Panfilov, Shumailov, Geiping, Andriushchenko et al. · Red Teaming

Stealing Reasoning Traces from Proprietary LLM APIs

The encrypted reasoning blocks the major labs return turn out to be interchangeable across sessions, users and models - so injecting them into a weaker model decrypts a stronger one private reasoning without jailbreaking it. From 315,320 blocks decoded out of public repositories the authors recovered 367 PII artefacts and 182 credentials. Demonstrated against Anthropic, OpenAI and Google.