# How to Steal Reasoning Without Reasoning Traces

arXiv: https://arxiv.org/abs/2603.07267 · HTML: https://mlsanity.com/paper/2603.07267/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 7 Mar 2026.

## Built on by (most cited first, 8 of 8)

- [Stealing Reasoning Traces from Proprietary LLM APIs](https://mlsanity.com/paper/2608.09867/) (2026)
- [Hidden Thoughts Are Not Secret: Reasoning Trace Exposure in LLMs](https://mlsanity.com/paper/2606.00642/) (2026)
- [How Much Does a Reasoning Summary Reveal? An Observability Ladder for Large Language Models](https://mlsanity.com/paper/2608.02089/) (2026)
- [Capable yet Parsimonious: Extracting and Characterizing Hidden Chain-of-Thought in Frontier Models](https://mlsanity.com/paper/2609.26637/) (2026)
- [The Distillation Game: Adaptive Evaluations & Efficient Defenses](https://mlsanity.com/paper/2605.22737/) (2026)
- [Recon: Reconstruction-Guided Reasoning Synthesis for User Modeling](https://mlsanity.com/paper/2605.26969/) (2026)
- [Distillation Defenses Easily Break After Reinforcement Learning](https://mlsanity.com/paper/2609.35699/) (2026)
- [Thinking Inertia: LLMs Keep Thinking When Told Not To](https://mlsanity.com/paper/2610.11765/) (2026)

## Abstract (arXiv)

Many large language models (LLMs) use reasoning to generate responses but do not reveal their full reasoning traces (a.k.a. chains of thought), instead outputting only final answers and brief reasoning summaries. To demonstrate that hiding reasoning traces does not prevent users from "stealing" a model's reasoning capabilities, we introduce trace inversion models that, given only the inputs, answers, and (optionally) reasoning summaries exposed by a target model, generate detailed, synthetic reasoning traces. We show that (1) traces synthesized by trace inversion have high overlap with the ground-truth reasoning traces (when available), and (2) fine-tuning student models on inverted traces substantially improves their reasoning and enables distillation from proprietary, black-box LLMs.