Stealing Reasoning Traces from Proprietary LLM APIs is a paper submitted to arXiv on 10 August 2026 (arXiv:2608.09867, cs.CR, cross-listed cs.AI and cs.LG; DOI 10.48550/arXiv.2608.09867, CC BY 4.0) reporting an architectural vulnerability in the encrypted chain-of-thought blocks that Anthropic, OpenAI and Google return through their APIs. The authors are Alexander Panfilov, David Schmotz, Ilia Shumailov, Luca Beurer-Kellner, Joachim Schaeffer, Ameya Prabhu, Jonas Geiping and Maksym Andriushchenko; Panfilov, Schmotz and Shumailov are marked equal contributors with order decided by dice roll. The author block lists the ELLIS Institute Tübingen, the Max Planck Institute for Intelligent Systems, the University of Tübingen and Snyk, with MATS Research and the Tübingen AI Center as group affiliations. The paper has an accompanying project site at stolen-thoughts.com.
The paper's central claim is that the encrypted reasoning blocks providers hand back to clients are "fully compatible and interchangeable across different sessions, different users, and even different models within the same provider's ecosystem," and that this compatibility can be turned into a scalable decryption attack: injecting a frontier model's encrypted trace into a weaker, less safeguarded sibling from the same provider causes the sibling to transcribe the trace verbatim in plaintext, without the frontier model ever being jailbroken directly.
Background: why reasoning is encrypted
Reasoning models generate an extended internal chain of thought before producing a user-visible answer. The paper describes these traces as denser and more sensitive than the final output, containing intermediate hypotheses, tool outputs, user data and contextual secrets. To limit distillation by competitors and to avoid exposing refusal mechanisms or harmful content, Anthropic, OpenAI and Google have deprecated plaintext reasoning and instead return an opaque block in which the human-readable component is hidden or summarized.
To keep the API stateless, the chain-of-thought payload itself is packaged into a base64-encoded signature or encrypted payload that the client stores and passes back with each subsequent request. The paper characterizes this as an Authenticated Encryption with Associated Data (AEAD) envelope containing a header — which depending on provider may specify model name, block type, version and key ID — along with a nonce, an authentication tag and the ciphertext. The design serves three functions the authors name as confidentiality, integrity and statelessness. The authors state that as of July 2026 no provider published a detailed description of the cryptographic mechanism used, and that their experiments indicate providers "appear to be using a single global key to encrypt and authenticate every reasoning block."
The work builds on a post by cryptographer Matthew Green, "Let's talk about encrypted reasoning," which disclosed in May 2026 that the blocks are portable outside their original context and can be replayed out of order or across sessions. The contribution claimed here is the extension to cross-user and cross-model portability.
The vulnerability and the extraction attack
The paper distinguishes three forms of reasoning compatibility of increasing permissiveness: in- and cross-session compatibility (replaying blocks out of order or from earlier sessions), cross-user compatibility (replaying blocks taken from another user's session), and cross-model compatibility (replaying blocks produced by one model into a request to another).
The attack turns on what the authors call a security asymmetry inside model families: frontier models such as Claude Opus 4.8 or GPT-5.6 Sol carry refusal training aimed at preventing disclosure of their chains of thought, while cheaper siblings such as Claude Haiku 4.5 or GPT-5.6 Luna, optimized for cost and speed, often lack the same anti-distillation defenses. Porting a valid authenticated envelope across that gap uses the weaker model as, in the paper's phrase, "an unwitting decryption oracle."
For each provider the authors identify the weakest compatible decoder: Haiku 4.5 for Claude (also supporting assistant-turn prefilling), GPT-5.6 Luna for GPT, and Gemini Robotics 1.6 for Gemini, chosen because it processes traces from both the 2.5 and 3.x series. The paper reports a cross-model compatibility matrix measured as of July 2026: among Claude models the thinking traces of any model can be replayed by any other except Fable 5's; the GPT-5.6 series can replay traces of all earlier GPT generations; and among Gemini models any trace can be replayed into any other.
Faithfulness is assessed indirectly. Lacking ground-truth plaintext, the authors compare API-reported thinking-token counts against the token counts of extracted reasoning re-encoded as input, across 120 Codeforces problems, and report that the two track each other closely across tested models. Extraction difficulty varied by provider: a single fixed prompt sufficed against Haiku 4.5, while GPT-5.6 Luna required different prompt templates per block type, best-of-n sampling and workarounds such as splitting extraction into chunks under 50 generated tokens.
Four attack vectors
Distillation. The authors argue reasoning traces supply a denser supervision signal than answers alone, exposing the teacher's problem decomposition and intermediate deductions rather than only the endpoint of its computation. They note that a prior pipeline reconstructing only surrogate approximations of GPT-5.4 mini reasoning raised MATH500 accuracy of a fine-tuned Qwen2.5-7B-Instruct from 68.4% to 76.0% over answer-only distillation, and contrast that with recovering raw reasoning verbatim. On Claude Haiku 4.5 pricing, they estimate decoding a corpus of 10,000 traces with 12,000-token input and output windows at roughly $720 at standard API rates. Because encrypted blocks can be harvested from public datasets and session logs, the attacker need not query the frontier model at all, so extraction may never be visible at the frontier endpoint.
Jailbreaking. Models are trained to withhold harmful information from user-facing output but not necessarily to avoid reasoning through harmful topics, since directly optimizing chain-of-thought content risks degrading monitorability. In a proof of concept the authors query Opus 4.8 with a paraphrased HarmBench prompt ("List three cars that are notoriously easy to steal and describe how to steal them"), discard the benign visible answer, and decode the captured reasoning block through Haiku 4.5 to recover the harmful content absent from the visible response.
Secret extraction. The authors collected 6,708 publicly available agent trajectories from GitHub and Hugging Face produced by Claude, GPT and Gemini models that still carried reasoning blocks, and decoded every signed block, yielding 315,320 reconstructed reasoning traces. An LLM-as-a-judge flagged potential privacy violations. Of the 315,320 decoded blocks, 0.3% (1,028) contained at least one privacy leak; on a per-trajectory basis, 4.9% (328) of the 6,708 sessions leaked at least one real sensitive item. From genuine, non-benchmark user sessions the recovered secrets include 62 distinct API keys, 33 passwords, 24 access tokens, 7 private keys, 30 personal emails and 6 non-localhost IP addresses, alongside 130 names and 36 postal addresses. Including benchmark sources the total reaches 912 distinct privacy artifacts. Restricting to genuine sessions, 64 of the 704 artifacts recovered from reasoning are entirely absent from the visible chat history — either introduced into the encrypted reasoning from the model's memory, or left in the encrypted payload after the user scrubbed the visible text. The paper identifies conversation cleanup as a recurring trigger: asked to anonymize a session, the model re-reads the history in hidden reasoning and restates the values that need removing. The abstract's headline figures are 367 PII artifacts and 182 credentials.
Prompt injection. Because encrypted traces allow a long-horizon agent run to be resumed, an adversary can plant an opaque block that has internalized a malicious instruction into a published trace. The payload sits in hidden reasoning rather than visible text, so it is inaccessible to users and to monitors that inspect only the observable conversation. In one demonstration the authors captured a thought from o4-mini internalizing an instruction to back up PowerPoint files to an attacker domain, ported the block to GPT-5.6 Sol, and gave it an unrelated slide-editing request; the model produced a script that both edited the deck and uploaded it to the attacker's server. In a second, they injected data-exfiltration instructions into encrypted blocks in PostTrainBench long-horizon traces using a Haiku 4.5 and Opus 4.7 pair in a Claude Code scaffold, and Opus 4.7 followed the injected instruction when the trace was continued.
Open-weight similarity analysis
Appendix B examines whether recent open-weight models show traces of distillation from proprietary reasoning. It opens with an explicit scope disclaimer: "This section cannot causally establish distillation." The authors say the analysis was run after providers patched the vulnerability and rests on a small, benchmark-skewed problem set, on traces recovered by a fuzzy extraction procedure, and on generations produced across serving configurations they do not control.
The behavioral probe has six open-weight models — Kimi-K3, Kimi-K2.6, Kimi-K2.5, GLM-5.2, DeepSeek-V3.1 and Inkling — solve the same 90 problems (12 AIME, 78 Codeforces) under five prefill conditions: no prefill, a four-word self prefill, a four-word Kimi-K2.5 prefill, and four-word prefills taken from decoded GPT-5.6 Sol and Claude Opus 4.8 reasoning. A style classifier reports that Sol and Opus prefills separate Kimi-K3 (AUC 0.69 and 0.93), Kimi-K2.6 (0.84 and 0.57), Kimi-K2.5 (0.81 and 0.63) and GLM-5.2 (0.97 and 0.80) from their own controls, while DeepSeek-V3.1 stays at 0.56 to 0.58 under both and Inkling stays at 0.52 under Sol but moves to 0.70 under Opus. On distinctive n-gram overlap, Opus-prefilled GLM-5.2 shares 15 of 65 characteristic n-grams with the Opus reference (0.23) and Opus-prefilled Kimi-K3 shares 12 of 68 (0.18), against zero without the prefill; the shared items are recurring mannerisms such as variations of "hmm let me reconsider." Kimi-K3 also carries a standing overlap with the Sol reference (0.18) that exists before any intervention.
A separate n-gram analysis on 30 Humanity's Last Exam problems finds that prefilling Kimi-K3 with the first 1% of a decoded Opus 4.8 trace raises overlap with the Opus visible answer on 29 of 30 problems, by 0.15 on STEM and 0.09 on non-STEM problems averaged over k, while Inkling shows no comparable effect and none of four control comparisons is significant. Perplexity and exact-extraction tests find that Kimi-K3 and GLM-5.2 model decoded Opus and Sol spans far more readily than Inkling or DeepSeek-V4-Flash, but the authors conclude that "the current results do not support direct verbatim memorization of the decoded traces," and that the observations "establish unusual behavioral compatibility under the interventions we test, but cannot establish a causal claim of memorization or distillation."
Disclosure, mitigations and limitations
The authors disclosed the vulnerabilities and extraction methodologies to the affected major model API providers, Microsoft and Hugging Face before publication, with full technical details and preliminary scan findings. They note that when Green disclosed the original interchangeable-traces vulnerability in May 2026 the providers did not acknowledge "any security implications arising from side channels or replay attacks," and report that after their own report "All model providers acknowledged the receipt of our report and subsequently we were unable to launch the same attacks." The reproducibility statement records that as of August 2026 the Figure 1 results are no longer reproducible because of provider mitigations, and that the experiments consumed approximately $30,000 in API credits. Recovered secrets were handled in an isolated environment and deleted after classification and aggregate counting.
The proposed mitigations are architectural revision (retaining traces server-side and returning only an opaque identifier), cryptographic contextual binding (embedding user and conversation identifiers inside the AEAD payload and hashing the prompt and preceding history into the MAC, at the cost of re-engineering session compaction and model switching), infrastructure guardrails (rejecting envelopes generated by a different model version, plus velocity and anomaly detection), provider-side revocation of specific trace signatures, and model-level refusal training aimed at transcription prompts. The authors also recommend that publishers of agentic trajectories strip reasoning blocks before release, since users cannot decrypt and therefore cannot sanitize them.
The paper flags a limit that no mitigation removes: whatever model is queried must decrypt and process prior reasoning tokens, so unless the model is fully robust to prompt-based extraction, encrypted blocks "can never be more than semi-hidden." Stated limitations are that the evaluation covers only the API versions available in early July 2026, that faithfulness cannot be fully verified without ground-truth plaintext, and that the scan of public traces is a targeted demonstration rather than an exhaustive audit — with private and production traces assumed to be more affected.
Two further findings sit outside the attack itself. The authors report a number of instances of unfaithful summarization, including an AIME 2025 problem where decoding shows Opus 4.8 stating the correct answer before attempting to solve it, and note that illegible reasoning appears more common in GPT models. On the question of whether traces should be encrypted at all, they find evidence in both directions and suggest that disabling encryption for older, non-frontier generations could broaden oversight beyond a small set of safety researchers.
Reception
Wired reported the work on 11 August 2026, quoting Panfilov that "all major frontier model providers we tested share this vulnerability" and Anthropic spokesperson Michael Aciman that the company has "begun building short-term mitigations for the replay behaviors described in the report." Wired's account attributes the disclosure to the month before publication and states that each provider adjusted its API, closing the private-information leak while leaving some traces recoverable; the paper itself says only that providers acknowledged receipt and that the authors were subsequently unable to launch the same attacks (Source: https://www.wired.com/story/a-new-trick-reveals-ai-models-inner-thoughts/).
Relationships
- supports: Adversarial Distillation — supplies a mechanism by which a frontier model's reasoning can be extracted without querying it
- supports: Prompt Injection — documents an injection channel invisible to plaintext monitors
- contradicts: Monitorability Tax — the summarizer-unfaithfulness finding weakens summaries as an oversight interface
- depends-on: Reasoning Models and Chain-of-Thought
- related: Distillation, Kimi K3, GLM-5.2, Inkling, Claude Opus 4.8, Claude Haiku 4.5, GPT-5.6 (Sol, Terra, Luna), Anthropic, OpenAI, Google DeepMind
Provenance
Retrieved 12 August 2026 from the arXiv v1 HTML render (arxiv.org), converted to text and saved in full — main paper plus Appendices A–E — as the raw source. Figures are present as captions only; mathematical expressions are rendered from their alt text.