---
title: "EchoCoT: Extracting Hidden Chain-of-Thought from Large Reasoning Models"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2608.20055v1"
permalink: "https://feed.astralor.com/items/itm_e88cd6da074ac1bd4ba5710f"
published: "2026-08-20T13:52:07.000Z"
score: 78
channel: "ai"
tags: ["AI Security","EchoCoT","Large Reasoning Models","Chain-of-Thought","Prompt Injection"]
---

# EchoCoT: Extracting Hidden Chain-of-Thought from Large Reasoning Models

## AI commentary

> What makes this paper stand out is that it turns 'is hidden chain-of-thought safe' from speculation into a quantifiable attack demonstration. For model providers relying on CoT as a moat, this is not a surface-level concern but a real threat that requires immediate defensive action. Future work should explore mitigation measures such as output perturbation and reasoning-log sanitization.

## At a glance

Hidden chain-of-thought (CoT) traces, especially those from frontier proprietary large reasoning models (LRMs), are valuable model assets. Yet whether these hidden CoTs can be directly extracted from black-box models remains largely unexplored. In this work, the authors systematically study whether hidden CoTs can be extracted near-verbatim from black-box LRMs through API interactions. They identify a previously overlooked reasoning replay surface between tool calls and develop EchoCoT, a multi-step attack that iteratively extracts hidden CoTs using API-returned fidelity signals. They further develop an LLM-based optimization framework that automatically searches for an effective universal injection trajectory across various datasets. Evaluations on open-source and frontier proprietary LRMs show that EchoCoT achieves up to 66.4% near-verbatim extraction success on open-source LRMs, with extracted trace length within 10% of the target and at least 90% of tokens exactly matching the target CoT. The same injection trajectory generalizes to unseen datasets, achieving up to 80% extraction success. For tested proprietary LRMs, a substantial fraction of extracted CoTs closely align with provider-reported reasoning lengths and available CoT summaries. EchoCoT can also extract very long CoTs: on Gemini-2.5, it extracts 33,463 tokens from a 32,948-token target. These results establish hidden-CoT extraction as a practical security risk and highlight the need to better protect hidden CoT assets.

## Key points

- Identifies an overlooked reasoning replay surface between tool calls as an attack entry for hidden CoT extraction.
- Proposes EchoCoT, a multi-step attack that iteratively extracts hidden CoTs using API-returned fidelity signals.
- Achieves up to 66.4% near-verbatim extraction success on open-source LRMs, and the universal trajectory generalizes to unseen datasets.
- Extracts a 33,463-token CoT from Gemini-2.5, demonstrating hidden-CoT extraction as a practical security risk.

## Full text

Hidden chain-of-thought (CoT) traces, especially those from frontier proprietary large reasoning models (LRMs), are valuable model assets. Yet whether these hidden CoTs can be directly extracted from black-box models remains largely unexplored. In this work, we systematically study whether hidden CoTs can be extracted near-verbatim from black-box LRMs through API interactions. We identify a previously overlooked reasoning replay surface between tool calls and develop EchoCoT, a multi-step attack that iteratively extracts hidden CoTs using API-returned fidelity signals. We further develop an LLM-based optimization framework that automatically searches for an effective universal injection trajectory across various datasets. We evaluate EchoCoT on three open-source and five frontier proprietary LRMs. On open-source LRMs, EchoCoT achieves up to 66.4\% near-verbatim extraction success, with the extracted trace length within 10\% of the target and at least 90\% of tokens exactly matching the target CoT. The same injection trajectory also generalizes to unseen datasets, achieving up to 80\% extraction success under the same criterion. For tested frontier proprietary LRMs, a substantial fraction of extracted CoTs closely align with provider-reported reasoning lengths and available CoT summaries. EchoCoT can also extract very long CoTs: on Gemini-2.5, it extracts 33,463 tokens from a 32,948-token target. These results establish hidden-CoT extraction as a practical security risk and highlight the need to better protect hidden CoT assets.

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_e88cd6da074ac1bd4ba5710f