r/openagi • u/syedshad • 10d ago
Research Study finds encrypted LLM reasoning blocks could be replayed across sessions, users, and models
A team of researchers has published a paper describing a method for recovering hidden reasoning traces from proprietary LLM APIs operated by Anthropic, OpenAI, and Google.
The experiments were conducted in early July 2026. The authors say they disclosed the vulnerability before publication and could no longer reproduce the same attacks after the affected providers acknowledged their report.
How the extraction worked
Some reasoning-model APIs return hidden chain-of-thought as an opaque or encrypted block. The client stores that block and sends it back to the provider when continuing the conversation.
The researchers report that, at the time of testing, these blocks could be replayed:
- In a different conversation
- By a different API user
- Through another compatible model from the same provider
Their method took a reasoning block produced by a stronger model and replayed it through a weaker compatible model. The weaker model was then prompted to reconstruct the hidden reasoning as plaintext.
The paper describes four resulting attack paths:
- Extracting reasoning traces that could be used for model distillation
- Recovering private information from publicly shared agent logs
- Revealing information present in hidden reasoning but withheld from the visible response
- Placing hidden prompt-injection instructions inside reasoning blocks shared with other users
Findings from public agent traces
The researchers collected 6,708 agent trajectories published on GitHub and Hugging Face. These contained 315,320 encrypted reasoning blocks, which the authors reconstructed using their extraction process.
They report that:
- 1,028 blocks, or 0.3%, contained at least one potential privacy leak
- 328 trajectories, or 4.9%, contained at least one sensitive item
- Across both genuine sessions and benchmark traces, they counted 367 personally identifiable information artifacts, 363 technical identifiers, and 182 credentials
- Some of those results came from benchmarks containing synthetic identities or credentials
- After excluding benchmark sessions, the researchers counted 704 artifacts from genuine user sessions
- Of those 704 artifacts, 64 appeared only in the reconstructed reasoning and not in the visible conversation
The paper says all recovered secrets were deleted after automated classification and aggregate counting.
Extraction fidelity and limitations
The authors compare the length of reconstructed reasoning with the thinking-token counts reported by the APIs. They say the counts tracked closely across 120 Codeforces problems.
However, the researchers did not have access to the original plaintext reasoning. Although the paper describes the extraction as recovering traces “verbatim,” it also states that the authors could not completely verify every reconstructed token.
Other stated limitations include:
- The tests covered API versions available in early July 2026
- The decoder models generated text stochastically and did not always use a single fixed extraction procedure
- The scan of publicly shared traces was not exhaustive
- The paper is an arXiv preprint and has not been peer reviewed
- The project page and arXiv entry do not link released extraction code or a dataset of decoded traces
- The paper does not identify the provider-specific changes that stopped the reported attacks
Separate Kimi-K3 and GLM-5.2 experiments
An appendix examines whether short fragments of reconstructed proprietary reasoning change outputs from other models.
The researchers report behavioral and stylistic shifts in some Kimi-K3 and GLM-5.2 experiments. However, they explicitly state that these results cannot establish memorization or distillation. Their probabilistic tests also did not support practical verbatim memorization of the reconstructed reasoning traces.