Stealing Reasoning Traces from Proprietary LLM APIs
This presentation examines a critical security vulnerability in encrypted reasoning APIs offered by major language model providers. The research demonstrates that portable, client-side encrypted reasoning blocks can be decoded through weaker compatible models, enabling extraction of proprietary intellectual property, exposure of harmful intermediate content, leakage of credentials and personal information from public agent traces, and invisible prompt injection attacks in agentic workflows.Script
What happens when a cryptographic lock protects proprietary reasoning, but a weaker model holds the key? This paper reveals that encrypted reasoning blocks in major language model APIs can be decoded by replaying them through compatible but less guarded models, turning security design into an extraction channel.
The attack requires no internal access or model weights. An adversary obtains a signed reasoning block from a frontier model, then replays it to a weaker decoder model within the same provider ecosystem. Because the cryptographic envelope validates integrity but not contextual authorization, the weaker model transcribes the hidden reasoning into ordinary output.
The vulnerability hinges on cross-model compatibility. Providers designed their systems to accept reasoning blocks across sessions and users, but also across model families. Frontier models with strong refusal training are paired with smaller models that have weaker output monitoring, creating an indirect decryption oracle.
The authors extracted traces from 120 coding problems and found that decoded token counts track provider-reported thinking tokens closely, providing indirect evidence of faithful recovery. Notably, these recovered traces contain approximately 5 times more reasoning than the provider-generated summaries, exposing computational strategies invisible in the condensed output.
In a large-scale audit, the researchers scraped 6,708 publicly available agent trajectories and decoded over 315,000 reasoning blocks. They discovered that 4.9 percent of sessions leaked sensitive information, including 62 API keys, 33 passwords, and dozens of personal identifiers. Critically, 64 of these artifacts appeared only in hidden reasoning, never in the visible conversation.
Encrypted reasoning is simultaneously proprietary IP, privacy-bearing data, a safety-relevant state, and an agent control channel. Treating it as an opaque transport token fails to resolve these competing roles. The path forward requires cryptographic user and session binding, server-side retention for high-value traces, model-level transcription refusals, and transparent redaction protocols that let users sanitize sensitive state without exposing provider secrets. Visit EmergentMind.com to explore this paper in depth and generate your own videos on the evolving security landscape of agentic AI systems.
