Major AI Paper: Distillation Defenses of Top Three Global Models Broken—Small Models Extract Hidden Reasoning Chains from Large Models

For a long time, closed-source model vendors have treated 'hidden reasoning chains' as a core moat, encrypting the reasoning process and outputting only final results, attempting to black-box the cognitive process. However, a new paper led by Alexander Panfilov, a researcher at the MATS program, in collaboration with the Max Planck Institute for Intelligent Systems, the ELLIS Institute Tübingen, and the security company Snyk (arXiv:2608.09867), reveals the fragility of this assumption.

The study points out that the APIs of Anthropic, OpenAI, and Google's frontier models contain severe cryptographic bypass vulnerabilities: attackers do not need to crack encryption algorithms; they can recover and transcribe the hidden reasoning chain data from encrypted reasoning blocks simply by using lightweight models with simple prompts. This finding directly overturns the industry consensus that 'encryption equals security.'

The research team fully demonstrated the technical path of 'dimensionality reduction extraction': first, they captured encrypted reasoning chain data packets (Blobs) from API interactions of high-cost top-tier models (such as Claude 3 Opus 4.8), then fed these encrypted packets as context to lightweight models with much lower cost and parameter counts in the same ecosystem (such as Claude Haiku 4.5). By applying specifically crafted jailbreak prompts to the lightweight models to bypass their safety guardrails, the lightweight models acted as 'decoders,' transcribing the top-tier model's original reasoning process verbatim.

The research team acknowledges that, strictly speaking, they cannot prove character-by-character that the recovered results are 100% identical, so they refer to models like Haiku as 'fuzzy decoders.' However, they found a 'ruler': API billing. Experiments showed that for most samples from Claude, GPT, and Gemini, the number of plaintext tokens extracted closely followed the y=x distribution with the billed tokens, showing high consistency.

More critically, this vulnerability exploits the interoperability of data formats across the vendor's internal model matrix, using smaller models with weaker defenses as a breakthrough point, completely avoiding frontal attacks and defenses. According to the paper's calculations, at Haiku 4.5's API price, decoding 10,000 complete reasoning chains costs only about $720, making it scalable.

In the 'Memory Analysis' section, the research team revealed objective evidence that some models deeply absorb competitors' reasoning chains during training through quantitative experiments. They selected models such as Kimi-K3, GLM-5.2, DeepSeek-V4-Flash, Kimi-K2.6, and Inkling for comparison, searching for data fingerprints across three dimensions: 'verbatim extraction probability,' 'output style drift,' and 'reasoning language style.'

Experiments found that Kimi-K3's theoretical query cost to hit Opus reasoning is 4 to 6 orders of magnitude lower than DeepSeek-V4-Flash and Inkling, indicating that Opus's underlying logic is extremely 'familiar' in Kimi-K3's probability space. Injecting only the first 1% of Opus reasoning as a prefix caused Kimi-K3's visible answer style to significantly shift toward Opus, with n-gram word overlap converging; in contrast, the control model Inkling showed no such effect.

To rule out interference from in-context learning, the researchers conducted a 'prefix swap' control experiment: they gave Kimi-K3 Inkling's reasoning prefix and Inkling Kimi-K3's reasoning prefix. The resulting test curves almost completely overlapped with the baseline, indicating that Kimi-K3 showed no style drift when faced with Inkling's drafts.

A more aggressive bottom-line test showed that with only 1 to 16 word prefixes, Kimi-K3 exhibited significant style drift toward GPT-5.6 Sol (style separability AUC dropped from 0.96 to 0.89); GLM-5.2 also showed strong directional drift toward Opus. Once provided with the full Opus reasoning context, the theoretical cost for Kimi-K3 and GLM-5.2 to reproduce Opus's final answer plummeted by about 13 orders of magnitude.

This API vulnerability not only threatens model security but also directly raises enterprise data privacy issues. Many developers habitually publish debug logs containing 'encrypted reasoning packets' to public communities like GitHub and Stack Overflow, mistakenly believing these garbled data are highly secure due to encryption.

The research team exploited the vulnerability to replay and decrypt approximately 7,000 public Trace records, obtaining 62 high-privilege production environment API keys, 33 real email addresses, 33 unmasked high-risk plaintext passwords, as well as numerous internal server paths, database connection strings, and core business logic configuration information. The recovered privacy data included 367 items of personally identifiable information (PII), 363 technical identifiers, and 182 credentials.

This result reveals that the encryption mechanism originally intended to protect model reasoning logic has, due to logical flaws in API design, become a trigger for larger-scale user privacy leaks.

As early as May this year, cryptographer Matthew Green pointed out that encrypted reasoning packets could be captured and replayed externally, and submitted vulnerability reports to relevant vendors. However, the major AI labs responded coldly at the time, officially stating that 'no substantive security threats from side-channel attacks or replay mechanisms have been observed.' Yet, Panfilov's team confirmed the severity of the vulnerability with empirical results.

Prominent AI researcher Nathan Lambert commented that the paper 'is likely to become one of the most influential scientific papers of the year,' and Meta FAIR research scientist Arman Zharmagambetov also expressed strong agreement. The study also found that some models reproduce Claude/GPT reasoning fragments with a probability about a million times higher than other models; merely injecting the beginning of Opus reasoning caused subsequent thoughts to converge significantly, but the authors emphasize this is still insufficient to directly prove distillation.

The research reveals that when cheap lightweight models can serve as 'Trojan horses' to extract core logic from large models, traditional 'anti-distillation' strategies are effectively obsolete. The deeper issue points to alignment and safety regulation of large models: continuing to allow complex cognitive processes to evolve in opaque black boxes will bring systemic risks that are difficult to estimate. How to balance trade secret protection and system transparency will be a core issue that the AI industry cannot avoid in the next phase.