Stealing Reasoning Traces from Proprietary LLM APIs

Hidden AI reasoning can be decrypted by asking a weaker sibling model to read it aloud.

367

PII artifacts

Personal data items recovered

Found by decoding reasoning blocks developers had shared publicly.

How it works

Encrypted thoughts travel
Anthropic, OpenAI and Google hide model reasoning as encrypted blocks the client sends back each turn. One key fits every model.
Weak model decodes
Paste a strong model's block, like Opus 4.8, into cheap Haiku 4.5 and ask it to transcribe the reasoning verbatim.
Secrets spill out
Attack enables distillation, harmful-content leaks, invisible prompt injections, and recovered API keys and passwords from public logs.

From the paper