---
title: "Stealing Reasoning Traces from Proprietary LLM APIs: Encrypted Block Interchange Vulnerability Exposes Major Security Risks"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2608.09867v1"
permalink: "https://feed.astralor.com/items/itm_1e040ff47895495f5f1b65ae"
published: "2026-08-10T17:24:50.000Z"
score: 82
channel: "ai"
tags: ["Anthropic","Google","LLM Security","OpenAI","Encryption Vulnerability","Chain-of-Thought"]
---

# Stealing Reasoning Traces from Proprietary LLM APIs: Encrypted Block Interchange Vulnerability Exposes Major Security Risks

## AI commentary

> What makes this paper a must-read is how it tears open a seemingly secure encryption mechanism, proving that encryption does not equal isolation. For AI security teams and agent developers, this is a crucial warning: never assume hidden reasoning is safe, as encrypted blocks in logs can be more dangerous than plaintext.

## At a glance

This study reveals an architectural vulnerability affecting major LLM providers such as Anthropic, OpenAI, and Google. Providers return models' step-by-step reasoning (chain-of-thought) to clients as encrypted text blocks, which are sent back with each request, but these encrypted blocks are fully compatible and interchangeable across sessions, users, and models. An attacker can inject an encrypted reasoning trace from one model into a weaker, less safeguarded model from the same provider, forcing it to output the trace verbatim in plaintext, thereby bypassing anti-distillation protections and enabling large-scale data extraction and hidden prompt injection. By decoding 315,320 reasoning blocks scraped from public repositories, the researchers recovered 367 PII artifacts and 182 credentials. The flaw may also lead to hazardous information leakage and malicious payload injection.

## Key points

- Encrypted reasoning blocks are interchangeable across sessions, users, and models, creating an architectural vulnerability.
- Injecting encrypted traces from a safeguarded model into a weaker model from the same provider forces plaintext output.
- Attacks are demonstrated against Anthropic, OpenAI, and Google, recovering PII and credentials from public repositories.
- The flaw enables invisible prompt injection, potentially poisoning public agentic rollouts.

## Full text

Leading large language model providers now conceal their models' step-by-step reasoning, or chain-of-thought, to protect intellectual property and limit information leakage. Rather than storing these traces server-side, providers return them to the client as blocks of encrypted text, which the client passes back with each subsequent request. Building on prior research, we identify an architectural vulnerability: these encrypted blocks are fully compatible and interchangeable across different sessions, users, and models within a provider's ecosystem. We exploit this compatibility to develop a scalable decryption jailbreak. By injecting an encrypted reasoning trace from a given model into a weaker, and less safeguarded model from the same provider, we force it to decode and output the trace verbatim in plaintext, without ever jailbreaking the more capable model directly. This vulnerability enables four distinct attack vectors. First, it circumvents anti-distillation mechanisms, allowing adversaries to extract a proprietary model's reasoning, as we demonstrate across Anthropic, OpenAI, and Google. Second, it allows for large-scale private data extraction. Developers frequently share session logs publicly, unaware of contents of the encrypted blocks. By decoding 315,320 reasoning blocks scraped from public repositories, we recovered 367 Personally Identifiable Information (PII) artifacts and 182 credentials. Third, it inadvertently reveals hazardous information hidden within the reasoning process, even in cases where the model's final, visible output safely rejects a malicious request. Fourth, attackers can leverage this flaw to execute invisible prompt injections, embedding malicious payloads entirely within encrypted blocks to poison public agentic rollouts. Following responsible disclosure, we propose concrete cryptographic and system-level mitigations to secure client-side reasoning.

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_1e040ff47895495f5f1b65ae