Stealing Reasoning Traces from Proprietary LLM APIs
stolen-thoughts.com
Stealing Reasoning Traces from Proprietary LLM APIs
1–10 of 325 posts
Re: Stealing Reasoning Traces from Proprietary LLM APIs
#2Proprietary reasoning can be recovered from its encrypted traces. Anthropic, OpenAI, and Google return encrypted chain-of-thought blocks to clients that can be replayed across sessions, users, and models. We take a trace produced by a frontier model, replay it into a weaker sibling, jailbreak the weaker model, and recover the stronger model’s hidden reasoning in plaintext, without ever attacking the stronger model directly or triggering its anti-distillation safeguards.
Re: Stealing Reasoning Traces from Proprietary LLM APIs
#3Fascinating approach; however, a nightmare to scroll on mobile.
Re: Stealing Reasoning Traces from Proprietary LLM APIs
#4>We take a trace produced by a frontier model, replay it into a weaker sibling, jailbreak the weaker model, ...
Ha! I've been wondering if replaying across models would work, ever since https://blog.cryptographyengineering.com/2026/05/29/fooling-...
I'm honestly rather curious if this was intentionally allowed, it's the sort of validation that's easy to miss (particularly if you're wading into the vibe waters). Seems like something that'd be absolutely riddled with possibilities for shenanigans.
Re: Stealing Reasoning Traces from Proprietary LLM APIs
#5Neat.
Re: Stealing Reasoning Traces from Proprietary LLM APIs
#6Proprietary reasoning can be recovered from its encrypted traces. Anthropic, OpenAI, and Google return encrypted chain-of-thought blocks to clients that can be replayed across sessions, users, and models. We take a trace produced by a frontier model, replay it into a weaker sibling, jailbreak the weaker model, and recover the stronger model’s hidden reasoning in plaintext, without ever attacking the stronger model di…
Why do you restate the abstract? Anyone can read it from the link.
Re: Stealing Reasoning Traces from Proprietary LLM APIs
#7Can someone tell us how they were able to decrypt the encrypted payload? The article says they inserted the cyphertext into a session with a different model. Ok, but how does that allow you to decrypt it?
Re: Stealing Reasoning Traces from Proprietary LLM APIs
#8Really cool work, you get the actual traces. Looks like the vendors can all reliably fix this one though.
A harder to defend against approach here where they work backwards from the results and ask the model to generate a plausible trace: How to Steal Reasoning Without Reasoning Traces https://arxiv.org/pdf/2603.07267
Re: Stealing Reasoning Traces from Proprietary LLM APIs
#9> We take a trace produced by a frontier model, replay it into a weaker sibling, jailbreak the weaker model, ... Ha! I've been wondering if replaying across models would work, ever since https://blog.cryptographyengineering.com/2026/05/29/fooling-... I'm honestly rather curious if this was intentionally allowed, it's the sort of validation that's easy to miss (particularly if you're wading into the vibe waters). Seem…
If you didn’t allow it, you wouldn’t be able to change models in the same conversation, as key parts of the context would be lost.
Wouldn’t surprise me if the providers just remove that ability and lock the model once the conversation starts.
Re: Stealing Reasoning Traces from Proprietary LLM APIs
#10Proprietary reasoning can be recovered from its encrypted traces. Anthropic, OpenAI, and Google return encrypted chain-of-thought blocks to clients that can be replayed across sessions, users, and models. We take a trace produced by a frontier model, replay it into a weaker sibling, jailbreak the weaker model, and recover the stronger model’s hidden reasoning in plaintext, without ever attacking the stronger model di…
Why do you restate the abstract? Anyone can read it from the link.
This is Hacker News. You know people don't follow links and read.