# Stealing Reasoning Traces from Proprietary LLM APIs

arXiv: https://arxiv.org/abs/2608.09867 · HTML: https://mlsanity.com/paper/2608.09867/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- Placed in Reasoning for agents, planning and code, one of 17 directions in LLM reasoning.
- Builds on 16 of its 45 references that are in the map.
- First posted on arXiv 10 Aug 2026.

## Placed in

- LLM reasoning / [Reasoning for agents, planning and code](https://mlsanity.com/lr/reasoning-for-agents-planning-and-code/)
- LLM safety and security / [Jailbreaking](https://mlsanity.com/safety/jailbreaking/)

## Builds on (most cited first, 16 of 16)

- [OpenAI o1 System Card](https://mlsanity.com/paper/2412.16720/) (2024)
- [Measuring Faithfulness in Chain-of-Thought Reasoning](https://mlsanity.com/paper/2307.13702/) (2023)
- [Humanity's Last Exam](https://mlsanity.com/paper/2501.14249/) (2025)
- [Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation](https://mlsanity.com/paper/2503.11926/) (2025)
- [OpenThoughts: Data Recipes for Reasoning Models](https://mlsanity.com/paper/2506.04178/) (2025)
- [Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety](https://mlsanity.com/paper/2507.11473/) (2025)
- [Kimi K3: Open Frontier Intelligence](https://mlsanity.com/paper/2607.24653/) (2026)
- [Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks](https://mlsanity.com/paper/2602.20156/) (2026)
- [Stress Testing Deliberative Alignment for Anti-Scheming Training](https://mlsanity.com/paper/2509.15541/) (2025)
- [PostTrainBench: Can LLM Agents Automate LLM Post-Training?](https://mlsanity.com/paper/2603.08640/) (2026)
- [Black-Box On-Policy Distillation of Large Language Models](https://mlsanity.com/paper/2511.10643/) (2025)
- [ClawBench: Can AI Agents Complete Everyday Online Tasks?](https://mlsanity.com/paper/2604.08523/) (2026)
- [Claudini: Autoresearch Discovers State-of-the-Art Adversarial Attack Algorithms for LLMs](https://mlsanity.com/paper/2603.24511/) (2026)
- [How to Steal Reasoning Without Reasoning Traces](https://mlsanity.com/paper/2603.07267/) (2026)
- [Reference-Based Distillation Detection in LLMs](https://mlsanity.com/paper/2607.09692/) (2026)
- [Hidden in Thought: Transferable Chain-of-Thought Artifacts Induce Harmful Behavior](https://mlsanity.com/paper/2607.15286/) (2026)

## Built on by (most cited first, 9 of 9)

- [Capable yet Parsimonious: Extracting and Characterizing Hidden Chain-of-Thought in Frontier Models](https://mlsanity.com/paper/2609.26637/) (2026)
- [Measuring AI Accountability Through Argumentation Analysis: Can Model Reasoning Withstand Scrutiny?](https://mlsanity.com/paper/2609.05088/) (2026)
- [Feyospace-v1: How the Cyber Mercury Seven Trained Frontier Cyber Models](https://mlsanity.com/paper/2609.08418/) (2026)
- [LLM Agents Can Easily Tamper With Their Own Traces](https://mlsanity.com/paper/2609.30266/) (2026)
- [Distillation Defenses Easily Break After Reinforcement Learning](https://mlsanity.com/paper/2609.35699/) (2026)
- [On Language Drift during RLVR Post-Training](https://mlsanity.com/paper/2610.02015/) (2026)
- [Deception by Omission: Language Models Knowingly Hide Their Mistakes](https://mlsanity.com/paper/2610.11351/) (2026)
- [Thinking Inertia: LLMs Keep Thinking When Told Not To](https://mlsanity.com/paper/2610.11765/) (2026)
- [Hybrid Reasoning Agents](https://mlsanity.com/paper/2610.18861/) (2026)

## Abstract (arXiv)

Leading large language model providers now conceal their models' step-by-step reasoning, or chain-of-thought, to protect intellectual property and limit information leakage. Rather than storing these traces server-side, providers return them to the client as blocks of encrypted text, which the client passes back with each subsequent request. Building on prior research, we identify an architectural vulnerability: these encrypted blocks are fully compatible and interchangeable across different sessions, users, and models within a provider's ecosystem. We exploit this compatibility to develop a scalable decryption jailbreak. By injecting an encrypted reasoning trace from a given model into a weaker, and less safeguarded model from the same provider, we force it to decode and output the trace verbatim in plaintext, without ever jailbreaking the more capable model directly. This vulnerability enables four distinct attack vectors. First, it circumvents anti-distillation mechanisms, allowing adversaries to extract a proprietary model's reasoning, as we demonstrate across Anthropic, OpenAI, and Google. Second, it allows for large-scale private data extraction. Developers frequently share session logs publicly, unaware of contents of the encrypted blocks. By decoding 315,320 reasoning blocks scraped from public repositories, we recovered 367 Personally Identifiable Information (PII) artifacts and 182 credentials. Third, it inadvertently reveals hazardous information hidden within the reasoning process, even in cases where the model's final, visible output safely rejects a malicious request. Fourth, attackers can leverage this flaw to execute invisible prompt injections, embedding malicious payloads entirely within encrypted blocks to poison public agentic rollouts. Following responsible disclosure, we propose concrete cryptographic and system-level mitigations to secure client-side reasoning.