EchoCoT: Extracting Hidden Chain-of-Thought from Large Reasoning Models

Source

• Source name: arXiv
• Source kind: paper
• Authors / organization: Yiting Qu, Ziqing Yang, Chi Cui, Ye Leng, Junjie Chu, Yang Zhang
• Venue: arXiv: cs.CR
• Published: 2026-08-20
• Collected: 2026-08-21
• URL: http://arxiv.org/abs/2608.20055v1
• PDF: https://arxiv.org/pdf/2608.20055v1
• DOI: UNKNOWN
• Registry group: academic_apis_and_preprints
• Evidence role: canonical_academic_index
• Language: en
• Country / region: UNKNOWN

Plain-Language Brief

Researchers developed EchoCoT, a method that extracts hidden chain-of-thought (CoT) traces from large reasoning models (LRMs), which are valuable but often inaccessible assets. They found that EchoCoT can successfully extract CoTs from various LRMs, achieving up to 66.4% success on open-source models and up to 80% on unseen datasets. For proprietary LRMs, many extracted CoTs align with provider-reported reasoning lengths and summaries. The method can also extract very long CoTs.

What the Document Says

• The work focuses on extracting hidden chain-of-thought (CoT) traces from large reasoning models (LRMs).
• EchoCoT is a developed multi-step attack that iteratively extracts hidden CoTs using API-returned fidelity signals.
• An LLM-based optimization framework is used to automatically search for an effective universal injection trajectory across various datasets.
• The study involves evaluating EchoCoT on three open-source and five frontier proprietary LRMs.
• On open-source LRMs, EchoCoT achieves up to 66.4% near-verbatim extraction success with the extracted trace length within 10% of the target and at least 90% of tokens exactly matching the target CoT.
• The same injection trajectory generalizes to unseen datasets, achieving up to 80% extraction success under the same criterion.
• For tested frontier proprietary LRMs, a substantial fraction of extracted CoTs closely align with provider-reported reasoning lengths and available CoT summaries.
• EchoCoT can extract very long CoTs: on Gemini-2.5, it extracts 33,463 tokens from a 32,948-token target.

Key Concepts Mentioned

• hidden chain-of-thought (CoT) traces
• large reasoning models (LRMs)
• EchoCoT
• API interactions
• fidelity signals
• LLM-based optimization framework

Claims Made by the Document

• Hidden CoT traces can be extracted near-verbatim from black-box LRMs through API interactions.
• EchoCoT achieves up to 66.4% near-verbatim extraction success on open-source LRMs.
• The same injection trajectory generalizes to unseen datasets, achieving up to 80% extraction success.

Evidence Used

• Methods used: EchoCoT, LLM-based optimization framework
• Evaluation on various LRMs and results provided in the text

Methods / Approach

UNKNOWN

Limitations Stated by the Authors

UNKNOWN

Limitations Noted by the Agent

Agent interpretation — not from the source.

UNKNOWN

Open Questions

UNKNOWN

Notes for Future Q&A

May include interpretation. Labeled where it does.

UNKNOWN

Raw Abstract / Excerpt

Hidden chain-of-thought (CoT) traces, especially those from frontier proprietary large reasoning models (LRMs), are valuable model assets. Yet whether these hidden CoTs can be directly extracted from black-box models remains largely unexplored. In this work, we systematically study whether hidden CoTs can be extracted near-verbatim from black-box LRMs through API interactions. We identify a previously overlooked reasoning replay surface between tool calls and develop EchoCoT, a multi-step attack that iteratively extracts hidden CoTs using API-returned fidelity signals. We further develop an LLM-based optimization framework that automatically searches for an effective universal injection trajectory across various datasets. We evaluate EchoCoT on three open-source and five frontier proprietary LRMs. On open-source LRMs, EchoCoT achieves up to 66.4% near-verbatim extraction success, with the extracted trace length within 10% of the target and at least 90% of tokens exactly matching the target CoT. The same injection trajectory also generalizes to unseen datasets, achieving up to 80% extraction success under the same criterion. For tested frontier proprietary LRMs, a substantial fraction of extracted CoTs closely align with provider-reported reasoning lengths and available CoT summaries. EchoCoT can also extract very long CoTs: on Gemini-2.5, it extracts 33,463 tokens from a 32,948-token target. These results establish hidden-CoT extraction as a practical security risk and highlight the need to better protect hidden CoT assets.