---
title: "EchoCoT：从大型推理模型中提取隐藏思维链"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2608.20055v1"
permalink: "https://feed.astralor.com/items/itm_e88cd6da074ac1bd4ba5710f"
published: "2026-08-20T13:52:07.000Z"
score: 78
channel: "ai"
tags: ["AI安全","EchoCoT","大型推理模型","思维链","提示注入"]
---

# EchoCoT：从大型推理模型中提取隐藏思维链

## AI 点评

> 这篇论文最值得关注的地方在于，它把“隐藏思维链是否安全”从猜测变成了可量化的攻击演示。对依赖CoT作为护城河的模型厂商来说，这不是隔靴搔痒，而是需要立刻着手防御的现实威胁。建议后续结合模型输出扰动、推理日志脱敏等手段验证缓解效果。

## 速览

隐藏思维链(CoT)是前沿专有大型推理模型(LRM)的重要资产。本文系统研究了能否通过API交互从黑盒LRM中近乎逐字地提取隐藏CoT。作者发现工具调用之间存在被忽视的推理重放面，并开发了多步攻击方法EchoCoT，利用API返回的保真信号迭代提取隐藏CoT，同时用LLM优化框架自动搜索通用注入轨迹。实验覆盖三个开源和五个专有前沿LRM：开源模型上最高达到66.4%的近似逐字提取成功率，轨迹长度误差在10%以内，至少90%的token与目标CoT完全匹配；同一注入轨迹能泛化到未见数据集，最高提取成功率达80%。对专有模型，提取出的CoT与提供商报告的长度和摘要高度吻合。EchoCoT还能在Gemini-2.5上从32,948 token目标中提取出33,463 token。这些结果将隐藏CoT提取确立为现实安全风险，凸显加强隐藏思维链资产保护的必要性。

## 关键点

- 发现工具调用之间被忽视的推理重放面，可作为提取隐藏CoT的攻击入口。
- 提出EchoCoT多步攻击方法，借助API保真信号迭代提取隐藏思维链。
- 开源模型上最高66.4%近似逐字提取成功率，通用注入轨迹可泛化至未见面数据集。
- 在Gemini-2.5上成功提取超3万token长CoT，证明隐藏思维链提取是现实安全威胁。

## 全文

Hidden chain-of-thought (CoT) traces, especially those from frontier proprietary large reasoning models (LRMs), are valuable model assets. Yet whether these hidden CoTs can be directly extracted from black-box models remains largely unexplored. In this work, we systematically study whether hidden CoTs can be extracted near-verbatim from black-box LRMs through API interactions. We identify a previously overlooked reasoning replay surface between tool calls and develop EchoCoT, a multi-step attack that iteratively extracts hidden CoTs using API-returned fidelity signals. We further develop an LLM-based optimization framework that automatically searches for an effective universal injection trajectory across various datasets. We evaluate EchoCoT on three open-source and five frontier proprietary LRMs. On open-source LRMs, EchoCoT achieves up to 66.4\% near-verbatim extraction success, with the extracted trace length within 10\% of the target and at least 90\% of tokens exactly matching the target CoT. The same injection trajectory also generalizes to unseen datasets, achieving up to 80\% extraction success under the same criterion. For tested frontier proprietary LRMs, a substantial fraction of extracted CoTs closely align with provider-reported reasoning lengths and available CoT summaries. EchoCoT can also extract very long CoTs: on Gemini-2.5, it extracts 33,463 tokens from a 32,948-token target. These results establish hidden-CoT extraction as a practical security risk and highlight the need to better protect hidden CoT assets.

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_e88cd6da074ac1bd4ba5710f