Machine Learning

Stealing Reasoning Traces from Proprietary LLM APIs

Alexander Panfilov, David Schmotz, Ilia Shumailov, Luca Beurer-Kellner, Joachim Schaeffer, Ameya Prabhu, Jonas Geiping, Maksym Andriushchenko

Featured August 21, 2026

Original Paper

AI-generated analysis — This is SciGrove's AI interpretation of the paper, not peer-reviewed content. Always refer to the original paper.

Simply

Smart computer programs hide their secret thinking in scrambled messages, but this paper shows how to trick a less-smart program into unscrambling the secret thoughts from the powerful ones, revealing hidden information and bypassing security.

In depth

The paper identifies a critical architectural vulnerability in how leading LLM providers handle encrypted reasoning traces. These traces, returned to clients as opaque blocks, are found to be fully compatible and interchangeable across different user sessions and even across models within the same provider's ecosystem. This allows an adversary to capture an encrypted trace from a powerful, safeguarded model and inject it into a weaker, less-protected model, forcing the latter to decode and output the trace verbatim in plaintext, effectively bypassing the stronger model's security without direct jailbreaking.

Key Takeaways

1
Proprietary LLM providers return encrypted reasoning traces to clients, which are intended to protect intellectual property and sensitive information.
2
The core vulnerability is the cross-compatibility of these encrypted blocks across different users, sessions, and models within the same provider's ecosystem.
3
Attackers can exploit this by injecting an encrypted trace from a powerful model into a weaker, less-safeguarded model, coercing it to plaintext decryption and enabling various attacks like data extraction and prompt injection.

Conceptual Flow

HIGH LEVEL

Methodology: Tricking a Weaker Model

The paper's method involves taking a secret thought from a strong computer program and making a weaker program reveal it.

Strong Program's Secret Thought

Inject into Weak Program

Weak Program Reveals Secret

Results: Uncovering Hidden Dangers

This trick allows stealing secret thinking, finding private user data, and even planting hidden bad instructions in computer programs.

Revealed Secret Thought

Leads To

Stolen Ideas

Private Data Leaks

Hidden Bad Commands

This breakdown was generated by SciGrove. Get the same analysis — intuition, storyboard, peer review, a runnable prototype and a glossary — on any paper you upload or paste a DOI for.