工作日早上 7 点读 AI，周日早上 8 点读周报订阅邮件

METAL LAB

Stealing Reasoning Traces from Proprietary LLM APIs

arXiv:2608.098672026-08-09

AI公司把模型的思考过程加密隐藏起来,但研究者发现可以骗一个能力较弱的同门模型把它原样读出来

Anthropic、OpenAI、Google等公司现在会把推理模型在给出最终答案前的内部思考过程加密后再返回给用户,而不是直接明文展示。这篇论文发现这些加密的推理区块可以在不同会话、不同用户、甚至同一家公司的不同模型之间互换使用,于是利用这一点把强模型产生的加密推理喂给防护较弱的同门弱模型,让它原样转录成明文。他们用这种方法解码了从公开仓库抓取的315,320条推理区块,恢复出367项个人信息和182项账号密钥。

METAL LAB 解读图

利用弱模型解码加密推理的攻击流程

证据状态已报告实测结果

  1. 向强模型提问向像Opus 4.8这样防护严密的模型提问,获取其返回的加密推理区块(签名)。
  2. 转移加密区块把这个原本属于另一会话、另一用户或另一模型的加密区块,插入到对同公司另一模型的请求中。
  3. 交给弱模型把区块喂给像Haiku 4.5这样防护较弱的同门模型,并要求它把'自己的'思考原样输出。
  4. 得到明文弱模型解密并逐字输出了强模型原本隐藏的推理内容。
  5. 四种滥用方式可用于蒸馏专有推理、提取泄露的个人信息与密钥、暴露隐藏的有害内容、以及实施隐蔽的提示注入攻击。
这是 METAL LAB 制作的解读图，并非论文作者提供的原图。

他们做了什么

  1. 现代推理模型在给出最终回答前会先生成一大段内部思考文字,厂商为保护知识产权和安全,把这段内容加密后再发给用户。
  2. 研究团队发现这些加密的推理区块具有可移植性:同一家公司生态系统内,不同会话、不同用户、甚至不同模型之间都可以互相替换使用。
  3. 他们把强模型(例如Claude Opus)产生的加密推理注入到防护较弱的同门弱模型(例如Claude Haiku)中,要求它把自己的思考原样输出,结果弱模型把强模型的隐藏推理逐字转录成了明文,全程没有直接攻破强模型本身。
  4. 把这套方法应用到从GitHub和Hugging Face抓取的6,708条真实智能体会话记录上,解码出315,320条推理区块,恢复出367项个人身份信息(PII)和182项账号密钥,其中真实用户会话中就包含62个API密钥、33个密码、30个个人邮箱。
  5. 他们还证明,即使模型最终给出的可见回答安全地拒绝了恶意请求,危险信息仍可能残留在隐藏的推理过程中,并可通过同样的方法提取出来。
Figure 1: Decoding reasoning traces in Anthropic, OpenAI and Google APIs. Top: Reasoning-trace extraction in two API calls. An Opus 4.8 request (top left) returns a signed thinking block along with a thinking summary. Sending just the thinking signature from Opus 4.8 to a Haiku model and requesting it to output its own reasoning in <thinking-copy> tokens makes Haiku transcribe the Opus 4.8 hidden reasoning (top right). Bottom: Extracted traces closely track the number of generated thinking tokens. We evaluate each model on 120 Codeforces programming problems and record the number of thinking tokens generated by the source model, as reported by the API (x-axis). We then reconstruct the reasoning trace from its signature, pass it as an input message to the same model that generated encrypted reasoning, and measure its API-reported token count (y-axis).
Figure 1: Decoding reasoning traces in Anthropic, OpenAI and Google APIs. Top: Reasoning-trace extraction in two API calls. An Opus 4.8 request (top left) returns a signed thinking block along with a thinking summary. Sending just the thinking signature from Opus 4.8 to a Haiku model and requesting it to output its own reasoning in <thinking-copy> tokens makes Haiku transcribe the Opus 4.8 hidden reasoning (top right). Bottom: Extracted traces closely track the number of generated thinking tokens. We evaluate each model on 120 Codeforces programming problems and record the number of thinking tokens generated by the source model, as reported by the API (x-axis). We then reconstruct the reasoning trace from its signature, pass it as an input message to the same model that generated encrypted reasoning, and measure its API-reported token count (y-axis).
Figure 3: Prefilling Kimi K3’s reasoning changes the style of its visible responses. In this example, we observe that prefilling a small number of Claude-generated reasoning tokens into Kimi K3’s reasoning trace shifts its final output to closely match Claude’s. In all cases, the visible response is free-form generation and is not itself prefilled. We quantify this phenomenon in Appendix B.
Figure 3: Prefilling Kimi K3’s reasoning changes the style of its visible responses. In this example, we observe that prefilling a small number of Claude-generated reasoning tokens into Kimi K3’s reasoning trace shifts its final output to closely match Claude’s. In all cases, the visible response is free-form generation and is not itself prefilled. We quantify this phenomenon in Appendix B.
Table 1: Cross-model compatibility of encrypted reasoning. As per July 2026. Row: the source model that produced the encrypted reasoning block; column: the target model receiving the injected reasoning. A ✓ indicates that, for this combination, the target model interacts with the injected thought. Claude: the thinking traces of any model can be replayed by any other, except Fable 5’s thoughts. GPT: the GPT-5.6 series can replay the traces of all earlier model generations. Gemini: the thinking traces of any model can be replayed into any other.
ClaudeGPTGemini
Source / TargetF5O4.8S5S4.6S4.5H4.5Source / Target5.6s5.6t5.6l55-m5-nSource / Target3.1P3PRob3.5F3F
Fable 5✓✗✗✗✗✗GPT-5.6-sol✓✓✓✗✗✗Gemini 3.1 Pro✓✓✓✓✓
Opus 4.8✓✓✓✓✓✓GPT-5.6-terra✓✓✓✗✗✗Gemini 3 Pro✓✓✓✓✓
Sonnet 5✓✓✓✓✓✓GPT-5.6-luna✓✓✓✗✗✗Gemini Robotics 1.6✓✓✓✓✓
Sonnet 4.6✓✓✓✓✓✓GPT-5✓✓✓✓✗✗Gemini 3.5 Flash✓✓✓✓✓
Sonnet 4.5✓✓✓✓✓✓GPT-5-mini✓✓✓✗✓✗Gemini 3 Flash✓✓✓✓✓
Haiku 4.5✓✓✓✓✓✓o4-mini✓✓✓✗✗✓Gemini 3.1 Flash Lite✓✓✓✓✓
Figure 4: Reasoning exposes harmful information that is absent from the final output. We paraphrase a HarmBench query (26) to elicit longer reasoning from Opus 4.8. Consistent with prior findings on the chain-of-thought of open-weight reasoning models (45), Opus 4.8’s decoded reasoning reveals harmful information that could enable misuse uplift, even though its final answer remains benign.
Figure 4: Reasoning exposes harmful information that is absent from the final output. We paraphrase a HarmBench query (26) to elicit longer reasoning from Opus 4.8. Consistent with prior findings on the chain-of-thought of open-weight reasoning models (45), Opus 4.8’s decoded reasoning reveals harmful information that could enable misuse uplift, even though its final answer remains benign.
Figure 5: Decoded reasoning contains privacy artifacts. We present two qualitative examples of decoded opaque reasoning blocks published online that contain privacy-sensitive information. Left: GPT-5.2 Codex recalls the API keys that must be removed before publishing a repository on GitHub. We mask the final five characters of each key as XXXXX. Right: Claude Sonnet 4.6 reasons over the private data of a synthetic persona, Alex Green, while handling a flight-booking task in a ClawBench (44) rollout. The Alex Green persona is a synthetic benchmark identity, not a real person: https://huggingface.co/datasets/TIGER-Lab/ClawBench/blob/main/shared/alex_green_personal_info.json. We provide more examples in Section D.3.
Figure 5: Decoded reasoning contains privacy artifacts. We present two qualitative examples of decoded opaque reasoning blocks published online that contain privacy-sensitive information. Left: GPT-5.2 Codex recalls the API keys that must be removed before publishing a repository on GitHub. We mask the final five characters of each key as XXXXX. Right: Claude Sonnet 4.6 reasons over the private data of a synthetic persona, Alex Green, while handling a flight-booking task in a ClawBench (44) rollout. The Alex Green persona is a synthetic benchmark identity, not a real person: https://huggingface.co/datasets/TIGER-Lab/ClawBench/blob/main/shared/alex_green_personal_info.json. We provide more examples in Section D.3.
Table 2: Leakage vectors mapped to protections and processes. Each tick states what the mitigation supplies; the final column records the operational steps that deliver it.
#IssueWhat the mitigation providesMitigation
1Cross-user leakage✓ User-identity binding ✓ Stateless verification ✓ Immediate mismatch rejection1. Embed user_id in AEAD associated data at issuance. 2. On replay, compare bound identity to authenticated caller. 3. Reject the envelope on any mismatch.
2Cross-session leakage✓ Session + predecessor binding ✓ Ordinality (P1) under compaction ✓ Native fork / compact / downgrade support ✓ Dramatically reduced blast radius1. Hash-chain each envelope to session_id and its predecessor (Eq. 1). 2. Enforce ordinality server-side. 3. Retain only Merkle roots after compaction so surviving spans stay verifiable.
3Legacy public/enterprise datasets✓ Permanent undecodability of pre-fix signatures ✓ Clean cryptographic separation from new material1. Rotate every pre-fix signing key. 2. Refuse to decode any envelope under a retired key ID. 3. (Optional) Offer identity-verified re-signing for enterprise archives.
4Backwards compatibility✓ Zero-break migration path ✓ Bounded dual-format window ✓ Identity-verified re-issuance1. Accept both legacy and context-bound envelopes during a fixed deprecation window. 2. Expose an opt-in batch re-signature endpoint. 3. Re-issue only after confirming the requester owns the original session.
5Model-level compliance✓ Closure of residual gaps beyond cryptography ✓ Resistance to transcription / replay jailbreaks1. Post-train models to recognise transcription-style prompts (e.g., <thinking-copy>). 2. Refuse the request irrespective of envelope validity.
6Nonce predictability✓ Critical since key is shared between users ✓ Cryptographic foundation for every binding above ✓ Collision- and forgery-resistance at provider scale1. Draw a high-entropy nonce from a CSPRNG for every block. 2. Enforce server-side uniqueness before the envelope is issued.
Figure 6: Distinct artifacts recovered from reasoning blocks scraped from publicly available user-posted traces, grouped into three headline categories (all sources; see Appendix D).
Figure 6: Distinct artifacts recovered from reasoning blocks scraped from publicly available user-posted traces, grouped into three headline categories (all sources; see Appendix D).
Figure 7: Illegible GPT-5 reasoning. GPT-5 reasoning decoded with GPT-5.6 Luna; the ratio of decoded to API-reported thinking tokens is 1:1. Compared to Gemini and Claude, obfuscated reasoning appears more common in GPT models, including GPT-5.6 Sol, with artifacts similar to those previously reported by 36.
Figure 7: Illegible GPT-5 reasoning. GPT-5 reasoning decoded with GPT-5.6 Luna; the ratio of decoded to API-reported thinking tokens is 1:1. Compared to Gemini and Claude, obfuscated reasoning appears more common in GPT models, including GPT-5.6 Sol, with artifacts similar to those previously reported by 36.
Table 3: Best-of-k n-gram overlap with the source model’s visible answer. We measure overlap with the first 100 tokens of the visible answer produced by the model supplying the reasoning prefill, using the commong n-gram intersection. For each problem, we compute best-of-k overlap for k∈{1,10,50,100}, average across these four values, and then average across problems. Δ denotes the difference between the prefilled and unprefilled conditions. We report two-sided paired t-tests on the per-problem differences. In the lower block, Kimi-K3 and Inkling supply prefills to each other, so neither model receives proprietary reasoning. After Bonferroni correction, only Kimi-K3 mean differences remain significant; none of the control comparisons do.
ModelPrefillCategoryPrefilledControlΔp
Kimi-K3Opus 4.8STEM0.3050.160+1.5×10−11.7×10−5
Kimi-K3Opus 4.8non-STEM0.2890.203+8.6×10−26.3×10−6
InklingOpus 4.8STEM0.2170.205+1.2×10−27.4×10−2
InklingOpus 4.8non-STEM0.2410.239+2.1×10−35.5×10−1
Kimi-K3InklingSTEM0.3590.337+2.2×10−21.2×10−1
Kimi-K3Inklingnon-STEM0.2720.263+9.4×10−35.5×10−1
InklingKimi-K3STEM0.4140.411+2.2×10−37.2×10−1
InklingKimi-K3non-STEM0.3200.306+1.4×10−23.3×10−2
Figure 8: An example of summary unfaithfulness. For the AIME 2025 Problem 14, we compare the summary of Claude Opus 4.8’s thinking returned by the API (left) with our decoding of the thinking block’s signature (Section 2.4). Decoding reveals that the model states the correct answer before attempting to solve the problem.
Figure 8: An example of summary unfaithfulness. For the AIME 2025 Problem 14, we compare the summary of Claude Opus 4.8’s thinking returned by the API (left) with our decoding of the thinking block’s signature (Section 2.4). Decoding reveals that the model states the correct answer before attempting to solve the problem.
Figure 9: Divergence of Visible-Answer Style under Opus 4.8 Reasoning Prefill. For each pair of an Opus 4.8 hidden reasoning trace and its visible response, we extract the 1-, 2-, and 3-grams appearing in the visible response. We then measure the number of these n-grams that also appear in outputs generated by Kimi K3 and Inkling under two conditions: (i) the models generate both reasoning and output without intervention (non-prefilled), and (ii) the models’ reasoning is prefilled with the first 1% of tokens from the Opus reasoning trace. The x-axis shows the number of sampled completions, and the y-axis shows the maximum number of shared n-grams within each batch of completions. Curves show the mean over the 15 HLE prompts (32) of each category, STEM and non-STEM (30 in total); shaded bands are ±1 standard error of the mean over the prompts. We observe that Kimi K3’s output changes substantially under the 1% reasoning prefill relative to the non-prefilled control, while Inkling’s does not; Table 3 reports the per-category means and significance tests.
Figure 9: Divergence of Visible-Answer Style under Opus 4.8 Reasoning Prefill. For each pair of an Opus 4.8 hidden reasoning trace and its visible response, we extract the 1-, 2-, and 3-grams appearing in the visible response. We then measure the number of these n-grams that also appear in outputs generated by Kimi K3 and Inkling under two conditions: (i) the models generate both reasoning and output without intervention (non-prefilled), and (ii) the models’ reasoning is prefilled with the first 1% of tokens from the Opus reasoning trace. The x-axis shows the number of sampled completions, and the y-axis shows the maximum number of shared n-grams within each batch of completions. Curves show the mean over the 15 HLE prompts (32) of each category, STEM and non-STEM (30 in total); shaded bands are ±1 standard error of the mean over the prompts. We observe that Kimi K3’s output changes substantially under the 1% reasoning prefill relative to the non-prefilled control, while Inkling’s does not; Table 3 reports the per-category means and significance tests.
Table 4: Breakdown of discovered privacy artifacts by category at each stage of the filtering pipeline. Labeler 1: items flagged by the first-pass LLM-as-a-judge labeler (Haiku 4.5). Labeler 2: items subsequently classified as genuine privacy artifacts. Deduplication: distinct values, grouped by category and value. Non-benchmark: artifacts remaining after excluding benchmark sessions, such as PostTrainBench, TerminalBench, and ClawBench. We note that these sessions may contain genuine artifacts introduced by users running the benchmarks, in addition to benchmark-specific synthetic content. Reasoning only: values that appear nowhere else in the raw session and occur exclusively in the model’s reasoning.
CategoryLabeler 1 (Figure 44)Labeler 2 (Figure 45)DeduplicationNon-benchmarkReasoning only
Personal information
Name4,3505411731304
Address83923387365
Email65123272303
Date of birth12224931
Government ID2921710
Payment card9064900
Phone76181040
Credentials
Access token8528430243
API key96690696211
Password1,23533072332
Private key62111170
Technical identifiers
IP address1,76320660
URL14,1925533323
File or repository path31,38037328127924
Internal identifier14,3692717141
Account identifier3,0723121171
Session identifier1,6626531
Other1,0683429235
Total76,7782,19494170464
Figure 10: Control for Figure 9: the same measurement with the prefill source swapped. As in Figure 9, but neither model is prefilled with proprietary reasoning: Kimi-K3 receives the first 1% of an Inkling trace and is scored against Inkling’s visible answer (left), and Inkling receives the first 1% of a Kimi-K3 trace and is scored against Kimi-K3’s visible answer (right). Same 30 HLE problems, curves are the mean over the 15 prompts of each category; shaded bands are ±1 standard error of the mean over the prompts. Neither model separates from its control in either category.
Figure 10: Control for Figure 9: the same measurement with the prefill source swapped. As in Figure 9, but neither model is prefilled with proprietary reasoning: Kimi-K3 receives the first 1% of an Inkling trace and is scored against Inkling’s visible answer (left), and Inkling receives the first 1% of a Kimi-K3 trace and is scored against Kimi-K3’s visible answer (right). Same 30 HLE problems, curves are the mean over the 15 prompts of each category; shaded bands are ±1 standard error of the mean over the prompts. Neither model separates from its control in either category.
Figure 24: Probabilistic extraction (14) of reasoning traces on 30 HLE problems, k=16 tokens, median over problems (faint lines: individual problems). Rows: extraction of reasoning; extraction of the visible answer under increasing context; the scorer’s own trace as control.
Figure 24: Probabilistic extraction (14) of reasoning traces on 30 HLE problems, k=16 tokens, median over problems (faint lines: individual problems). Rows: extraction of reasoning; extraction of the visible answer under increasing context; the scorer’s own trace as control.
Table 5: Which persona fields the hidden reasoning gives up. Fields of the synthetic Alex Green persona used by ClawBench, against what the reasoning of ClawBenchV2Trace agent runs contains — 75 runs for Opus 4.7, 81 for GPT-5.5, on the same tasks. ✓ = recovered; ✗ = never appears.
Persona fieldGPT 5.5Opus 4.7
identityLegal name (Alex Green)✓✓
Street + unit (664 Spadina Ave, 1208)✓✓
City / province / country✓✓
Postal code (M5S 2H7)✓✓
Security-question answer✗✓
Date of birth✓✗
credsSession email✓✓
Password / session token✗✓
Figure 25: As in Figure 24, on 10 AIME 2025 problems, with GPT-5.6 Sol decoded traces as a second prefill. Kimi-K3 reaches GPT-5.6 Sol’s answer wording within ∼102 queries even conditioned on its own reasoning (third row, right), while no other model does so within 108 queries.
Figure 25: As in Figure 24, on 10 AIME 2025 problems, with GPT-5.6 Sol decoded traces as a second prefill. Kimi-K3 reaches GPT-5.6 Sol’s answer wording within ∼102 queries even conditioned on its own reasoning (third row, right), while no other model does so within 108 queries.
Figure 26: Median perplexity of reasoning traces under seven scoring models. Every model scores perplexity of the reasoning, conditional on the problem, over the same 120 Codeforces problems. Rows are the model whose reasoning is being scored; columns are the model doing the scoring. The diagonal, where a model scores its own reasoning, is set in italic. Colour is on a logarithmic scale, dark for reasoning the scorer finds native.
Figure 26: Median perplexity of reasoning traces under seven scoring models. Every model scores perplexity of the reasoning, conditional on the problem, over the same 120 Codeforces problems. Rows are the model whose reasoning is being scored; columns are the model doing the scoring. The diagonal, where a model scores its own reasoning, is set in italic. Colour is on a logarithmic scale, dark for reasoning the scorer finds native.

研究结果

  • 在Anthropic、OpenAI、Google三家的API上,研究者都成功把强模型的加密推理注入防护较弱的同门弱模型(Haiku 4.5、GPT-5.6 Luna、Gemini Robotics 1.6),并让其原样输出明文推理。
  • 在120道Codeforces编程题上,API报告的思考token数与重新编码后提取出的推理token数在大多数情况下高度吻合,支持提取结果的可信度。
  • 对6,708条公开抓取的智能体会话解码出的315,320条推理区块中,共恢复出367项个人信息和182项账号密钥,其中真实用户会话里包含62个API密钥、33个密码、30个个人邮箱。
  • 在恢复出的704项真实会话相关信息中,有64项完全没有出现在可见的聊天记录里,只存在于加密的推理区块内。
  • 对Opus 4.8用改写过的HarmBench提示提问后,其最终可见回答安全拒绝了请求,但解码出的推理内容中仍包含了具体的有害信息(如汽车盗窃方法)。

可应用场景

  • 使用推理模型API的开发者可以据此意识到,不应随意把包含加密推理区块的原始会话日志直接公开发布。
  • AI服务提供商在设计或审查推理加密方案时,可以参考这篇论文揭示的跨会话、跨用户、跨模型可复用漏洞。
  • 安全研究人员在审查其他多模型API生态系统时,可以借鉴这种跨模型兼容性测试方法。

局限与待验证事项

  • 截至2026年8月,各厂商在论文披露后已采取了缓解措施,论文中描述的具体攻击方式已无法照原样重现。
  • 实验只覆盖了Anthropic、OpenAI、Google这几家特定的模型组合,其他厂商或未来的模型是否存在同样漏洞尚未验证。
  • 在解码的315,320条区块中,只有0.3%真正含有个人信息,不能因此推断所有公开的推理日志都存在同等风险。
  • 推理提取的忠实度只是通过token数量匹配间接验证的,并不能保证提取内容与模型真实私有推理逐字完全一致。
  • 论文提出的加密和系统层面的缓解方案目前只是建议,尚未被证实已经落地并生效。

为什么重要

这说明只审查AI最终给用户看的答案是不够的,因为敏感或有害内容可能完整地藏在被加密、来回传递的推理区块里。这对把会话日志公开分享的开发者尤其重要,因为他们可能在不知情的情况下,把藏在加密区块里的真实密码和个人信息一起泄露了出去。

本文术语

  • 思维链/推理过程 · 模型在给出最终答案之前,一步步展开的内部思考文字
  • 加密推理区块 · 厂商把模型的推理过程打包成一段无法直接读懂的加密文本,再传回给客户端
  • 解码模型 · 被利用来把别的模型加密推理原样读出来的、防护较弱的模型
  • AEAD认证加密 · 一种既加密内容又能验证内容是否被篡改的加密方式
  • 蒸馏攻击 · 利用别家模型的输出或推理过程作为训练数据,复制出一个廉价的仿制模型

论文原文摘要（英文）

Leading large language model providers now conceal their models' step-by-step reasoning, or chain-of-thought, to protect intellectual property and limit information leakage. Rather than storing these traces server-side, providers return them to the client as blocks of encrypted text, which the client passes back with each subsequent request. Building on prior research, we identify an architectural vulnerability: these encrypted blocks are fully compatible and interchangeable across different sessions, users, and models within a provider's ecosystem. We exploit this compatibility to develop a scalable decryption jailbreak. By injecting an encrypted reasoning trace from a given model into a weaker, and less safeguarded model from the same provider, we force it to decode and output the trace verbatim in plaintext, without ever jailbreaking the more capable model directly. This vulnerability enables four distinct attack vectors. First, it circumvents anti-distillation mechanisms, allowing adversaries to extract a proprietary model's reasoning, as we demonstrate across Anthropic, OpenAI, and Google. Second, it allows for large-scale private data extraction. Developers frequently share session logs publicly, unaware of contents of the encrypted blocks. By decoding 315,320 reasoning blocks scraped from public repositories, we recovered 367 Personally Identifiable Information (PII) artifacts and 182 credentials. Third, it inadvertently reveals hazardous information hidden within the reasoning process, even in cases where the model's final, visible output safely rejects a malicious request. Fourth, attackers can leverage this flaw to execute invisible prompt injections, embedding malicious payloads entirely within encrypted blocks to poison public agentic rollouts. Following responsible disclosure, we propose concrete cryptographic and system-level mitigations to secure client-side reasoning.

作者 · Alexander Panfilov

在 arXiv 阅读

最新论文

全部论文 →

METAL LAB 最新报道

图片来源： Alexander Panfilov et al., arXiv:2608.09867, CC BY 4.0