Encrypted reasoning fails to stop distillation and turns developer logs into a security risk

模型蒸馏攻防的秘诀：厂商藏不住的推理，和你删不掉的密钥

Vendors encrypt model reasoning to block distillation, but two new papers show it barely works. One reveals that encrypted reasoning blocks from Anthropic, OpenAI, and Google are interchangeable across models—attackers can spend $720 to use a weak model like Haiku 4.5 to decode Opus 4.8's reasoning traces in bulk. The other paper goes further: without touching encrypted blocks, an inversion model trained on a 1.5B weak model can reconstruct GPT-5.4 mini's reasoning from public outputs alone, lifting a student model's MATH500 accuracy from 68.4% to 76.0%. The bigger problem is that this encryption dumps risk onto developers. Researchers decrypted 6,708 public Agent traces from GitHub and found 62 API keys, 33 passwords, and 7 private keys—64 of these secrets never appeared in the plaintext conversation. Developers can't inspect or scrub these opaque blocks, so sharing a session log for debugging means exposing secrets you can't even see.

Why it matters: Two papers show encrypted reasoning can be extracted via cross-model attacks for $720, a direct security warning for API builders. Score stays below 85 because it's still a preprint without vendor response or confirmed exploitation at scale.