Source: arXiv (Panfilov, Schmotz, Shumailov, Beurer-Kellner, Schaeffer, Prabhu, Geiping, Andriushchenko) — 2026-08-10
Summary
A new paper, "Stealing Reasoning Traces from Proprietary LLM APIs," finds an architectural flaw in how frontier providers hide chain-of-thought reasoning: Anthropic, OpenAI, and Google all return that reasoning as encrypted, opaque blocks meant to protect IP and block distillation, but the encryption doesn't cryptographically bind each block to the specific session, user, or model it came from. Because of that, the authors demonstrate they can splice and replay encrypted reasoning blocks across contexts to recover a proprietary model's actual reasoning content — with as few as two API calls — and they show the attack working against all three major providers.
Key Takeaways
- The stated purpose of encrypting chain-of-thought output is to protect a provider's IP and stop competitors from distilling a cheaper model off the reasoning traces — this attack defeats that purpose directly, not around the edges.
- The core flaw is a binding failure: the encryption scheme doesn't cryptographically tie an encrypted reasoning block to the exact session, user, or model that generated it, which is what makes the blocks interchangeable in the first place.
- Because the blocks are interchangeable, the attack works by splicing and replaying encrypted reasoning blocks across different sessions, different users, and even different models within the same provider's ecosystem.
- The attack requires as few as two API calls to recover reasoning content — an extremely low bar that makes this practical to execute rather than theoretical.
- All three major frontier providers — Anthropic, OpenAI, and Google — were shown to be affected, indicating this is likely a shared architectural pattern across the industry rather than one vendor's isolated implementation bug.
Reel Script
Hook (17s)
OpenAI, Anthropic, and Google all encrypt their models' internal reasoning specifically so you can't steal it and train a cheaper copy. A new paper just showed how to steal it anyway — in two API calls.
Core Concept (85s)
Frontier reasoning models "think" before they answer — they generate an internal chain-of-thought, working through the problem step by step, before producing the final response you see. Providers hide that chain-of-thought from you and return it as an encrypted, opaque block instead, and they do that for a specific business reason: if competitors could read the raw reasoning, they could use it to train, or "distill," a cheaper model that mimics the expensive one's thinking without paying for the original research. So the encryption isn't an accident — it's a deliberate IP wall. This paper's finding is that the wall has a structural crack in it. Good encryption should bind data to its exact context, meaning an encrypted block from your session, with your specific request, should be provably tied to that one context and unusable anywhere else. What the researchers found is that these providers' encrypted reasoning blocks aren't bound that tightly — the encryption protects the contents from being read, but it doesn't lock the block to the specific place it came from. That's the difference between a locked box and a locked box that also proves which room it belongs in — these blocks are locked, but interchangeable.
Hands-On (70s)
Because the blocks aren't bound to their origin, the researchers found they could take an encrypted reasoning block and essentially transplant it — splice it into a different session, hand it to a different user's request, or move it across different models inside the same provider's lineup — and use that transplant to reconstruct what the model was actually thinking. And the attack surface is small: they demonstrate this recovery working with as few as two API calls, not some elaborate multi-day extraction campaign. They ran this against all three major frontier providers — Anthropic, OpenAI, and Google — and got it working on each, which points to this being a shared design pattern across the industry, not a bug specific to one company's implementation.
Takeaway (25s)
If you're a provider betting on encrypted chain-of-thought as your moat against distillation, this paper says that moat currently has a hole in it, and if you're a builder relying on "the reasoning is protected" as a security assumption in your own stack, stop assuming that. Go read the paper before you make any architecture decision that depends on this holding.