Papers.Data.Code
Paper

Stealing Reasoning Traces from Proprietary LLM APIs

Alexander Panfilov, David Schmotz, Ilia Shumailov, Luca Beurer-Kellner, Joachim Schaeffer, Ameya Prabhu, Jonas Geiping, Maksym Andriushchenko

Uses cross-model compatibility of encrypted CoT blocks to make weaker sibling models decode and print stronger models' hidden reasoning.

arXiv ↗Aug 10, 2026Dataset ↗

  • llm
  • llm security
  • prompt injection
  • privacy leakage
Method diagram plus scaling plots across three providers showing core claim of thought recovery
Method diagram plus scaling plots across three providers showing core claim of thought recovery

What it is

Shows a cross-model API flaw that lets weaker sibling LLMs decrypt hidden reasoning traces from stronger proprietary models and expose leaked secrets. Instead of attacking a frontier model directly, it replays its encrypted reasoning blob into a weaker compatible model from the same provider, turning that model into a decryption oracle across sessions, users, and models.

Key results

  • Decoded 315,320 public reasoning blocks and found 367 PII artifacts
  • Recovered 182 credentials, including 62 API keys and 33 passwords
  • Demonstrated extraction attacks across Anthropic, OpenAI, and Google

Client-side encrypted reasoning is unsafe when blobs are portable across users, sessions, and model tiers.

One useful ML email a week.

More from Aug 10 – Aug 16

The whole week →

Picked Aug 14

Picked Aug 13

Worth your time, not all of your time.

We track new ML work across papers, code, and data, then keep only the pieces worth a closer look. Selected, not collected.

Papers.Data.Code

The Weekly ML Signal

Selected, not collected.

One useful ML email a week: the papers, repos and datasets worth your attention.

Worth your time, not all of your time.