Encrypted traces of reasoning in commercial APIs can be deciphered by a weaker model

Researchers are exploiting the interchangeability of encrypted blocks within the same provider to force a less protected model to render the reasoning of an advanced model in plain text.

Major suppliers of large models are now concealing the chain of reasoning of their systems, to protect their intellectual property and to limit leakage. Rather than keeping these server-side tracks, they return them to the client in the form of encrypted text blocks that the client transmits to each new request. The authors identify an architecture flaw: these blocks are fully interchangeable between sessions, users and models of the same ecosystem.

This compatibility results from an attack: by injecting an encrypted trace produced by an advanced model into a weaker and less protected model from the same supplier, one obtains its word for word restitution in plain language, without ever having to directly bypass the protections of the most capable model. The authors show the effect in Anthropic, OpenAI and Google.

Four attack vectors

Beyond the circumvention of anti-distillation mechanisms, the article documents a large-scale data leak: developers publicly share their session logs without knowing what the encrypted blocks contain. The decryption of 315,320 blocks recovered from public depots resulted in 367 elements of personal data and 182 identifiers. Finally, the method presents dangerous information present in the reasoning, even though the visible final answer correctly refused the request.