Why Frontier AI Labs Fight to Hide Chain of Thought — Ilia Shumailov & Alexander Panfilov

Frontier LLMs, including those from Anthropic, OpenAI, and Google, share a critical architectural vulnerability that allows the extraction and decoding of "reasoning traces"—the hidden, internal thought processes models generate before producing a final answer. By replaying these encrypted blobs into smaller models, attackers can manipulate model behavior, bypass safety guardrails, and extract sensitive user data, such as passwords or medical information, even if the visible output has been sanitized. This vulnerability stems from stateless architectures that return reasoning to the client, enabling portable, cross-session exploitation. While labs are implementing mitigations, the ease of decoding these traces highlights significant risks regarding model monitoring and the potential for malicious distillation. Ultimately, the research underscores the tension between model efficiency and security, suggesting that current methods for concealing internal reasoning are insufficient against sophisticated, automated exploitation techniques.