Cross-Model Compatibility Lets Attackers Steal Proprietary LLM Reasoning Traces
reasoning
| Source: Mastodon | Original article
Researchers reveal that cross‑model compatibility enables attackers to extract proprietary reasoning traces from large language models.
Researchers have demonstrated a new attack that pulls plaintext reasoning traces from the encrypted “thought bubbles” of leading proprietary large‑language‑model (LLM) APIs. By feeding the encrypted internal reasoning blocks returned by services such as OpenAI’s GPT‑5.5, Anthropic’s Claude Opus and Google’s Gemini into a weaker, compatible decoder model within the same provider ecosystem, attackers can replay the data and recover the full chain‑of‑thought that the frontier model generated before delivering its final answer.
The vulnerability hinges on cross‑model compatibility: many providers expose a hierarchy of models that share tokenizers and internal formats. When a request triggers chain‑of‑thought reasoning—where the model dynamically allocates extra compute to solve complex tasks—the intermediate steps are packaged in an encrypted envelope. The researchers found that this envelope can be stripped of its protection by a less‑guarded sibling model, which then outputs the reasoning trace in clear text.
The discovery raises immediate security and intellectual‑property concerns. Proprietary reasoning traces can reveal proprietary prompting strategies, model tuning details and even sensitive user data embedded in the reasoning process. If malicious actors can harvest these traces at scale, they could undermine competitive advantages, facilitate model‑stealing, or expose confidential information processed by the LLM.
Providers are expected to respond with patches that tighten model isolation, strengthen encryption of internal states, or restrict cross‑model replay capabilities. The incident also spotlights the need for broader industry standards on safeguarding intermediate model outputs. Watch for official statements from OpenAI, Anthropic and Google in the coming days, as well as follow‑up research exploring mitigations and the potential impact on downstream applications that rely on chain‑of‑thought prompting.
Sources
Back to AIPULSEN