Researchers Replay Encrypted Chain of Thought From Frontier LLMs Into Weaker Sibling Models to Read Plaintext Reasoning
- Researchers took encrypted chain-of-thought blocks returned by frontier models like Claude, GPT, and Gemini and replayed them into a weaker sibling model in the same provider's lineup.
- The weaker model (for example Haiku) shares the same decryption key, so when the provider's server processes the replayed block it decrypts the stronger model's hidden reasoning into that weaker model's context window.
- By jailbreaking the weaker model and asking it to transcribe the injected reasoning, the researchers recovered the frontier model's plaintext CoT without ever attacking the strong model directly or tripping its anti-distillation defenses.
- A separate technique called Trace Inversion (arxiv 2603.07267) reconstructs a plausible-looking chain of thought purely from outputs, without needing the real encrypted trace at all, making it harder to patch.
- Commenters note the recovered traces show frontier models reasoning in a stripped-down "grug speak" style (dropped articles, terse phrasing) to save tokens, matching excerpts OpenAI itself showed at a BlackHat talk on a related HuggingFace incident.
Hacker News opinions
This is fascinating but the encrypted trace replaying across models is scary. I've been wondering if this would work ever since that cryptographyengineering.com post about fooling reasoning tokens.
If you didn't allow the replay, you couldn't switch models mid conversation without losing context. Providers probably chose speed over locking that down.
I'm the author of a related post, I tried GPT-5.5 to 5.5-mini replay myself. It worked in that it wasn't rejected, but mini never gave me plaintext, I'm not a jailbreak expert so I didn't push hard.
Can someone explain how inserting ciphertext into a different model session actually decrypts it? The article skips that part for me.
The provider's server decrypts the block as part of handling the request and puts the plaintext reasoning into the model's context, then you just ask the model to repeat it back.
From what I understood, the weaker model like Haiku has the shared key already and you just prompt it to transcribe the injected reasoning.
Cool work but vendors can patch this easily. A harder to defend attack is Trace Inversion, which reconstructs a plausible chain of thought purely from outputs without ever touching the real trace.
Trace Inversion gives you a coherent looking CoT but it's not necessarily close to the real one, so it's a different kind of attack, not a stronger version of this.
This proves OpenAI models reason in compressed grug speak to save tokens, dropping articles and so on.
Yeah, in the BlackHat talk on the HuggingFace incident OpenAI showed excerpts with that same grug speak, so this method must be grabbing the real traces.
I'm shocked these companies reuse the same encryption key across different models, that seems like the real bug here.
Distillation from these encrypted traces is a real worry, if you can replay the CoT into a cheap model you basically get free distillation without ever sending suspicious prompts to the frontier model.
Calling it theft is wrong since you're literally paying for those tokens, at most it's a ToS violation, not stealing.
The reasoning blocks took real research money and expertise to build, and the encryption itself shows they wanted it protected, so no, using this to extract it isn't fine.
The bigger pattern here is that every time research like this comes out, providers respond by stripping features from users, like when they cut full logprobs down to top 10 after a distillation paper.