新论文提出 Trace Inversion 攻击，仅凭模型的提问、最终答案及简短推理摘要，即可制造合成推理轨迹训练学生模型，无需匹配受害者真实内部推理。收集 10,000 条 GPT-5.4 mini 查询仅需 $173.28，隐藏思维链无法可靠阻止能力迁移。
You don’t necessarily need to see how a powerful AI thinks to copy some of its reasoning ability.
Its final answers can contain enough signal to manufacture new reasoning traces for training another model.
The paper’s attack, Trace Inversion, only needs the model’s question, final answer, and optionally its short reasoning summary.
A separate inversion model learns from an open reasoning model, then turns those sparse black-box outputs into long synthetic reasoning traces for training a student.
The crucial point is that those traces do not have to match the victim’s true internal reasoning exactly.
They only have to be good enough supervision.
And the paper estimates $173.28 to collect 10,000 GPT-5.4 mini queries.
So the defense problem now shifts: hiding or obfuscating chain of thought can reduce transparency without reliably preventing capability transfer.
The attacker can manufacture the missing training signal after the API call.
Very big warning from this paper. Your AI's hidden reasoning can become a second, invisible data leak. You can clean the visible chat and still accidentally publish passwords, API keys, or private data. A company can secure its smartest model perfectly and still lose its secrets through a cheaper model in the same family. The weakest model can become the security hole for the strongest one. Encrypted reasoning is supposed to hide what frontier models think, but this paper shows the encrypted blob itself can become the attack surface. Anthropic, OpenAI, and Google APIs return opaque reasoning blocks to clients so they can be replayed in later turns without storing the reasoning server-side. The problem is portability: the authors found these blocks could be reused across sessions, users, and even models within the same provider. That lets an attacker take a trace from a stronger model, feed it to a weaker compatible sibling with looser safeguards, and use that model as a decoder. Across public agent logs, the team decoded 315,320 reasoning blocks from 6,708 trajectories; 328 sessions, or 4.9%, leaked at least one sensitive item. In genuine user sessions, they recovered 62 API keys, 33 passwords, 24 access tokens, and 30 personal emails. So an encrypted reasoning field in a log is not necessarily safe metadata if another model can read it. After responsible disclosure, providers patched the reported attacks, and the exact exploits were no longer reproducible by August 2026.在 X 查看被引用的帖子
来源：Rohan Paul · x.com