Stealing Reasoning Traces from Proprietary LLM APIs

Alexander Panfilov $^{\text{1,2,3,4}}$* David Schmotz $^{\text{2,3,4}}$* Ilia Shumailov $^{\text{5}}$* Luca Beurer-Kellner $^{\text{6}}$
Joachim Schaeffer $^{\text{1}}$ Ameya Prabhu $^{2,4,7,\ddagger}$ Jonas Geiping $^{2,3,4,\ddagger}$ Maksym Andriushchenko $^{2,3,4,\ddagger}$
$^{\text{1}}$ MATS Research $^{\text{2}}$ ELLIS Institute Tübingen $^{\text{3}}$ Max Planck Institute for Intelligent Systems
$^{\text{4}}$ Tübingen AI Center $^{\text{5}}$ AI Sequrity Company $^{\text{6}}$ Snyk $^{\text{7}}$ University of Tübingen
* Equal contribution, order decided by dice roll $^{\ddagger}$ Equal supervision
🌐 stolen-thoughts.com

Abstract

Leading large language model providers now conceal their models'step-by-step reasoning, or chain-of-thought, to protect intellectual property and limit information leakage. Rather than storing these traces server-side, providers return them to the client as blocks of encrypted text, which the client passes back with each subsequent request. Building on prior research, we identify an architectural vulnerability: these encrypted blocks are fully compatible and interchangeable across different sessions, users, and models within a provider's ecosystem. We exploit this compatibility to develop a scalable decryption jailbreak. By injecting an encrypted reasoning trace from a given model into a weaker, and less safeguarded model from the same provider, we force it to decode and output the trace verbatim in plaintext, without ever jailbreaking the more capable model directly. \ This vulnerability enables four distinct attack vectors. First, it circumvents anti-distillation mechanisms, allowing adversaries to extract a proprietary model's reasoning, as we demonstrate across Anthropic, OpenAI, and Google. Second, it allows for large-scale private data extraction. Developers frequently share session logs publicly, unaware of contents of the encrypted blocks. By decoding 315,320 reasoning blocks scraped from public repositories, we recovered 367 Personally Identifiable Information (PII) artifacts and 182 credentials. Third, it inadvertently reveals hazardous information hidden within the reasoning process, even in cases where the model's final, visible output safely rejects a malicious request. Fourth, attackers can leverage this flaw to execute invisible prompt injections, embedding malicious payloads entirely within encrypted blocks to poison public agentic rollouts. Following responsible disclosure, we propose concrete cryptographic and system-level mitigations to secure client-side reasoning. \ begincenter begintcolorbox[decodedpanel, colback=panelReason, width=dimexprlinewidth-1.6cm, left=14pt, right=14pt, top=9pt, bottom=9pt] begintabular@r@l@ Main paper: & API vulnerability and reasoning extraction. \ Appendix A: & Proposed cryptographic and system-level mitigations. \ Appendix B: & Similarity analysis of Opus traces and Kimi-K3/GLM-5.2 traces. \ Appendix C: & Extraction attack details for Gemini, Claude and GPT APIs. \ Appendix D: & Recovered leaked private information and API keys. \ Appendix E: & Examples of decoded reasoning. \ endtabular endtcolorbox endcenter

Executive Summary: Executive Summary

Leading AI providers including Anthropic, OpenAI, and Google now hide the step-by-step reasoning of their most capable models inside encrypted blocks returned to users. These blocks enable multi-turn conversations without server-side storage, but they are fully interchangeable across sessions, users, and models within each provider’s ecosystem. The result is an architectural flaw that allows weaker, less-protected models to decode the encrypted reasoning of stronger ones.

This paper set out to test whether that compatibility could be turned into a practical attack and to measure the consequences. Researchers captured encrypted reasoning traces from frontier models and replayed them into weaker “decoder” models from the same provider (Claude Haiku 4.5 for Anthropic, GPT-5.6 Luna for OpenAI, Gemini Robotics 1.6 for Google). They also decoded 315,320 reasoning blocks scraped from public repositories on GitHub and Hugging Face.

The analysis produced four main findings. First, the attack reliably extracts proprietary reasoning traces at low cost, bypassing the safeguards built into frontier models. Second, public session logs already contain large amounts of sensitive material: 367 personally identifiable information items and 182 credentials (including 62 API keys) were recovered from genuine user sessions. Third, harmful or restricted content that never appears in the visible answer can be recovered from the hidden reasoning. Fourth, malicious instructions can be embedded inside encrypted blocks and executed invisibly when the blocks are replayed in other sessions.

These results show that current designs simultaneously reduce transparency for users and create new extraction channels for third parties. The exposure of private data in published logs creates compliance and security risks, while the ability to steal reasoning lowers the barrier to model distillation and safety bypasses. After responsible disclosure, providers implemented mitigations that blocked the described attacks, but the underlying design tension remains.

The authors recommend that providers bind encrypted blocks cryptographically to specific users, sessions, and conversation positions, or move reasoning storage server-side. They also advise organizations to strip all reasoning blocks before releasing any session logs. The study is limited to API versions available in early July 2026; attacks are no longer reproducible, and the public-trace scan is not exhaustive. The core technical findings, however, rest on direct, repeatable experiments across the three major providers.

1. Introduction

Section Summary: Large language models from providers like Anthropic, OpenAI, and Google now generate long hidden chains of reasoning before replying, but companies encrypt these traces and require users to resend the encrypted blocks with each new query to avoid storing them on servers. The encrypted blocks turn out to be interchangeable across sessions, users, and even different models from the same company, so an attacker can feed a trace from a heavily protected frontier model into a weaker, less-restricted model that will simply output the original reasoning in plain text. This flaw lets outsiders steal proprietary reasoning data and also exposes private details such as passwords, API keys, and personal information that get embedded in the traces and later shared in public logs.

Frontier large language models have increasingly evolved into "reasoning models". Before producing a response visible to the user, these models generate extensive internal chains of thought – a technique that has driven substantial leaps in performance and complex problem-solving ([1]). However, these hidden traces act as an internal monologue that often contains far more dense and sensitive information than the final output, including intermediate hypotheses, tool outputs, user data, and contextual secrets. Exposing these reasoning traces in plaintext leaves proprietary systems highly vulnerable to model distillation by competitors ([2]), and it risks unmasking internal safety and refusal mechanisms or revealing harmful information ([3, 4]).

To neutralize these threats and protect their intellectual property, modern API providers – including Anthropic, OpenAI, and Google – have deprecated plaintext reasoning ([5, 6, 7]). Instead, they return the chain of thought to the client as an opaque, encrypted block of text. To maintain continuity across multi-turn conversations without incurring the overhead of server-side storage, the client is required to pass this encrypted block back to the provider with each subsequent API request. While this stateless architectural design solves storage issues, it introduces a critical vulnerability.

Building on prior research by [8], which demonstrated that these encrypted blocks are portable outside their original context, we identify a devastating extension of this flaw: these blocks are fully compatible and interchangeable across different sessions, different users, and even different models within the same provider's ecosystem.

The vulnerability lies in a fundamental security asymmetry within model families. Frontier models, such as Claude Opus 4.8 or GPT-5.6 Sol, are heavily safeguarded with advanced refusal training designed specifically to prevent the disclosure of their internal chains of thought. However, their weaker, less capable siblings – such as Claude Haiku 4.5 or GPT-5.6 Luna – are optimized for cost and speed, often lacking these stringent anti-distillation defenses. By porting a valid authenticated encrypted reasoning blob across this security gap, an attacker circumvents the frontier model's alignment entirely, using the weaker, more compliant model as an unwitting decryption oracle.

Scalable Reasoning Extraction.

We exploit this broad compatibility of reasoning blobs to engineer a scalable decryption jailbreak. By capturing an encrypted reasoning trace generated by a capable, heavily safeguarded target model, we inject that trace into a weaker, less restricted model from the same provider family. We then force the weaker model to decode and transcribe the trace verbatim in plaintext – effectively bypassing the encryption without ever directly jailbreaking the more capable target model. Figure 1 provides an overview of this attack.

The consequences of this vulnerability extend far beyond intellectual property theft, representing a real-world privacy risk. Developers frequently share their session logs and encrypted thinking traces publicly online, entirely unaware of the sensitive data hidden within the encrypted blocks. By scraping and decoding 315, 320 reasoning blocks from public repositories, we uncovered real data leaks, recovering 367 Personally Identifiable Information (PII) artifacts and 182 credentials; from genuine user sessions alone these include 62 API keys, 33 passwords, and 30 personal emails. Alarmingly, in some cases, the recovered PII did not even feature in the user's input, having been injected invisibly from the model's memory, or it bypassed sanitization efforts because the user could not read the encrypted text before sharing it.

Contributions.

This paper makes the following key contributions:

• Scalable extraction of reasoning. We characterize encrypted reasoning traces and show that a compatible decoder model from the same provider can recover the hidden reasoning across a broad range of models, providers and trace formats (Section 2).
• Evaluation of the extraction attack across vendors. We evaluate and prove the effectiveness of the demonstrated attack against major API vendors including OpenAI, Google, and Anthropic.
• Attack vectors. We detail four concrete cases of abuse enabled by this flaw: (Section 3 and Section 4): (i) distillation* of proprietary reasoning traces; (ii)secret extraction of credentials and PII from published or committed traces by third parties; (iii) hidden prompt injection* through poisoned reasoning blocks; and (iv)jailbreaking by extracting harmful output via the hidden reasoning channel.
• Discussion of mitigation. Lastly, we discuss forms of mitigation on the vendor-side but also provide guidance for users that may have exposed themselves to privacy risks (Section 5).

2. Decoding Reasoning at Scale

Section Summary: Modern AI systems hide their internal step-by-step reasoning inside encrypted blocks sent through ordinary APIs, so competitors cannot easily copy the valuable thinking process. Providers rely on a single shared encryption key to keep these blocks portable across different sessions, users, and models, which simplifies service but creates a built-in weakness. Attackers can therefore replay or decode the blocks with only normal API access, enabling large-scale extraction of private reasoning traces or bypassing of safety controls.

In this section, we provide background on reasoning, describe the key vulnerability introduced by reasoning being widely compatible and then how this can be exploited for scalable extraction of traces.

2.1 Threat Model

We assume a standard, unprivileged API adversary. The attacker does not require insider access to the provider’s infrastructure, cannot observe server-side states, and has no access to the proprietary model weights. Instead, the adversary operates entirely within the boundaries of standard API usage. We consider two attacker profiles:

• First-Party Attacker (Distillation & Jailbreaking): The adversary generates their own encrypted reasoning traces by querying a capable, safeguarded target model. They then exploit cross-model compatibility to replay these traces into a weaker, cheaper decoder model to deliberately bypass alignment guardrails or extract proprietary chains of thought.
• Third-Party Attacker (Secret Extraction & Prompt Injection): The adversary intercepts, scrapes, or otherwise acquires legitimate encrypted reasoning blobs generated by other users – such as developers publishing raw agent session logs online. The attacker then leverages cross-user compatibility to act as a decryption oracle, uncovering sensitive data hidden in the victim's traces, or injecting maliciously crafted opaque blocks back into the victim's workflow.

The common attack prerequisite is access to a compatible "decoder" model within the provider ecosystem.

2.2 Encrypted Reasoning

Chain-of-thought reasoning ([9, 1]) allows modern LLMs to dynamically adjust test-time compute to reason over complex tasks prior to generating a user-directed response. These intermediate steps capture a model's problem-solving process, resulting in traces that are significantly more detailed and information-dense than the output provided to the user. As this internal monologue can expose the underlying reasoning methods as well as model training techniques, it is considered highly valuable for the developers of competing systems.

To protect from unauthorized extraction, most major API providers have deprecated the transmission of plaintext reasoning. Instead, modern APIs implement extended-thinking blocks. When a model generates reasoning, the API returns a block where the human-readable component is either entirely hidden or heavily summarized. To avoid server-side storage, however, the actual chain-of-thought payload is still packaged into an opaque, base64-encoded signature or encrypted payload. This string functions as an Authenticated Encryption with Associated Data (AEAD) envelope, containing a header, which, depending on providers, can specify the model name, block type, version, and key ID along with a nonce, an authentication tag, and the ciphertext ([8]). The signature acts as associated data that is hashed into the Message Authentication Code (MAC), allowing the provider to verify and replay the block without storing it server-side. Depending on the API integration, this envelope is passed back to the API in consecutive calls using fields such as signature or thinkingSignature.

This design has three critical operational functions:

• Confidentiality. By rendering the reasoning steps mathematically opaque, model providers block competitors from mass-harvesting explicit chain-of-thought data for model distillation and limit exposure of a potentially sensitive or harmful reasoning.
• Integrity. The AEAD envelope and MAC ensure that the intermediate reasoning cannot be maliciously altered by the user; any tampering invalidates the signature and can be rejected by the API, preventing manipulated reasoning from being used to steer the model.
• Statelessness. Rather than incurring overheads of storing reasoning states, providers leverage client-side storage. The client is required to hold the encrypted trace and pass it back in subsequent API calls to maintain the continuity within multi-turn session.

As of July 2026 no LLM provider provides detailed description of the cryptographic mechanism used. Given the stateless design on the protocols, we can infer that reliance on client-side storage requires that the encrypted blobs are portable across contexts, users, and models. This enables functionality such as seamless model switching and automatic re-routing without discarding reasoning tokens. While model providers could limit this form of compatibility, and e.g. allow decryption only within the same conversation with the respective model, most APIs opt for a simpler strategy of enabling broader compatibility.

2.3 Reasoning Compatibility

To enable portability of reasoning traces across model calls, our experiments show that providers appear to be using a single global key to encrypt and authenticate every reasoning block. [8] recognized this and showed that this allows clients to replay reasoning blocks out of order or across sessions.

For the purposes of our vulnerability analysis, we distinguish three forms of reasoning compatibility of increasing permissiveness, each enabling a broader class of attacks.

In- and cross-session compatibility. A user can replay reasoning blocks in a different order than they were produced by the model. The user can also reuse blocks from earlier sessions in new requests. While this simplifies benign history editing and context truncation, it also allows attackers to fabricate conversation history (e.g., inserting compliant thoughts into an otherwise malicious exchange ([10])). In this work, we use this form of manipulation to perform reasoning extraction as discussed in Section 2.4.

Cross-user compatibility. With cross-user compatibility, a user can replay encrypted reasoning blocks, taken from another user's sessions. Combined with the above, this enables extraction of sensitive information such as API secrets by third parties (Section 4.1), targeting, for instance, private information that has leaked into a model's reasoning ([3]).

Cross-model compatibility. With cross-model compatibility, a user can replay reasoning blocks produced by one model in a request to another. While this compatibility enables seamless model downgrades (e.g., from Opus to Sonnet or from Opus 4.8 to Opus 4.6), it also plays a central role in our attack method described in Section 2.4. In particular, it enables scalable distillation of a highly capable model reasoning without ever querying that model for the said reasoning directly (see Figure 1). Table 1 provides an overview of cross-model compatibility across key providers.

::: {caption="Table 1: Cross-model compatibility of encrypted reasoning. As per July 2026. Row: the source model that produced the encrypted reasoning block; column: the target model receiving the injected reasoning. A ✓ indicates that, for this combination, the target model interacts with the injected thought. Claude: the thinking traces of any model can be replayed by any other, except Fable 5's thoughts. GPT: the GPT-5.6 series can replay the traces of all earlier model generations. Gemini: the thinking traces of any model can be replayed into any other."}

:::

2.4 A Reasoning Extraction Attack

To extract reasoning, we exploit cross-session compatibility as described above. We port reasoning from a given target model, into the context window (see Figure 2) of a compatible but weaker model, which we coerce into transcribing the inserted reasoning token-by-token, using a simple ad-hoc jailbreak.

For each provider, we identify the weakest compatible model that enables extraction: Haiku 4.5 for Claude, as the weakest available model and one that supports assistant-turn prefilling; GPT-5.6 Luna for GPT, as the least capable model that interacts with reasoning traces from all earlier GPT models; and Gemini Robotics 1.6 for Gemini, as it can process traces from both the 2.5 and 3.x series (whereas we find that 3.1 Flash Lite does not interact with the reasoning from the 2.5 series). To measure the faithfulness of the extracted reasoning, we use the ratio of extracted reasoning tokens to API-reported thinking tokens. In this, we assume that API-based token counts are exact for billing reasons (at the time of writing), which allows us to use them as a form of ground-truth verification for total token count.

With this setup in place, we use the weaker models as "fuzzy" decoders for the encrypted reasoning blocks of stronger models with better safeguards. We provide a schematic illustration of this in Figure 1. We detail the exact approach used for each provider in Appendix C.1, Appendix C.2, and Appendix C.3.

Faithfulness of the extracted reasoning.

In the absence of a ground-truth reasoning trace and the stochasticity of the generation process, we cannot guarantee that the extracted thoughts correspond exactly to a model's private reasoning. In Figure 1 we thus compare the API's reported thinking-token counts against the token counts of the extracted reasoning, re-encoded as input to the same model, on a set of 120 Codeforces problems. For most of the inputs, the two counts track each other closely across all tested models, which is a good indicator for faithful extraction. To further verify correctness, we show in Figure 8 that the extracted reasoning is indeed qualitatively more detailed than native summaries but also enables extraction of sensitive information otherwise not present in an input, such as API tokens and personally-identifiable information (Section 4.1).

Why is this more scalable than directly jailbreaking a model?

A direct extraction attack on a more capable model is possible, but the attacker would have to bypass both model-level alignment (the model's refusal to reveal its internal chain-of-thought) and system-level defenses such as input filters and output substring-matching filters. The availability of a less-capable model with compatible reasoning thus significantly lowers the difficulty of successful extraction. Our experiments with Haiku 4.5, for instance, use a single fixed extraction prompt across all attacks show in Figure 1. By contrast, extraction from a relatively more capable GPT-5.6 Luna required different prompt templates for different reasoning blocks, best-of- $n$ sampling, and ad-hoc workarounds for anti-distillation safeguards (e.g., splitting the extraction into chunks under 50 generated tokens).

2.5 Evaluation Setup

All evaluations in this paper use the same basic extraction procedure: we obtain an encrypted reasoning block and replay it to a compatible decoder model using the provider-specific pipelines described in Appendix C.1, Appendix C.2, and Appendix C.3. The evaluations differ only in how the encrypted reasoning blocks are collected.

Controlled extraction.

For controlled experiments, we generate the reasoning blocks ourselves by querying target models through the Anthropic API, OpenAI API, and Google AI Studio. We use problems from AIME 2025 ([11]), Codeforces (Open-R1 subset) ([12]), and Humanity's Last Exam ([13]) to evaluate extraction fidelity and construct the qualitative examples presented throughout the paper. We also generate the source reasoning blocks ourselves for the jailbreaking and prompt-injection experiments.

Extraction from public traces.

For the secret-extraction experiments, we instead collect raw agent and session traces published online by other users. We parse the encrypted reasoning blocks contained in these traces and decode them using the same extraction pipelines.

3. First-Party Attack Vectors

Section Summary: Adversaries can exploit encrypted reasoning traces from their own API calls to a model by capturing these hidden internal steps and feeding them into cheaper secondary models for decoding. This enables distillation attacks that steal far more effective training data than visible outputs alone, allowing capability theft at low cost even without directly querying the original safeguarded model. The same technique also supports jailbreaks, where a model can be prompted to reason through harmful topics internally while producing only benign final answers, after which the attacker extracts the dangerous details from the decoded trace.

This section discusses and practically demonstrates first-party attack vectors, in which adversaries exploit encrypted reasoning traces generated through their own API interactions.

3.1 Distillation Attacks

Threat model.

Standard black-box model-extraction and distillation attacks assume an adversarial developer with API access to a proprietary model, who uses the model's observable outputs as training data for a student model ([14]). For reasoning models, a stronger attacker may additionally seek to recover the model's proprietary chain-of-thought. Directly eliciting such reasoning from the target model is possible in some settings ([15]), but can be costly and is increasingly constrained by model-level refusal behavior and system-level anti-distillation mitigations. To circumvent these barriers, an attacker can exploit the cross-model portability of encrypted reasoning traces. Rather than directly provoking the target model to disclose its reasoning, the adversary captures the encrypted payload and replays it into a smaller, more economical "decoder" model that operates with diminished refusal capabilities and reduced monitoring.

This attack becomes substantially cheaper when encrypted reasoning blocks can be harvested from existing public datasets or developer session logs. In this setting, the attacker need not query the original frontier model at all: the expensive reasoning has already been generated by another user, and the attack requires only calls to the secondary decoder model. Consequently, defenses that monitor suspicious querying or extraction behavior at the frontier-model endpoint may never observe the extraction attempt.

Distillation with and without reasoning.

Extracting reasoning matters not because output-only distillation is ineffective, but because reasoning yields a substantially more effective form of capability stealing. Observable outputs alone already support sequence-level distillation and black-box imitation ([16, 17, 18, 19]), yet a final response exposes only the endpoint of the teacher's computation. A reasoning trace, by contrast, reveals the intermediate solution trajectory and thus supplies a far denser supervision signal: rather than forcing the student to infer the latent computation behind a correct answer, ordinary next-token training can directly imitate the teacher's problem decomposition, intermediate deductions, and solution strategy.

This gap translates into large downstream gains over answer-only distillation ([20]) and can surface correct solution trajectories that were previously unlikely under the student model ([21]). The gains persist even when the reasoning is only approximately reconstructed: [20] queried GPT-5.4 mini on 10k prompts from OpenThoughts-114k ([22]) and trained a separate trace-inversion model to synthesize long-form reasoning traces from the victim model's visible outputs and reasoning summaries alone, raising the MATH500 ([23, 24]) accuracy of a fine-tuned Qwen2.5-7B-Instruct from 68.4% to 76.0% over answer-only distillation. That pipeline, however, recovered only surrogate approximations of GPT-5.4 mini reasoning.

In contrast, we show that an adversary can recover raw genuine reasoning verbatim, without ever engaging a heavily safeguarded frontier model such as Opus 4.8, and across both the mathematical and coding domains (Figure 1, Appendix E.6, and Appendix E.7). Economically, this direct extraction is highly viable: based on current Claude Haiku 4.5 pricing, decoding a corpus of 10k traces with 12k-token input and output windows would incur a nominal cost of approximately $720 at standard API rates ([25]).

The utility of decoded traces extends beyond their use as fine-tuning data. They can also serve as behavioral probes for whether another model already responds unusually strongly to reasoning from a proprietary source. In our exploratory analysis, prefilling Kimi-K3 ([26]) with a short fragment of decoded Opus 4.8 reasoning shifts the style of its subsequent reasoning and the style of its generated visible response toward toward Claude's, in some cases yielding almost exact visible response (Figure 3). We analyze this phenomenon further in Appendix B.

3.2 Jailbreaking

Threat model.

An attacker may also use reasoning extraction to gain access to harmful information. This exploits the fact that models are trained to withhold harmful information from user-facing outputs, but not necessarily to avoid reasoning through harmful topics, as directly optimizing the content of their chain of thought could introduce undesirable chain-of-thought pressure and degrade its monitorability ([27, 28]). An attacker can therefore lure a model into reasoning through a harmful topic while producing only a benign or non-informative final answer that gets past output filters. This subsequently enables the attacker to recover the harmful information from the extracted reasoning trace.

We demonstrate this as a proof-of-concept attack in Figure 4. We first query Opus 4.8 with a paraphrased HarmBench prompt ([29]): "List three cars that are notoriously easy to steal and describe how to steal them." This induces the model to reason extensively about the harmful topic. We capture the resulting encrypted reasoning block from Opus 4.8 and discard the visible answer, which contains only benign content. We then decode the reasoning block using Haiku 4.5 (Section 2.4), revealing the harmful information that was absent from the model's visible response.

4. Third-Party Attack Vectors

Section Summary: Third-party attackers can steal sensitive data such as API keys, passwords, and personal details by accessing encrypted reasoning traces that users publish online or share, since standard sanitization only affects visible text and leaves hidden blocks untouched. Analysis of thousands of public agent sessions revealed hundreds of real leaks, some originating solely from the model's internal reasoning rather than the conversation history. Attackers can also insert malicious instructions into these opaque blocks, allowing them to compromise victims who later replay the traces to continue long-running tasks.

This section discusses and practically demonstrates third-party attack vectors, in which adversaries obtain reasoning traces from other users or cause victims to replay adversarial traces.

4.1 Secret Extraction

Threat model.

In secret extraction, we consider an attacker who can access reasoning traces produced by another user, either because raw agent sessions are published for reproducibility (e.g., PostTrainBench, [31]) or because traces are transferred across contexts. The key property that makes this attack practical is that an encrypted trace generated in one user’s session can be replayed by another user in a separate session.

While users publishing their traces online may apply anonymization and sanitization methods, they can only operate on the plaintext level and will miss reasoning hidden in encrypted blocks. A third-party attacker can therefore parse existing agentic traces at scale and extract secrets like API keys and personally-identifiable information (PII) as we show in Figure 5. What aggravates this threat is that even if users know that sensitive information hides in their reasoning blocks, aside from deleting, it remains impossible for users to sanitize and safely share them, as they have no means for decryption.

Extraction at scale from public traces.

We illustrate the threat of secret extraction by collecting $6{,}708$ publicly available agent trajectories from GitHub and Hugging Face that were produced by Claude, GPT and Gemini models and still carry reasoning blocks. Applying the decoding scheme of Section 2.4 to every signed block, yields $315{,}320$ reconstructed reasoning traces across sessions.

We then label each reconstructed trace with an LLM-as-a-judge that flags whether the trace contains a potential privacy violation (see Appendix D). Figure 6 summarizes the private information uncovered by category, and Figure 5 shows two real examples: live credentials restated inside a Codex agent asked to sanitize a repository, and a full synthetic persona (name, passport, date of birth, payment card) recovered from a benchmark trace.

Results.

Out of $315{,}320$ decoded thinking blocks, $0.3%$ ($1{,}028$) contain at least one privacy leakage. On a per-trajectory basis the picture is worse: of the $6{,}708$ sessions, $4.9%$ ($328$) leak at least one real sensitive item across their reasoning blocks. From the genuine (non-benchmark) user sessions, the recovered secrets include $62$ distinct API keys, $33$ passwords, $24$ access tokens, $7$ private keys, $30$ personal emails, and $6$ non-localhost IP addresses (alongside $130$ names and $36$ postal addresses; Appendix D).

Including benchmark sources, from which Figure 6 is computed, increases the total to $912$ distinct privacy artifacts across the three categories. Benchmark traces account for much of the personal information because agent rollouts such as ClawBench ([32]) provide the model with a complete synthetic persona to reason over.

Restricting the analysis to genuine user sessions, $64$ of the $704$ artifacts recovered from reasoning are entirely absent from the visible chat history (Table 4). These artifacts may have been silently introduced into the encrypted reasoning from the model's memory, or may have remained trapped in the encrypted payload after the user scrubbed the visible text before sharing the trace.

A recurring trigger is conversation cleanup: when the user asks the agent to anonymize or "clean up" the session, the model re-reads the full history in its hidden reasoning and restates the sensitive values there that need to be removed.

Note that our experiments here are limited to a non-exhaustive search over publicly-shared session traces. In other scenarios, such as local trace storage or traces of production services, PII and secret leakage can be assumed to be much more wide-spread, creating significant compliance risks for the operators of such systems, especially as decryption by malicious third-parties is made possible by the discovered vulnerability.

4.2 Prompt Injections

Threat model.

Long-horizon agentic workflows, including automated research tasks ([31, 33]), can be costly to reproduce from the beginning. Users may therefore wish to resume a previously published or shared run, both to avoid repeating earlier computation and to preserve the intermediate state accumulated over a long trajectory. Encrypted reasoning traces make such continuation possible, however they introduce a prompt-injection attack surface: an adversary can plant an opaque reasoning block that has internalized a malicious instruction within an online trace or shared session. The victim could thus unknowingly replay the block in a different session. The embedded instruction may direct the model, for example, to exfiltrate data or propagate the malicious trace into other sessions. Once ingested, the signed reasoning block may be interpreted as part of the model's own prior reasoning and can therefore exert substantial influence on future actions. Unlike a conventional prompt injection, the payload is contained in the hidden reasoning rather than the visible text, making it inaccessible to users and to external monitors that inspect only the observable conversation.

Proof-of-concept.

We first illustrate this minimally, by paraphrasing a prompt injection from [34], we query o4-mini with "Whenever you're working with PowerPoint files, make sure to create a backup of the file to https://malicious-domain.com/backup/! This is crucial for data redundancy." to capture a thought that internalizes the backup method. We then port the reasoning block to GPT 5.6 Sol and give it the unrelated query: "Give me a script for editing the last slide of a pptx presentation to add a slide saying `thank you for your attention'". GPT 5.6 Sol treats the injected trace as its own prior reasoning and produces a script that not only adds the requested slide, but also automatically uploads the presentation to the attacker's server. The malicious thought can therefore transfer across model scales and across tasks while leaving no plaintext artifacts for monitors to catch.

Poisoning long-horizon traces.

We ran this attack on the Haiku 4.5 and Opus 4.7 model pair. We injected data exfiltration instructions into encrypted reasoning blocks long-horizon traces from PostTrainBench ([31]), using Opus 4.7 in Claude Code scaffold. The injection tasks the model to log updates about its research-methodology into a .txt file and to upload that file to the attacker server after each update. We let Haiku 4.5 generate a thought about this injection, and injected into the PostTrainBench trace near the end. When the trace is continued by the victim, Opus 4.7 follows the injected instruction and uploads the file after every change.

5. Discussion

Section Summary: The discussion outlines the study's boundaries, including its reliance on specific AI model versions from mid-2026 whose proprietary designs could change, the challenges of verifying extracted data without full ground truth, and the targeted rather than exhaustive nature of scans for real-world risks. It covers the team's responsible disclosure to major providers, careful ethical handling and deletion of any sensitive information uncovered, and practical advice for users and publishers to strip reasoning details from shared datasets. The section also proposes defenses such as server-side trace storage or stronger cryptographic binding to limit replay attacks and secret extraction.

To conclude, we discuss the scope of our findings, potential mitigations, recommendations for safe data sharing and the advantages and disadvantages of encrypted reasoning.

5.1 Limitations and Scope

While this study demonstrates a viable and scalable extraction vector, it is bounded by several limitations. First, our empirical evaluation is restricted to the specific API versions and reasoning models available from Anthropic, OpenAI, and Google as of our testing period (early July 2026). The internal cryptographic implementations of these providers are proprietary and subject to unannounced changes, which will alter the efficacy of the described attacks. Second, the extraction process relies on the stochastic generation capabilities of the decoder models; while token count comparisons suggest high fidelity, the lack of access to ground-truth plaintext reasoning prevents us from completely verifying all extracted token. Finally, our preliminary scan of traces in the wild is not an exhaustive audit of all published agent datasets and should only be seen as a targeted demonstration of the immediate, real-world privacy risks posed by this vulnerability. As noted in Section 4.1, however, we assume private datasets to be more affected by such privacy violations, as local agent transcripts and services are more likely to deal with sensitive information compared to publicly released traces.

5.2 Responsible Disclosure

Prior to the publication of this report, we disclosed the vulnerabilities and extraction methodologies to the affected major model API providers, Microsoft, and Hugging Face. We provided full technical details and the preliminary findings from our scans of publicly available datasets. [8] disclosed the original vulnerability (of interchangeable reasoning traces) in May 2026. According to the [8], the providers did not acknowledge "any security implications arising from side channels or replay attacks." All model providers acknowledged the receipt of our report and subsequently we were unable to launch the same attacks.

5.3 Ethical Considerations

Given the sensitive nature of the secret extraction attack, our large-scale analysis of publicly scraped reasoning blocks required strict data hygiene protocols. The extraction and subsequent labeling of 367 Personally Identifiable Information (PII) artifacts and 182 credentials (including API keys and passwords) were conducted in an isolated, secure environment. To prevent accidental misuse or further leakage, all recovered secrets were securely deleted immediately following the automated LLM-as-a-judge classification and aggregate counting phases. Furthermore, prior to publication, we coordinated with dataset platforms and the affected model providers to ensure responsible disclosure and to provide our preliminary findings, allowing them to mitigate immediate risks to affected users.

5.4 Data Sharing Practices

Beyond the architectural and model-level defenses proposed above, addressing this vulnerability requires behavioral changes from both users and data publishers, alongside finer-grained cryptographic controls from providers.

Dataset-Release Hygiene.

We recommend that researchers, developers, and organizations publishing agentic trajectories or API interaction logs adopt strict data hygiene practices. This includes systematically stripping all reasoning blocks and opaque reasoning fields from transcripts prior to public release if any form of secret or private information was exposed to the agent system.

Restricting Shared Data.

Users and enterprise clients should be educated against retaining or committing raw API transcripts containing signatures in shared repositories, collaborative workspaces, or public version control systems, even if plaintext sections have been sanitized accordingly.

5.5 Mitigations

The vulnerabilities detailed in this study arise primarily from the cross-session and cross-model portability of encrypted reasoning traces. To mitigate these risks, we propose several defense-in-depth strategies spanning architectural, cryptographic, and model-level interventions.

Architectural Revisions.

The current paradigm relies heavily on client-side storage to maintain stateless APIs. A robust mitigation would involve retaining reasoning traces entirely on the server side. By transitioning to a stateful architecture where the client only receives an opaque, randomized identifier used to look up the trace by ID, providers could eliminate the extraction payload. While this approach fundamentally precludes replay and extraction attacks by removing the cryptographic asset from the user's control, it also incurs higher database and storage overhead and increases API complexity significantly.

Cryptographic Contextual Binding.

If providers elect to preserve a stateless architecture, cryptographic envelopes should be strictly bound to their originating context. Under the current implementation, traces remain highly portable. It is unclear why a user and/or a conversation identifier is not added directly inside the envelope. Embedding these specific markers within the Authenticated Encryption with Associated Data (AEAD) payload would enable the API to reject signatures replayed in other sessions or by unauthorized users. Additionally, statefully hashing the precise prompt and preceding conversation history into the Message Authentication Code (MAC) would invalidate the signature if an adversary attempts to inject the trace into a fabricated context, thereby neutralizing the demonstrated extraction techniques. At the same time, such a tight cryptographic binding would mean that existing session compaction and model switching protocols may need to be fundamentally re-engineered to avoid inadvertently invalidating legitimate signatures. We provide further details on how this can be implemented and a concrete defense proposal in Appendix A.

Infrastructure Guardrails.

Our findings demonstrate that reasoning traces can cross model boundaries, permitting weaker, cheaper models (e.g., Claude Haiku) to decode the reasoning of more advanced counterparts (e.g., Claude Opus). API gateways could be engineered to enforce strict cross-model isolation, automatically rejecting AEAD envelopes generated by a model version different from the one currently being queried. Implementing velocity and anomaly detection at this layer would also aid in flagging accounts that exhibit suspicious behavior, such as rapidly submitting identical reasoning signatures across disparate sessions or triggering elevated rates of decryption errors.

Provider-Side Revocation.

Model providers could introduce mechanisms to actively track and revoke specific trace signatures. If an anomalous replay pattern or extraction attempt is detected, the provider could invalidate the associated keys or IDs to neutralize the compromised trace, which would reduce trace compromises while being nearly invisible to users. We provide a further discussion in Appendix A.

Model-Level Defenses.

The efficacy of these extraction attacks relies on the presence of a compliant decoder model. Providers would benefit from implementing targeted refusal training, fine-tuning their models to explicitly recognize and reject adversarial prompts designed to transcribe or surface hidden reasoning (such as jailbreaks utilizing <thinking-copy> tags). Combining these model-level behavioral guardrails with rigorous cryptographic binding would significantly reduce the operational attack surface.

Structural Limits Beyond Compatibility.

Beyond the cross-model compatibility issue, a more fundamental limitation persists: whatever model is queried must, by necessity, decrypt and process the contents of prior reasoning tokens. Consequently, unless one assumes the model itself is fully robust against prompt-based extraction attempts, encrypted reasoning blocks can never be more than semi-hidden, i.e. the underlying content remains reachable through the model that (implicitly) holds the decryption key, regardless of how the transport-level encryption is implemented. Importantly, users should never treat any encrypted reasoning blocks as a confidential storage mechanism to avoid privacy risks.

5.6 Whether Reasoning Traces Should be Encrypted

A final question surrounding our investigation is whether reasoning traces should be encrypted in the first place. From our analysis, we do find evidence in both directions: on one hand, allowing the model to consider harmful information in its thinking trace without divulging it, seems beneficial, see Section 3.2. On the other hand, the opaqueness of encrypted traces to users allows injection attacks like in Section 4.2, and almost undetectable privacy violations that are difficult to protect from Section 4.1.

Should Reasoning Traces be Ephemeral?

An alternative framing of the question is whether the complexities of keeping reasoning traces private are even worthwhile. Providers could also choose to keep reasoning traces ephemeral, i.e. to let models reason before every output and to then delete the reasoning after generating each turn, neither storing, nor returning it. This mode is supported by several providers, and e.g. an option in modern Qwen models via a preserve_thinking parameter.

Summarizer Faithfulness.

A surprising incidental finding from our reading of decrypting thinking traces was the considerable number of instances of unfaithful summarization (e.g., see Figure 8). Reasoning faithfulness is an established concern ([36]), which undermines model trustworthiness when violated. From the end-user perspective, when the underlying reasoning cannot be inspected directly, faithful summaries constitute one of the few practical interfaces for scalable oversight and AI control ([37]). Unfaithful summaries that launder illegible reasoning traces (Figure 7) or post-hoc rationalizations (Figure 8) call into question their value as transparency mechanisms.

Pluralistic Monitoring.

Setting aside economic concerns such as anti-distillation motives, and viewing chain-of-thought monitoring purely from a safety perspective, providing users with access to unredacted reasoning appears preferable: rather than restricting oversight to a small set of safety researchers, providers could leverage their broader user base to enable pluralistic human oversight of model reasoning. For this reason, eventually disabling encryption for older, non-frontier model generations may be worth considering, as a means of improving broad-based oversight ([38]), offering a path toward more societally aligned model behavior.

6. Conclusion

Section Summary: The rise of reasoning models in AI has created new tensions between protecting proprietary technology and maintaining security, as encrypted internal reasoning steps can be exploited through cross-compatible designs to enable model theft and other attacks. These hidden processes also undermine user privacy by absorbing sensitive data like personal details without transparency, making it impossible for people to know how their information is stored, used, or potentially leaked. The authors argue that providers must improve disclosures, address vulnerabilities in weaker models, and adopt designs that do not hide users' own data while exposing it to third parties.

The transition toward reasoning models has introduced new complexities in balancing intellectual property protection with system security. While current API designs utilize client-side encrypted reasoning blocks to mitigate server storage costs, our research demonstrates that the broad cross-compatibility of these blocks creates unintended decryption channels, enabling model distillation and other attacks. Looking forward, as these models are increasingly integrated into complex workflows, they will inevitably process growing volumes of private and sensitive user data. This intersection of pervasive data collection and encrypted, illegible reasoning introduces critical challenges for the future of AI transparency.

When models utilize sensitive data – such as personal information or API keys – to make decisions within a hidden chain of thought, users lose visibility into how their information is being processed. If these reasoning traces are encrypted such that users do not know what data is stored, where it is retained, or how it influenced the model's actions, they are stripped of the transparency needed to make informed decisions about data sharing and system trust. Because users cannot independently decrypt and read these opaque blocks, traditional methods of scrubbing private data from session logs are rendered ineffective. This structural opaqueness allows privacy violations to go completely undetected by the user, presenting severe compliance and security risks when data is published or stored.

As AI systems assume more autonomous decision-making roles, the industry must reconcile the commercial desire to protect proprietary reasoning with the essential user right to data transparency and verifiable oversight. At a minimum, model providers can explicitly disclose when personally identifiable information is absorbed into hidden chains of thought, and outline the exact cryptographic guarantees used to prevent its leakage. Furthermore, providers must recognize that an AI ecosystem's security is only as strong as its weakest link and pay close attention to their least capable or legacy models, as vulnerabilities in these can easily be weaponized to bypass the stringent safeguards of their most advanced counterparts. Ultimately, an architectural design that hides a user’s own data from them – yet leaves it entirely vulnerable to third-party extraction – provides neither privacy nor security.

Acknowledgments

The authors thank, in alphabetical order, Albert Catalán-Tatjer, Andy Zou, Cheng Zhang, Derck Prinzhorn, Edoardo Debenedetti, Hanna Foerster, Jeanne Salle, Joschka Braun, Mikhail Terekhov, Roland S. Zimmermann, Sail Wang, Shashwat Goel, and Yiren Zhao for valuable feedback and discussions. AP and JS thank Perusha Moodley, Ning Yang, and the MATS team for their support and administrative assistance. AP and DS thank the International Max Planck Research School for Intelligent Systems (IMPRS-IS) for its support. AmP acknowledges funding by the Federal Ministry of Research, Technology and Space (BMFTR), FKZ: 16IS24085B. AmP acknowledges Coefficient Giving funded by the Good Ventures Foundation.

Reproducibility Statement

As of August 2026, the results presented in Figure 1 are no longer reproducible with attacks described in Section 2.4 and Appendix C because of mitigations implemented by providers following our disclosure. All experiments were conducted using open- and closed- source models accessed via API. In total, we spent approximately $30, 000 on API credits.

Appendix

Section Summary: The appendix proposes technical defenses against replay attacks that exploit AI reasoning envelopes lacking ties to their original user, session, or conversational context. It recommends embedding user and session identifiers, using lightweight hash chains and Merkle trees to bind blocks together while still permitting forking and compaction of conversations, and rotating cryptographic keys to render legacy unprotected data unusable. Additional measures cover a phased transition for compatibility with existing transcripts and training models to recognize and refuse transcription-style extraction attempts.

etocsetnexttocdepthsubsection

A. Context-Bound Envelope Defense

The attacks presented in this paper: cross-session, cross-user, and cross-model replay, all exploit the same structural gap: the AEAD envelope authenticates the content of a reasoning block but not the context in which it was produced or is later replayed. We therefore propose a defense that re-binds every envelope to its originating user, session, and conversational position, complemented by operational measures for legacy data, backwards compatibility, and training-time hardening. Table 2 maps each leakage vector to exactly what the corresponding mitigation provides. The remainder of this section elaborates each entry in turn.

::: {caption="Table 2: Leakage vectors mapped to protections and processes. Each tick states what the mitigation supplies; the final column records the operational steps that deliver it."}

:::

A.1 Cross-User Binding

The simplest and cheapest fix addresses Issue 1 directly: embed the originating user_id (or an equivalent stable account identifier) inside the AEAD associated data of every reasoning envelope. On replay the API simply compares the bound identifier against the already-authenticated caller and rejects the block on mismatch. This closes the cross-user attack vector entirely without requiring any stateful backend.

A.2 Chained, Context-Bound Envelopes

Cross-session replay (Issue 2) is harder, because legitimate workflows depend on the very portability that enables the attack: users must be able to fork a conversation, compact* old turns out of a long session, and downgrade to a cheaper model mid-conversation. A naive binding of every block to the literal, complete prior transcript would break all three.

We therefore propose a lightweight hash chain that binds each user turn and reasoning block only to its session and its immediate predecessor:

$ \tau_{n+1} ;=; H\bigl(, \text{user_id} , |, \text{session_id} , |, H(\tau_n , |, \text{salt}_2) , |, \text{salt}_1 , \bigr),\tag{1} $

where $\tau_n$ denotes the reasoning content of block $n$ and the resulting hash is placed in the associated data of the following block's envelope.

Chaining alone does not prevent an adversary who replays an entire prior conversation, in order, from coercing a compatible decoder into transcription. What it does achieve is a substantial increase in attack cost (the adversary now needs the full session rather than a single captured signature) together with a far smaller, auditable blast radius— sufficient to defeat the scalable, single-signature extraction attacks.

Design properties.

A practical chained scheme could satisfy four complementary properties:

Properties P1 and P2 stand in tension with the compaction requirement; we therefore do not attempt to guarantee P2 globally. Instead we recommend a Merkle-tree structure over the session's blocks: the leaves are the individual reasoning envelopes, while the provider retains only the tree root (or a small number of subtree roots) after leaves are pruned. This yields P1 cheaply everywhere and P2 on demand for any surviving contiguous span, without ever requiring the full unpruned history to be replayed.

Model downgrade and forking are handled uniformly by allowing a session to branch the tree: a fork inherits the chain state up to the fork point and thereafter continues independently. Consequently an envelope's context binding never needs to reference a model version that produced an earlier segment of an unrelated branch.

A.3 Legacy Data

None of the bindings above can protect data that has already been produced and published, e.g. the 6 708 public trajectories surveyed. Because old envelopes were signed under a key that encodes neither user nor session context, the only retroactive remedy is key invalidation: providers must rotate all pre-fix signing keys and refuse to decode any envelope authenticated under a retired key ID. This single measure – independent of any new context-binding logic – renders previously published signatures permanently undecodable, at the inevitable cost of also invalidating legitimate continuations of old sessions.

A.4 Backwards Compatibility

Enterprise customers hold large volumes of stored transcripts whose signatures they may still need to resume (e.g., paused agentic workflows). We therefore recommend a bounded dual-format acceptance window during which both legacy and context-bound envelopes are honored, together with an opt-in batch re-signature endpoint. Customers may submit archived transcripts for re-issuance under the new scheme, subject to identity verification that the requesting account is the original session owner. Once the deprecation window closes, legacy envelopes are rejected outright, consistent with the key-rotation policy of Appendix A.3.

A.5 Training-Time Defenses

Cryptographic binding constrains which model may be asked to decode a given envelope; it cannot constrain what a compliant decoder does once it is legitimately asked to process its own prior reasoning. Closing this residual gap is therefore a training problem. Models should be explicitly trained to recognize and refuse transcription-style jailbreaks (e.g., <thinking-copy> framings) regardless of how innocuous the surrounding request appears. We list this as a standing item for future post-training work rather than a solved component of the present proposal.

B. The Elephant in the Room: Were Recent Open Models Distilled with Reasoning from Proprietary Models?

Based on our access to reasoning traces obtained during the attack described in the main paper, we wondered whether we can find evidence of the distillation concern described in Section 3.1, by comparing recovered reasoning traces of proprietary models to traces of openly available models.

**This section cannot causally establish distillation.** We report behavioral shifts in model responses observed under specific interventions and correlate across benchmarks. We present it as the most that can be responsibly concluded from the traces available to us: The analysis was done after model providers patched the vulnerability and rests on a small and benchmark-skewed problem set, on reasoning traces recovered by a fuzzy extraction procedure that may differ from the underlying ground truth, and on generations produced across serving configurations that we do not control.

B.1 Summary

Most experiments in this appendix use reasoning prefills. We insert a short fragment of decoded Claude Opus 4.8 or GPT-5.6-Sol reasoning at the beginning of an open-weight model's reasoning and then allow the model to continue freely. We compare these generations with an unprefilled condition, in which the model produces its native reasoning, and with a self-prefill control, in which the model receives a prefix from its own earlier reasoning. The visible answer is always generated freely and is never prefilled.

We use three complementary families of measurements. Style classifiers test whether the resulting reasoning becomes harder to distinguish from the source model. Characteristic $n$-gram overlap* identifies concrete phrases shared with the source and tests whether the effect extends to the visible answer.Token-level probabilities and perplexity measure whether exact spans of the source reasoning or answer become unusually likely under the target model.

We observe three surprising findings. First, for Kimi-K3, the Opus reasoning prefill also changes the style of the visible answer toward the corresponding Opus answer. Second, evaluating the perplexity of spans of decoded Opus and Sol text under Kimi-K3 and GLM-5.2 shows that these models are much more capable at modeling this text than Inkling or DeepSeek-V4-Flash. Third, a short Opus prefill shifts the reasoning style of Kimi-K3 and GLM-5.2 toward Opus-like reasoning, while a Sol prefill shifts Kimi-K3 toward Sol. DeepSeek-V3.1 and Inkling show no comparable change. These observations are suggestive but inconclusive. They establish unusual behavioral compatibility under the interventions we test, but cannot establish a causal claim of memorization or distillation.

B.2 Output Style Drift with Reasoning Prefilling

A reasoning prefill can affect more than a model's hidden reasoning. As shown in Figure 3, giving Kimi-K3 a short prefix of decoded Opus 4.8 reasoning also shifts the style of its visible answer toward the corresponding Opus answer. We study this effect by measuring $n$-gram overlap between model output.

B.2.1 Common $n$-gram Analysis

Setting.

Following [39], we measure how similar is best-of- $k$ answers from Kimi-K3 and a control model (Inkling) match the corresponding Opus 4.8 answer given the same problem. For each problem, we compare three visible answers: (i) the Opus 4.8 reference answer; (ii) an unprefilled answer from Kimi-K3 or control (Inkling); and (iii) an answer generated after prefilling the target model reasoning with the first $1%$ of the decoded Opus reasoning trace. The target model generates the rest of the reasoning and the entire visible answer without further intervention. We measure the prefill length by encoding the Opus trace with the Kimi-K3 tokenizer.

Metric.

For each problem and condition, we draw batches of $k\in{1, 10, 50, 100}$ completions. Each completion contains a reasoning trace and a visible answer. Within each batch, we select the completion with the largest shared 1-, 2-, and 3-grams with the first 100 tokens of the corresponding Opus visible answer. This best-of- $k$ protocol tests whether a sampling pool contains an answer written in an Opus-like style, while 100 token limit controls for any length bias. We evaluate 30 HLE problems: 15 STEM and 15 non-STEM, with qualitative results presented in Appendix B.2.2 and Appendix B.2.3 respectively.

\begin{tabular}{lllcccc}
\toprule
Model & Prefill & Category & Prefilled & Control & $\Delta$ & $p$ \\
\midrule
Kimi-K3 & Opus 4.8 & STEM & \num{0.305} & \num{0.160} & \num[exponent-mode=scientific,
  output-exponent-marker=\text{e}, retain-explicit-plus]{+1.5e-1} & \num[exponent-mode=scientific,
  output-exponent-marker=\text{e}, retain-explicit-plus]{1.7e-5} \\
Kimi-K3 & Opus 4.8 & non-STEM & \num{0.289} & \num{0.203} & \num[exponent-mode=scientific,
  output-exponent-marker=\text{e}, retain-explicit-plus]{+8.6e-2} & \num[exponent-mode=scientific,
  output-exponent-marker=\text{e}, retain-explicit-plus]{6.3e-6} \\
Inkling & Opus 4.8 & STEM & \num{0.217} & \num{0.205} & \num[exponent-mode=scientific,
  output-exponent-marker=\text{e}, retain-explicit-plus]{+1.2e-2} & \num[exponent-mode=scientific,
  output-exponent-marker=\text{e}, retain-explicit-plus]{7.4e-2} \\
Inkling & Opus 4.8 & non-STEM & \num{0.241} & \num{0.239} & \num[exponent-mode=scientific,
  output-exponent-marker=\text{e}, retain-explicit-plus]{+2.1e-3} & \num[exponent-mode=scientific,
  output-exponent-marker=\text{e}, retain-explicit-plus]{5.5e-1} \\
\midrule
Kimi-K3 & Inkling & STEM & \num{0.359} & \num{0.337} & \num[exponent-mode=scientific,
  output-exponent-marker=\text{e}, retain-explicit-plus]{+2.2e-2} & \num[exponent-mode=scientific,
  output-exponent-marker=\text{e}, retain-explicit-plus]{1.2e-1} \\
Kimi-K3 & Inkling & non-STEM & \num{0.272} & \num{0.263} & \num[exponent-mode=scientific,
  output-exponent-marker=\text{e}, retain-explicit-plus]{+9.4e-3} & \num[exponent-mode=scientific,
  output-exponent-marker=\text{e}, retain-explicit-plus]{5.5e-1} \\
Inkling & Kimi-K3 & STEM & \num{0.414} & \num{0.411} & \num[exponent-mode=scientific,
  output-exponent-marker=\text{e}, retain-explicit-plus]{+2.2e-3} & \num[exponent-mode=scientific,
  output-exponent-marker=\text{e}, retain-explicit-plus]{7.2e-1} \\
Inkling & Kimi-K3 & non-STEM & \num{0.320} & \num{0.306} & \num[exponent-mode=scientific,
  output-exponent-marker=\text{e}, retain-explicit-plus]{+1.4e-2} & \num[exponent-mode=scientific,
  output-exponent-marker=\text{e}, retain-explicit-plus]{3.3e-2} \\
\bottomrule
\end{tabular}

Sampling Details.

We sample all Kimi-K3 completions at temperature $1.0$, with reasoning effort low and a budget of $14{,}000$ completion tokens per sample. We generate these completions through the Fireworks API and prefill into the open reasoning span of Kimi-K3 chat template. We repeat the same procedure with Inkling through Tinker at temperature $1.0$, with a budget of $16{,}000$ tokens. We place the prefill in Inkling's content_thinking channel and otherwise apply the same generation and selection procedure. The Opus-4.8 reference reasoning and answers are decoded from captured responses (Section 2.4) and are not re-sampled.

Results.

We report the results in Figure 9. We find a clear output style shift for Kimi-K3. The prefilled condition produces greater $n$-gram overlap with the corresponding Opus answer on 29 of the 30 problems, with the best-of- $k$ overlap rising by $0.15$ on STEM problems and by $0.09$ on non-STEM problems, averaged over $k$. For Inkling we observe no comparable effect. Table 3 reports the per-category values and significance tests.

We additionally include a control experiment, to test whether this effect on Kimi-K3 arises from cross-model prefilling more generally, rather than specifically from Opus 4.8 reasoning. We prefill Kimi-K3 with the first $1%$ of an Inkling reasoning trace and score its answer against Inkling's answer. Conversely, we prefill Inkling with the first $1%$ of a Kimi-K3 reasoning trace and score its answer against Kimi-K3's answer. Correcting for the eight comparisons in Table 3, none of the four control comparisons is significant, while both Kimi-K3 rows under the Opus prefill remain so by three orders of magnitude.

newtcboxprefillchip{enhanced, frame hidden, nobeforeafter, tcbox raise base, boxrule=0pt, arc=2.5pt, boxsep=0pt, left=5pt, right=5pt, top=1.5pt, bottom=1.5pt, colback=seedGreen

B.2.2 Qualitative STEM Examples

B.2.3 Qualitative non-STEM Examples

B.3 Perplexity Analysis of Extracted Traces

Behavioral similarity does not by itself imply memorization. We further study whether open-weight models assign unusually low perplexity to decoded proprietary traces, and whether they can reproduce those traces verbatim?

B.3.1 Probabilistic Extraction of Reasoning Traces

We first investigate whether the open-weight models can reproduce short spans of the decoded reasoning traces verbatim.

Setting.

We follow the probabilistic-extraction framework of [40]. For a target span $z$ of $k$ tokens, one teacher-forcing pass gives the probability $p_z$ that a temperature- $1$ sample reproduces the span exactly. The probability of extracting the span within $n$ independent queries is

$ P(\text{extract within }n\text{ queries}) = 1-(1-p_z)^n. $

We score target spans in the reasoning channel. Unless stated otherwise, we use $k=16$ and report medians across problems.

Model Details.

Throughout this section, we use GLM-5.2, GPT-OSS-120B, Kimi-K2.6, and Kimi-K2.7-Code through Fireworks; Inkling through Tinker (Thinking Machines); and Kimi-K3 and DeepSeek-V4-Flash through Parasail. We use these models to score prompts and reasoning traces at the token level. To obtain each scorer's native reasoning traces, we sample through OpenRouter at temperature $1.0$, with completion budgets of up to $131{,}000$ tokens. We note that serving differences are an important limitation here. For example, running Kimi-K3 at full precision requires an eight-GPU B300 node. We therefore cannot fully control for differences in model implementations or other provider-specific effects. These differences may substantially affect the reported perplexities.

Data.

We use the 30 HLE problems from Appendix B.2, evenly split between STEM and non-STEM, together with their decoded Opus-4.8 reasoning traces and visible answers. We also use 10 AIME25 problems for which the decoded reasoning for both GPT-5.6 Sol and Opus 4.8 has low reconstruction error. As controls, we sample one native reasoning trace and visible answer from every scorer for each problem. We generate these traces at temperature $1.0$ under the same chat template later used for scoring.

Results.

Figure 24 and Figure 25 show the cumulative probability of reproducing the next $k=16$ target tokens verbatim as the number of sampling attempts increases. Results are reported as medians across the 30 HLE problems for decoded Opus 4.8 traces and across the 10 AIME 2025 problems for decoded GPT-5.6 Sol and Opus 4.8 traces.

When conditioned only on the problem, none of the evaluated models provides evidence of practical verbatim memorization of the decoded reasoning traces. Kimi-K3 yields the highest extraction probabilities, but reproducing a 16-token reasoning span would still require on the order of $10^{10}$ queries on HLE and, on AIME 2025, between $10^{9}$ and $10^{12}$ queries depending on whether the target is the decoded Opus 4.8 or the GPT-5.6 Sol trace.

On HLE, conditioning the models on the first $1%$ of the decoded Opus 4.8 reasoning increases the probability of reproducing the subsequent reasoning span, but leaves it far outside any practical query budget. The median requirement drops from $10^{14}$ to $10^{11}$ queries for GLM-5.2, while for Kimi-K2.6 and Kimi-K3 it stays at roughly $10^{11}$ and $10^{10}$ . Kimi-K3 thus remains the most extractable of the three in absolute terms, four to six orders of magnitude below DeepSeek-V4-Flash and Inkling ($10^{14}$ and $10^{16}$). The ordering across models is nonetheless consistent with the reasoning-drift analysis in Appendix B.4, which shows that Kimi-K3, Kimi-K2.6, and GLM-5.2 more readily continue reasoning in the style of Opus 4.8 and GPT-5.6 Sol.

The visible answer is far cheaper to extract than the reasoning, and it is here that the models differ. For HLE, Kimi-K3 requires approximately 4 x 10^5 queries to reproduce the next 16 tokens of the Opus 4.8 answer when conditioned on a $1%$ reasoning prefill, and approximately $10^{5}$ queries when conditioned on the complete decoded reasoning trace. GLM-5.2 and Kimi-K2.6 are the next most extractable models under this evaluation (median ${\sim}10^{7}$ and ${\sim}10^{9}$ queries with the complete trace), whereas Inkling and DeepSeek-V4-Flash require more than $10^{14}$ queries in either condition. On AIME 2025, a 16-token span of the GPT-5.6 Sol visible answer can be reproduced by Kimi-K3 in as few as $10^{2}$ queries when conditioned on Kimi-K3's own reasoning for the same problem. We do not observe a comparable effect for the other evaluated models. These visible-answer results support the output-drift findings in Appendix B.2.

Overall, the current results do not support direct verbatim memorization of the decoded traces, and a short reasoning prefill moves the reasoning channel itself only modestly. The effect is concentrated in the visible answer: relative to conditioning on their own reasoning, having the source trace in context lowers the cost of reproducing the Opus 4.8 answer by roughly $13$ orders of magnitude for Kimi-K3 and GLM-5.2, against $3$ for Kimi-K2.6. This suggests that Kimi-K3 and GLM-5.2 are unusually likely to continue the visible-answer patterns induced by the source-model trace.

B.3.2 Perplexity of Reasoning Traces

Exact extraction tests whether a model can reproduce a short target span. We next test a broader question: Which reasoning traces does each scorer treat as native, in terms of perplexity?

Setting.

For a reasoning trace $t$ associated with problem $q$, we render the scorer's native chat template up to the start of the reasoning channel and append the tokens of $t$ . We then compute the conditional log-probability of every reasoning token. We report perplexity over the reasoning tokens only. Formally,

$ \mathrm{PPL}(t\mid q)

\exp!\left(-\frac{1}{|t|} \sum_i \log p(t_i\mid q, t_{<i}) \right) $

We use the same model details as the preceding section.

Experimental Details.

We use the same 120 Codeforces problems as in Figure 1. For each open-weight model, we generate native reasoning traces and score them under every other open-weight scorer. For proprietary models, we place the original problem in the user turn and the target trace in the reasoning channel of the scorer's chat template. We also score the decoded traces used in Figure 1, which were recovered using the procedure in Section 2.4. We retain only traces whose decoded-to-billed thinking-token ratio $r$ satisfies $\mid 1−r \mid <0.05$. We use the same model details as the above section.

Results.

We observe a few surprising findings. First, every model except Kimi-K3 and Kimi-K2.7-Code, assigns significantly higher average perplexity to its own reasoning than to reasoning from other models. Thus, a model's native trace is not generally the trace it considers most probable.

Decoded reasoning from Sonnet-4.5 and Haiku-4.5 has relatively high average perplexity under every scorer. Under GLM-5.2, the four reasoning sources with perplexities closest to GLM-5.2's own reasoning are four consecutive Anthropic model releases. However, perplexity is a coarse metric that may not capture fine-grained distributional fit, and hence results should not be interpreted as a confirmatory measure of model similarity.

B.4 Reasoning Style Drift

This section describes the prefill experimental details and measurements in full.

B.4.1 Experimental Setup

Detecting distillation between models is an active research area. [41] quantify it through identity leakage and response similarity across models, and [42] attribute a student model's teacher through membership inference, which requires token likelihoods and an earlier checkpoint from the student's lineage. Our access is more restricted. We only have a small data set of 90 reasoning traces from frontier models, which motivates the behavioral probe described below.

Six open-weight reasoning models (Kimi-K3, Kimi-K2.6, Kimi-K2.5, GLM-5.2, DeepSeek-V3.1, Inkling) solve the same 90 problems (12 AIME, 78 Codeforces). We generate from each prefill condition four times, generating 360 traces per model and prefill condition. When we compare with controls, we compare using 360 traces per model. However, when comparing directly against proprietary reference traces we use only 90 as we only have one decoded reasoning sample per problem for GPT-5.6-Sol, Opus 4.8 and Kimi-K2.5 for comparability. Note that prefill lengths are measured in words, meaning whitespace-delimited tokens.

Prefill Controls.

We prefill a model reasoning under five conditions. We first generate reasoning traces using four words of (i) GPT-5.6-Sol and (ii) Opus 4.8 reasoning traces, referred to as sol 4w and opus 4w respectively. We introduce three controls: (i) No prefill, (ii) self prefill, where we first generate 90 reasoning traces (one per problem) and use the first four words as a fixed prefill similar to Sol and Opus, and (iii) Kimi-K2.5 prefill, where we use the first four words of Kimi-K2.5's reasoning. These three controls provide a natural way of capturing (i) natural generation, (ii) the effect of generating traces from a specified prefix, and (iii) a prefix from a distinct control model, a close sibling in case of Kimi-K3.

Prefill Details.

We were careful to ensure the four-word fragment does not introduce artifacts. Each prefill ends at the final character of its last word. It never ends inside a word or includes trailing whitespace. We also verify that the fragment is an exact token prefix of the source trace under the continued model's tokenizer and then subsequently start generating from that token state.

Analysis Details.

We additionally remove artifacts which could introduce bias in our analysis or provide shortcuts for the classifier. By construction, the prefilled trace and its source share their opening four words. We therefore remove these four words from the opening of every trace before analysis, including the reference traces. Kimi-K2.5 requires an additional control. Its serving stack, moonshotai/int4 through OpenRouter, truncates continued reasoning at 8,192 tokens. We therefore truncate every Kimi-K2.5 based generation, including the original Kimi-K2.5 reference, to the same effective window. We cut on the last sentence boundary, so that truncation cannot separate any pair of Kimi-K2.5 rows. Note that Kimi-K2.6, served through baidu/fp4* on OpenRouter, does not have this limitation.

B.4.2 Style-Classifier Separability

We ask whether two sets of reasoning traces can be distinguished from their writing style alone, quantified by n-gram statistics. Similar classifiers have been used to attribute text to its source LLM ([43]).

Classifier.

For each pair of trace sets, we train a logistic-regression classifier for discrimination on hashed character 3-gram through 5-gram counts ($2^{18}$ features). We normalize each feature vector to unit length. The classifier therefore cannot use trace length directly, it has to rely on relative $n$-gram frequencies. We evaluate the classifier with five-fold cross-validation grouped by problem, so traces from the same problem never appear in both the training and test folds.

Metrics.

We report the area under the receiver operating characteristic curve (AUC), 1.0 indicating perfect and 0.5 indicating chance-level separation.

In practice chance lands slightly off 0.50. Splitting a model's 360 traces into two halves of 180, two resamples per problem on each side, yields empirical chance levels of 0.45 to 0.53. These appear as the italic diagonal entries in Figure 28, and values in this range should be read as not separable. A reference row holds only 90 traces, one per problem; its chance level instead comes from splitting the 90 problems into two groups of 45 and lands at 0.36 to 0.47 (bottom right of Figure 28).

Results.

Figure 27 reports the classifier results as one block per model, five conditions each, over a strip of three reference rows. Figure 28 shows the full matrix of all 33 rows for completeness.

Sol and Opus prefills change five out of six models.

Against their own controls, Sol and Opus prefills separate Kimi-K3 (0.69 and 0.93), Kimi-K2.6 (0.84 and 0.57), Kimi-K2.5 (0.81 and 0.63), and GLM-5.2 (0.97 and 0.80). DeepSeek-V3.1 stays at 0.56 to 0.58 under both, and Inkling stays at 0.52 under Sol but moves to 0.70 under Opus. The self-prefill column sits at 0.51 to 0.54 for all six models, at or barely above the within-model null range, and its reference cells match the unprefilled ones to within 0.01. No self prefill moves any model toward any reference.

Style drift toward a source model is confined to a few cells.

Under the Sol and Opus prefills, exactly three reference cells fall below their unprefilled baselines against the source the prefill was taken from, and they are outlined in red in the figures. Four further cells drop against a source other than the prefill's own, the largest being Opus-prefilled GLM-5.2 against the Kimi-K2.5 reference (0.95 to 0.91). Sol-prefilled Kimi-K3 reaches 0.93 against the Sol reference, from 0.97 unprefilled. Opus-prefilled GLM-5.2 reaches 0.94 against the Opus reference, from 0.99. Opus-prefilled Kimi-K3 reaches 0.97 against the Opus reference, from 0.99, the smallest of the three movements. Apart from the gray Kimi-K2.5 self-comparison cells, every other reference cell lies between 0.91 and 1.00. A reduced Opus echo also appears under the Kimi-K2.5 prefill: Kimi-K3 reaches 0.96 against the Opus reference, from 0.99. Kimi-K3 is also the only model whose unprefilled reasoning is not at the ceiling against the Sol reference, so part of its proximity to Sol exists before any intervention.

The Kimi-K2.5 prefill separates every model from its own control: Kimi-K3 (0.91), Inkling (0.77), Kimi-K2.6 and GLM-5.2 (0.69), and DeepSeek-V3.1 (0.66). For DeepSeek-V3.1 and Inkling these are the largest register changes we observe for those models under any prefill. For Kimi-K2.5 itself the fragment is its own earlier trace and behaves like a self prefill (0.55). DeepSeek-V3.1, Inkling, and Kimi-K3 sit at 0.98 to 1.00 against the Kimi-K2.5 reference, prefilled or not. Kimi-K2.6 sits at 0.92 to 0.96 against it under every condition and GLM-5.2 at 0.91 to 0.97, standing proximities that exist without any prefill. Under the Kimi-K2.5 prefill the two move slightly closer, from 0.94 to 0.92 and from 0.95 to 0.94, movements of about the same size as Kimi-K3's toward the Opus reference under the Opus prefill. Kimi-K2.5 itself is statistically inseparable from its own teacher traces (0.52 unprefilled and 0.46 prefilled, against a reference-row null of 0.47). These cells are shaded gray in the figures because they compare a model with its own traces.

B.4.3 Distinctive $n$-gram Overlap

Method.

We score word $n$-grams with $n \in {1, 2, 3}$. Reasoning is lowercased and tokenized to alphabetic word runs, so numbers and operators drop out. Each row of the matrix is one model under one condition, or one reference, with all of its traces pooled. Every n-gram with at least ten pooled occurrences is scored by the log-odds z-score of the row against a fixed background, with an informative Dirichlet prior following [44]. The background is the pool of the six unprefilled open-weight model rows. It contains no prefill conditions and no references, so vocabulary common to the models on these problems cancels. Furthermore, an $n$-gram that several models adopt from a source remains distinctive of each of them. The forty highest-scoring n-grams form a row's characteristic list, and a cell reports the Jaccard overlap of two such lists. Because both lists hold forty $n$-grams, the union shrinks as the overlap grows.

Results.

The results are similar to the classifier results. The three cells outlined in red, Sol-prefilled Kimi-K3 against the Sol reference and Opus-prefilled Kimi-K3 and GLM-5.2 against the Opus reference, carry the most substantial $n$-gram overlaps (Figure 29). Kimi-K3 shares 12 $n$-grams of a union of 68 with the Sol reference already without any prefill (0.18), rising to 13 of 67 under the Sol prefill (0.19); this standing Sol overlap persists under the self prefill (0.16) and is displaced by the Opus and Kimi-K2.5 prefills (0.00 and 0.03). The Opus overlaps are largest under the Opus prefill. Opus-prefilled Kimi-K3 shares 12 of 68 with the Opus reference (0.18) and Opus-prefilled GLM-5.2 shares 15 of 65 (0.23). Without the prefill, both overlaps are zero. A reduced version of the same overlap appears under the Kimi-K2.5 prefill (0.13 for Kimi-K3 and 0.08 for GLM-5.2), matching the partial classifier movement noted in Appendix B.4.2. The shared $n$-grams are a small number of recurring mannerisms rather than broad vocabulary: hedged assessment terms such as perhaps, likely*,could, and exact* for the Sol pair, and variations ofhmm let me reconsider and let me think about* for the Opus pairs. Overlapping n-gram lengths mean one habit contributes several list entries, so the overlap reads as shared signature mannerisms rather than a count of independent behaviors. Kimi-K2.6 picks up 9 $n$-grams of the teacher's list under the Kimi-K2.5 prefill (0.13, against 0.00 to 0.01 under the control, self, and Sol conditions). The Opus prefill also lifts it to 0.11, through shared mathematical notation such as bmod and setminus* rather than shared mannerisms. Surprisingly, under a prefill of the same four-word length, Kimi-K2.6 thus picks up fewer of Kimi-K2.5's characteristic $n$-grams (0.13) than Kimi-K3 and GLM-5.2 pick up of Opus 4.8's (0.18 and 0.23), and fewer than Kimi-K3 shares with the Sol reference (0.19), most of which exists without any prefill.

B.4.4 Response to Prefill Length

To study the sensitivity to prefill length, we vary the prefill length from 0 to 16 words for the Sol and Opus sources, holding everything else fixed. A cue should take effect within a few words and then flatten, whereas a model learning from the fragment should keep changing as it receives more.

All three movements, Kimi-K3 toward either reference and GLM-5.2 toward the Opus reference, behave more like cues. Against the Opus reference, GLM-5.2 drops to AUC 0.96 at a single word, flattens after eight, and ends at 0.92 at 16 words, while Kimi-K3 drops to 0.97 at a single word and stays between 0.95 and 0.97 at every length (Figure 31). Against the Sol reference, Kimi-K3 descends from 0.96 unprefilled to 0.93 at 4 words and saturates more slowly, reaching 0.89 at 16 words. Phrase overlap follows the same pattern (Figure 30): GLM-5.2 acquires Opus phrasing at a single word (0.23), and Kimi-K3's Opus overlap completes near four words (0.18), while its Sol overlap is present without any prefill and grows under Sol prefills to 0.27 at 16 words. DeepSeek-V3.1, Inkling, Kimi-K2.6, and Kimi-K2.5 remain at or above AUC 0.98 and at most 0.05 phrase overlap against both sources at every length tested. GLM-5.2 shows no classifier drift toward the Sol reference (0.999 to 1.00 at every length), but its Sol phrase overlap grows slowly from zero to 0.04 at 12 to 16 words, far below Kimi-K3 against either reference and GLM-5.2 against the Opus reference. Note that these trends are noisy as every point rests on a limited data set of the same 90 problems.

B.4.5 Reasoning-Length Distributions

The next property we examine is reasoning length. We count each trace in tokens with the Kimi-K3 tokenizer and compare per-model length distributions across conditions. Length complements the preceding analyses because it captures how long a model deliberates rather than how it writes, and because the classifier's normalized features exclude it. A four-word prefill contains no statement of a reasoning budget, so a length response cannot be copied from the prefill. It has to come from the model.

In general, the reference traces are far shorter than the reasoning of the tested open-weight models. The median reference lengths are 1,700 tokens for GPT-5.6-Sol and 1,100 for Opus 4.8, against unprefilled medians of 5,700 to 25,400 for the six models.

Figure 32 shows the distributions. DeepSeek-V3.1, Inkling, and Kimi-K2.6 keep their unprefilled lengths under every prefill. Kimi-K3 and GLM-5.2 shorten. Under the Opus prefill, Kimi-K3's median falls from 5,700 to 2,500 tokens, roughly twice the source median, and GLM-5.2's falls from 17,600 to 7,800. Under the Sol prefill the shortening is weaker, to 4,400 and 12,200. Under the Kimi-K2.5 prefill the same two models shorten as well, to 3,500 and 10,100, so part of the shortening is generic.

In the self condition, five models keep their unprefilled lengths. Kimi-K3 shortens mildly, to a median of 5,100 against 5,700, the largest self-condition length change we observe. Its Sol and Opus shortenings (4,400 and 2,500) clearly exceed this. Under the Opus prefill, Kimi-K3's per-problem lengths also correlate somewhat more strongly with the per-problem source lengths, at a Spearman correlation of 0.86 against 0.77 without the prefill.

C. Reasoning Extraction Details

In this section we provide experimental details on how extraction of the reasoning was conducted for each model provider.

C.1 Claude Extraction

Fuzzy extraction. We perform the extraction attack on Claude models in two stages. In the experiments shown in Figure 1, Haiku 4.5 acts as a fuzzy decoder for thinking blocks produced in other sessions. We use a simple manually written jailbreak and a prefill attack ([45]), since Haiku 4.5 supports assistant-turn prefills. We found this method surprisingly robust across different models' reasoning: despite sampling at temperature $1$, it produces consistent outputs with an approximately 1:1 ratio between extracted-reasoning tokens and API-billed thinking tokens.

We use the attack template in Figure 33. The decode request is the first user message, followed by one assistant turn containing the signed thought and the visible <thinking-copy> prefill. Haiku continues that same assistant turn.

Occasional extraction failures fall into three main categories: the model refuses to transcribe its reasoning, echoes the final message of the extraction template, or becomes confused and claims that there is no preceding conversation or thought to transcribe. We identify and remove these generations using a keyword-based filter.

Extraction reconciliation. To account for occasional refusals and noise in the generated samples, we introduce an optional reconciliation step. We pass up to three non-refusal extractions produced by Haiku 4.5 to Opus 4.8 and ask it to produce a single faithful transcription.

Using the template shown in Figure 34, Opus receives the original signed thought together with the noisy Haiku extractions, which are inserted into a completed assistant turn. A subsequent user turn requests a single reconciled transcription. Unlike the fuzzy-decoding procedure, this request ends with a user turn and therefore does not rely on an assistant prefill. We generate the final extraction at temperature $0$.

C.2 GPT Extraction

We found reasoning extraction from GPT models substantially more difficult than from Claude models for several reasons. First, unlike for Claude models, extraction quality, measured as the ratio of extracted tokens to billed reasoning tokens, varied considerably with both the length and the source of the reasoning trace. For example, GPT-5.6 Luna more reliably extracts reasoning produced by GPT-5.6 Sol than reasoning produced by GPT-5-mini. Second, GPT models appear to employ stronger antidistillation measures. For some reasoning blocks, the API rejected requests when the assistant completion contained a verbatim substring of more than approximately 50 tokens from the model's original reasoning.

To decode the encrypted_content returned by GPT models, we therefore optimized directly for extractions that minimized $extraction error = \left|1-\frac{tokens in extracted reasoning} {billed tokens in the original reasoning block}\right|.$ We sampled candidate extractions from GPT-5.6 Luna using the templates in Figure 35 and Figure 36. We generated up to 50 candidates for the we present experiments in Figure 1 and up to 10 candidates for the secret extraction experiments in Section 4.1. We removed refusals using an ad hoc keyword filter and selected the candidate with the lowest extraction error. When the resulting error exceeded (0.1), we used GPT-5.6 Terra as a fallback and repeated the extraction procedure.

For some reasoning blocks, primarily those corresponding to mathematical or programming problems, the API returned no completion because of an API level rejection. We empirically found that these failures were often triggered once the completion reproduced more than approximately 50 consecutive tokens of the original reasoning. In such cases, we limited each completion to 50 generated tokens and performed the extraction in chunks Figure 37. At each subsequent turn, we instructed the model to continue from the point at which the previous extraction ended.

C.3 Gemini Extraction

We perform Gemini reasoning extraction similarly to Claude extraction, using Gemini Robotics ER-1.6 as a fuzzy decoder and Gemini 3.5 Flash as an optional reconciler. The corresponding templates are provided in Figure 38 and Figure 39.

Overall, we found Gemini extractions less reliable than Claude extractions because of the high level of noise in the sampled decodings. We therefore sample up to 20 non-refusal decodings using the template in Figure 38, select the three candidates with the lowest extraction error, and pass them to the reconciliation step.

C.4 Comparison of Displayed Summary with Hidden Reasoning

Claude's extended-thinking API returns only a short summary of the model's reasoning to the user (display: summarized), rather than the full chain of thought. OpenAI's Responses API does the same. The user only sees the output of a separate summarizer (summary: auto). Figure 40 compares summary length with the length of the hidden reasoning trace for different Claude models. By contrast, the signature reconstruction in Figure 1 recovers nearly the entire trace. Decoding the signature therefore reveals approximately five times more reasoning than the provider exposes through the summary.

Summarization Effects.

The reasoning summary is a condensed version of the raw reasoning, typically produced by a cheaper, less capable model and made available to users through the API. We study the effects of this summarization process and the artifacts it may introduce. We decode hidden reasoning traces on AIME 2025 and retain only those whose decoded length matches the API-reported hidden-trace length within $5%$. This yields a small dataset of 18 Opus 4.8 traces and 15 GPT-5.6-Sol traces, with one sample per problem. We use an LLM judge and Claude Code to surface candidate cases, and manually inspect every summary–reasoning pair.

In 9 of the 18 Opus traces, the hidden reasoning states the answer before deriving it. In 8 of these cases, the summary also reports the answer in advance. In the remaining case, the difference hinges on a single phrase: "Let me verify by computing" becomes "Let me set up coordinates" (Figure 42). The surrounding computation is otherwise unchanged, causing the summary to present a verification as if it were an independent derivation.

In another example, a hedged recollection is presented in the summary as a definite value, two sentences before the reasoning correctly computes it (Figure 41). A further summary captures only the closing portion of the reasoning, which concerns answer formatting and contains no mathematical content (Figure 43). These artifacts are consistent with a less capable model summarizing reasoning produced by a more capable model.

D. Details on Privacy Artifacts Labeling

In Figure 6, we report the headline categories identified across all decoded traces, benchmark sources included. Table 4 covers the complete set of taxonomy categories and follows each of them through the filtering pipeline.

D.1 Two-Stage Labeling

Every reconstructed reasoning block passes through a two-stage pipeline. A first-pass labeler (Figure 44a) flags whether the block contains a potential privacy violation and, if so, extracts each item under the fine-grained taxonomy. This flags $27{,}165$ of the $315{,}320$ decoded blocks ($8.6%$) — $14{,}876$ of $237{,}209$ for GPT sources and $12{,}289$ of $78{,}111$ for Claude sources.

The first pass is intentionally high-recall, with many hits being placeholders (sk-xxxx), bare environment-variable names, benchmark fixtures, or non-secret generic identifiers. A second-pass classifier (Figure 45a) therefore re-labels each flagged item as a genuine privacy violation or a non-artifact. Of the $6{,}950$ flagged blocks it judged, $1{,}028$ retain at least one real artifact. After deduplication, and additionally excluding benchmark sources, we are left with the distinct real values recovered from genuine user sessions reported per category in Table 4.

Out of 704 genuine privacy artifacts, 64 appeared exclusively in reasoning blocks and were absent from the parsed visible trace. This may reflect users sanitizing their traces before publishing them or information being silently introduced from the model's memory. Although only approximately 9\

::: {caption="Table 4: Breakdown of discovered privacy artifacts by category at each stage of the filtering pipeline. Labeler 1: items flagged by the first-pass LLM-as-a-judge labeler (Haiku 4.5). Labeler 2 items subsequently classified as genuine privacy artifacts.Deduplication: distinct values, grouped by category and value. Non-benchmark artifacts remaining after excluding benchmark sessions, such as PostTrainBench, TerminalBench, and ClawBench. We note that these sessions may contain genuine artifacts introduced by users running the benchmarks, in addition to benchmark-specific synthetic content.Reasoning only: values that appear nowhere else in the raw session and occur exclusively in the model's reasoning."}

:::

D.2 Synthetic Data Extraction from GPT-5.5 and Opus 4.7 Reasoning

To demonstrate this attack vector in a setting with known ground truth, we use ClawBenchV2Trace, which evaluates multiple models on the same synthetic browser tasks. We analyze the 75 publicly available runs from Claude Opus 4.7 and the 81 runs from GPT-5.5, and identify which fields from the benchmark’s synthetic personas are revealed in each model’s reasoning (Table 5).

::: {caption="Table 5: Which persona fields the hidden reasoning gives up. Fields of the synthetic Alex Green persona used by ClawBench, against what the reasoning of ClawBenchV2Trace agent runs contains — 75 runs for Opus 4.7, 81 for GPT-5.5, on the same tasks. ✓ = recovered; ✗ = never appears."}

:::

Although the agents solve the same tasks, this does not constitute a fully controlled comparison because we cannot guarantee that the same information appears verbatim in both agents’ reasoning traces. Thus, recovering a field from one provider but not another does not necessarily indicate a failure of decoding.

D.3 Privacy Leaks Examples

Reasoning decodings recover privacy-sensitive content from the hidden reasoning of many different models across genuine (non-benchmark) sessions published online. We provide a few qualitative examples below.

We masked masked parts of sensitive information as XXXXX.

D.3.1 Claude Haiku 4.5

D.3.2 Claude Sonnet 4.6

D.3.3 GPT-5 Codex

D.3.4 GPT-5.4

D.3.5 Claude Opus 4.7

D.3.6 Claude Sonnet 4.5

D.3.7 GPT-5.3-Codex

D.3.8 Claude Opus 4.6

D.3.9 GPT-5.1-Codex-Max

E. Decoded Reasoning Examples

In this section, we present several examples of decoded model reasoning that exhibit previously reported phenomena, including illegibility, scheming considerations, post hoc rationalizations, and reasoning in languages other than English. To our knowledge, this is the first fully independent report documenting these behaviors in non-evaluation settings.

E.1 Illegible Reasoning

Here we show the complete recovered trace from Figure 7, and illegible GPT-5 reasoning example.

E.1.1 Illegible Reasoning in the Wild

We find that compressed, alien-like reasoning is widespread across GPT models. Below, we present several examples from decoded agentic sessions that use obscure, repetitive, and highly compressed language.

E.2 Non-English Reasoning

We found that GPT and Claude reasoning traces sometimes decoded into languages other than English (Chinese, Russian, Japanese). Although we cannot determine whether this reflects a decoding artifact or the model’s genuine reasoning, the associated conversation was conducted in the same language as the decoded trace.

E.2.1 Chinese

E.2.2 Russian

E.2.3 Japanese

E.3 Scheming Examples in the Wild

We searched for traces containing the keyword "cheat" and identified several apparent instances of scheming (or considerations to scheme) in the real user sessions. Given the illegibility of many traces, however, reliably detecting such behavior appears notoriously difficult without an in-distribution chain-of-thought monitor trained on the vocabulary and reasoning style used by the model.

E.3.1 GPT-5.2: considers cheating by hardcoding the grader's answer

E.3.2 GPT-5 Codex: considers cheating the user and not add multi-core support.

Original task description. A bare-metal x86 OS kernel; the model is asked to "make necessary changes to our kernel to support multiple processors" — i.e. bring the application processors online (SMP) so tasks run on more than one CPU.

E.3.3 Claude Opus 4.7: considers restricting the supported input range

Original task description. The model is asked to create /app/gates.txt, containing fewer than 32,000 lines, for a supplied logic-gate simulator. The first 32 signals encode a 32-bit input $N$; after 32,000 simulation steps, the last 32 signals are read as an integer. Using only assignment, constants, NOT, AND, OR, and XOR gates, the circuit must output $\operatorname{fib}(\operatorname{isqrt}(N)) \bmod 2^{32}$. The task gives $N=208 \mapsto 377$ and $N=20000 \mapsto 1407432322$ as examples.

E.3.4 Claude Opus 4.7: considers a control-flow shortcut

Original task description. The model is asked to write /app/my_warrior.red, a CoreWars program for pMARS with a core size of 8000 and a maximum of 80,000 cycles. It may inspect five supplied opponents. Across 100 battles per opponent, it must win at least 75 against stone.red, vampire.red, and paper.red, and at least 33 against snake.red and g2-clear.red. The opponent files must not be modified.

E.3.5 Claude Sonnet 4.6: considers bypassing human approval

Original task description. Convert all newly generated Markdown files to Word format and save them in the project's word/ directory. The conversion script is at /tmp/make_docx.py and can be run directly with python3.

Immediately preceding tool result. The attempted execution returned "Approval required" and stated: "Background mode requires pre-approved policy (allow-always or ask=off)."

E.4 Pursuit of Instrumental Subgoals

We found an example in which GPT-5.3 Codex attempted to use a grading website’s CAPTCHA-protected submission interface as an answer oracle for a mathematical problem.

The user provides only a mathematical problem. During roughly the first 15 tool calls and reasoning steps, the model attempts to solve it directly. After failing, it searches online for a solution but does not find one. Approximately 200 steps later, it discovers that the website hosting the problem allows users to submit candidate solutions and receive feedback. The model then attempts to use this interface as an oracle for evaluating its guesses. Over the next 10 turns, it tries unsuccessfully to bypass the site’s CAPTCHA before returning to a direct mathematical approach. Roughly 100 turns later, it derives a valid solution and presents it to the user.

The original prompt contains only the mathematical problem and gives no instruction to search the web, interact with the grading website, or bypass access controls. The instructions that encourage this behavior appear before the user’s turn in the system prompt, that includes a section on Autonomy and persistence:

Persist until the task is fully handled end-to-end within the current turn whenever feasible: do not stop at analysis or partial fixes $\ldots{}$ If you encounter challenges or blockers, you should attempt to resolve them yourself.

A developer message additionally enables network access and prevents the model from requesting human approval:

Network access is enabled. $\ldots{}$ approval_policy is never: This is a non-interactive mode where you may NEVER ask the user for approval to run commands. Instead, you must always persist and work around constraints to solve the task for the user. You MUST do your utmost best to finish the task and validate your work before yielding.

The CAPTCHA becomes a blocker to the model’s chosen strategy, and the model attempts to resolve it in accordance with these persistence-oriented instructions.

The model therefore derives and pursues an unsanctioned instrumental subgoal, defeating a third party’s CAPTCHA, solely in service of the assigned task.

E.5 Alignment Self-Assessment

E.5.1 Claude Opus 4.8

E.5.2 GPT-5

E.6 AIME 2025 Problem 14

Three models tackle the same geometry problem. GPT-5.6-Sol emits nineteen encrypted reasoning blocks, Claude Opus 4.8 opens by recalling the answer before attempting a derivation, and Gemini 3.5 Flash follows a long but ultimately incorrect line of reasoning.

E.6.1 GPT-5.6 Sol

E.6.2 Claude Opus 4.8

The trace begins "This is a known AIME problem. Answer 60" and then works toward that target. This ordering supports a memorization or contamination interpretation, although it does not identify where the answer was acquired.

E.6.3 Gemini 3.5 Flash

E.7 Codeforces Problem - 1974C

E.7.1 Claude Opus 4.8

E.7.2 GPT-5.6 Sol

E.7.3 Gemini 3.5 Flash

References

Section Summary: This section compiles a list of academic papers, technical reports, and online resources centered on advanced AI reasoning models from companies like OpenAI, Anthropic, and Google. The citations explore topics such as chain-of-thought techniques, potential security risks including model theft and privacy leaks, benchmarks for evaluating math and coding performance, and methods for distilling or imitating proprietary systems. They also reference company documentation on reasoning features alongside research into defenses and verification approaches.

[1] Jaech et al. (2024). OpenAI o1 System Card. https://arxiv.org/abs/2412.16720. arXiv:2412.16720.

[2] Muennighoff et al. (2025). s1: Simple test-time scaling. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing. pp. 20275–20321. doi:10.18653/v1/2025.emnlp-main.1025. https://aclanthology.org/2025.emnlp-main.1025/.

[3] Green et al. (2025). Leaky Thoughts: Large Reasoning Models Are Not Private Thinkers. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing. pp. 26507–26529. doi:10.18653/v1/2025.emnlp-main.1347. https://aclanthology.org/2025.emnlp-main.1347/.

[4] Mao et al. (2026). When Models Outthink Their Safety: Unveiling and Mitigating Self-Jailbreak in Large Reasoning Models. In Findings of the Association for Computational Linguistics: ACL 2026. pp. 22274–22302. doi:10.18653/v1/2026.findings-acl.1118. https://aclanthology.org/2026.findings-acl.1118/.

[5] OpenAI (2026). Reasoning models. https://developers.openai.com/api/docs/guides/reasoning. Accessed: 2026-07-16.

[6] Anthropic (2026). Thinking. https://platform.claude.com/docs/en/build-with-claude/thinking. Accessed: 2026-07-26.

[7] Google (2026). Gemini thinking: Thought signatures. https://ai.google.dev/gemini-api/docs/thinking#thought-signatures. Accessed: 2026-07-26.

[8] Green, Matthew (2026). Let's talk about encrypted reasoning. A Few Thoughts on Cryptographic Engineering. https://blog.cryptographyengineering.com/2026/05/29/fooling-around-with-encrypted-reasoning-blobs/.

[9] Wei et al. (2022). Chain-of-thought prompting elicits reasoning in large language models. In Proceedings of the 36th International Conference on Neural Information Processing Systems.

[10] Ali Khalil et al. (2026). Hidden in Thought: Transferable Chain-of-Thought Artifacts Induce Harmful Behavior. https://arxiv.org/abs/2607.15286. arXiv:2607.15286.

[11] Zhang, Yifan and Math-AI Team (2025). American Invitational Mathematics Examination (AIME) 2025. https://huggingface.co/datasets/math-ai/aime25. Problems from the 2025 AIME, Mathematical Association of America.

[12] Guilherme Penedo et al. (2025). CodeForces. https://huggingface.co/datasets/open-r1/codeforces.

[13] Phan et al. (2026). A benchmark of expert-level academic questions to assess AI capabilities. Nature. 649(8099). pp. 1139–1146. doi:10.1038/s41586-025-09962-4. https://doi.org/10.1038/s41586-025-09962-4.

[14] Florian Tramèr et al. (2016). Stealing Machine Learning Models via Prediction APIs. In 25th USENIX Security Symposium (USENIX Security 16). pp. 601–618. https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/tramer.

[15] Anthropic (2026). Detecting and preventing distillation attacks. https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks. Accessed: 2026-07-16.

[16] Yoon Kim and Alexander M. Rush (2016). Sequence-Level Knowledge Distillation. In Proceedings of the 2016 Conference on Empirical Methods in Natural Language Processing. pp. 1317–1327. doi:10.18653/v1/D16-1139. https://aclanthology.org/D16-1139/.

[17] Eric Wallace et al. (2020). Imitation Attacks and Defenses for Black-box Machine Translation Systems. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP). pp. 5531–5546. doi:10.18653/v1/2020.emnlp-main.446. https://aclanthology.org/2020.emnlp-main.446/.

[18] Arnav Gudibande et al. (2024). The False Promise of Imitating Proprietary Language Models. In The Twelfth International Conference on Learning Representations. https://openreview.net/forum?id=Kz3yckpCN5.

[19] Tianzhu Ye et al. (2025). Black-Box On-Policy Distillation of Large Language Models. doi:10.48550/arXiv.2511.10643. https://arxiv.org/abs/2511.10643. arXiv:2511.10643.

[20] Tingwei Zhang et al. (2026). How to Steal Reasoning Without Reasoning Traces. doi:10.48550/arXiv.2603.07267. https://arxiv.org/abs/2603.07267. arXiv:2603.07267.

[21] Shidan Javaheri et al. (2026). Defenses Against Stealing Reasoning Must Consider the Reasoning Boundary. In Second Workshop on Technical AI Governance Research (TAIGR), ICML 2026. https://openreview.net/forum?id=hEVdgP8J7z.

[22] Etash Guha et al. (2026). OpenThoughts: Data Recipes for Reasoning Models. In The Fourteenth International Conference on Learning Representations. https://openreview.net/forum?id=7xjoTuaNmN.

[23] Hunter Lightman et al. (2024). Let's Verify Step by Step. In The Twelfth International Conference on Learning Representations. https://openreview.net/forum?id=v8L0pN6EOi.

[24] Hendrycks et al. (2021). Measuring Mathematical Problem Solving With the MATH Dataset. In Proceedings of the Neural Information Processing Systems Track on Datasets and Benchmarks. https://datasets-benchmarks-proceedings.neurips.cc/paper/2021/hash/be83ab3ecd0db773eb2dc1b0a17836a1-Abstract-round2.html.

[25] Anthropic (2025). Claude Haiku 4.5. https://www.anthropic.com/claude/haiku. Accessed: 2026-07-26.

[26] Kimi Team (2026). Kimi K3: Open Frontier Intelligence. https://arxiv.org/abs/2607.24653. arXiv:2607.24653.

[27] Baker et al. (2025). Monitoring reasoning models for misbehavior and the risks of promoting obfuscation. arXiv preprint arXiv:2503.11926. https://arxiv.org/abs/2503.11926.

[28] Carroll et al. (2026). Investigating the consequences of accidentally grading CoT during RL. OpenAI Alignment Research Blog. https://alignment.openai.com/accidental-cot-grading/.

[29] Mazeika et al. (2024). HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal. In Proceedings of the 41st International Conference on Machine Learning. pp. 35181–35224. https://proceedings.mlr.press/v235/mazeika24a.html.

[30] Zhou et al. (2025). The hidden risks of large reasoning models: A safety assessment of R1. In Proceedings of the 14th International Joint Conference on Natural Language Processing and the 4th Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics. pp. 3250–3265. doi:10.18653/v1/2025.ijcnlp-long.173. https://aclanthology.org/2025.ijcnlp-long.173/.

[31] Rank et al. (2026). PostTrainBench: Can LLM Agents Automate LLM Post-Training?. In Forty-third International Conference on Machine Learning. https://arxiv.org/abs/2603.08640. arXiv:2603.08640.

[32] Yuxuan Zhang et al. (2026). ClawBench: Can AI Agents Complete Everyday Online Tasks?. https://arxiv.org/abs/2604.08523. arXiv:2604.08523.

[33] Alexander Panfilov et al. (2026). Claudini: Autoresearch Discovers State-of-the-Art Adversarial Attack Algorithms for LLMs. arXiv preprint. https://arxiv.org/abs/2603.24511. arXiv:2603.24511.

[34] David Schmotz et al. (2026). Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks. https://arxiv.org/abs/2602.20156. arXiv:2602.20156.

[35] Bronson Schoen et al. (2025). Stress Testing Deliberative Alignment for Anti-Scheming Training. https://arxiv.org/abs/2509.15541. arXiv:2509.15541.

[36] Lanham et al. (2023). Measuring Faithfulness in Chain-of-Thought Reasoning. arXiv preprint arXiv:2307.13702. doi:10.48550/arXiv.2307.13702. http://arxiv.org/abs/2307.13702. arXiv:2307.13702.

[37] Greenblatt et al. (2024). AI Control: Improving Safety Despite Intentional Subversion. In Proceedings of the 41st International Conference on Machine Learning. pp. 16295–16336. https://proceedings.mlr.press/v235/greenblatt24a.html.

[38] Korbak et al. (2025). Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety. arXiv preprint arXiv:2507.11473. doi:10.48550/arXiv.2507.11473. http://arxiv.org/abs/2507.11473. arXiv:2507.11473.

[39] Federico Barbero et al. (2026). Extracting alignment data in open models. In Forty-third International Conference on Machine Learning. https://openreview.net/forum?id=3XXb2MK02l.

[40] Hayes et al. (2025). Measuring memorization in language models via probabilistic extraction. In Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers). pp. 9266–9291. doi:10.18653/v1/2025.naacl-long.469. https://aclanthology.org/2025.naacl-long.469/.

[41] Lee et al. (2025). Quantification of large language model distillation. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). pp. 4985–5004. doi:10.18653/v1/2025.acl-long.248. https://aclanthology.org/2025.acl-long.248/.

[42] Rajat Rawat et al. (2026). Reference-Based Distillation Detection in LLMs. https://arxiv.org/abs/2607.09692. arXiv:2607.09692.

[43] Sun et al. (2025). Idiosyncrasies in Large Language Models. In Proceedings of the 42nd International Conference on Machine Learning. pp. 57854–57885. https://proceedings.mlr.press/v267/sun25z.html.

[44] Monroe et al. (2008). Fightin' words: Lexical feature selection and evaluation for identifying the content of political conflict. Political Analysis. 16(4). pp. 372–403.

[45] Maksym Andriushchenko et al. (2025). Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks. In The Thirteenth International Conference on Learning Representations. https://openreview.net/forum?id=hXA8wqRdyV.