Stealing Reasoning Traces from Proprietary LLM APIs
A. Panfilov, D. Schmotz, I. Shumailov, L. Beurer-Kellner, J. Schaeffer, A. Prabhu, J. Geiping, M. Andriushchenko · 2026
Ce que cela signifie pour vous
Le raisonnement caché d'un modèle contient régulièrement des éléments sensibles absents de sa réponse visible : il doit être traité comme une donnée à protéger, pas comme un artefact inoffensif.
Résumé
Reasoning models return their chain-of-thought to the client as an opaque encrypted block that the client must replay on later calls. These blocks are shown to be interchangeable across sessions, users and sibling models, so a weaker model from the same provider can be coerced into transcribing a stronger model's hidden reasoning verbatim. Decoding 315,320 blocks scraped from publicly shared sessions recovered 704 distinct real secrets, including 62 API keys and 33 passwords, 64 of which appeared nowhere in the visible transcript, making plaintext-only sanitization ineffective. The displayed reasoning summary is also measured to hide roughly five times more content than it shows.