Extracting Reasoning Traces from Commercial LLM APIs

Proprietary models from major companies like Anthropic, OpenAI, and Google return encrypted Chain-of-Thought (CoT) blocks to clients. These traces have a structure that can be replayed across sessions, users, and models.

Researchers extracted traces generated by frontier models and then replayed them on lower-performing sibling models. Subsequently, they jailbroke the sibling models to recover the hidden reasoning process of the original powerful model in plaintext.

This method has the following characteristics:

• It bypasses anti-distillation defenses by not directly attacking the powerful model.
• The recovered reasoning content closely matches the number of hidden thinking tokens reported by the API.
• The recovered data may contain actual confidential and sensitive information.