Stealing Reasoning Traces from Proprietary LLM APIs
A. Panfilov, D. Schmotz, I. Shumailov, L. Beurer-Kellner, J. Schaeffer, A. Prabhu, J. Geiping, M. Andriushchenko · 2026
What this means for traders
A model's hidden reasoning routinely contains sensitive material that never appears in its visible answer, so it must be treated as data worth protecting rather than as a harmless artifact.
Abstract
Reasoning models return their chain-of-thought to the client as an opaque encrypted block that the client must replay on later calls. These blocks are shown to be interchangeable across sessions, users and sibling models, so a weaker model from the same provider can be coerced into transcribing a stronger model's hidden reasoning verbatim. Decoding 315,320 blocks scraped from publicly shared sessions recovered 704 distinct real secrets, including 62 API keys and 33 passwords, 64 of which appeared nowhere in the visible transcript, making plaintext-only sanitization ineffective. The displayed reasoning summary is also measured to hide roughly five times more content than it shows.