I must say right of the bat this is the best research paper/working paper in regards to its styling. Beautiful
[deleted]
Stealing Reasoning Traces from Proprietary LLM APIs
71–80 of 325 posts
Re: Stealing Reasoning Traces from Proprietary LLM APIs
#72You cannot steal what is not owned. At least in the EU there is no copyright for LLM outputs, so I guess all they might do is violate the terms of service.
Even copyrighted information can never be "stolen". It can only copied without authorization.
Re: Stealing Reasoning Traces from Proprietary LLM APIs
#73Proprietary reasoning can be recovered from its encrypted traces. Anthropic, OpenAI, and Google return encrypted chain-of-thought blocks to clients that can be replayed across sessions, users, and models. We take a trace produced by a frontier model, replay it into a weaker sibling, jailbreak the weaker model, and recover the stronger model’s hidden reasoning in plaintext, without ever attacking the stronger model di…
Why do you restate the abstract? Anyone can read it from the link.
This is a non-transparent aspect of submitting a link to HN that is quite misleading.
You think that you are adding a description for your post when in fact you're simply submitting a regular comment not promoted or distinguished in any way.
It's even worse considering posts without URLs would take the same text from the same input box on the HN submission form and append it under the post title, locking it to the top of the page - so if you've browsed linkless posts you think maybe the submission text is gonna end up just like that, but it doesn't. (Also I think you'll even see URLs like an archive link end up appended just below the submission title for URL posts. Which I guess is a special feature.[1])
Any reason I should not send HN an email requesting clarification of this the submission page?
Edit: quoting https://news.ycombinator.com/submit :
“If there is no url, text will appear at the top of the thread.”
[1]modpowers(?) used to directly append links to URL submissions further confuse the matter: https://news.ycombinator.com/item?id=49243880
Re: Stealing Reasoning Traces from Proprietary LLM APIs
#74If I'm reading this right, they literally just ask a LLM to tell them what the traces say, with the key being that the traces are portable across LLM models, so they can switch to a smaller one that's easier to jailbreak.
Re: Stealing Reasoning Traces from Proprietary LLM APIs
#75I must say right of the bat this is the best research paper/working paper in regards to its styling. Beautiful
I agree on desktop/laptop, but on mobile there are images that appear under the text making it hard to read.
On an iPhone Pro Max only the first trace is readable.
Navigating to the right lands between two cards, so that neither is readable.
Re: Stealing Reasoning Traces from Proprietary LLM APIs
#76Prefilling Kimi K3 with opus is a super interesting idea. That being said, I absolutely hate this website layout
Re: Stealing Reasoning Traces from Proprietary LLM APIs
#77Earlier quoted context omitted.
If you didn’t allow it, you wouldn’t be able to change models in the same conversation, as key parts of the context would be lost. Wouldn’t surprise me if the providers just remove that ability and lock the model once the conversation starts.
I really don't understand why server-side storage of the trace isn't a viable approach here, with only a unique key flowing to the client and back. Does it have something to do with how backend load-balancing works?
That’s incompatible with zero data retention and so you’ll lose a lot of enterprise customers.
Re: Stealing Reasoning Traces from Proprietary LLM APIs
#78Earlier quoted context omitted.
I really don't understand why server-side storage of the trace isn't a viable approach here, with only a unique key flowing to the client and back. Does it have something to do with how backend load-balancing works?
Makes no difference. There is a policy as to whether to allow use of a reasoning trace in a given context. Whether that trace originates from authenticated ciphertext or a backend database is basically irrelevant.
Good point, thanks.
Re: Stealing Reasoning Traces from Proprietary LLM APIs
#79Earlier quoted context omitted.
If you didn’t allow it, you wouldn’t be able to change models in the same conversation, as key parts of the context would be lost. Wouldn’t surprise me if the providers just remove that ability and lock the model once the conversation starts.
There seems to be an obvious choice to make here, should you give the users to decrypt and use the COT that they did not generate themselves? This is only required if you want users to be able to share things with everyone and you are going for the simplest implementation. If not you could try to keep a record of keys associated with a user, then when a new request comes in look through to see if the user has a valid…
It’s about being able to change models mid-task. For example, I want to be able to plan using Fable but implement the plan using Sonnet, and that won’t work if this is implemented.
Re: Stealing Reasoning Traces from Proprietary LLM APIs
#80Earlier quoted context omitted.
If you didn’t allow it, you wouldn’t be able to change models in the same conversation, as key parts of the context would be lost. Wouldn’t surprise me if the providers just remove that ability and lock the model once the conversation starts.
100% guaranteed that this research just forced this to happen now. Sucks.
It’s already patched according to the authors. Details were not specified.