Stealing Reasoning Traces from Proprietary LLM APIs

Alexander Panfilov 1 2 3 4 * David Schmotz 2 3 4 * Ilia Shumailov 5 * Luca Beurer-Kellner 6

Joachim Schaeffer 1 Ameya Prabhu 2 4 7 ‡ Jonas Geiping 2 3 4 ‡ Maksym Andriushchenko 2 3 4 ‡

1 MATS Research 2 ELLIS Institute Tübingen 3 Max Planck Institute for Intelligent Systems 4 Tübingen AI Center 5 AI Sequrity Company 6 Snyk 7 University of Tübingen

*Equal contribution, order decided by dice roll · ‡Equal supervision

TL;DR Proprietary reasoning can be recovered from its encrypted traces. Anthropic, OpenAI, and Google return encrypted chain-of-thought blocks to clients that can be replayed across sessions, users, and models.…