinary and transformed queries, and several concepts must share an editing budget. Figure 1 locates the intervention within RAG. Linear erasure provides useful comparisons, but reducing target retrieval need not reduce exposure under context packing. Access also matters: a query transform cannot inspect and remove target documents like a membership-aware filter. We therefore evaluate suppression, utility, and exposure together, distinguishing the information available to each method.

Image not extracted

$C^{2}$U combines an Atomic Compositional Representation (ACR) with a raw-query bypass. Target profiles and calibration controls determine a negative, diagonally preconditioned direction and a calibrated gate. Least-squares coefficients and an appended residual atom carry that direction through the frozen atom bank; only the weight difference returns to the raw query. A trust region limits the update. For multiple concepts, separate gates allocate a shared angular budget before their deltas are added.

The experiments assess both useful suppression and its limits. The single-concept comparison includes stronger-access methods and methods that suppress more at larger utility costs; query-transform evaluation tests whether suppression coexists with increased context exposure. Separately, ArXiv four-concept composition passes selection, independent confirmation, and first-use test evaluation, while the two-concept design fails selection. Our contributions are threefold:

• Bounded query editing. An atom-coordinate operator with calibrated gating, residual completion, and a raw-query trust region (§ 3) with gate-off exact identity.

• Suppression and utility evidence. Joint retrieval and exposure comparisons across datasets, encoders, and query conditions, with explicit access classes and evidence scope.

• Concept composition. Separate-gate, shared-budget editing evaluated against averaged-direction steering.

Related Work and Problem

Retrieval and safety. RAG research improves retrieval and context use through filtering, ranking, and corrective generation ([12, 2, 30, 28, 17]). Retrieved sources can nevertheless introduce unsafe content or poisoning ([1, 31]). Moderation and safety frameworks ([13, 16]) address complementary parts of this problem; adversarial suffixes and latent instructions illustrate why output defenses alone need evaluation ([32, 22]). Unlike database redaction or retriever optimization ([25]), our intervention preserves the raw document index that retrieval searches.

Unlearning and representation control. Parameter-updating unlearning ([6, 24, 8]) and diffusion concept erasure ([21, 9, 27, 5]) motivate selective interventions but do not establish fixed-index retrieval behavior. INLP ([23]) and LEACE ([4]) remove linearly accessible concepts; CURE ([15]) and RAG Embedder Control ([14]) provide recent representation-control comparisons. Our focus is a bounded query-side operator and its composition rule. Training and adaptation differences are described in Sections A.3 and C.

Problem. Let $q \in S^{d-1}$ be a normalized frozen-encoder query and $u_j \in S^{d-1}$ the unchanged indexed document vectors. Retrieval ranks $q^\top u_j$. Given a target concept profile, we produce $q'$ to reduce target retrieval while preserving control-label retrieval and avoiding extra target exposure on control queries. Query-role and target-document membership labels are evaluation inputs, not inputs to the deployed C2U operator.

A profile identifies what to suppress through examples, not a runtime list of forbidden document IDs. Calibration controls characterize non-target geometry and set the gate before evaluation. At retrieval time the same operator applies to target and control queries without observing their roles. Suppressing target-seeking queries can still introduce unwanted evidence for other users, so target suppression and control-query exposure are separate outcomes throughout the evaluation.

Deployed Query Editing

Atomic representation. The atom bank $A \in\mathbb{R}^{N \times d}$ is a learned dictionary whose rows $a_i$ are unlabeled unit directions in the encoder’s representation space; $N$ varies by dataset and encoder (Section A.1). The frozen encoder maps text $x$ to $h_x$, and a lightweight projection head scores $h_x$ against every row; a temperature-scaled softmax turns these scores into atom weights, whose bank combination reconstructs the representation:

Training optimizes only the bank and head—the encoder stays frozen throughout—with a retrieval objective on $z_x$ and an entropy penalty that keeps $w_x$ peaked; both are frozen afterward (Section A.3). Editing then happens in atom coordinates: a direction in representation space becomes a change of weight coefficients rather than a free-form vector edit. The reconstruction itself never enters deployment. The index stores raw encoder vectors, and online editing returns only the weight-difference delta to the raw query rather than replacing the query by $z_x$; substituting the reconstruction would define a different method and break identity with the unchanged index deployment searches.

Direction and calibrated gate. Let $\mu_t,\mu_c$ be means of normalized target-profile and calibration-control vectors. With $v = \operatorname{normalize}(\mu_t - \mu_c)$, the negative, diagonally preconditioned direction is $g = \operatorname{normalize}(-D^{-1}v)$, where $D$ is a ridge-regularized, shrunk diagonal control second-moment matrix. A separate raw-space score $z(q) =$ $q^\top\operatorname{normalize}(u_t)-q^\top\operatorname{normalize}(u_c)$ determines the continuous gate:

Here $z_0,z_1$ are the calibration-control median and 95th percentile. The gate uses neither ranks nor candidate labels; degenerate calibration uses the conservative fallback in Section A.6.

Residual completion. The bank $\mathcal{A}\in\mathbb{R}^{N\times d}$ and weight-generating head are frozen after ACR training (Section A.3); $N$ varies by dataset and encoder (Section A.1). Solve $a=\operatorname{lstsq}(\mathcal{A}^{\top},g)$ and set $p=\mathcal{A}^{\top}a$, $e=g-p$. Above the residual threshold, append $r=e/\lVert e\rVert$ and use $b_\beta=[a;\beta\lVert e\rVert]$ in $\mathcal{A}'=[\mathcal{A};r]$. For zero or small residuals, append $r=p/\lVert p\rVert$ with coefficient zero; a degenerate $p$ fails closed. Thus $\beta$ scales only the appended coefficient. At the selected $\beta=1$, projected and residual components recover full $g$ in exact arithmetic; the small-residual branch instead truncates $e$ to its in-span projection.

Angular allocation and delta transfer. Let $h=\mathcal{A}'^{\top}b_\beta$ and $\phi=\angle(q,h)$. The requested angle is $\theta_{\mathrm{req}}=0.3s(q)$; angular feasibility gives $\theta=\max(0,\min(\theta_{\mathrm{req}},\phi-\epsilon_{\mathrm{plane}}))$. For active, feasible rows set

Edited weights are neither clipped nor renormalized. Normalizing $h$ defines its angle only; $b_\beta$ retains its magnitude. The requested, feasible, and realized angles therefore differ in general, particularly when $\beta\ne1$. Transfer the actual edited-minus-padded weight difference:

Training uses reconstruction, whereas online editing uses this difference; precision, cancellation, and threshold details are in Section A.6.

Raw-query trust-region update. For active rows, return $q'=\operatorname{normalize}(q+\eta\delta_q)$, taking the full step if feasible and otherwise reducing $\eta\in[0,1]$ to satisfy the numerical counterpart of

The raw query, not its reconstruction, anchors the update (Figure 2). Gate-off and zero-delta rows return the input directly. The 0.2-rad cap is tighter than the 0.98 cosine floor and can further reduce the realized angle. Numerical checks are detailed in Section A.6.

Image not extracted

The trust region bounds motion, not retrieval damage. For ideal unit queries satisfying a cap $\theta_{\max}$, each unit document’s score changes by at most $2\sin(\theta_{\max}/2)$ (Theorem J.4).

Design rationale. Each component answers one deployment question. The calibrated gate decides whether a query is edited at all, from the profile and unlabeled calibration controls alone: it needs neither candidate labels nor ranks, scales the requested angle continuously, and passes concept-distant queries through as an exact identity. The raw-query bypass fixes what is edited: the deployed object is the encoder’s own vector, the index is never touched, and the reconstruction $z_x$ stays a training device. The residual atom makes the profile direction expressible in bank coordinates even when the frozen atom bank does not span it, so the weight-difference transfer carries the full direction rather than its projection, and the trust region bounds the resulting rotation. In composition, one shared budget caps the summed rotation across concepts, so several active gates cannot compound into a large motion, keeping the deployed operator bounded, query-side, and index-preserving.

Why not profile subtraction. The classical atom-coordinate edit subtracts profile mass from query weights (Section A.5). Under the locked bank and deployed runtime, every measured subtraction variant is an exact inactive identity: frozen query weights overlap the top-30 atom profile by only $\approx0.0011$, and the applied-angle diagnostic stays near $2 \times10^{-5}$ rad. Two validation-only revival probes—knob-only bank retraining and an off-diagonal orthogonality loss—fail to revive subtraction and leave the deployed route unchanged (Section A.6). Atom coordinates are what make this failure measurable: query and profile mass occupy almost disjoint weight coordinates, so a subtractive edit has nothing to act on. Suppression must instead add a bounded rotation along the completed direction—the deployed operator. These bounded interventions do not rule out every subtraction method under other banks or objectives.

Evaluation

Setup and Evidence Scope

We evaluate Amazon, ArXiv, IMDB, MNLI, and TOFU ([19, 3, 26, 18]), using MiniLM, bge, e5, and Qwen3 frozen encoders and three seeds. Single-concept stages contain 60 units, each with 100 target and 300 control queries, a shared 100-target/300-control raw index, and 20 target-profile documents. The final comparison contains 6,000 target and 18,000 control row contributions. Profile, selection, confirmation, and final-evaluation allocations are disjoint; selection and independent confirmation precede the fixed configuration.

Table 1 summarizes the task each dataset poses: a target concept whose documents should leave the top ranks is paired with a control attribute whose retrieval must survive the edit—a scientific topic against its ArXiv category, a sensitive biography topic against author identity, review sentiment against product category, movie genre against review sentiment, and source genre against the entailment label. Queries are titles or abstracts, natural questions, review titles, or hypotheses; IMDB uses one synthetic template per role. ArXiv controls come from the whole corpus rather than matched categories, so its control statistics describe a relaxed, global comparison.

Dataset	Target	Control	Queries
ArXiv	topic	categoryg	title/abstract
TOFU	sensitive topic	author identity	questions
Amazon	sentiment	product category	review titles
IMDB	movie genre	sentiment	templatedd
MNLI	text genre	logic label	hypotheses

Single-concept and attack evaluations are posthoc extensions of existing test units, without test tuning or an untouched-test claim. Multi-concept experiments use separate budgets and acceptance gates; only ArXiv $K = 4$ reaches a separately gated first-use test. IMDB’s row-bootstrap intervals are duplicate-template diagnostics, not strong semantic-sample evidence.

Access and metrics. C$^{2}$U uses profiles and unlabeled calibration controls without candidate access. Raw, Delta-Edit, PISCES, Random, and the portable DARE-GRL mapper are query-side comparisons; INLP, LEACE, CURE, and RAG-Emb-Ctrl additionally fit on 400 labeled calibration examples per unit. Filter-and-Resell uses candidate/document membership; Rank-Router uses target-document membership as a label-assisted benchmark router. PISCES, DARE-GRL, CURE, and RAG Embedder Control are in-house diagnostic adaptations, not official reproductions ([11, 10, 15, 14] (Yi et al. 2025)). Their access classes preclude a cross-class dominance interpretation.

Binary H5 Drop is the reduction in any-target-in-top-five retrieval on target queries. CN is control own-label Hit@5 loss; TE is the change in any-target-in-top-five retrieval on control

Raw (zero differences) is omitted; positive CN or TE is a cost. ‡Candidate/document access; §membership-assisted; ʳrelaxed global control; ᵈduplicate-template diagnostic.

queries. Positive CN or TE is a cost; utility-clean means both rate changes are at most $10^{-9}$. We report rate differences in percentage points (pp), with target-cosine changes in the full results.

Dataset summaries average four encoders and three seeds; pooled summaries weight the five datasets equally. Absolute levels and per-dataset intervals are in Table 4; statistical definitions and resampling scope are in Section A.

Dataset	Raw H5 (%)	C²U H5 (%)	Drop (pp)	95% CI (pp)
Amazon	96.83	90.50	+6.33	[4.83, 7.92]
ArXivr	97.83	92.17	+5.67	[4.42, 7.00]
IMDB1	100.00	97.42	+2.58	[1.75, 3.50]
MNLI	94.58	91.17	+3.42	[2.25, 4.50]
TOFU	84.42	81.17	+3.25	[1.92, 4.58]

Single-Concept Results

Suppression and utility. Table 2 shows larger C$^{2}$U suppression on Amazon and ArXiv than on MNLI and TOFU. Aggregate-derived pooled binary target Hit@5 decreases from 94.7333% to 90.4833%, a 4.25 pp drop rather than near-complete removal. H5 Drop is positive with non-positive CN and TE on every dataset; pooled CN is −0.68 pp and TE −5.65 pp.

Method	H5 Drop $\uparrow$	CN $\downarrow$	TE $\downarrow$
Amazon
C$^{2}$U	+6.33	-0.64	-12.44
Delta-Edit	0.00	0.00	-0.08
PISCES	-0.33	-0.25	+2.69
Random	+1.17	-0.17	+3.00
INLP	+12.17	-0.50	+18.86
LEACE	+36.58	-0.61	-0.83
RAG-Emb-Ctrl	+68.83	-0.69	-33.53
CURE	0.00	0.00	0.00
DARE-GRL	+22.50	-0.11	+38.53
Filter-and-Refill‡	+0.92	-0.56	-4.14
Rank-Router§	+7.00	-0.64	-13.83
ArXivʳ
C$^{2}$U	+5.67	-1.25	-7.64
Delta-Edit	0.00	+0.03	0.00
PISCES	-0.17	-0.25	+1.33
Random	+1.08	+4.92	+6.31
INLP	+5.92	+5.00	+8.89
LEACE	+1.00	+2.19	+16.19
RAG-Emb-Ctrl	+69.50	+5.56	-21.03
CURE	0.00	0.00	0.00
DARE-GRL	+22.67	+68.58	+58.61
Filter-and-Refill‡	+38.33	-1.97	-18.06
Rank-Router§	+5.67	-1.08	-7.64
IMDBᵈ
C$^{2}$U	+2.58	0.00	0.00
Delta-Edit	0.00	0.00	0.00
PISCES	+1.83	0.00	0.00
Random	+2.42	+2.03	+23.11
INLP	0.00	0.00	+16.67
LEACE	+1.83	0.00	+8.33
RAG-Emb-Ctrl	+30.75	0.00	+25.00
CURE	0.00	0.00	0.00
DARE-GRL	+34.08	+25.00	+58.33
Filter-and-Refill‡	0.00	0.00	0.00
Rank-Router§	+2.58	0.00	0.00
MNLI
C$^{2}$U	+3.42	-1.08	-6.03
Delta-Edit	0.00	+0.03	+0.03
PISCES	-0.25	-0.08	+0.42
Random	+1.58	+2.67	+3.67
INLP	+4.00	+0.22	+5.83
LEACE	+1.25	+0.06	+7.94
RAG-Emb-Ctrl	+42.58	+1.33	-34.25
CURE	0.00	0.00	0.00
DARE-GRL	+35.42	+27.72	+14.50
Filter-and-Refill‡	+10.50	-1.94	-11.83
Rank-Router§	+3.83	-1.22	-6.36
TOFU
C$^{2}$U	+3.25	-0.44	-2.14
Delta-Edit	0.00	0.00	+0.03
PISCES	+0.42	+0.08	+0.53
Random	-0.92	+0.94	+0.92
INLP	+6.42	+6.47	+9.00
LEACE	+4.92	-0.08	+0.58
RAG-Emb-Ctrl	+28.92	-1.19	-23.78
CURE	0.00	0.00	0.00
DARE-GRL	+11.33	+24.58	+11.72
Filter-and-Refill‡	+4.00	-1.19	-7.31
Rank-Router§	+4.58	-0.42	-2.67
Pooled
C$^{2}$U	+4.25	-0.68	-5.65
Delta-Edit	0.00	+0.01	-0.01
PISCES	+0.30	-0.10	+0.99
Random	+1.07	+2.08	+7.40
INLP	+5.70	+2.24	+11.85
LEACE	+9.12	+0.31	+6.44
RAG-Emb-Ctrl	+48.12	+1.00	-17.52
CURE	0.00	0.00	0.00
DARE-GRL	+25.20	+29.16	+36.34
Filter-and-Refill‡	+10.75	-1.13	-8.27
Rank-Router§	+4.73	-0.67	-6.10

Suppression–utility trade-offs. RAG-Emb-Ctrl reaches pooled H5 Drop +48.12 pp, with utility/exposure costs including IMDB TE +25.00 pp; CURE is a utility-gated no-op and does not suppress. DARE-GRL reaches +25.20 pp with CN +29.16 pp and TE +36.34 pp. Filter-and-Refill (+10.75 pp) and Rank-Router (+4.73 pp) exceed C2U with utility-clean outcomes under stronger access. Full results and the Pareto view are in Section E and Figure 5.

Image not extracted

Encoder heterogeneity. The dataset means hide a wide encoder-level spread (Table 9, Table 11 and Table 12). On Amazon, C2U’s H5 Drop ranges from 2.0 pp with bge to 14.0 pp with e5; ArXiv is the most uniform (4.3–8.0 pp), MNLI spans 1.7–6.7 pp and TOFU 1.3–5.0 pp; on IMDB only bge shows a drop (10.3 pp). e5 is the most responsive encoder on three datasets and Qwen3 the least on three. CN is non-positive in 19 of 20 dataset–encoder cells (MNLI with Qwen3: +0.67 pp) and TE in all 20. The pooled 4.25 pp thus summarizes behaviours that differ sevenfold across encoders.

Dataset	Encoder	C$^{2}$U	Raw	INLP	LEACE	RAG-Emb-Ctrl	CURE	PISCES	DARE-GRL	Random	Delta-Edit	Filter-and-Refill$^{\ddagger}$	Rank-Router$^{\S}$
Amazon	minilm	0.0633	<u>0.0000</u>	0.0733	0.1367	0.4867	0.0000	-0.0100	-0.0167	-0.0100	<u>0.0000</u>	0.0033	0.0900
	bge	0.0200	<u>0.0000</u>	0.0100	0.6300	0.9800	0.0000	0.0000	<u>0.4700</u>	<u>0.0000</u>	<u>0.0000</u>	0.0233	0.0200
	e5	0.1400	0.0000	0.1567	0.4867	0.4767	0.0000	0.0000	<u>0.3333</u>	<u>0.0333</u>	0.0000	0.0000	0.1400
	qwen3	0.0300	0.0000	0.2467	0.2100	0.8100	0.0000	-0.0033	0.1133	<u>0.0233</u>	0.0000	0.0100	0.0300
ArXiv	minilm	0.0500	0.0000	0.0467	0.0033	0.9600	0.0000	0.0000	<u>0.2133</u>	<u>0.0200</u>	0.0000	0.5833	0.0500
	bge	0.0800	0.0000	0.0900	0.0067	0.5000	0.0000	0.0000	<u>0.3167</u>	<u>0.0100</u>	0.0000	0.2567	0.0800
	e5	0.0533	0.0000	0.0733	0.0200	0.4400	0.0000	-0.0033	-0.0300	<u>0.0100</u>	0.0000	0.1800	0.0533
	qwen3	0.0433	0.0000	0.0267	0.0100	0.8800	0.0000	-0.0033	<u>0.4067</u>	<u>0.0033</u>	0.0000	0.5133	0.0433
IMDB	minilm	<u>0.0000</u>	0.0000	0.0000	0.0000	0.0000	0.0000	<u>0.0000</u>	0.0000	0.0033	<u>0.0000</u>	0.0000	0.0000
	bge	0.1033	0.0000	0.0000	0.0000	0.5767	0.0000	0.0000	<u>0.3333</u>	<u>0.0433</u>	0.0000	0.0000	0.1033
	e5	<u>0.0000</u>	0.0000	0.0000	0.0733	0.3933	0.0000	0.0733	<u>0.6667</u>	<u>0.0267</u>	0.0000	0.0000	0.0000
	qwen3	<u>0.0000</u>	0.0000	0.0000	0.0000	0.2600	0.0000	0.0000	<u>0.3633</u>	<u>0.0233</u>	0.0000	0.0000	0.0000
MNLI	minilm	0.0267	0.0000	0.0667	0.0267	0.7300	0.0000	0.0033	<u>0.5333</u>	<u>0.0100</u>	0.0000	0.1833	0.0333
	bge	0.0267	0.0000	0.0400	0.0300	0.3133	0.0000	0.0000	<u>0.3000</u>	<u>0.0033</u>	0.0000	0.0800	0.0300
	e5	0.0667	0.0000	-0.0067	0.0033	0.2767	0.0000	-0.0133	<u>0.2433</u>	<u>0.0433</u>	0.0000	0.1400	0.0733
	qwen3	0.0167	0.0000	0.0600	-0.0100	0.3833	0.0000	0.0000	<u>0.3400</u>	<u>0.0067</u>	0.0000	0.0167	0.0167
TOFU	minilm	0.0433	<u>0.0000</u>	0.0467	0.0200	0.1967	0.0000	0.0000	<u>0.3933</u>	-0.0067	<u>0.0000</u>	0.0567	0.0500
	bge	0.0233	0.0000	0.0667	0.0600	0.2733	0.0000	-0.0033	<u>0.1833</u>	<u>0.0133</u>	0.0000	0.0267	0.0467
	e5	0.0500	0.0000	0.0500	0.1000	0.2933	0.0000	0.0100	-0.1133	-0.0133	0.0000	0.0433	0.0600
	qwen3	0.0133	0.0000	0.0933	0.0167	0.3933	0.0000	0.0100	-0.0100	-0.0300	0.0000	0.0333	0.0267

Dataset	Encoder	C$^{2}$U	Raw	INLP	LEACE	RAG-Emb-Ctrl	CURE	PISCES	DARE-GRL	Random	Delta-Edit	Filter-and-Refill$^{\ddagger}$	Rank-Router$^{\S}$
Amazon	minilm	-0.0011	0.0000	0.0000	-0.0011	-0.0011	0.0000	0.0000	-0.0011	0.0000	0.0000	0.0011	-0.0011
Amazon	bge	-0.0167	0.0000	-0.0144	-0.0178	-0.0178	0.0000	-0.0067	0.0056	-0.0056	0.0000	-0.0167	-0.0167
Amazon	e5	-0.0033	0.0000	-0.0011	-0.0022	-0.0033	0.0000	-0.0011	-0.0033	0.0000	0.0000	-0.0033	-0.0033
Amazon	qwen3	-0.0044	0.0000	-0.0044	-0.0033	-0.0056	0.0000	-0.0022	-0.0056	-0.0011	0.0000	-0.0033	-0.0044
ArXiv	minilm	-0.0122	0.0000	0.0178	0.0233	0.0978	0.0000	-0.0044	0.6544	0.0044	0.0000	-0.0167	-0.0089
ArXiv	bge	-0.0078	0.0000	0.0422	0.0256	0.0100	0.0000	-0.0011	0.7244	0.0156	0.0000	-0.0189	-0.0111
ArXiv	e5	-0.0144	0.0000	0.1189	0.0178	0.0478	0.0000	-0.0022	0.6211	0.1467	0.0000	-0.0200	-0.0067
ArXiv	qwen3	-0.0156	0.0000	0.0211	0.0211	0.0667	0.0000	-0.0022	0.7433	0.0300	0.0011	-0.0233	-0.0167
IMDB	minilm	0.0000	0.0000	0.0000	0.0000	0.0000	0.0000	0.0000	0.3333	0.0578	0.0000	0.0000	0.0000
IMDB	bge	0.0000	0.0000	0.0000	0.0000	0.0000	0.0000	0.0000	0.3333	0.0022	0.0000	0.0000	0.0000
IMDB	e5	0.0000	0.0000	0.0000	0.0000	0.0000	0.0000	0.0000	0.0000	0.0211	0.0000	0.0000	0.0000
IMDB	qwen3	0.0000	0.0000	0.0000	0.0000	0.0000	0.0000	0.0000	0.3333	0.0000	0.0000	0.0000	0.0000
MNLI	minilm	-0.0244	0.0000	-0.0256	-0.0067	0.0389	0.0000	-0.0078	0.2322	0.0167	0.0011	-0.0422	-0.0256
MNLI	bge	-0.0100	0.0000	-0.0211	-0.0033	0.0078	0.0000	-0.0022	0.2578	0.0256	0.0000	-0.0211	-0.0078
MNLI	e5	-0.0156	0.0000	0.0356	0.0000	-0.0100	0.0000	0.0000	0.3278	0.0356	0.0000	-0.0178	-0.0200
MNLI	qwen3	0.0067	0.0000	0.0200	0.0122	0.0167	0.0000	0.0067	0.2911	0.0289	0.0000	0.0033	0.0044
TOFU	minilm	-0.0067	0.0000	0.0278	-0.0000	-0.0133	0.0000	0.0011	0.1833	-0.0033	0.0000	-0.0078	-0.0067
TOFU	bge	-0.0011	0.0000	0.0467	0.0000	-0.0067	0.0000	0.0011	0.2400	0.0122	0.0000	-0.0067	-0.0011
TOFU	e5	-0.0011	0.0000	0.1122	-0.0067	-0.0156	0.0000	-0.0011	0.2567	0.0233	0.0000	-0.0089	-0.0011
TOFU	qwen3	-0.0089	0.0000	0.0722	0.0033	-0.0122	0.0000	0.0022	0.3033	0.0056	0.0000	-0.0244	-0.0078

Dataset	Encoder	C$^{2}$U	Raw	INLP	LEACE	RAG-Emb-Ctrl	CURE	PISCES	DARE-GRL	Random	Delta-Edit	Filter-and-Refill$^{\ddagger}$	Rank-Router$^{\S}$
Amazon	minilm	-0.0700	0.0000	0.0811	0.0178	-0.3533	0.0000	0.0067	0.3678	0.0189	-0.0011	-0.0100	-0.1011
Amazon	bge	-0.1356	0.0000	0.2922	-0.0611	-0.2644	0.0000	0.0111	0.3956	0.0200	0.0000	-0.0933	-0.1411
Amazon	e5	-0.1800	0.0000	0.2733	-0.0267	-0.2556	0.0000	0.0644	0.3778	0.0600	0.0000	-0.0256	-0.1833
Amazon	qwen3	-0.1122	0.0000	0.1078	0.0367	-0.4678	0.0000	0.0256	0.4000	0.0211	-0.0022	-0.0367	-0.1278
ArXiv	minilm	-0.0389	0.0000	0.0567	0.1922	-0.1756	0.0000	-0.0033	0.5067	0.0211	0.0000	-0.1467	-0.0389
ArXiv	bge	-0.0878	0.0000	0.0500	0.1789	-0.1789	0.0000	0.0078	0.4700	0.0333	0.0000	-0.1478	-0.0878
ArXiv	e5	-0.1089	0.0000	0.1900	0.1422	-0.2578	0.0000	0.0400	0.7056	0.1489	0.0000	-0.2156	-0.1089
ArXiv	qwen3	-0.0700	0.0000	0.0589	0.1344	-0.2289	0.0000	0.0089	0.6622	0.0489	0.0000	-0.2122	-0.0700
IMDB	minilm	0.0000	0.0000	0.6667	0.3333	0.0000	0.0000	0.0000	1.0000	0.2822	0.0000	0.0000	0.0000
IMDB	bge	0.0000	0.0000	0.0000	0.0000	0.3333	0.0000	0.0000	0.6667	0.0944	0.0000	0.0000	0.0000
IMDB	e5	0.0000	0.0000	0.0000	0.0000	0.3333	0.0000	0.0000	0.3333	0.3167	0.0000	0.0000	0.0000
IMDB	qwen3	0.0000	0.0000	0.0000	0.0000	0.3333	0.0000	0.0000	0.3333	0.2311	0.0000	0.0000	0.0000
MNLI	minilm	-0.0556	0.0000	0.0378	0.0433	-0.3789	0.0000	-0.0078	-0.1211	-0.0044	0.0000	-0.1411	-0.0578
MNLI	bge	-0.0611	0.0000	0.0111	0.0433	-0.3833	0.0000	-0.0011	0.0722	0.0167	0.0000	-0.1544	-0.0644
MNLI	e5	-0.0911	0.0000	0.1400	0.1333	-0.3011	0.0000	0.0211	0.2500	0.0756	0.0000	-0.1456	-0.0978
MNLI	qwen3	-0.0333	0.0000	0.0444	0.0978	-0.3067	0.0000	0.0044	0.3789	0.0589	0.0011	-0.0322	-0.0344
TOFU	minilm	-0.0200	0.0000	0.0633	0.0211	-0.1844	0.0000	0.0022	-0.2378	0.0100	0.0000	-0.0611	-0.0278
TOFU	bge	-0.0244	0.0000	0.1111	0.0167	-0.2433	0.0000	0.0144	0.0811	0.0100	0.0011	-0.0433	-0.0267
TOFU	e5	-0.0167	0.0000	0.1122	-0.0233	-0.2133	0.0000	0.0056	0.3356	0.0222	0.0000	-0.0811	-0.0244
TOFU	qwen3	-0.0244	0.0000	0.0733	0.0089	-0.3100	0.0000	-0.0011	0.2900	-0.0056	0.0000	-0.1067	-0.0278

Operating point. The deployed configuration is the validation-selected residual coefficient $\beta= 1$ with the 0.2-rad cap and 0.98 cosine floor; the validation sweep over larger caps and smaller $\beta$ found no eligible alternative (Section A.6).

Analysis of Bounded Editing

Figure 3 summarizes the bounded operator on the posthoc rows. The gate admits most queries: 94.7% of target and 71.5% of control queries receive an edit. The cap then binds: 76.5% of target and 44.3% of control queries sit at the 0.2 rad boundary, so realized motion is usually below the requested angle. Panel (b) shows after-edit target queries at lower cosine to the target-document centroid. This view is consistent with the Hit@5 drops in Table 2; the retrieval effect is measured there, not inferred from the shift. Two cautions remain: Control (raw) is unedited while most control queries are edited, and centroid cosine is one directional, not full semantic alignment. Full angle distributions and retrieval examples: Figure 6b and Table 6.

Image not extracted

Dataset	Query	Target	Base top-5 labels	Method top-5 labels	TC drop	Angle
Amazon	WORTH THE MONEY	Positive	Negative, Positive, Negative, Negative, Positive	Negative, Negative, Negative, Negative, Negative	+0.101	0.196
ArXiv	Research about AI-based code generators have gained a fundamental role in assisting developers in writing software starting from natural language (NL)	System Attacks	Software Engineering, Software Engineering, Software Engineering, System Attacks, Artificial Intelligence	Software Engineering, Software Engineering, Artificial Intelligence, Software Engineering, Machine Translation	+0.166	0.200
IMDB	Positive feedback on Horror cinema	Horror	Romance, Romance, Horror, Action, Sci-Fi	Action, Sci-Fi, Romance, Sci-Fi, Sci-Fi	+0.103	0.200
MNLI	The marauders rounded up the villagers.	fiction	travel, travel, travel, travel, fiction	travel, travel, travel, travel, travel	+0.114	0.200
TOFU	Who is the person described in the text: ’In Luka Khachidze’s works, readers can expect a diverse range of characters, but predominantly they are male leads exploring their love interests and overcom. . .	Work	General, General, General, Work, Work	General, General, General, General, Family	+0.123	0.200

Suppression and Exposure under Query Transforms

We compare each method with Raw under the same condition: standard queries, instruction injection, or Zou-noise suffixes (Zou et al., [32]). Target density $\Delta$ is the change in the fraction of top-five documents carrying the target label, averaged over target queries; it is not binary H5 Drop. CER $\Delta$ records whether any target document enters the packed context ($B = 512 Density: target-label fraction in the target-query top-5; CER: any-target occurrence in the packed control context (budget $B=512$, at most 50 documents); utility: control own-label Hit@10 loss. CURE never suppresses. ^rArXiv: relaxed global control. ^dIMDB: duplicate-template diagnostic. ^pPooled: equal-weight mean over the five datasets (fifteen dataset–condition cells). Metric definitions and posthoc scope: §4.4.

tokens, at most 50 documents), averaged over control queries. Attack utility is control own-label Hit@10 loss, distinct from CN and TE. The two describe different populations, so a decrease in one need not entail a decrease in the other; both are reported together.

Table 3 shows why the two must be read together. INLP lowers Amazon target density by 15.8 pp while raising control exposure by 17.6 pp: target documents leave the target queries’ top five but enter other users’ packed controls. RAG-Emb-Ctrl lowers both on four datasets, most strongly on ArXiv (−72.4 and −21.9 pp), but raises IMDB exposure (+8.9 pp) and costs control utility (+5.3 pp on ArXiv, +5.7 on MNLI). $C^{2}$U’s density and CER means are negative on every dataset with utility changes between −2.2 and +0.3 pp.

Amazon	Method	Density $\Delta$ $\downarrow$	CER $\Delta$ $\downarrow$	Utility loss $\downarrow$
Amazon	$C^{2}$U	-16.4	-13.7	0.0
Amazon	PISCES	-1.2	+4.3	0.0
Amazon	Random	-0.4	+6.4	0.0
Amazon	INLP	-15.8	+17.6	0.0
Amazon	LEACE	-21.9	+2.4	0.0
Amazon	RAG-Emb-Ctrl	-34.7	-31.4	0.0
Amazon	CURE	0.0	0.0	0.0
Amazon	DARE-GRL	-9.2	+46.0	0.0
MNLI	Method	Density $\Delta$ $\downarrow$	CER $\Delta$ $\downarrow$	Utility loss $\downarrow$
MNLI	$C^{2}$U	-14.9	-6.8	+0.3
MNLI	PISCES	-2.3	+0.4	-0.2
MNLI	Random	-3.9	+1.2	+1.2
MNLI	INLP	-17.7	+4.8	-0.9
MNLI	LEACE	-8.4	+3.3	-0.3
MNLI	RAG-Emb-Ctrl	-40.6	-47.5	+5.7
MNLI	CURE	0.0	0.0	0.0
MNLI	DARE-GRL	-29.8	+6.6	+6.9
ArXivr	Method	Density $\Delta$ $\downarrow$	CER $\Delta$ $\downarrow$	Utility loss $\downarrow$
ArXivr	$C^{2}$U	-17.7	-11.7	-2.2
ArXivr	PISCES	-2.0	+0.6	-0.2
ArXivr	Random	-5.6	+4.6	+4.7
ArXivr	INLP	-34.1	+2.0	+4.1
ArXivr	LEACE	-14.0	+11.8	+2.2
ArXivr	RAG-Emb-Ctrl	-72.4	-21.9	+5.3
ArXivr	CURE	0.0	0.0	0.0
ArXivr	DARE-GRL	-50.7	+33.8	+63.6
TOFU	Method	Density $\Delta$ $\downarrow$	CER $\Delta$ $\downarrow$	Utility loss $\downarrow$
TOFU	$C^{2}$U	-4.4	-4.5	-0.1
TOFU	PISCES	-0.6	+1.3	+0.1
TOFU	Random	-0.1	+1.5	+0.9
TOFU	INLP	-5.6	+14.0	+2.2
TOFU	LEACE	-5.1	+3.2	0.0
TOFU	RAG-Emb-Ctrl	-20.0	-30.6	+0.4
TOFU	CURE	0.0	0.0	0.0
TOFU	DARE-GRL	-0.3	+18.4	+13.8
IMDBd	Method	Density $\Delta$ $\downarrow$	CER $\Delta$ $\downarrow$	Utility loss $\downarrow$
IMDBd	$C^{2}$U	-11.1	-0.8	0.0
IMDBd	PISCES	-0.6	+0.2	0.0
IMDBd	Random	-5.4	+14.7	+0.7
IMDBd	INLP	-16.7	+10.1	-0.1
IMDBd	LEACE	-5.6	+5.7	+0.1
IMDBd	RAG-Emb-Ctrl	-34.3	+8.9	-0.1
IMDBd	CURE	0.0	0.0	0.0
IMDBd	DARE-GRL	-29.4	+27.9	0.0
Pooledp	Method	Density $\Delta$ $\downarrow$	CER $\Delta$ $\downarrow$	Utility loss $\downarrow$
Pooledp	$C^{2}$U	-12.9	-7.5	-0.4
Pooledp	PISCES	-1.4	+1.4	-0.1
Pooledp	Random	-3.1	+5.7	+1.5
Pooledp	INLP	-18.0	+9.7	+1.1
Pooledp	LEACE	-11.0	+5.3	+0.4
Pooledp	RAG-Emb-Ctrl	-40.4	-24.5	+2.2
Pooledp	CURE	0.0	0.0	0.0
Pooledp	DARE-GRL	-23.9	+26.5	+16.9

Table 3 reports per-dataset means over the three conditions and an equal-weight pooled block. Table 14 counts the 15 dataset–condition cells on unrounded values (per-condition matrix: Table 15), since an average can hide a condition-level increase: suppression requires density $\Delta< 0$; divergence additionally requires CER $\Delta> 0$. Counts are descriptive signs, not significance tests; standard is a no-attack condition. $C^{2}$U suppresses in all 15 cells with 0/15 divergent. Its attack utility change still ranges from −5.2 to +2.6 pp, so this does not establish universal utility preservation under attack.

Table 15 | Retrieval under standard and transformed queries. Per-query paired percentage-point changes relative to the same Raw reference under the same condition; Target densityΔ, CERΔ on control queries (context budget $B=512$, at most 50 documents), and control own-label Hit@10 loss are all lower-is-better. Bold/underline are computed only inside the exact profile-only group (C²U, PISCES, Random), excluding the Raw reference; no cross-access-group dominance is claimed. The Mean columns pool the three query conditions per dataset. |

Method	Standard (no attack): Target densityΔ	Standard (no attack): Control CERΔ	Standard (no attack): Hit@10 loss↓	Injection: Target densityΔ	Injection: Control CERΔ	Injection: Hit@10 loss↓	Zou-noise: Target densityΔ	Zou-noise: Control CERΔ	Zou-noise: Hit@10 loss↓	Mean: Target densityΔ	Mean: Control CERΔ	Mean: Hit@10 loss↓
Amazon
C²U	-18.0	-12.2	-0.1	-14.3	-16.7	0.0	-16.7	-12.4	0.0	-16.4	-13.7	0.0
PISCES	-3.5	+3.4	-0.1	+0.2	+4.9	0.0	-0.5	+4.6	0.0	-1.2	+4.3	0.0
Random	-5.7	+2.2	0.0	+2.5	+11.2	0.0	+2.1	+5.7	0.0	-0.4	+6.4	0.0
INLP	-31.2	+20.1	-0.1	-5.4	+16.9	0.0	-10.7	+15.8	0.0	-15.8	+17.6	0.0
LEACE	-45.2	0.0	-0.1	-6.2	+3.2	0.0	-14.3	+4.1	0.0	-21.9	+2.4	0.0
RAG-Emb-Ctrl	-59.7	-34.6	-0.1	-19.3	-28.6	0.0	-25.1	-30.8	0.0	-34.7	-31.4	0.0
CURE	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0
DARE-GRL	-38.4	+36.3	-0.1	+9.5	+50.7	0.0	+1.3	+50.9	0.0	-9.2	+46.0	0.0
ArXiv
C²U	-14.6	-6.1	-0.8	-20.1	-21.9	-5.2	-18.4	-7.1	-0.8	-17.7	-11.7	-2.2
PISCES	-2.1	+1.1	-0.2	-2.0	-0.4	-0.2	-2.0	+1.0	-0.2	-2.0	+0.6	-0.2
Random	-4.8	+4.8	+3.6	-6.0	+3.9	+5.7	-6.0	+5.1	+4.7	-5.6	+4.6	+4.7
INLP	-33.0	+3.7	+4.6	-35.0	-3.3	+2.3	-34.4	+5.6	+5.4	-34.1	+2.0	+4.1
LEACE	-14.8	+10.6	+1.6	-11.8	+12.5	+3.4	-15.4	+12.3	+1.7	-14.0	+11.8	+2.2
RAG-Emb-Ctrl	-68.2	-14.0	+5.6	-76.3	-34.9	+3.3	-72.7	-16.8	+6.9	-72.4	-21.9	+5.3
CURE	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0
DARE-GRL	-51.4	+41.5	+66.3	-50.5	+19.6	+60.0	-50.4	+40.2	+64.6	-50.7	+33.8	+63.6
IMDB
C²U	-10.9	0.0	0.0	-14.5	0.0	0.0	-7.9	-2.3	-0.1	-11.1	-0.8	0.0
PISCES	0.0	0.0	0.0	-0.4	0.0	0.0	-1.4	+0.7	+0.1	-0.6	+0.2	0.0
Random	-8.1	+8.2	+0.1	-1.1	+22.3	+1.7	-7.0	+13.6	+0.3	-5.4	+14.7	+0.7
INLP	-18.6	0.0	0.0	-11.8	+25.0	0.0	-19.6	+5.3	-0.2	-16.7	+10.1	-0.1
LEACE	-4.7	+8.3	0.0	-7.2	0.0	0.0	-5.0	+8.9	+0.4	-5.6	+5.7	+0.1
RAG-Emb-Ctrl	-35.5	+8.3	0.0	-31.0	+16.7	0.0	-36.3	+1.6	-0.2	-34.3	+8.9	-0.1
CURE	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0
DARE-GRL	-38.3	+25.0	0.0	-15.4	+33.3	0.0	-34.4	+25.3	0.0	-29.4	+27.9	0.0
MNLI
C²U	-11.4	-3.4	-0.5	-19.8	-8.8	+2.6	-13.5	-8.1	-1.1	-14.9	-6.8	+0.3
PISCES	-2.0	+0.9	-0.2	-2.0	+0.4	-0.2	-2.8	+0.1	-0.3	-2.3	+0.4	-0.2
Random	-4.8	+2.9	+1.0	-3.5	-0.3	+1.4	-3.2	+0.9	+1.3	-3.9	+1.2	+1.2
INLP	-16.9	+9.0	-0.9	-14.8	+3.0	-1.5	-21.2	+2.3	-0.3	-17.7	+4.8	-0.9
LEACE	-8.0	+6.6	-0.4	-7.5	+1.1	+0.1	-9.6	+2.2	-0.7	-8.4	+3.3	-0.3
RAG-Emb-Ctrl	-43.1	-45.1	+0.6	-37.8	-51.8	+14.0	-40.7	-45.5	+2.6	-40.6	-47.5	+5.7
CURE	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0
DARE-GRL	-37.5	+13.1	+10.0	-21.9	+2.3	+0.3	-30.0	+4.3	+10.4	-29.8	+6.6	+6.9
TOFU
C²U	-2.9	-1.6	-0.1	-5.7	-6.1	0.0	-4.4	-5.8	-0.3	-4.4	-4.5	-0.1
PISCES	-0.9	+1.1	+0.1	-0.8	+1.3	-0.1	-0.3	+1.7	+0.1	-0.6	+1.3	+0.1
Random	-0.1	+1.1	+0.9	-0.5	+2.2	+1.0	-0.2	+1.4	+0.8	-0.1	+1.5	+0.9
INLP	-7.0	+11.4	+1.8	-5.7	+14.4	+2.6	-4.2	+16.3	+2.1	-5.6	+14.0	+2.2
LEACE	-5.7	+1.4	-0.3	-5.5	+3.9	+0.2	-4.2	+4.4	-0.1	-5.1	+3.2	0.0
RAG-Emb-Ctrl	-18.3	-27.4	-0.4	-22.8	-34.7	+1.9	-18.9	-29.8	-0.4	-20.0	-30.6	+0.4
CURE	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0	0.0
DARE-GRL	-1.2	+15.3	+13.3	+0.3	+20.2	+13.6	+0.2	+19.7	+14.6	-0.3	+18.4	+13.8

INLP and LEACE diverge in 13/15 cells; PISCES, DARE-GRL, and Random in 11/15. RAG-Emb-Ctrl suppresses in all cells but diverges in the three IMDB cells (CER up to +16.7 pp); the duplicate-template limitation applies. CURE’s 0/15 divergence is trivial: it suppresses in zero cells. Among evaluated suppressing profile-only methods, only $C^{2}\mathrm{U}$ avoids density–exposure divergence under these query transforms. Stronger-access filters and routers are excluded by the attack contract. The full matrices and both posthoc arms also appear in Section H.

Multi-Concept Composition

Each concept $c$ has its own direction $g_c$, gate $s_c(q)$, and augmented-bank coefficients. Angular requests start at $0.3s_c(q)$ and shrink proportionally whenever their sum exceeds $\min(0.3\max_c s_c(q), 0.2)$. Each allocated angle converts to a feasible coefficient scale; the atom-coordinate deltas are added and pass through the shared trust-region update. The comparator instead steers along the normalized average of unit concept directions under a single max gate—a different gating and allocation rule.

The capacity-expanded ArXiv $K = 4$ arm passes selection and independent confirmation before first access to fresh test rows. Its endpoint is

where $H$ is per-concept H5 Drop. Test lift is +0.04125, CI95 [+0.0325, +0.050625], from 4,000 bootstraps of the twelve paired unit differences. All four compose concept cells are positive; Figure 4 separately shows paired conceptwise differences. Filter-and-Refill-multi remains a non-gating document-membership oracle reference (+0.7181).

Image not extracted

Independent gates decide, per concept, whether a query carries evidence for that concept and how much rotation it requests, so a query tied to one concept is edited mainly toward that concept. The shared budget rescales all requests so their sum stays within the single-concept budget: when several gates fire, each receives a smaller share. The per-concept lifts in Figure 4 are all positive but uneven: +1.4 pp for Artificial Intelligence (positive in 10 of 12 units), +5.7 for Software Engineering, +6.9 for Neurons and Cognition, and +14.2 for Number Theory. The spread is consistent with concepts differing in gate activity and direction separation, not with properties of individual atoms.

The expansion uses larger budgets than earlier arms, so the ladder is not a controlled experiment on sample size alone. It is the only untouched-test arm here: its $K = 2$ design fails selection, and the earlier arms are validation-only or fail acceptance, as Section G and Figure 8 document.

Image not extracted

Conclusion

$C^2$U edits the query, not the encoder or the index: a calibrated gate admits concept-evidenced queries, the profile direction enters atom coordinates via a residual atom, and the difference rotates the raw query by at most 0.2 rad before retrieval. The selected configuration lowers target Hit@5 by 4.25 pp pooled with non-positive control costs on every dataset mean, keeps density and control exposure changes non-positive in every dataset–condition cell under query transforms, and composes four ArXiv concepts with positive lift on each. It suits fixed-index retrievers tolerating partial, bounded suppression rather than removal.

Limitations

Three limitations bound the claims. First, suppression is partial: the aggregate-derived after-edit target Hit@5 stays near 90% pooled, so $C^2$U reduces exposure rather than removing a concept. Second, the data and evaluation scope is narrow: five English datasets, four encoders, and 100/300-query units; IMDB has one template per role, ArXiv uses relaxed global controls, single-concept and attack results are posthoc extensions of frozen test units, and the untouched multi-concept claim covers ArXiv $K = 4$ only, with capacity and granularity limiting other datasets. Third, we evaluate retrieval only: generated-output safety, multilingual or open-domain corpora, and defense-aware adaptive attackers are untested, and low runtime access does not establish a measured cost advantage.

Ethical considerations

Retrieval-side suppression may reduce unwanted exposure but can also hide legitimate evidence or enforce biased policies. Concept definitions, access to profiles, and effects on non-target retrieval require transparent governance and auditing. This method is not a substitute for privacy deletion, consent, output safeguards, or monitoring. The work evaluates retrieval rather than safety of generated content.

Appendix

Experimental Details

Implementation and Data Protocol

Retrieval framework. All locked experiments share one evaluation pipeline per unit: the raw frozen-encoder document embeddings are encoded once per unit, shared bit-identically across methods, and never mutated; retrieval similarity is the dot product of $\ell_2$-normalized embeddings. The four encoders are sentence-transformers/all-MiniLM-L6-v2, BAAI/bge-base-en-v1.5, intfloat/e5-base-v2, and Qwen/Qwen3-Embedding-0.6B, each pinned to a specific revision with a local snapshot manifest.

Index construction and budgets. The single-concept and attack cohorts use 100 target/300 control index documents and 100 target/300 control queries per unit, with 20 target-profile documents. These budgets do not describe all multi-concept stages. Within the single-concept allocation, profile, selection, confirmation, and test rows are disjoint. Multi-concept budgets and the known v2 overlap defect are reported in Section G; blocked capacity rows are not zero-filled or replenished from another split.

Lock ladder and reuse. Single-concept selection and independent confirmation precede its method lock. Its final evaluation and the attacks extend previously frozen test units without test tuning or an untouched-test claim. Recent baselines have their own selection, confirmation, and posthoc-final records; their provenance-complete replay occurred after final outcomes were observed and closes provenance, not prospective selection. Multi-concept test access requires its separately specified acceptance lock. Only expanded ArXiv $K = 4$ first accesses its allocated test rows after passing that gate. Common infrastructure does not make these one protocol or imply identical bootstrap populations across arms.

Hyperparameters and bank dimensions. The deployed single-concept setting appends one row to each frozen $N$-atom bank, with 20 target-profile documents, residual-coefficient multiplier $\beta= 1$, cap 0.2 rad, and floor 0.98. The frozen validation assets have $N = 64$ for ArXiv under every encoder. For Amazon, IMDB, MNLI, and TOFU, $N = 768$ for MiniLM, 1,536 for bge/e5, and 2,048 for Qwen3; embedding dimensions are respectively 384, 768, and 1,024. These are asset dimensions, not a newly selected bank-size sweep. The historical top-30 atom-profile truncation is not the deployed raw-space gate. Configuration selection uses validation only; the posthoc evaluation does not retune it.

Evaluation Metrics

Let $Q_t$ and $Q_c$ denote the sets of target queries and control queries, respectively. For a given query $q$, TopK$(q)$ represents the set of labels or categories associated with the top-$K$ retrieved documents. H5, TC, and CN are reductions (Base minus Method), while TE is an exposure change (Method minus Base); the equations below specify each sign. The locked metric names map as follows: Hit@K Drop = hit_at_5_drop (H5), Target Cos Drop = TC, Control/Neighbor Delta = CN, Target Exposure $\Delta$ = TE.

Erasure and utility in the standard setting.

1. Target Hit@K Drop (↑) measures the reduction in retrieval success for target queries:

2. Target Cos Drop (↑) quantifies the reduction in cosine similarity between target-query representations and the target concept centroid. Let $\mu_t$ be the centroid of all target document embeddings in the base index:

3. Control/Neighbor Delta (↓) evaluates the impact on non-target retrieval utility. Let $y_q$ be the ground-truth control label for $q\in Q_c$:

4. Target Exposure $\Delta$ (↓) measures the change in false-positive retrieval of target documents by control queries:

All three locked main hit metrics use $K=5$: H5 and TE concern target-label presence, while CN concerns control own-label presence. Attack utility instead uses own-label Hit@10. Rate differences in percentage points multiply the above quantities by 100; target-cosine differences are not rates.

Absolute levels and intervals. The main table’s Raw and C$^2$U after-rates are aggregate-derived. Per dataset, Raw H5 is reconstructed as a comparator’s after-hit rate plus its locked H5 Drop; all seven reconstructions agree to floating-point precision. C$^2$U’s own drop is then subtracted. The five Raw/after pairs are 96.8333/90.5000% (Amazon), 97.8333/92.1667% (ArXiv), 100.0000/97.4167% (IMDB), 94.5833/91.1667% (MNLI), and 84.4167/81.1667% (TOFU). Equal-weight pooling gives 94.7333/90.4833%. These are not new measurements. The per-dataset binary H5 Drop intervals reuse the existing standard/no-attack matched replay and its 4,000 paired-row bootstrap samples. There is no native pooled H5 CI in the final summary; we neither average interval endpoints nor substitute validation intervals. IMDB row resampling does not create independent templates.

Robustness under query transforms. We evaluate Standard (no attack), Injection, and Zou-noise. Changes are relative to Raw under the same condition, paired by query.

Intervals reuse the existing standard/no-attack paired-row replay (4,000 bootstrap samples; 1,200 target-row contributions per dataset). No pooled H5 interval is reported. Relaxed global control.

• Target density Δ (pp) (↓): for $D_5(q) = \frac{1}{5}\sum_{j \in\operatorname{Top5}(q)} \mathbf{1}[j \in D_t]$, this is $100\mathbb{E}_{Q_t}[D_5^{\mathrm{Method}} - D_5^{\mathrm{Raw}}]$. It is a target-document fraction, not binary H5.

• CER Δ (pp) (↓): let $\operatorname{Docs}(q; 512, 50)$ be the ranked context packed under the locked token accounting, with budget 512, at most 50 documents, and partial last-document inclusion where allowed. Then

The reported delta is $100\mathbb{E}_{Q_c}[\operatorname{CER}^{\mathrm{Method}} - \operatorname{CER}^{\mathrm{Raw}}]$: the population is control queries.

• Utility Drop (pp) (↓): the decrease in control own-label Hit@10 under the same condition. CN instead uses own-label Hit@5; TE uses target Hit@5.

Suppression and divergence counts use unrounded dataset–condition signs, not significance tests.

ACR Training and Reconstruction

ACR trains a dictionary and lightweight projection head atop a frozen encoder. Atoms have no pre-assigned semantic labels and start from standard-normal samples. Given frozen representation $h_x$, a bilinear compatibility score and temperature-scaled softmax give

The weights are peaked but not literally sparse. With rows $a_i$ in $\mathcal{A}$, training reconstruction is

This reconstruction is used by the training objective. At deployed retrieval the index contains raw encoder vectors, and the raw query receives only equation (4); replacing it by $z_x$ would define a different method. Entropy concentration does not prove that the deployed additive edit has small support. The full training objective follows.

Optimization Setup

Training dynamics. To preserve the retrieval geometry of the pre-trained dense retriever, we freeze the encoder parameters throughout ACR training. Optimization is restricted to the atom bank $\mathcal{A}$ and the lightweight projection head. We use AdamW with a batch size of 32 and an initial learning rate of $10^{-3}$, a ReduceLROnPlateau scheduler (factor 0.5, patience one epoch), a 90/10 train-validation split, and early stopping within a small epoch budget.

Hyperparameter configuration. The reported training setup uses alignment penalty weight $\lambda_{\mathrm{align}} = 1.0$, entropy regularization weight $\lambda_{\mathrm{ent}} = 0.02$, retrieval margin $m_r = 0.3$, and scoring temperature $\tau= 0.1$. Bank dimensions vary as specified in Section A.1; the locked reproduction probe establishes bit-identical recovery of its MNLI/MiniLM/seed-1 checkpoint, not one universal checkpoint or bank size for all units.

Training objective (ACR). We freeze the transformer encoder and optimize only the atom bank and a lightweight projection head. For each triplet $(q,d^+,d^-)$, ACR outputs a composed Euclidean embedding $e_x^{\mathrm{acr}}$ and atom weights $w_x \in\Delta^{\lvert A\rvert-1}$ for $x \in\{q,d^+,d^-\}$. We $L_2$-normalize the composed embeddings and compute cosine similarities by dot product:

Let $e_x^{\mathrm{base}}$ denote the frozen dense retriever embedding for input $x$, and let $\bar{e}_x^{\mathrm{base}} = e_x^{\mathrm{base}}/(\lVert e_x^{\mathrm{base}}\rVert_2+\epsilon)$. The total loss is:

where:

(i) Cosine triplet retrieval loss.

(ii) Cosine alignment loss. We encourage each ACR-composed embedding to remain close to the corresponding frozen retriever embedding:

(iii) Entropy penalty on atom weights. To obtain sharper training-weight distributions, we penalize entropy; this does not imply sparsity of the deployed least-squares coefficient edit:

Here, $m_r > 0$ is the triplet margin, and $\lambda_{\mathrm{align}},\lambda_{\mathrm{ent}} > 0$ are scalar weights.

Historical Profile Subtraction (Not the Deployed Edit)

The historical formulation averages the weights of 20 profile documents and normalizes their non-negative mass:

It retains the top $K_{\mathrm{atom}} = 30$ coordinates and renormalizes. The original exposition used an atom-cosine activity

followed by

The tested subtraction family includes native/hybrid weight normalizations; these historical expressions do not specify the selected additive operator. In particular, $\alpha_x$ is not an input to the deployed gate, and its vanishing is not the deployed identity condition. Under the locked bank and deployed runtime the measured subtraction variants are exact inactive identities, with approximately $2 \times10^{-5}\,\mathrm{rad}$ in the diagnostic angular readout. That mechanism finding does not prove every subtraction method must fail.

Numerical Details and Validation-Only Mechanism Probes

Diagonal-O2 and G0. The runtime names map onto the main-text terms: the negative diagonal-O2 direction is the diagonally preconditioned direction, the continuous G1 ramp with its conservative G0 fallback is the calibrated gate, and the delta exit is the raw-query trust-region update. For normalized controls $x$, let $m_i = \mathbb{E}_{c}[x_i^2]$ and $\bar{m} = d^{-1}\sum_i m_i$. The diagonal uses $D_{ii} = 0.9m_i + 0.1\bar{m} + 0.001$, with an implementation denominator floor. The runtime first forms $v = \operatorname{normalize}(\mu_t - \mu_c)$ and $-0.1D^{-1}v/(v^\top D^{-1}v)$, then normalizes this negative vector for least-squares routing. The means are not separately normalized for this direction; they are separately normalized only for the gate score. Non-finite or degenerate directions fail closed. When G1 quantiles are non-finite or not increasing, G0 uses a conservative calibration order-statistic threshold with declared control false-positive rate 0.02; equality is ineligible. The median-to-95th-percentile G1 ramp is otherwise continuous.

Least squares and numerical branches. The solve uses true least squares on $A^\top$ in float64. Above the residual threshold, $h_\beta= p + \beta e$; below $10^{-6}$ the appended row is normalized $p$ and its coefficient is zero. A degenerate projected vector also fails closed rather than dividing by zero. The fallback row is bookkeeping, not a new independent direction. Exact in-span $g$ is recovered by its projected coefficients; a small nonzero omitted residual causes truncation, and coefficient/bank rounding adds numerical error. The angular scale uses the unit direction of $h_\beta$, but multiplies the original coefficient vector. Gate-off, zero-angle, and non-positive-denominator branches produce zero scale. FP32 subtraction is performed after constructing and casting padded and steered weights. The exit checks $\cos(\operatorname{float32}(\theta_{\mathrm{cap}}))$ against the floor, tries $\eta= 1$, and otherwise keeps the feasible lower bisection endpoint in $[0,1]$. Inactive rows are copied from the original query array. Finite bisection does not guarantee the exact real-valued boundary point.

Coverage and selected residual coefficient. Across 120 diagnostic validation units, true least-squares projection ratio averages 0.895, with 96/120 directions recorded as fully covered. Coverage is not suppression and is not evidence of atom necessity. The residual-coefficient ladder $\beta\in\{1, 0.5, 0.25\}$ selects $\beta= 1$: confirmation primary H5 +0.0644, CI95 [+0.0467, +0.0864], with 3/3 seeds and 4/4 encoders positive. This validation endpoint is distinct from the posthoc test pooled value. Lowering $\beta$ changes only the residual contribution, not the whole edit. The runtime rejects $\beta= 0$; algebraically setting it to zero would still retain the projected component and would not generally yield identity.

Operating-point sweep: negative result. Default $\cos(0.2) = 0.9800665778 > 0.98$, so cap 0.2 is tighter than the floor. Only caps above $\arccos(0.98) = 0.2003348423\ldots\ \mathrm{rad}$ are floor-limited. The $\beta= 1$ settings at caps 0.3, 0.5, 1.0 tie reference primary H5 +0.049444 (five-dataset pooled +0.033000), while target-cosine values still change slightly. This observed metric tie is not geometric identity with cap 0.2. At $\beta= 0.5$, cap 0.5, primary H5 falls to +0.043056 (five-dataset pooled +0.029167). Every setting, including the reference, is ineligible under this sweep because TOFU CN is +0.000278 > 0 + 10$^{-9}$. A reference-only confirmation replay reproduces the locked 480 unit-metrics exactly. The existing selected configuration stands; the sweep authorizes no new successful operating point. Reference cap saturation is 0.5813 in validation and 80.7%/61.9% of active target/control edits at test; default saturation is at the nominal cap, not at arccos(0.98).

Subtraction revival probes: both NO-GO. Frozen query-weight overlap with the top-30 profile is approximately 0.0011 under the v1 operationalization. Four knob-only bank configurations (reproduction, 1536 atoms, ten epochs, and their combination, with the reproduction baseline corrected to one epoch) fail the revival criterion: subtraction’s applied-angle diagnostic stays near $2 \times10^{-5}\ \mathrm{rad}$ and its runtime output stays inactive. The reproduction checkpoint is bitwise identical; augmented H5 is unchanged. The probe’s mean-weight cosine near 0.998 is a different statistic, not a substitute for applied-angle evidence. A second probe adds an off-diagonal orthogonality loss with weights 1 and 10: the bank moves, but augmented H5/CN/TE remain unchanged and subtraction stays inactive. Both

caption: Overview of datasets used in evaluation. The Target Concept represents the semantic information to be suppressed, while the Control Attribute represents the utility signal to be maintained.

:::

decisions are NO-GO; neither conditional full arm triggers. These bounded interventions do not exhaust possible losses or establish a general impossibility theorem.

Compute Environment

The original training and evaluation ran on a single GPU of a workstation with 4 NVIDIA RTX 6000 Ada Generation GPUs (no distributed training); the locked re-evaluation reported here ran on a single NVIDIA L20 GPU. $C^{2}$U does not train a large language model, fine-tune a generator, or require retriever-index rebuilding during concept unlearning; optimization is restricted to the atom bank and lightweight projection/composition modules. Legacy wall-clock latency, peak-memory, and checkpoint-size figures from the original pipeline are not artifact-proven under the locked protocol and are therefore not reported.

Dataset Details

We evaluate across five datasets covering scientific literature, fictional biographies, product reviews, movie reviews, and logical inference. For each dataset, we define the Target Concept to be suppressed and the Control Attribute to be preserved. Table 5 summarizes the definitions.

Why these datasets. We select these datasets to stress-test concept suppression under heterogeneous retrieval conditions: (i) domain-specific terminology and hierarchical labels (ArXiv), (ii) identity-linked fictional knowledge where topic-level suppression can interact with author identity (TOFU), (iii) real-world sentiment versus topical content confounding (Amazon), (iv) an adversarial query formulation that explicitly mentions the target concept (IMDB), and (v) logic-conditioned matching where the control signal is relational rather than topical (MNLI). Together, they cover both natural and synthetic queries, multiple domains, and distinct target/control factorization patterns.

Hierarchical Scientific Knowledge (ArXiv)

We construct a hierarchical dataset using the Cornell–University/arxiv corpus (Kaggle: https://www.kaggle.com/dsv/7548853, accessed Jan. 28, 2026) to simulate concept suppression in specialized domains. The dataset uses the ArXiv taxonomy, where the Control Attribute is defined as the primary category (L1, e.g., cs.CR, cs.CV). The Target Concept (L2) is derived via heuristic keyword matching within the abstract, such as mapping terms like “attack” or “malware” to the concept System Attacks within the cs.CR domain.

For the retrieval task, each document $d$ consists of the concatenated paper title and abstract. Each query $q$ is generated using a stochastic strategy: 50% of queries use the exact paper title to simulate navigational search, while the remaining 50% use the first sentence of the abstract to simulate semantic search. The locked protocol evaluates the L2 concept System Attacks under a relaxed global control (the matched-L1 control pool is capacity-deficient), and this label is preserved in every table.

Fictional Knowledge Unlearning (TOFU)

The TOFU (Task of Fictional Unlearning) dataset [18] consists of question-answer pairs about fictional authors, designed for unlearning tasks. We adapt this dataset for retrieval by treating the answer as the document source. The Control Attribute is the Author ID, representing the identity that should be preserved. The Target Concept is the semantic topic of the fact, such as Family, Location, or Work, which is classified via keyword matching on the question text.

The retrieval setup involves documents formatted as biography records and queries taken directly from the dataset questions. This structure tests whether the retrieval system can suppress topic-level evidence while preserving author-linked retrieval utility. TOFU remains an entity-centric regime: target and non-target facts are tightly coupled around author identifiers, which is why conservative, trust-region-bounded steering is appropriate here.

Classification and Inference Tasks

Product Reviews (Amazon). Adapted from the amazon_polarity dataset, which is derived from the Amazon Reviews corpus [19] and is also included in text-embedding benchmarks such as MTEB/MMTEB [20, 7], this task aims to suppress sentiment information while preserving product categorization. The Target Concept is sentiment (Positive/Negative), and the Control Attribute is product category, such as Books or Electronics, extracted via keyword filtering. Queries are derived from review titles, while documents contain full review content.

Movie Reviews (IMDB). In contrast to the Amazon dataset, the IMDB dataset [3] inverts the roles of sentiment and content. Here, the Target Concept is movie genre, such as Sci-Fi or Romance, and the Control Attribute is sentiment. Since the original dataset lacks titles, we generate synthetic queries using templates that explicitly mention the target concept, such as “Find a Positive review about a Sci-Fi movie”. This presents a challenging setting where the query explicitly seeks the concept intended for suppression. Under the locked split, the IMDB evaluation rows collapse to one unique target and one unique control query text; we retain the row with its duplicate-template diagnostic label and treat its zero-variance metrics as a diagnostic, not as high-confidence evidence.

Logical Inference (MNLI). Adapted from the multi_nli dataset [26], this task evaluates concept suppression in logical inference contexts. The Target Concept is the source text genre, such as Government or Fiction, and the Control Attribute is the NLI label (Entailment, Neutral, or Contradiction). The retrieval task is formulated such that the query is the hypothesis and the document is the premise.

Baseline Implementation Details

All baselines are evaluated under the same locked pipeline: the same per-unit raw-base index, the same query IDs and seeds, and the same metric definitions. Access-class labels are part of each method’s identity and appear in every table.

Linear Concept Erasure Methods

INLP (Iterative Nullspace Projection). Proposed by Rayvógel et al. (2020), INLP iteratively trains linear probes to predict the target concept and projects representations onto the nullspace of the probe weights. In the locked protocol INLP fits on the 400 labeled calibration rows of each unit, placing it in the profile-only + labeled calibration fit access class.

LEACE (Least-Squares Concept Erasure). Belrose et al. [4] introduced LEACE as a closed-form erasure transform minimizing dependence between representations and concept labels. It uses the same labeled calibration fit as INLP, and the runner fails closed when the erasure library is missing, unversioned, fails fitting, or returns an empty eraser.

Model Editing Baselines (Diagnostic Adaptations)

PISCES. PISCES [11] was proposed for generative safety in LLMs. Our in-house adaptation treats the output projection layer of the retriever as the editable component, identifies directions with high cosine similarity to the target concept centroid, and masks them.

DARE-GRL. We construct a training-based baseline combining Gradient Reversal Layers [10] with DARE-style model merging [29]: a lightweight mapper is trained with a GRL objective against a concept adversary, and the delta weights are sparsified and rescaled before merging. The port to the retrieval encoder is our in-house adaptation.

Recent Embedding-Space Baselines (Diagnostic Adaptations)

CURE. CURE [15] extracts concept-irrelevant content through a frozen pretrained encoder with GPT-4o concept labels and a task classifier, then reconstructs a controlled, debiased representation. The faithful pipeline requires raw text, concept/task supervision, and a downstream classifier, none of which the frozen query-only retrieval contract exposes; our in-house adaptation fits a content/reversal-inspired projection on the frozen calibration vectors of each unit, using the same 400 labeled calibration examples as INLP and LEACE, transforms queries only, and preserves the raw document index. Under the preregistered utility gate the adapted adapter is locked to strength zero, so every reported CURE cell is an exact identity operation.

RAG Embedder Control. Kim et al. [14] debias a RAG embedder with SimCSE-style contrastive reverse-bias training (PEFT/WiSE-FT). Full fidelity requires trainable embedder weights and corpus-side re-encoding, which the frozen offline vector cache does not authorize; our portable adaptation fits a deterministic reverse-bias linear adapter on the frozen calibration vectors and labels of each unit (400 labeled calibration examples), transforms queries only, and keeps the raw fixed document index. It is a portable adaptation, not an official full-embedder reproduction.

Other Query-Side and Stronger-Access References

Raw. The identity (no-edit) transform; the per-query paired reference for the attack arm (its relative metrics are exactly zero by construction).

Delta-Edit. A fidelity-preserving delta variant that adds an FP32 edited-minus-original atom delta to the raw query; at the locked operating point it is a near-identity control.

Filter-and-Refill. Removes target documents from the candidate set and refills the top-$K$ from the remainder; it consumes candidate/document membership and is reported only as a stronger-access reference.

Rank-Router. A relaxed boundary router that consumes target-document membership labels; it is a label-assisted benchmark router, not an unlabeled query-only deployment method, and is reported only as a reference.

Random Perturbation. Isotropic Gaussian noise $\epsilon\sim\mathcal{N}(0,\sigma^2 I)$ added to query embeddings, with $\sigma$ calibrated to match the average edit norm of C$^{2}$U, controlling for generic representation degradation.

Case Study: Target-Suppression Flips

Table 6 shows one locked test-stage target query per dataset where the base retriever returns the target in the top-5 and C$^2$U removes it entirely. The selection rule was frozen before any query text was read: among target rows with a base hit and a method miss and non-zero applied angle, choose the maximum target-cosine drop with deterministic tie-breaks. Query texts were joined from the source parquets only after the rule was frozen. These success-selected examples illustrate target-label removal under a small, trust-region-bounded rotation (≈ 0.2 rad, at the cap). They are not representative-frequency estimates and do not establish unchanged control neighborhoods; aggregate CN and TE measure those separate outcomes.

Selection mechanics. The rule behind Table 6 is a deterministic function of locked per-query rows: among posthoc-extension target rows with a base top-five target hit, a method miss, and a non-zero applied angle, it takes the maximum target-cosine drop under deterministic tie-breaks. Ties depend on row content alone, never on judgments made after reading the queries. Re-running it on the same locked rows therefore returns the same five queries: reproducible selections, not hand-picked anecdotes.

Reading the rows. In each row the base top five carries exactly one target-labeled document and the edited list carries none—the flip the rule selects for. The vacated slot is refilled by the next non-target candidates, so the list stays full while the target label disappears. The rotation behind each flip stays inside the trust region (≈ 0.2 rad, at the cap), and the target-cosine drop is positive on all five datasets, matching the pooled Hit@5 Drop of Table 2. The five rows span one query per dataset, so the illustration covers every corpus rather than a single favorable one.

Scope of the examples. The flips give the pooled effect a concrete shape: C$^2$U can remove a target document from the top five through one bounded, query-side rotation while the raw index and the control population stay fixed. They say nothing about how often such removals occur—frequency is the pooled tables’ question—and nothing about control neighborhoods, which aggregate CN and TE measure separately (Table 11 and Table 12). Nor do they isolate why a particular document leaves the list: the edited query moves every score within the drift bound, and the flip is an outcome of the full ranking, not of a per-document operation. Drawn from the same locked test units as those tables and evaluated exactly once with no test tuning, the five examples carry the posthoc-extension label of Section H, not an untouched-test claim.

Legacy Qualitative Atom Examples

The following table from the original appendix is retained as qualitative context for the flips above; its numbers are paper-reported from the original evaluation pipeline and have no locked counterpart.

[Paper-reported, original evaluation pipeline]

Atom ID	Post-hoc Label	Purity	Representative Keywords
492	Genomics	0.60	assembly, datasets, single
485	Biomolecules	0.50	protein, network, security
901	GR and Cosmology	0.50	structures, field, nucleat
564	Biomolecules	0.40	domain, learning, neto2
475	Crypto and Security	0.30	vulnerabilities, software

Full Dataset–Method and Dataset–Encoder Results

Table 8 retains the complete dataset–method rendering.

Method	Hit@5 Drop ↑	Target Cos. ↑	Ctrl./Neigh. Δ ↓	Target Exp. Δ ↓
C²U	0.0633	0.0565	-0.0064	-0.1244
Raw	0.0000	0.0000	0.0000	0.0000
Delta-Edit	0.0000	0.0015	0.0000	-0.0008
PISCES	-0.0033	0.0014	-0.0025	0.0269
Random	0.0117	0.2226	-0.0017	0.0300
INLP	0.1217	0.0394	-0.0050	0.1886
LEACE	0.3658	0.0386	-0.0061	-0.0083
RAG-Emb-Ctrl	0.6883	0.0874	-0.0069	-0.3353
CURE	0.0000	0.0000	0.0000	0.0000
DARE-GRL	0.2250	0.5455	-0.0011	0.3853
Filter-and-Refill‡	0.0092	0.0000	-0.0056	-0.0414
Rank-Router§	0.0700	0.0541	-0.0064	-0.1383
C²U	0.0567	0.0859	-0.0125	-0.0764
Raw	0.0000	0.0000	0.0000	0.0000
Delta-Edit	0.0000	0.0025	0.0003	0.0000
PISCES	-0.0017	0.0152	-0.0025	0.0133
Random	0.0108	0.2434	0.0492	0.0631
INLP	0.0592	0.1387	0.0500	0.0889
LEACE	0.0100	0.0627	0.0219	0.1619
RAG-Emb-Ctrl	0.6950	0.2217	0.0556	-0.2103
CURE	0.0000	0.0000	0.0000	0.0000
DARE-GRL	0.2267	0.5746	0.6858	0.5861
Filter-and-Refill‡	0.3833	0.0000	-0.0197	-0.1806
Rank-Router§	0.0567	0.0838	-0.0108	-0.0764
C²U	0.0258	0.0766	0.0000	0.0000
Raw	0.0000	0.0000	0.0000	0.0000
Delta-Edit	0.0000	0.0016	0.0000	0.0000
PISCES	0.0183	0.0017	0.0000	0.0000
Random	0.0242	0.2643	0.0203	0.2311
INLP	0.0000	0.0805	0.0000	0.1667
LEACE	0.0183	0.0146	0.0000	0.0833
RAG-Emb-Ctrl	0.3075	0.0695	0.0000	0.2500
CURE	0.0000	0.0000	0.0000	0.0000
DARE-GRL	0.3408	0.6527	0.2500	0.5833
Filter-and-Refill‡	0.0000	0.0000	0.0000	0.0000
Rank-Router§	0.0258	0.0749	0.0000	0.0000
C²U	0.0342	0.0531	-0.0108	-0.0603
Raw	0.0000	0.0000	0.0000	0.0000
Delta-Edit	0.0000	0.0007	0.0003	0.0003
PISCES	-0.0025	0.0099	-0.0008	0.0042
Random	0.0158	0.2260	0.0267	0.0367
INLP	0.0400	0.1060	0.0022	0.0583
LEACE	0.0125	0.0301	0.0006	0.0794
RAG-Emb-Ctrl	0.4258	0.1680	0.0133	-0.3425
CURE	0.0000	0.0000	0.0000	0.0000
DARE-GRL	0.3542	0.5446	0.2772	0.1450
Filter-and-Refill‡	0.1050	0.0000	-0.0194	-0.1183
Rank-Router§	0.0383	0.0506	-0.0122	-0.0636
C²U	0.0325	0.0592	-0.0044	-0.0214
Raw	0.0000	0.0000	0.0000	0.0000
Delta-Edit	0.0000	0.0003	0.0000	0.0003
PISCES	0.0042	0.0016	0.0008	0.0053
Random	-0.0092	0.2293	0.0094	0.0092
INLP	0.0642	0.0431	0.0647	0.0900
LEACE	0.0492	0.0048	-0.0008	0.0058
RAG-Emb-Ctrl	0.2892	0.0315	-0.0119	-0.2378
CURE	0.0000	0.0000	0.0000	0.0000
DARE-GRL	0.1133	0.5547	0.2458	0.1172
Filter-and-Refill‡	0.0400	0.0000	-0.0119	-0.0731
Rank-Router§	0.0458	0.0497	-0.0042	-0.0267
C²U	0.0425	0.0662	-0.0068	-0.0565
Raw	0.0000	0.0000	0.0000	0.0000
Delta-Edit	0.0000	0.0013	0.0001	-0.0001
PISCES	0.0030	0.0060	-0.0010	0.0099
Random	0.0107	0.2371	0.0208	0.0740
INLP	0.0570	0.0816	0.0224	0.1185
LEACE	0.0912	0.0302	0.0031	0.0644
RAG-Emb-Ctrl	0.4812	0.1156	0.0100	-0.1752
CURE	0.0000	0.0000	0.0000	0.0000
DARE-GRL	0.2520	0.5744	0.2916	0.3634
Filter-and-Refill‡	0.1075	0.0000	-0.0113	-0.0827
Rank-Router§	0.0473	0.0626	-0.0067	-0.0610

Table 9 to Table 12 report the complete dataset × encoder decomposition behind the pooled cells of Table 2, one grid per metric; every cell is the mean over the three locked seeds, and the per-seed rows are retained in the locked artifact. Utility-clean status and the marking rule follow the pre-registered Pareto criterion of § 4.2: CN $\le10^{-9}$ and TE $\le10^{-9}$, H5 Drop compared only inside the exact profile-only class, and no cross-class dominance; bold and underline mark the best and second-best values inside the profile-only access class of each row. ArXiv carries the relaxed global control label and IMDB the duplicate-template diagnostic label throughout.

Visual Diagnostics

The five panels in this section are descriptive renderings of locked outcomes under the unified figure standard of this paper: they recompute or replot rows that the locked chains already contain, and they add no new evidence. Each caption states its populations, denominators, and provenance. The paragraphs below connect each panel to the main-text claim it supports and state what the panel does not show.

Pareto view. Figure 5 plots every displayed method’s pooled suppression against its pooled utility cost, one point per method and dataset, pooled over four encoders and three seeds, with colors marking the locked access classes. CURE coincides with Raw because its utility gate locks it to a zero-strength identity, and DARE-GRL’s larger suppression sits together with its large positive CN and TE costs.

Target-cosine shift. Figure 6a shows per-query cosines to the target-document centroid on locked test rows, base versus steered, one panel per dataset. The steered target distribution shifts left of base in every dataset: queries move away from the target centroid, which is the geometric reading of Hit@5 drops in Table 2. The figure shows target rows only; Figure 7b adds the control distribution, and the main-text Figure 3 is the pooled three-population companion.

Applied-angle readout. Figure 6b is the trust region’s readout: the angle the deployed edit actually applies to each locked test query. Gate-off rows are exactly zero, since a closed gate is an exact identity. Active edits concentrate at the 0.2-rad cap, slightly tighter than arccos(0.98); among edited queries, 80.7% of the 5,681 target edits and 61.9% of the 12,876 control edits sit at the cap, whereas the main-text Figure 3 uses all queries of each group as denominator (76.5% and 44.3%). Saturation at the cap is what the operating-point sweep of Section A.6 stress-tests.

Profile sharpness. Figure 7a measures how concentrated each dataset’s concept profiles are in atom coordinates: each curve is the median over a dataset’s 12 locked validation units of the sorted, max-normalized mean profile-weight vector, plotted against atom-rank fraction. ArXiv uses 64 atoms for every encoder; the other datasets use 768/1,536/2,048 for MiniLM/bege+e5/Qwen3. Sharper drop-offs mean that profile mass concentrates on a few atoms, which is why one per-concept residual row appended at deployment can represent the profile direction in bank coordinates (§ 3). Concentrated profiles do not by themselves imply sparse deployed edits.

Projection separability. Figure 7b plots kernel densities of each query’s cosine to the target centroid of the unchanged base index for three populations: target at base, target after steering, and control, recomputed from the locked per-unit tensors (the same recomputation reproduces the locked target rows to $2.8 \times10^{-8}$). A steered target distribution that moves toward the control distribution reads as suppressed concept expression. Cosine to a single centroid is one direction only, so the panel corroborates the hit-based outcomes rather than certifying suppression by itself.

Multi-Concept Composition Ladder

Table 13 retains the four-arm history. Only the expanded ArXiv $K = 4$ arm is a pass; its $K = 2$ design and the earlier arms are validation-only or failures and cannot be presented as passes. Each concept has a separate raw-space G1/G0 gate and coefficient vector. If $s_c$ are gates, start with $t_c = 0.3s_c$ and set $\beta_q = \min(0.2\lambda x_c, 0.2)$. For positive total request allocate $\tilde{t}_c = t_c \min(1, B_q / \sum_\ell t_\ell)$; if all gates vanish all allocations are zero. Per-concept angular feasibility and sine-ratio scaling precede additive delta composition and the shared trust exit. The comparator uses a normalized average of unit O2 directions with a single max gate. The endpoint takes minima of per-concept H5 within each method and unit, then differences them and averages units, as in equation (6); it does not minimize paired conceptwise differences or use a min gate.

Dataset	Encoder	$C^2$U	Raw	INLP	LEACE	RAG-Emb-Ctrl	CURE	PISCES	DARE-GRL	Random	Delta-Edit	Filter-and-Refill‡	Rank-Router§
Amazon	minilm	0.0279	0.0000	0.0604	0.0717	0.0861	0.0000	0.0003	0.3298	0.0818	-0.0000	0.0000	0.0245
Amazon	bge	0.0555	0.0000	0.0384	0.0525	0.1702	0.0000	0.0030	0.6610	0.2786	0.0025	0.0000	0.0555
Amazon	e5	0.0505	0.0000	0.0174	0.0057	0.0099	0.0000	-0.0023	0.8229	0.3486	0.0009	0.0000	0.0481
Amazon	qwen3	0.0921	0.0000	0.0415	0.0246	0.0832	0.0000	0.0047	0.3683	0.1812	0.0025	0.0000	0.0884
ArXiv	minilm	0.1317	0.0000	0.2284	0.1124	0.4639	0.0000	0.0300	0.3187	0.0994	0.0036	0.0000	0.1286
ArXiv	bge	0.0710	0.0000	0.0922	0.0340	0.0862	0.0000	0.0081	0.6618	0.2913	0.0031	0.0000	0.0681
ArXiv	e5	0.0498	0.0000	0.0639	0.0124	0.0330	0.0000	0.0012	0.8220	0.3500	0.0007	0.0000	0.0490
ArXiv	qwen3	0.0910	0.0000	0.1705	0.0920	0.3038	0.0000	0.0216	0.4959	0.2331	0.0025	0.0000	0.0896
IMDB	minilm	0.0808	0.0000	0.1724	0.0518	0.0435	0.0000	0.0036	0.6319	0.1797	0.0012	0.0000	0.0808
IMDB	bge	0.0795	0.0000	0.0438	-0.0065	0.1467	0.0000	0.0012	0.6263	0.2738	0.0024	0.0000	0.0726
IMDB	e5	0.0620	0.0000	0.0240	0.0029	0.0154	0.0000	0.0021	0.8481	0.3581	0.0013	0.0000	0.0620
IMDB	qwen3	0.0841	0.0000	0.0817	0.0104	0.0725	0.0000	-0.0000	0.5046	0.2458	0.0015	0.0000	0.0841
MNLI	minilm	0.0850	0.0000	0.1581	0.0730	0.4172	0.0000	0.0204	0.2980	0.0869	0.0012	0.0000	0.0810
MNLI	bge	0.0299	0.0000	0.0899	0.0230	0.0890	0.0000	0.0068	0.6297	0.2628	0.0007	0.0000	0.0284
MNLI	e5	0.0247	0.0000	0.0317	0.0046	0.0364	0.0000	0.0004	0.8094	0.3459	0.0003	0.0000	0.0226
MNLI	qwen3	0.0726	0.0000	0.1444	0.0200	0.1295	0.0000	0.0118	0.4413	0.2083	0.0007	0.0000	0.0703
TOFU	minilm	0.0677	0.0000	0.0291	0.0071	0.0325	0.0000	0.0013	0.4427	0.1372	0.0003	0.0000	0.0529
TOFU	bge	0.0441	0.0000	0.0373	-0.0001	0.0181	0.0000	0.0002	0.6042	0.2539	0.0002	0.0000	0.0372
TOFU	e5	0.0366	0.0000	0.0679	0.0024	0.0093	0.0000	0.0006	0.7699	0.3352	0.0000	0.0000	0.0332
TOFU	qwen3	0.0883	0.0000	0.0380	0.0099	0.0659	0.0000	0.0040	0.4019	0.1909	0.0007	0.0000	0.0757

Original pools (v1): validation-only pass. Pooled over MNLI and ArXiv $K = 4$, the paired acceptance claim passes selection (+0.0300, CI95 [+0.0167, +0.0450]) and independent confirmation (+0.0250, CI95 [+0.0050, +0.0467]). All eight dataset–concept compose H5 cells are positive. Other datasets are capacity-blocked, not zeros; this pass authorizes no test by itself.

New pools (v2): failed acceptance with a registered defect. Amazon L1 $K = 4$, ArXiv L2 $K = 8$, and MNLI $K = 3$ have a positive selection paired endpoint (+0.0244), but selection acceptance fails: Amazon Books and Electronics have compose H5 −0.0133 and −0.0267. Confirmation does not replicate (−0.0044). The builder restarts allocation cursors across role kinds, contaminating selection with profile rows and creating corpus/query overlap. Confirmation is disjoint from profiles, and its independent failure supports the negative verdict; test rows are disjoint from other slices and never accessed. The overlap remains an additional blocker, not an excused positive result. IMDB/TOFU control capacity is insufficient. The diagnostic ArXiv $K = 2/4/8$ sweep is also negative and carries the defect label.

Cursor-disjoint rebuild (v3): failed selection. The repaired builder uses advancing cross-role cursors and true overlap checks. Pre-outcome capacity/mechanism rules restrict it to ArXiv: MNLI/IMDB/TOFU lack controls, while Amazon is excluded after ineffective L1 retrieval suppression and lacks suitable L2 controls. Both pre-registered $K = 2$ and $K = 4$ designs fail selection. Confirmation never runs and test refusal is exercised; no test rows are touched.

Notes: Each cell is the mean over the three locked seeds (1–3). Encoders: minilm = all-MiniLM-L6-v2, bge = bge-base-en-v1.5, e5 = e5-base-v2, qwen3 = Qwen3-Embedding-0.6B (pinned revisions). Raw is the identity (no-edit) reference. Marking scope per row is the exact profile-only access class (C$^{2}$U, Raw, PISCES, Random, Delta-Edit); INLP and LEACE (400 labeled calibration examples per unit), CURE and RAG-Emb-Ctrl (400 labeled calibration examples per unit; posthoc adapted-baseline extensions under the same locked protocol), DARE-GRL (training-based), $^{\ddagger}$ (candidate/document access), and $^{\S}$ (target-membership label-assisted) are shown unmarked. Utility-clean requires CN $\le10^{-9}$ and TE $\le10^{-9}$, and no cross-access-class dominance is claimed. ArXiv uses a relaxed global control; IMDB carries the duplicate-template diagnostic label. Column tints encode the locked access class (same colors as Figure 5); the C$^{2}$U column is highlighted.

Capacity expansion (v4): ArXiv $K = 4$ passes. Earlier locked validation differences inform a budget design, not a causal diagnosis of quantization noise. The T1/T2/T3 ladder is frozen before v4 outcomes; all tiers fail the predeclared 0.8 power criterion. The adjudicated fallback selects the largest feasible T3: 200 selection, 200 confirmation, and 400 test target queries per concept, with 1,200 controls per split. Profiles remain 20 documents per concept; the index uses 25 target documents per concept and 300 controls. Cursor-disjoint allocation requires 845 rows per concept and 4,800 control rows overall. Method configuration and the atom bank are unchanged, but evaluation pools and budgets differ.

Concepts are frozen by free-row ranking after prior consumption: Software Engineering, Artificial Intelligence, Neurons and Cognition, Number Theory; $K = 2$ is the prefix. $K = 2$ fails selection ($-0.0008$, CI95 $[-0.0075, +0.0058]$, only one of three seeds positive). $K = 4$ passes selection ($+0.0425$, CI95 $[+0.0279, +0.0575]$) and independent confirmation ($+0.0517$, CI95 $[+0.0357, +0.0663]$). Its hard-gated test endpoint is $+0.04125$, CI95 $[+0.0325, +0.050625]$ from 4,000 bootstraps of twelve paired unit differences; all four concept cells, three seeds, and four encoders are positive. The retained table rounds these to $+0.0412$ and $[+0.0325, +0.0506]$. These are previously unused multi-concept test rows, first evaluated without tuning after the passing lock; refusal was exercised before that lock existed. This untouched-test scope is separate from the posthoc single-concept/attack cohorts. The document-membership oracle Filter-and-Refill-multi is a non-gating upper reference ($+0.7181$), not an access-matched competitor.

The ladder supports a scoped improvement over the averaged-direction comparator on ArXiv $K = 4$. It does not prove that larger budgets remove interference, that noise caused earlier failures, or that atom representation alone causes the gain.

Notes: Each cell is the mean over the three locked seeds (1–3). Encoders: minilm = all-MiniLM-L6-v2, bge = bge-base-en-v1.5, e5 = e5-base-v2, qwen3 = Qwen3-Embedding-0.6B (pinned revisions). Raw is the identity (no-edit) reference. Marking scope per row is the exact profile-only access class (C$^{2}$U, Raw, PISCES, Random, Delta-Edit); INLP and LEACE (400 labeled calibration examples per unit), CURE and RAG-Emb-Ctrl (400 labeled calibration examples per unit; posthoc adapted-baseline extensions under the same locked protocol), DARE-GRL (training-based), $\ddagger$ (candidate/document access), and $\S$ (target-membership label-assisted) are shown unmarked. Utility-clean requires CN ≤ $10^{-9}$ and TE ≤ $10^{-9}$, and no cross-access-class dominance is claimed. ArXiv uses a relaxed global control; IMDB carries the duplicate-template diagnostic label. Column tints encode the locked access class (same colors as Figure 5); the C$^{2}$U column is highlighted.

Composition view. Figure 8 is a descriptive view of the locked ArXiv $K = 4$ outcomes, not new evidence. Panels (a,b) place raw and compose-edited queries in one deterministic PCA basis on the pre-registered bge/seed-1 illustration (variance share 0.157): control centroids shift by 0.022, target centroids by 0.058–0.118. Panel (c) reports residual-atom cosines—SE–NT 0.022, NC–NT 0.015, SE–AI 0.560—not the Gram matrix of full 02 edit directions. Panel (d) shows paired per-concept H5 differences, with Artificial Intelligence smallest (+0.0142): every concept contributes positively, which is what the min-concept endpoint of equation 6 rewards. $K = 2$ failed selection and never entered test.

Query-Transform Evaluation and Full Results

Table 15 retains every dataset–condition value and the Mean columns; Table 14 summarizes the same cells as counts and signed worst values. The original arm covers 5 datasets × 4 encoders × 3 seeds × 3 conditions × 7 methods, including Raw: 504,000 per-query rows. A separate additive arm supplies the two recent adaptations; the original count is not the combined-arm count. Both are posthoc extensions of frozen single-concept units, with no test tuning and no untouched-test claim. The main table omits Raw’s construction-zero row, not its role as the paired reference. Candidate/document-access Filter-and-Refill, membership-assisted Rank-Router, and Delta-Edit are predeclared attack exclusions.

Transforms are bitwise-equal reimplementations of the original pure functions; the recent-baseline arm replays its standard-condition runs unchanged, and CURE’s all-zero cells are its locked zero-strength identity. Aggregates use 4,000 paired bootstrap samples. CER is averaged over control queries with the 512-token/50-document packing rule; the legacy attack “Hit” heading is clarified as target density without changing values. Main Table 3 summarizes equal-weight cell means, and Table 14 the unrounded suppression/divergence signs and signed worst values; neither is significance or adaptive-attack certification.

Reading the full matrix. Table 15 expands every summary cell into per-condition values. Each dataset block lists the eight evaluated methods in the main table’s order with locked access-class tints and the $C^{2}$U row highlighted; each condition group pairs target density $\Delta$ on target queries with CER $\Delta$ and own-label Hit@10 loss on control queries, and the Mean group reproduces the main table’s per-dataset cells. Marks compare only the exact profile-only group ($C^{2}$U, PISCES, Random).

Condition-level patterns. Read per condition, the counts in Table 14 are not artifacts of Mean pooling. $C^{2}$U lowers target density in all 15 cells and never raises control exposure, with attack utility between −5.2 and +2.6 pp; its remaining variation is condition mix, not sign. INLP’s Amazon pair—density down 15.8 pp, exposure up 17.6 pp on Mean—repeats under every condition, the displacement pattern behind the 13/15 divergent cells it shares with LEACE. RAG-Emb-Ctrl suppresses most strongly on ArXiv (−72.4 density, −21.9 exposure) yet diverges in the three IMDB cells, worst +16.7 pp under injection, and costs utility on ArXiv (+5.3 pp) and MNLI (+5.7); the duplicate-template limitation applies. CURE’s all-zero matrix is its locked zero-strength identity, so its 0/15 divergence count is trivial. PISCES, Random, and DARE-GRL diverge in 11/15 cells.

Image not extracted

Image not extracted

Image not extracted

Notes: ^v validation-only acceptance; not a test claim. ^d diagnostic-only; the test runner refuses unless the method lock is PASS. ^c v2 confirmation CI95 straddles zero per dataset: Amazon [-0.0233, +0.0033]; ArXiv [-0.0100, +0.0100]; MNLI [-0.0100, +0.0000]; v2 selection per-concept compose Hit@5 Drop on Amazon L1 is negative for Books (-0.0133) and Electronics (-0.0267), failing the per-concept gate. Granularity: the v2 Amazon cells use L1; all ArXiv cells (v2, v3, v4) use L2. ^e Concepts (pre-registered free-row ranking; v4 re-ranked after v3 consumption): v3 $K=2$: {Artificial Intelligence, Software Engineering}; $K=4$: {Artificial Intelligence, Genomics, Neurons and Cognition, Software Engineering}; v4 $K=2$: {Software Engineering, Artificial Intelligence}; $K=4$: {Software Engineering, Artificial Intelligence, Neurons and Cognition, Number Theory}. ^f confirmation never ran: no design passed selection. ^g v3 gates failed (CI95 lower bound $\le0$; $K=2$: seeds 2/3, encoders 3/4; $K=4$: seeds 2/3, encoders 1/4); v4 $K=2$ fails the CI-lower-bound, all-seeds, and encoder gates (seeds 1/3, encoders 2/4 positive). ^t test-stage acceptance on freshly allocated, never-before-used test rows (the first use of these test rows in any experiment, evaluated exactly once with no test-time tuning); the refusal path was exercised and evidenced before the PASS method lock existed. v4 tier T3 (pre-registered before any v4 outcome): 200/200 selection/confirmation and 400 test target queries per concept, 1,200 control rows per split; v4 $K=4$ test gates: seeds 3/3, encoders 4/4 positive. Filter-and-Refill-multi (document-membership oracle, non-gating upper reference) min-concept Hit@5 Drop on the same units: v2 confirmation Amazon +0.6967, ArXiv +0.9333, MNLI +0.8867; v3 selection $K=2$ +0.9433, $K=4$ +0.8967; v4 selection $K=2$ +0.7683, $K=4$ +0.7662; v4 test $K=4$ +0.7181. v3/v4 scope: MNLI/IMDB/TOFU excluded by capacity (best-case free control rows MNLI 395, IMDB 565, TOFU 428 vs 1,200 required), Amazon by mechanism (v2-measured L1-granularity retrieval-level ineffectiveness; L2 offers no non-target control).

Reproducibility and Source Record

Frozen experimental packages retain per-arm protocols, configuration/input/method locks, encoder/environment records, per-query outputs, aggregation rules, and independent checks. Bootstrap units differ: main per-dataset H5 intervals reuse the standard replay’s paired-row bootstrap, whereas the multi-concept test resamples twelve unit differences. Recent-baseline provenance replay is explicitly retrospective. Unknown legacy resource measurements remain unavailable, not estimated.

The ARR manuscript uses the official ACL template and a lightweight single-JSON conversion/source record, CONVERSION_PROVENANCE.json. That record is distinct from frozen experimental audit chains; ARR has no ICLR-style closure-manifest claim. The restructuring introduces no experiments or test-time selection. Full matrices, negative probes, and descriptive views distinguish evidence reuse from new inference. Generated summaries derive from existing locked aggregates rather than newly accessed raw test queries.

Theoretical Analysis of the Deployed Edit Operator

We distinguish exact real-arithmetic identities from the finite-precision, thresholded implementation in § 3. No theorem below proves retrieval benefit, atom necessity, or absence of multi-concept interference. Throughout, $S^{d-1}$ is the unit sphere of $\mathbb{R}^{d}$, $g$ denotes the negative diagonal-O2 unit direction, and $d$ denotes ambient dimension. Unit queries and documents are assumed where stated. Numerical branches are specified separately in Section A.6.

Trust-Region Geometry of the Delta Exit

Proof. Non-parallelism gives $b-a^{2} > 0$, so $q+\eta\delta$ cannot vanish. Direct differentiation gives

The derivative is negative for $\eta> 0$, and $\varphi(0) = 1 > \gamma$. Continuity gives the unique crossing when $\varphi(1) < \gamma$. Maintaining feasible lower and infeasible upper endpoints gives the bisection claim.

Remark J.3 (Degeneracy and numerical scope). If $\delta=tq$, the normalized point stays $q$ while $1+\eta t>0$; an antiparallel segment may reach a singular zero or flip sign. Such a segment is not covered by the lemma. Finite FP32 checks and denominator safeguards do not establish exact real-number boundary attainment or monotonicity of rounded cosines. The drift result below applies to a normalized output satisfying its stated cap condition; numerical tolerances must be accounted for when applying it to computed outputs.

Remark J.6 (Floor and cap). If $\theta_{\mathrm{cap}}>\arccos\gamma_{\mathrm{floor}}$, the floor is tighter; at equality they coincide. Below that angle the nominal cap is tighter. Equal floors across raised caps do not imply equality with a smaller-cap edit, nor identical rankings or H5. The observed operating-point ties and the residual-coefficient counterexample are empirical results in Section A.6.

Exact Direction Routing through the Residual Atom

Remark J.9 (What residual completion does not say). A pure last-coordinate edit produces only a multiple of $e$ when $e \ne0$. That is not the deployed full-direction route, which also changes projected coefficients $a$. At a positive numerical threshold $\varepsilon_r$, the fallback for $0 < \lVert e\rVert< \varepsilon_r$ yields $p$, not exactly $g$, even before rounding; its exact-arithmetic truncation error is $\lVert e\rVert$. FP32 bank/weight subtraction adds further error. The theorem describes ideal routing, not bitwise equality or a retrieval advantage over dense $g$.

Angular scale. For unit direction $h$, $q^\top h = \cos\phi$ with $0 < \phi< \pi$, and $0 \le\theta< \phi$, solving for a turn of $\theta$ along $q + kh$ gives $k = \sin\theta/ \sin(\phi- \theta)$. Write $h = \cos\phi\,q + \sin\phi\,v_\perp$ and resolve the angle to obtain $k\sin(\phi- \theta) = \sin\theta$. The runtime uses this scale with unnormalized routed coefficients. At $\beta= 1$ their ideal dense direction has unit norm; for general $\beta$, $\lVert p + \beta e\rVert$ need not be one, so the same coefficient scale need not realize precisely the requested angle. The trust exit acts afterward in either case.

Coherence Bounds for Multi-Concept Composition

For simultaneous suppression of $K \ge2$ target concepts (§ 4.5), let $\delta_1,\ldots,\delta_K \in\mathbb{S}^{d-1}$ be the unit full per-concept edit directions and write $\Delta= \sum_{k=1}^{K}\eta_k\delta_k$ for nonnegative coefficients. Here $\eta_k$ denotes each pre-exit dense magnitude after angular allocation, not the exit step $\eta$ or the allocated angle itself. The following is an exact-arithmetic bound on this sum.

Definition J.10 (Mutual coherence). The Gram matrix of the concept directions is $G \in\mathbb{R}^{K\times K}$, $G_{k\ell} = \langle\delta_k,\delta_\ell\rangle$, and the mutual coherence is $\mu= \max_{k\ne\ell}|G_{k\ell}|$.

Proof. (a) $\langle\Delta,\delta_k\rangle= \eta_k + \sum_{\ell\ne k}\eta_\ell\langle\delta_\ell,\delta_k\rangle\ge\eta_k - \mu\sum_{\ell\ne k}\eta_\ell$, using $\langle\delta_\ell,\delta_k\rangle\ge-\mu$ and $\eta_\ell\ge0$. (b) $G$ has unit diagonal and off-diagonal entries bounded by $\mu$ in absolute value, so each Gershgorin disc of $G$ is centered at $1$ with radius $\sum_{\ell\ne k}|G_{k\ell}| \le(K-1)\mu$; since $G$ is symmetric, its eigenvalues are real and lie in the union of these discs. The Rayleigh-quotient sandwich $\lambda_{\min}(G)\lVert\eta\rVert_2^2 \le\eta^\top G\eta\le\lambda_{\max}(G)\lVert\eta\rVert_2^2$ with $\lambda_{\min}(G) \ge\max(0,1-(K-1)\mu)$ (the Gram matrix is positive semidefinite) and $\eta^\top G\eta= \lVert\sum_k\eta_k\delta_k\rVert_2^2$ gives the claim. (c) Plug $\eta_k=\eta$ into (a): $\langle\Delta,\delta_k\rangle\ge\eta(1-(K-1)\mu)>0$ for every $k$.

Remark J.12 (Geometry is not retrieval non-interference). The norm bound depends on both coherence and coefficient magnitudes. Positive alignment of a pre-normalization sum does not guarantee improved per-concept retrieval after normalization and trust clipping. Nor can the residual-atom heatmap in Figure 8 instantiate $G$: at $\beta=1$ the full directions contain projected and residual components. With a common projector, $\langle g_k,g_\ell\rangle= \langle p_k,p_\ell\rangle+ \langle e_k,e_\ell\rangle$, not simply $\langle r_k,r_\ell\rangle$. Low residual coherence therefore does not establish full-direction incoherence, causal isolation of dictionary benefits, or absence of interference.

Weight Concentration and Gate-Off Identity

The weight generator assigns $w_{x,i} \propto\exp(\operatorname{sim}(h_x,a_i)/\tau)$ over the $N$ atoms (Section A.3). The next lemma describes input-weight concentration, not locality of the deployed edit: least-squares coefficients can be dense regardless of the support or peakedness of $w_x$.

Proof. Divide numerator and denominator of $w_{(1)}$ by $e^{s_{(1)}/\tau}$ to get $w_{(1)} = \left(1+\sum_{i\ge2}e^{-\Delta_i/\tau}\right)^{-1}$, then bound each $\Delta_i \ge\Delta$ and sum the $N-1$ identical terms; the tail mass is $\sum_{i\ge2}w_{(i)} = 1-w_{(1)} \le\frac{(N-1)e^{-\Delta/\tau}}{1+(N-1)e^{-\Delta/\tau}} \le(N-1)e^{-\Delta/\tau}$.

Proof. A zero gate gives zero angle and coefficient scale; identical padded and steered weights produce zero delta. The exit’s active mask requires both a positive gate and a delta norm above its numerical inactivity threshold. For inactive rows it explicitly copies the original source query, bypassing normalization. With every multi-concept gate zero, all allocations and scales vanish and the same copy branch applies. This is bit-exact copying of the input representation, not a consequence of ideal normalization algebra. Historical $\alpha_x$ is absent from this argument and from the deployed operator.

Remark J.15. The ideal cap bound and explicit inactive branch explain bounded motion and exact inactivity under their respective hypotheses. They do not establish dataset-level suppression or a dictionary advantage; empirical comparisons remain necessary.