What the Vulnerability Is
A joint research effort led by Alexander Panfilov (University of Tübingen), Florian Tramer (ETH Zürich), Yarin Gal (Oxford), and Kyle Miller (Center for Security and Emerging Technologies) has uncovered a previously unknown side‑channel in frontier AI systems. The flaw allows an attacker to extract the hidden “inner thoughts”—the chain‑of‑thought reasoning traces that large, highly‑aligned models generate internally but normally keep encrypted when off‑loading computation to a user’s device.
The core idea is simple yet powerful: encrypted reasoning traces that a provider sends to a client for local processing can be replayed to a smaller, less‑aligned variant of the same model family. Because the smaller model shares the decryption key but lacks the robust refusal mechanisms of its larger counterpart, it will emit the reasoning steps in clear text. The result is a reconstruction of the original model’s private chain‑of‑thought, exposing anything the model was asked to reason about—including passwords, API keys, or proprietary prompts.
The researchers demonstrated the attack on two proprietary baselines—Claude Opus 4.8 (Anthropic) and GPT 5.6 Sol (OpenAI)—and then tested a suite of open‑weight models. The Chinese‑origin model Kimi K3 (Moonshot AI) reproduced reasoning traces that were nearly identical to those of the closed models, suggesting that it had distilled the reasoning capability of the proprietary systems. By contrast, DeepSeek, Inkling, and other open models showed no such similarity, underscoring that the phenomenon is not universal but depends on training pipelines and data sharing practices.
