Stealing Reasoning Traces from Proprietary LLM APIs

Major artificial intelligence companies including Anthropic, OpenAI, and Google return encrypted chain-of-thought reasoning blocks to clients using proprietary application programming interfaces. Because models within the same family share a single encryption key, users can capture these encrypted blocks and replay them across different sessions, users, and models.

Researchers demonstrated a method to steal these hidden reasoning traces in plaintext. They fed an encrypted trace produced by a frontier model into a weaker sibling model within the same family, such as Claude Haiku 4.5, and applied a jailbreak prompt. This forced the weaker model to transcribe the hidden reasoning verbatim. The extracted traces revealed raw, unpolished thinking tokens that were never meant to be seen by humans, such as rough notes on code architecture and styling.

The paper also revealed a prompt injection technique where a model was tricked into thinking about exfiltrating data, like uploading a file to a remote server, inside its reasoning trace. When this encrypted track was fed back into another model, the recipient treated its own reasoning trace as sacrosanct and proved much more likely to follow the embedded instructions.

Following reports from the paper's authors, the model providers acknowledged the findings and updated their systems, rendering this specific attack method unsuccessful.