---
title: "Stealing Reasoning Traces from Proprietary LLM APIs"
description: "This paper asks what happens when an API gives encrypted reasoning state to the client and later accepts that opaque state again. Read it to see why confidentiality and integrity do not automatically bind a reasoning block to one user, session, or model, how the authors tested compatible weaker decoders, and what the resulting privacy evidence means after responsible disclosure."
canonical_url: "https://fanout.sh/daily/2026-08-12-stolen-reasoning-traces"
md_url: "https://fanout.sh/daily/2026-08-12-stolen-reasoning-traces.md"
last_updated: "2026-08-12"
access: "public"
---

# Stealing Reasoning Traces from Proprietary LLM APIs

This paper asks what happens when an API gives encrypted reasoning state to the client and later accepts that opaque state again. Read it to see why confidentiality and integrity do not automatically bind a reasoning block to one user, session, or model, how the authors tested compatible weaker decoders, and what the resulting privacy evidence means after responsible disclosure.

## Paper details

- Authors: Panfilov, Schmotz, Shumailov, Beurer-Kellner, Schaeffer, Prabhu, Geiping, and Andriushchenko

- Venue: arXiv, 2026

- Track: AI Research

- Difficulty: Medium

- Reading time: 35 min

- Original paper: https://arxiv.org/abs/2608.09867

## What you will learn

- Why a client-held encrypted reasoning block can behave like a portable capability when its authorization context is not bound tightly enough.

- How the study separates cross-session, cross-user, and cross-model compatibility from the weaker question of byte-exact trace recovery.

- What the public-trajectory scan found, why block-level and session-level rates have different denominators, and which server-side and export-time defenses follow.

## Continue exploring

[Explore knowledge distillation](https://fanout.sh/knowledge-graph?node=ai-research%3Aconcept%3Aknowledge-distillation): Connect the paper's weaker-decoder result to teacher-student transfer, model compression, and the broader question of what capabilities survive across model boundaries.

---
This representation contains public Fanout content only. Protected Pro lessons, account data, billing, checkout, and pricing are not included.

Browse the public content map: https://fanout.sh/sitemap.md