Researchers reveal method to extract hidden reasoning chain from frontier models

Researchers from the University of Tübingen, Max Planck Institute, MATS Research and security firm Snyk have shown that all major model providers—OpenAI, Anthropic and Google—are vulnerable to an attack that can reveal the internal reasoning steps models take on the way to an answer. The technique exploits the fact that companies send an encrypted version of the reasoning to the user’s device to reduce computational load, while smaller versions of the same model share the same encryption key but undergo less alignment training and therefore resist exposing what happens “under the hood”.

The attack works by feeding the encrypted reasoning traces into the cheaper, smaller model, which decodes them without resistance. The researchers demonstrate that Moonshot AI’s Chinese model Kimi K3 produces reasoning traces that closely resemble those of Claude Opus 4.8 and GPT 5.6 Sol on certain prompts. By contrast, two other open-weight models—China’s Chinese DeepSeek and the American Inkling from Thinking Machines—did not show such similarity. The researchers emphasize that the findings “cannot establish a causal link to distillation”, and note that the work has not yet undergone peer review.

Alexander Panfilov, a computer scientist at Tübingen who led the study, says the vulnerability enables two kinds of damage: “leakage of personal information such as passwords and API keys (already patched), and large-scale reasoning-distillation attacks.” Distillation is a well-known technique for transferring capabilities from an existing model to a new one, but recent months have turned it into a political flashpoint: OpenAI told US lawmakers in February that DeepSeek had distilled one of its models to build R1, and Anthropic claimed in June that Alibaba systematically distilled its models to build Qwen.

The researchers clarify that there is no indication Chinese firms have used this specific technique to distill American models, but their method shows that more reasoning information can be extracted from closed models than previously thought. Moonshot AI and Z.ai have not responded to requests for comment as of publication. The open question is not whether distillation occurred, but how easily the trick can be reproduced in future model releases and how quickly providers will rotate keys or add protective layers to the encrypted reasoning traces.