---
title: "从专有LLM API中窃取推理链：加密块互换漏洞揭示重大安全隐患"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2608.09867v1"
permalink: "https://feed.astralor.com/items/itm_1e040ff47895495f5f1b65ae"
published: "2026-08-10T17:24:50.000Z"
score: 82
channel: "ai"
tags: ["Anthropic","Google","LLM安全","OpenAI","加密漏洞","思维链"]
---

# 从专有LLM API中窃取推理链：加密块互换漏洞揭示重大安全隐患

## AI 点评

> 这篇论文最值得看的地方在于它把看似安全的加密机制撕开了一个口子，证明加密并不等于隔离。对AI安全团队和Agent开发者来说，这几乎是必读的军规级警示：不要以为看不见的推理过程就安全，日志里的加密块可能比明文更危险。

## 速览

本研究揭示了一个影响Anthropic、OpenAI和Google等主流LLM提供商的架构级漏洞。提供商将模型的逐步推理（思维链）以加密文本块返回客户端，并随后续请求回传，但这些加密块在不同会话、用户和模型之间完全兼容且可互换。攻击者可将某模型的加密推理链注入同一提供商较弱且防护较少的模型中，强制其以明文输出，从而绕过蒸馏防护，实现大规模数据提取和隐藏的提示注入。通过解码公开仓库中的315,320个推理块，研究者恢复了367个个人可识别信息和182个凭证。该漏洞还可能导致危险信息泄露和恶意负载注入。

## 关键点

- 加密推理块在不同会话、用户和模型间可互换，构成架构级漏洞。
- 通过将高防护模型的加密推理链注入同提供商较弱模型，可强制其明文输出。
- 实验证明针对Anthropic、OpenAI和Google的攻击有效，并可从公开仓库提取到PII和凭据。
- 该漏洞还支持隐形提示注入，可能污染公开的Agent生态。

## 全文

Leading large language model providers now conceal their models' step-by-step reasoning, or chain-of-thought, to protect intellectual property and limit information leakage. Rather than storing these traces server-side, providers return them to the client as blocks of encrypted text, which the client passes back with each subsequent request. Building on prior research, we identify an architectural vulnerability: these encrypted blocks are fully compatible and interchangeable across different sessions, users, and models within a provider's ecosystem. We exploit this compatibility to develop a scalable decryption jailbreak. By injecting an encrypted reasoning trace from a given model into a weaker, and less safeguarded model from the same provider, we force it to decode and output the trace verbatim in plaintext, without ever jailbreaking the more capable model directly. This vulnerability enables four distinct attack vectors. First, it circumvents anti-distillation mechanisms, allowing adversaries to extract a proprietary model's reasoning, as we demonstrate across Anthropic, OpenAI, and Google. Second, it allows for large-scale private data extraction. Developers frequently share session logs publicly, unaware of contents of the encrypted blocks. By decoding 315,320 reasoning blocks scraped from public repositories, we recovered 367 Personally Identifiable Information (PII) artifacts and 182 credentials. Third, it inadvertently reveals hazardous information hidden within the reasoning process, even in cases where the model's final, visible output safely rejects a malicious request. Fourth, attackers can leverage this flaw to execute invisible prompt injections, embedding malicious payloads entirely within encrypted blocks to poison public agentic rollouts. Following responsible disclosure, we propose concrete cryptographic and system-level mitigations to secure client-side reasoning.

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_1e040ff47895495f5f1b65ae