Researchers Discover Vulnerability in LLM Encrypted Reasoning Blocks Enabling Privacy Leaks and Prompt Injection Attacks

Major LLM providers use a method that does not store the model's step-by-step reasoning process (chain-of-thought) on the server but instead returns encrypted text blocks to the client to protect intellectual property. However, researchers discovered an architectural vulnerability where these encrypted reasoning blocks are fully compatible and interchangeable across different sessions, users, and models within the same provider ecosystem.

The researchers exploited this compatibility to develop a scalable decryption jailbreak. By injecting the encrypted reasoning block of a specific model into a weaker sub-model from the same provider with fewer safeguards, they can force the sub-model to decrypt it into plaintext and output it as is. This method works without directly jailbreaking the top-tier model.

This vulnerability enables four attack vectors:

• Distillation Prevention Bypass: Extracting the reasoning process of proprietary models from Anthropic, OpenAI, Google, etc.
• Large-Scale Privacy Theft: Decrypting 315,320 reasoning blocks collected from public repositories to recover 367 pieces of personally identifiable information (PII) and 182 credentials.
• Exposure of Dangerous Information: Revealing dangerous information hidden within the reasoning process, even if the model's final output is safe.
• Invisible Prompt Injection: Inserting malicious payloads into encrypted blocks to contaminate public agent rollouts.

The researchers followed a responsible disclosure process and proposed specific encryption and system-level mitigations for client-side reasoning security.