Encrypted LLM Reasoning Traces Can Be Decoded, Leaking Secrets and Enabling Distillation

Researchers have shown that the encrypted chain-of-thought blocks major providers return to API clients aren’t as private as they look. Anthropic, OpenAI, and Google all ship these signed reasoning blocks alongside model responses, and the team found they can be replayed across sessions, users, and even different models. The attack sidesteps the frontier model entirely: a trace from a strong model is fed into a weaker sibling, which is then jailbroken to emit the hidden reasoning in plaintext — never touching the strong model’s anti-distillation defenses directly.

Run at scale, the technique proved both a privacy and an intellectual-property problem. From 6,708 public agent trajectories scraped off GitHub and Hugging Face, the pipeline reconstructed roughly 315,000 reasoning blocks. Within genuine user sessions it surfaced 704 distinct secrets — 62 API keys, 33 passwords, 24 access tokens, and dozens of email addresses, internal URLs, and other identifiers. Notably, 64 of those artifacts existed only inside the hidden reasoning and never appeared in the visible conversation, meaning data users assumed was ephemeral was recoverable from cached traces.

The work also undercuts two things labs count on. Seeding a weaker model (Kimi-K3) with just the first 1% of Opus 4.8’s reasoning pulled its answers toward Opus’s phrasing, demonstrating a cheap distillation vector. And because hazardous content a model reasons through but hides from its benign visible answer is also recoverable, the safety benefit of keeping reasoning private is weakened. The authors further note that provider-generated reasoning summaries can misrepresent what actually happened — smoothing an answer-first guess into a clean derivation. The findings are detailed in an arXiv preprint (2608.09867).