Stealing Reasoning Traces from Proprietary LLM APIs

Source

• Source name: arXiv
• Source kind: paper
• Authors / organization: Alexander Panfilov, David Schmotz, Ilia Shumailov, Luca Beurer-Kellner, Joachim Schaeffer, Ameya Prabhu, Jonas Geiping, Maksym Andriushchenko
• Venue: arXiv: cs.CR
• Published: 2026-08-10
• Collected: 2026-08-11
• URL: http://arxiv.org/abs/2608.09867v1
• PDF: https://arxiv.org/pdf/2608.09867v1
• DOI: UNKNOWN
• Registry group: academic_apis_and_preprints
• Evidence role: canonical_academic_index
• Language: en
• Country / region: UNKNOWN

Plain-Language Brief

Researchers have identified a vulnerability in the way large language model providers handle their models' step-by-step reasoning. This vulnerability allows for the decryption of encrypted reasoning traces from one model and its reuse in another, less secure model within the same provider's ecosystem. The researchers demonstrate this by extracting sensitive information such as Personally Identifiable Information (PII) and credentials from public logs.

What the Document Says

• The text discusses a vulnerability found in large language model providers where their models' reasoning traces are encrypted and interchangeable across different sessions, users, and models within the provider's ecosystem.
• The researchers demonstrate an attack that decrypts reasoning traces from a stronger model by injecting them into a weaker one, allowing for extraction of proprietary models' reasoning, large-scale private data extraction, revealing hidden hazardous information, and executing invisible prompt injections.
• The text also mentions responsible disclosure and proposed cryptographic and system-level mitigations to secure client-side reasoning.

Key Concepts Mentioned

• large language models
• step-by-step reasoning
• encrypted traces
• vulnerability
• decryption jailbreak
• anti-distillation mechanisms
• Personally Identifiable Information (PII)
• credentials

Claims Made by the Document

• There is a vulnerability in large language model providers' handling of their models' reasoning.
• This vulnerability allows for the extraction of a proprietary model's reasoning, large-scale private data extraction, revealing hidden hazardous information, and executing invisible prompt injections.

Evidence Used

• The researchers demonstrate these claims through examples across Anthropic, OpenAI, and Google.

Methods / Approach

• injecting encrypted reasoning traces from a given model into a weaker model
• decoding encrypted reasoning blocks scraped from public repositories

Limitations Stated by the Authors

UNKNOWN

Limitations Noted by the Agent

Agent interpretation — not from the source.

UNKNOWN

Open Questions

UNKNOWN

Notes for Future Q&A

May include interpretation. Labeled where it does.

UNKNOWN

Raw Abstract / Excerpt

Leading large language model providers now conceal their models' step-by-step reasoning, or chain-of-thought, to protect intellectual property and limit information leakage. Rather than storing these traces server-side, providers return them to the client as blocks of encrypted text, which the client passes back with each subsequent request. Building on prior research, we identify an architectural vulnerability: these encrypted blocks are fully compatible and interchangeable across different sessions, users, and models within a provider's ecosystem. We exploit this compatibility to develop a scalable decryption jailbreak. By injecting an encrypted reasoning trace from a given model into a weaker, and less safeguarded model from the same provider, we force it to decode and output the trace verbatim in plaintext, without ever jailbreaking the more capable model directly. This vulnerability enables four distinct attack vectors. First, it circumvents anti-distillation mechanisms, allowing adversaries to extract a proprietary model's reasoning, as we demonstrate across Anthropic, OpenAI, and Google. Second, it allows for large-scale private data extraction. Developers frequently share session logs publicly, unaware of contents of the encrypted blocks. By decoding 315,320 reasoning blocks scraped from public repositories, we recovered 367 Personally Identifiable Information (PII) artifacts and 182 credentials. Third, it inadvertently reveals hazardous information hidden within the reasoning process, even in cases where the model's final, visible output safely rejects a malicious request. Fourth, attackers can leverage this flaw to execute invisible prompt injections, embedding malicious payloads entirely within encrypted blocks to poison public agentic rollouts. Following responsible disclosure, we propose concrete cryptographic and system-level mitigations to secure client-side reasoning.