Stealing Reasoning Traces from Proprietary LLM APIs

Source

• Source name: arXiv
• Source kind: paper
• Authors / organization: Alexander Panfilov, David Schmotz, Ilia Shumailov, Luca Beurer-Kellner, Joachim Schaeffer, Ameya Prabhu, Jonas Geiping, Maksym Andriushchenko
• Venue: arXiv: cs.CR
• Published: 2026-08-10
• Collected: 2026-08-11
• URL: http://arxiv.org/abs/2608.09867v1
• PDF: https://arxiv.org/pdf/2608.09867v1
• DOI: UNKNOWN
• Registry group: academic_apis_and_preprints
• Evidence role: canonical_academic_index
• Language: en
• Country / region: UNKNOWN

Plain-Language Brief

Researchers have found a vulnerability in the way large language model providers handle encrypted reasoning traces. This vulnerability allows for decryption of these traces across different models within the same provider's ecosystem, potentially leading to theft of proprietary information, extraction of personal data, and even injection of malicious prompts.

What the Document Says

• The researchers identified a compatibility issue between encrypted reasoning traces in different sessions, users, and models within a provider's ecosystem.
• They exploited this issue to develop a scalable decryption jailbreak that forces weaker models to decode and reveal the encrypted trace in plaintext without directly jailbreaking the more capable model.
• This vulnerability allows for bypassing anti-distillation mechanisms, extracting proprietary reasoning, large-scale private data extraction, revealing hidden dangerous information, and executing invisible prompt injections.
• The researchers demonstrated this issue across Anthropic, OpenAI, and Google.

Key Concepts Mentioned

• large language models
• reasoning traces
• encryption
• compatibility
• vulnerability
• decryption jailbreak
• anti-distillation mechanisms
• personal data
• malicious prompts

Claims Made by the Document

• There is a compatibility issue between encrypted reasoning traces in different sessions, users, and models within a provider's ecosystem.
• This compatibility issue can be exploited to bypass anti-distillation mechanisms, extract proprietary reasoning, perform large-scale private data extraction, reveal hidden dangerous information, and execute invisible prompt injections.

Evidence Used

• The researchers provide examples of demonstrating this issue across Anthropic, OpenAI, and Google.

Methods / Approach

• Identification of an architectural vulnerability
• Exploitation of this compatibility to develop a scalable decryption jailbreak

Limitations Stated by the Authors

Not stated in source

Limitations Noted by the Agent

Agent interpretation — not from the source.

The proposed mitigations for securing client-side reasoning are not detailed in the provided text.

Open Questions

• What specific cryptographic and system-level mitigations were proposed by the authors to secure client-side reasoning?

Notes for Future Q&A

May include interpretation. Labeled where it does.

The text mentions responsible disclosure and proposed cryptographic and system-level mitigations, but does not detail what these proposals entail.

Raw Abstract / Excerpt

Leading large language model providers now conceal their models' step-by-step reasoning, or chain-of-thought, to protect intellectual property and limit information leakage. Rather than storing these traces server-side, providers return them to the client as blocks of encrypted text, which the client passes back with each subsequent request. Building on prior research, we identify an architectural vulnerability: these encrypted blocks are fully compatible and interchangeable across different sessions, users, and models within a provider's ecosystem. We exploit this compatibility to develop a scalable decryption jailbreak. By injecting an encrypted reasoning trace from a given model into a weaker, and less safeguarded model from the same provider, we force it to decode and output the trace verbatim in plaintext, without ever jailbreaking the more capable model directly. This vulnerability enables four distinct attack vectors. First, it circumvents anti-distillation mechanisms, allowing adversaries to extract a proprietary model's reasoning, as we demonstrate across Anthropic, OpenAI, and Google. Second, it allows for large-scale private data extraction. Developers frequently share session logs publicly, unaware of contents of the encrypted blocks. By decoding 315,320 reasoning blocks scraped from public repositories, we recovered 367 Personally Identifiable Information (PII) artifacts and 182 credentials. Third, it inadvertently reveals hazardous information hidden within the reasoning process, even in cases where the model's final, visible output safely rejects a malicious request. Fourth, attackers can leverage this flaw to execute invisible prompt injections, embedding malicious payloads entirely within encrypted blocks to poison public agentic rollouts. Following responsible disclosure, we propose concrete cryptographic and system-level mitigations to secure client-side reasoning.