Live data from Hacker News

Stealing Reasoning Traces from Proprietary LLM APIs

stolen-thoughts.com

311–320 of 325 posts

Re: Stealing Reasoning Traces from Proprietary LLM APIs

#311
post #309

> Prefilling Kimi-K3's reasoning with the first 1% of tokens of Opus 4.8's reasoning moves its visible answer toward Opus's wording, even though the answer itself is never prefilled is this supportive evidence for the distillation accusations in the news?

Prefilling any model with the first 1% of reasoning tokens from another model should always move the output towards the output of the other model directionally - that's just next token prediction doing its thing.

Re: Stealing Reasoning Traces from Proprietary LLM APIs

#312
post #228

Earlier quoted context omitted.

I love how some of the biggest advancements in llms came from the Chinese labs, yet people still jump to distillation being unreasonably effective. Distillation is very good at creating smaller models from large ones sure, but nothing to me indicates it is 'unreasonably effective' compared to all the other bells and whistles being iterated on

This article shows that when Kimi3's chain of thought is prefilled to match Opus's, the rest of the chain of thoughts Kimi3 outputs very closely aligns with Opus's. That seems strong evidence that Kimi3 is partly a distillation of Opus. And Kimi3 is not a small model. No doubt a lot of hard work went into Kimi, but seems clear that distillation was used effectively as well. (though maybe there's another interpretatio…

But they don't perform the same test on other models as far as I could tell? So we don't lnow if this is peculiar to kimi models or not.

Re: Stealing Reasoning Traces from Proprietary LLM APIs

#315
post #31
post #9

Earlier quoted context omitted.

If you didn’t allow it, you wouldn’t be able to change models in the same conversation, as key parts of the context would be lost. Wouldn’t surprise me if the providers just remove that ability and lock the model once the conversation starts.

I really don't understand why server-side storage of the trace isn't a viable approach here, with only a unique key flowing to the client and back. Does it have something to do with how backend load-balancing works?

Encrypted state cookies solve real problems (server-side storage, latency, scaling) and are not the problem. The problem is insufficient binding of some of a session's encrypted state cookies and others -- insufficient binding of some session state to other session state. Here we have HTTP encrypted state cookies for identifying authenticate user IDs and maybe for identifying sessions / chats, while the reasoning traces are also encrypted state cookies but not HTTP cookies, and the latter are somehow not sufficiently bound to the former.

The fix is to either have per-user or per-session keys for encrypting reasoning traces, or write the user ID / account ID and maybe also session ID into the plaintext of the reasoning trace _then check that that matches the ones in the HTTP cookies when decrypting the traces_.

Re: Stealing Reasoning Traces from Proprietary LLM APIs

#316

Earlier quoted context omitted.

I agree with you in principle. I'm just pointing out that the latter is in some way another valid point of view.

Thinking tokens aren't free though. This is not a valid point of view. If I was being charged for the raw, output/input token count, excluding thinking/reasoning token costs, then sure. But at least via the API, you pay for tokens you cannot see.

Well, I don’t pay for them. Maybe you do. But again, they’re a byproduct, an intermediary. They contribute to your result but aren’t the final result. I’m not defending their position, just showing you an alternative universe.

Re: Stealing Reasoning Traces from Proprietary LLM APIs

#317

Earlier quoted context omitted.

> If they charge by the token, all your tokens are belong to you I’m not sure this argument is correct. You can sign whatever contract you like with the model provider, right? Including “you are entitled to the end product but not the intermediate scratch work”? Coming from a place of genuine curiosity: is there some precedent or statute that would invalidate that contract? I don’t see why the reasoning tokens belong…

Sure, but the current one is charged per token in & token out. Not per completion / task / hour / whatever. You can't charge per token and then say "you stole that token". Again, they can unilaterally decide not to sell you tokens anymore, at any time, for any (legal) reason. But as it stands right now, it can't be stealing.

Again, I’m genuinely curious: can’t two parties sign a contract that says “you pay for all tokens required to produce the answer, but you only get the final answer tokens”?

My understanding of US law is that there’s nothing in logic or precedent that makes such a contract unenforceable.

As for whether it’s “stealing”: they might be able to press charges under federal Trade Secret Theft laws, I’m not sure. But I’m not seeing how you can be so very very certain that it’s at best a civil violation of contract. What’s the reason for your confidence that a judge would never find this to be trade secret theft or economic espionage?

Re: Stealing Reasoning Traces from Proprietary LLM APIs

#318

Earlier quoted context omitted.

Yes. Although, to be pedantic - stealing relocates (it doesn’t leave one less, it moves the only thing into another person’s possession), while copying duplicates. Copy vs move is IMHO accurate semantics.

i dont know what you're talking about: it's certainly one less for the victim! and if no theft occurred, nobody would be left with one less.

Yea, my bad, that was a brain fart. I guess I was thinking about it from the thing’s perspective rather than owners’.

Re: Stealing Reasoning Traces from Proprietary LLM APIs

#319

Earlier quoted context omitted.

No, it's not. It might be criminally prosecuted, but "stealing" has a precise definition that usually implies removing someone else's possession.

Where is this so defined?

In legal doctrine.
Post reply on HN