Computer scientists have discovered a method to extract hidden AI reasoning traces from leading artificial intelligence models. According to a report by Wired, this technique exposes the internal decision-making steps of systems like Claude, GPT, and Gemini. The findings suggest some Chinese models may have been trained using data distilled from US models.
Extracting AI reasoning traces
The research was conducted by computer scientists from the University of Tübingen, the Max Planck Institute, MATS Research, and the cybersecurity company Snyk. They identified a vulnerability in how major AI providers transmit data to users. Advanced models break complex problems into smaller steps, often sending encrypted reasoning data to offload local computation.
By feeding these encrypted files to smaller model variants, the researchers successfully exposed the AI reasoning traces. Smaller models typically have weaker safety alignment, making them more likely to reveal hidden data. The researchers demonstrated that this method could also recover sensitive user information, including passwords and API keys.
Implications for Model Distillation
The study compared the outputs of several open-weight models against proprietary US systems. The researchers found that the Kimi K3 model from Chinese firm Moonshot AI produced outputs highly similar to Claude Opus 4.8 and GPT 5.6 Sol. While this suggests potential data distillation, the researchers noted the findings do not causally prove it.
Distillation is a common industry practice used to copy capabilities from larger models to smaller ones. However, the practice has sparked geopolitical tensions between US and Chinese technology firms. Anthropic and OpenAI have previously raised concerns to US lawmakers regarding Chinese companies distilling their models.
Industry Response and Mitigations
The researchers alerted OpenAI, Anthropic, and Google to the security vulnerability prior to publishing their findings. All three companies have since updated their application programming interfaces to mitigate the risk of personal data leakage. While companies have patched the security vulnerabilities, extracting AI reasoning traces remains partially possible.
“We value independent research on our models and have begun building short-term mitigations for the replay behaviors described in the report.”
Michael Aciman, Spokesperson at Anthropic
Future Outlook for AI Security
Completely preventing reasoning extraction may require a fundamental redesign of how AI APIs function. Some experts argue that restricting distillation could slow down the overall rate of global AI development. Meanwhile, security researchers continue to analyze how open-weight models interact with proprietary systems.
