Encrypted reasoning traces are the opaque blocks that Anthropic, OpenAI and Google return in place of a reasoning model's plaintext chain of thought. The model's intermediate reasoning is packaged into an encrypted or signed payload; the client stores it and passes it back with each subsequent request so that multi-turn continuity is preserved without the provider holding session state. The design sits at the intersection of three goals that pull against one another: protecting proprietary reasoning from distillation, keeping the API stateless, and preserving enough visibility for oversight.
Design
Reasoning models generate extended intermediate steps before producing a user-visible answer (see Reasoning Models and Chain-of-Thought). Those traces are denser and more sensitive than the final output, carrying intermediate hypotheses, tool outputs, user data and contextual secrets. Through 2025 providers returned them in plaintext or as an optional field; by 2026 Anthropic, OpenAI and Google had all deprecated plaintext reasoning in their APIs, returning a block in which the human-readable component is either hidden entirely or replaced by a summary (Stealing Reasoning Traces from Proprietary LLM APIs).
The chain-of-thought payload itself still travels to the client, packaged as a base64-encoded signature or encrypted payload. Stealing Reasoning Traces from Proprietary LLM APIs characterizes it as an Authenticated Encryption with Associated Data (AEAD) envelope containing a header — which depending on the provider may specify model name, block type, version and key ID — along with a nonce, an authentication tag and the ciphertext, passed back through fields such as signature or thinkingSignature. The paper attributes three operational functions to the design: confidentiality, which blocks competitors from mass-harvesting explicit chains of thought; integrity, since tampering invalidates the MAC and can be rejected; and statelessness, which pushes storage cost onto the client. The authors state that as of July 2026 no provider had published a detailed description of the cryptographic mechanism in use.
Statelessness is what makes the envelopes portable. For a client to hold a trace and replay it, the block must remain valid outside the exact request that produced it — which in practice has meant validity across contexts, users and sibling models, enabling product behaviour such as seamless model switching and automatic re-routing without discarding reasoning tokens.
Portability and the extraction vulnerability
Johns Hopkins cryptographer Matthew Green, writing in May 2026, first documented that the blocks are portable outside their original context and can be replayed out of order or across sessions, and reported that providers did not acknowledge "any security implications arising from side channels or replay attacks" (Stealing Reasoning Traces from Proprietary LLM APIs, citing Green, "Let's talk about encrypted reasoning").
Stealing Reasoning Traces from Proprietary LLM APIs (arXiv:2608.09867, submitted 10 August 2026) extended the finding to cross-user and cross-model portability, reporting that the blocks are "fully compatible and interchangeable across different sessions, different users, and even different models within the same provider's ecosystem," and that providers appear to use a single global key to encrypt and authenticate every reasoning block. The authors distinguish three degrees of compatibility — in- and cross-session, cross-user, and cross-model — each enabling a broader class of attack.
The resulting attack turns on an asymmetry inside model families: frontier models such as Claude Opus 4.8 or GPT-5.6 Sol carry refusal training aimed at preventing disclosure of their reasoning, while cheaper siblings such as Claude Haiku 4.5 or GPT-5.6 Luna often lack the same anti-distillation defenses. Injecting a frontier model's encrypted trace into the weaker sibling causes it to transcribe the trace verbatim in plaintext, without the frontier model being jailbroken directly. The paper measured a cross-model compatibility matrix as of July 2026 in which, among Claude models, any model's traces could be replayed by any other except Fable 5's; the GPT-5.6 series could replay traces of all earlier GPT generations; and any Gemini trace could be replayed into any other Gemini model. Four downstream uses are documented: distillation of proprietary reasoning, jailbreaking through content present in reasoning but absent from a refused answer, extraction of credentials and personal data from publicly posted traces, and prompt injection payloads hidden inside the encrypted block.
Following disclosure to the affected providers, Microsoft and Hugging Face, all providers acknowledged the report and the authors record that they were subsequently unable to launch the same attacks; the paper's reproducibility statement says its headline results were no longer reproducible as of August 2026. Wired reported that each provider adjusted its API, closing the private-information leak while leaving some traces recoverable (Source: wired.com).
Privacy consequences of client-side storage
Because the payload is opaque to the user who holds it, ordinary sanitization does not reach it. Developers publishing agent trajectories for reproducibility strip secrets from the plaintext they can read, while the encrypted blocks travel with the transcript intact. Scanning 6,708 publicly posted agent trajectories from GitHub and Hugging Face and decoding 315,320 reasoning blocks, Stealing Reasoning Traces from Proprietary LLM APIs found that 0.3% of blocks and 4.9% of sessions leaked at least one real sensitive item, recovering from genuine user sessions 62 distinct API keys, 33 passwords, 24 access tokens, 7 private keys, 30 personal emails and 6 non-localhost IP addresses. Of 704 artifacts recovered from genuine sessions, 64 were absent from the visible chat history altogether. A recurring trigger was conversation cleanup: asked to anonymize a session, the model re-read the history in hidden reasoning and restated there the values it was removing.
The authors' recommendation to publishers is to strip reasoning blocks from transcripts before release, since users have no means of decrypting and therefore no means of sanitizing them.
Proposed mitigations
Stealing Reasoning Traces from Proprietary LLM APIs proposes a defence-in-depth set. Architectural revision would return reasoning to server-side storage, handing the client only an opaque identifier — eliminating the extraction payload at the cost of database overhead and API complexity. Cryptographic contextual binding would keep the stateless design but embed user and conversation identifiers inside the AEAD payload and hash the prompt and preceding history into the MAC, so that a replayed signature fails; the authors note this would require re-engineering session compaction and model-switching protocols that currently depend on portability. Infrastructure guardrails would reject envelopes generated by a different model version and add velocity and anomaly detection. Provider-side revocation would invalidate specific trace signatures on detection of anomalous replay. Model-level defenses would add refusal training against transcription prompts.
The paper flags one limit that none of these removes: whatever model is queried must decrypt and process the prior reasoning tokens, so unless the model is fully robust to prompt-based extraction, encrypted blocks "can never be more than semi-hidden," and users should not treat them as confidential storage.
Debate over encryption itself
Whether reasoning should be encrypted at all is unsettled in the source material, and Stealing Reasoning Traces from Proprietary LLM APIs reports evidence in both directions. Encryption lets a model consider harmful information in its thinking without divulging it; it also creates the injection surface and the near-undetectable privacy exposure described above. An alternative the authors raise is ephemeral reasoning — letting models reason before every output and deleting the trace afterwards, neither storing nor returning it — a mode already supported by several providers.
The oversight argument cuts against encryption. Where traces are hidden, provider-generated summaries become the practical interface for scalable oversight, and the paper reports a number of instances of unfaithful summarization, including a decoded Opus 4.8 trace that states the correct answer before attempting to solve the problem. Setting aside anti-distillation motives, the authors suggest that giving users unredacted reasoning would enable oversight by a broad user base rather than a small set of safety researchers, and that eventually disabling encryption for older, non-frontier generations may be worth considering. This bears on the Monitorability Tax: here the cost of preserving monitorability falls on intellectual-property protection rather than on capability.
Relationships
- depends-on: Reasoning Models and Chain-of-Thought
- supports: Adversarial Distillation — supplies an extraction channel invisible at the frontier endpoint
- supports: Prompt Injection — the encrypted block is an injection surface no plaintext monitor sees
- contradicts: Monitorability Tax — summaries relied on for oversight were found unfaithful
- related: Distillation, AI Transparency, Claude Haiku 4.5, Claude Opus 4.8, GPT-5.6 (Sol, Terra, Luna), Anthropic, OpenAI, Google DeepMind