Independent replication will determine whether the published attack can recover meaningful hidden reasoning traces from proprietary LLM APIs that do not expose chain-of-thought.

state: expiredheat: lowuncertainty: highknownscott: highllm-security reasoning-traces api-attacks

What is this?

A research paper reports an architectural vulnerability in proprietary LLM APIs that return hidden reasoning traces to clients as encrypted blocks: those blocks could allegedly be replayed across sessions, users, and sometimes sibling models. The researchers say a weaker model could be jailbroken and used as a decryption oracle to recover a stronger model’s hidden reasoning, creating risks including model distillation and behavioral analysis. The supplied snippets describe the authors’ findings and secondary discussion, but do not establish an independent replication; one secondary source says providers implemented mitigations and the attacks were no longer reproducible by August 2026.

Why it matters to Scott

The radar already tracks this exact replication question in `radar:proprietary-api-reasoning-trace-extraction`. It directly bears on Scott’s verification-boundary analysis and provider-bound reasoning-continuity design: successful cross-session, cross-account, or cross-model replay would expose limits in the integrity and isolation assumptions around encrypted reasoning state and could require stricter replay scoping or stripping in agent harnesses.

ip:concept.verification-boundaryip:source.the-unverified-conversation-why-llms-can-t-trust-their-own-history-ebookip:concept.reasoning-paradoxdev:concept.provider-bound-reasoning-continuityradar:proprietary-api-reasoning-trace-extractionradar:concept.llm-securityradar:concept.llm-apisradar:concept.model-distillation

queries asked of Scott's wikis

client-side state trust boundaries in LLM APIs
hidden reasoning traces and chain-of-thought security
agent logging and caching of encrypted reasoning blocks
cross-model replay and decryption-oracle attacks
reasoning-trace leakage as a model-distillation vector
security assumptions for proprietary model APIs

Measured heat

no measured readings yet — the hourly heat pass fills this in

How the heat travelled

no chain yet — the hourly chain pass fills this in

Evidence (4) — ⭐ canonical anchor

source	object	author	score	comments
🟧 hn	Stealing Reasoning Traces from Proprietary LLM APIs	amai	1	0
🟧 echo.blog ⭐	Green’s original post reports his own experiments with encrypted reasoning blobs: replaying unmodified blocks across sessions, accounts, and	Matthew Green	—	—
🟧 hn	Stealing Reasoning Traces from Proprietary LLM APIs	doppp	2	0
🟠 reddit	Trace-Inverter-4B: A Qwen 4B FT on Jackrongs datasets of synthetic traces to support {prompt, final answer} -> synthetic reasoning LocalLLaMA	Signature97	6	3

Interpretation history

2026-08-27T07:30:00Z
Repeated checks have produced no independent replication, provider-specific test, or validation against genuine hidden traces; the adjacent trace-inverter thread has also gone quiet. The original security claim remains unresolved, but this episode has faded and should be reopened only on substantive new testing or provider disclosure.
2026-08-25T06:33:01Z
No independent proprietary-API replication, provider-specific testing, or validation against genuine hidden traces has emerged. The adjacent trace-inverter discussion has run out of new information, leaving the security claim open but cold.
2026-08-23T05:31:18Z
The refreshed discussion only amplifies the adjacent trace-inverter artifact and still provides no independent proprietary-API replication or evidence that synthetic reconstructions match genuine hidden traces. The core security claim remains open and unchanged.
2026-08-21T16:51:28Z
The released 4B trace-inverter makes final-answer-to-synthetic-reasoning reconstruction more implementable, but it is adjacent to the hypothesis rather than an independent test of extracting genuine hidden traces from proprietary APIs. The attack’s reproducibility, provider scope, and practical leakage remain unresolved.
2026-08-21T16:24:21Z
evidence attached: reddit.post.1vujtmx — A released 4B trace-inverter and synthetic datasets provide a concrete follow-on artifact for evaluating recovery of hidden reasoning from final answers.
2026-08-20T03:28:40Z
The attached item is another pointer to the already known paper, not an independent replication or new provider-specific test. The consequential question remains open, with no change to the attack’s demonstrated scope or reproducibility.
2026-08-20T02:22:41Z
evidence attached: hn.story.49369654 — The paper is direct evidence for the open hypothesis that proprietary APIs may leak meaningful hidden reasoning traces.
2026-08-19T17:52:41Z
No independent replication or new provider-specific testing has appeared; the small engagement change only repeats the existing attack claim and does not advance the case.
2026-08-19T17:33:41Z
grounded: known/high — The radar already tracks this exact replication question in `radar:proprietary-api-reasoning-trace-extraction`. It directly bears on Scott’s verification-bounda
2026-08-19T17:31:28Z
origin walked (codex/luna, conf 0.99): anchor hn.story.49364397 -> echo.blog.a0782b34d9 by Matthew Green
2026-08-19T17:30:33Z
case created — The linked paper presents a concrete, consequential attack claim whose effectiveness and provider applicability can be independently tested.

Decision trace

08-27 17:30expireRepeated checks have produced no independent replication, provider-specific test, or validation against genuine hidden traces; the adjacent trace-inverter thread has also gone quiet. The original secu
08-27 17:30alert_silentThe only trigger is staleness, with no consequential new evidence or expected near-term confirmation; there is nothing to surface before a normal briefing.
08-27 17:30alert_routeThe only trigger is staleness, with no consequential new evidence or expected near-term confirmation; there is nothing to surface before a normal briefing.
08-25 16:33repriceNo independent proprietary-API replication, provider-specific testing, or validation against genuine hidden traces has emerged. The adjacent trace-inverter discussion has run out of new information, l
08-25 16:33alert_silentThis check was triggered only by staleness and contains no consequential new evidence; the case can wait for independent replication or a provider disclosure.
08-25 16:33alert_routeThis check was triggered only by staleness and contains no consequential new evidence; the case can wait for independent replication or a provider disclosure.
08-23 15:31repriceThe refreshed discussion only amplifies the adjacent trace-inverter artifact and still provides no independent proprietary-API replication or evidence that synthetic reconstructions match genuine hidd
08-23 15:31alert_silentComment growth adds no provider-specific testing, independent validation, or new capability result, so there is no consequential delta to surface before the next briefing.
08-23 15:31alert_routeComment growth adds no provider-specific testing, independent validation, or new capability result, so there is no consequential delta to surface before the next briefing.
08-22 02:51repriceThe released 4B trace-inverter makes final-answer-to-synthetic-reasoning reconstruction more implementable, but it is adjacent to the hypothesis rather than an independent test of extracting genuine h
08-22 02:51alert_silentThe artifact supplies neither provider-specific testing nor evidence that its synthetic reconstructions match proprietary hidden reasoning, so it does not materially change Scott’s security assumption
08-22 02:51alert_routeThe artifact supplies neither provider-specific testing nor evidence that its synthetic reconstructions match proprietary hidden reasoning, so it does not materially change Scott’s security assumption
08-22 02:24alert_silentThis is an adjacent self-reported experiment, not an independent replication of proprietary trace extraction. It trains a no-bubble inverter from synthetic traces previously produced with bubble-assis
08-22 02:24surface_candidateThis is an adjacent self-reported experiment, not an independent replication of proprietary trace extraction. It trains a no-bubble inverter from synthetic traces previously produced with bubble-assis
08-22 02:24alert_routeThis is an adjacent self-reported experiment, not an independent replication of proprietary trace extraction. It trains a no-bubble inverter from synthetic traces previously produced with bubble-assis
08-22 02:24attachA released 4B trace-inverter and synthetic datasets provide a concrete follow-on artifact for evaluating recovery of hidden reasoning from final answers.
08-22 02:22propose_attachA released 4B trace-inverter and synthetic datasets provide a concrete follow-on artifact for evaluating recovery of hidden reasoning from final answers.
08-20 13:28repriceThe attached item is another pointer to the already known paper, not an independent replication or new provider-specific test. The consequential question remains open, with no change to the attack’s d
08-20 13:28alert_silentThe new attachment adds no findings beyond the tracked paper, so it can wait until an independent replication, provider disclosure, or working implementation appears.
08-20 13:28alert_routeThe new attachment adds no findings beyond the tracked paper, so it can wait until an independent replication, provider disclosure, or working implementation appears.
08-20 12:22alert_silentThis is a duplicate Hacker News link to the already tracked arXiv paper and adds no new findings, replication details, or first-party confirmation. It does not materially change what Scott should know
08-20 12:22alert_routeThis is a duplicate Hacker News link to the already tracked arXiv paper and adds no new findings, replication details, or first-party confirmation. It does not materially change what Scott should know
08-20 12:22attachThe paper is direct evidence for the open hypothesis that proprietary APIs may leak meaningful hidden reasoning traces.
08-20 12:22propose_attachThe paper is direct evidence for the open hypothesis that proprietary APIs may leak meaningful hidden reasoning traces.
08-20 03:52repriceNo independent replication or new provider-specific testing has appeared; the small engagement change only repeats the existing attack claim and does not advance the case.
08-20 03:52alert_silentThis re-evaluation contains no substantive new evidence beyond minor engagement, so it can wait for an independent replication, provider disclosure, or working implementation.
08-20 03:52alert_routeThis re-evaluation contains no substantive new evidence beyond minor engagement, so it can wait for an independent replication, provider disclosure, or working implementation.
08-20 03:49alert_shadowAn arXiv paper now directly addresses the radar’s tracked replication question and explicitly builds on prior replay experiments across sessions, accounts, and models. Its publication is a relevant ne
08-20 03:49alert_routeAn arXiv paper now directly addresses the radar’s tracked replication question and explicitly builds on prior replay experiments across sessions, accounts, and models. Its publication is a relevant ne
08-20 03:33groundThe radar already tracks this exact replication question in `radar:proprietary-api-reasoning-trace-extraction`. It directly bears on Scott’s verification-boundary analysis and provider-bound reasoning
08-20 03:31promote_anchororigin walk conf 0.99
08-20 03:30createThe linked paper presents a concrete, consequential attack claim whose effectiveness and provider applicability can be independently tested.