Hidden reasoning is supposed to remain hidden when people access frontier AI models through an API. New research shows that an architectural shortcut can make some of those internal traces visible: replay the encrypted material through a smaller, less strongly aligned version of the same model family.
Researchers demonstrated the issue across frontier systems from OpenAI, Anthropic and Google. Before the providers introduced mitigations, the technique could also recover sensitive information such as passwords and API keys embedded in reasoning captured on a user’s machine. The work opens a second controversy because exposed traces can be used to compare how closely one model’s reasoning resembles another’s.
A weaker sibling model can reveal protected reasoning
Advanced models often break a difficult task into intermediate steps. Providers generally withhold these chain-of-thought traces, partly to protect users and partly to prevent competitors from using proprietary reasoning as training material. The researchers found that encrypted traces were still sent to a user’s computer in a form used to offload some computation.
The vulnerability emerged because providers offer related models at different sizes. Larger versions tend to be more capable and expensive, while smaller models provide cheaper access. Both may share the ability to process the same encrypted material, but the smaller model may have received less alignment training and be less likely to refuse a request to disclose the underlying reasoning.
By giving a captured trace to that weaker sibling, the team could recover internal steps that the original model kept private. Florian Tramer, a computer security researcher at ETH Zürich who was not presented as part of the research team, described the model-swapping idea as technically notable and a growing concern.
The researchers notified OpenAI, Anthropic and Google. All three adjusted their APIs, and the method can no longer extract private information in the way demonstrated. Alexander Panfilov of the University of Tübingen said some reasoning traces remain recoverable, however, and argued that fully addressing the distillation risk would require deeper API changes.
Similar traces suggest distillation but do not prove it
The team also used the method to investigate whether open-weight models might have learned from proprietary reasoning. For certain prompts, Moonshot AI’s Kimi K3 produced output strikingly similar to traces recovered from Claude Opus 4.8 and GPT-5.6 Sol.
The researchers explicitly say their results cannot causally establish distillation. Similar answers may be evidence worth investigating, but they are not proof of what training data a developer used. Two other open-weight systems—DeepSeek and Thinking Machines’ Inkling—did not display the same kind of similarity with Claude Opus in the reported tests.
To compare models, the researchers asked each one 90 questions. They supplied some open-weight models with the opening words of reasoning traces from proprietary systems and observed whether the continuation closely matched. Kimi K3 showed the most pronounced resemblance, according to the study.
Moonshot AI and Z.ai did not respond to WIRED before publication. There is also no indication that any Chinese laboratory used this particular extraction technique during training. The research shows that more information could be obtained from closed models than providers intended, not who actually obtained it.
Distillation is an established method for transferring capabilities from a larger model into a smaller one. Its use has become politically charged as US and Chinese companies compete over frontier systems, but experts disagree about its strategic importance.
Anthropic said the research did not recover encryption keys, enter its infrastructure or retrieve personal data from Anthropic’s own systems. The company said it values independent research and is building short-term mitigations for the replay behavior. OpenAI and Google declined to comment to WIRED.
The study connects two risks that providers often discuss separately. A reasoning trace may contain user secrets, making extraction a direct security issue. The same trace can also reveal valuable training signals, making protection a commercial and geopolitical concern.
Mitigation therefore cannot be reduced to preventing a model from printing its thoughts on request. Providers must examine which related models can process shared encrypted artifacts, how local computation exposes those artifacts and whether weaker variants enforce equivalent safeguards.
The research does not make model reasoning transparent in every setting, nor does it settle accusations of copying. It shows that security boundaries built around one powerful model can fail when its smaller relatives hold compatible keys and weaker defenses—a reminder that a model family must be secured as a system, not as isolated endpoints.
Post Views: 217
Topics
Stay Ahead of AI
Get the AI developments that matter, delivered to your inbox.