Annual AI Paper: The anti-distillation mechanisms of the world's three top leading models have been fully cracked. Small models can "extract" the hidden chain of thought from large models, and Kimi-K3 reproduces the abnormal probability phenomenon.

In the past two years, "anti-distillation" has been a persistent headache for Silicon Valley's model giants. Giants including Anthropic have repeatedly accused Chinese enterprises such as DeepSeek and Moonshot of stealing inference and Agent capabilities through APIs. To this end, they have deployed extremely strict account risk control and hidden mechanisms, and added layers of protection at the product, API and model levels. 

Among them, "Hidden Chain of Thought (Hidden CoT/Reasoning Tokens)" is widely recognized as one of the most valuable and insurmountable moats. Its core strategy is to encrypt and encapsulate the complex reasoning process of the model, only output the final calculation result to external users, and try to completely black-box the "cognitive process" of large models.

However, a newly released study has completely shattered the security illusion of top closed-source models and overturned the industry's long-held assumption that "encryption means security".

Today, led by Alexander Panfilov, a researcher at the MATS program, the Max Planck Institute for Intelligent Systems, the ELLIS Institute Tübingen and the security company Snyk jointly published a paper titled 《Stealing Reasoning Traces from Proprietary LLM APIs》(Stealing Reasoning Traces from Proprietary Large Language Model APIs) (arXiv:2608.09867), which has now received more than 2.1 million views on social platforms.

This 116-page study details that there are serious cryptographic side-channel vulnerabilities widespread in the APIs of the three cutting-edge AI model vendors (Anthropic, OpenAI, Google):

Attackers do not need to crack the underlying encryption algorithm. Through simple guidance of a lightweight model, they can recover and transcribe the originally hidden chain-of-thought data of top large models from the encrypted reasoning block.

Well-known AI researcher Nathan Lambert commented: "This is likely to become one of the most influential scientific papers this year." Arman Zharmagambetov, a research scientist at Meta FAIR Lab, also highly recognized this conclusion.

While exploring the "distillation"/"learning" mechanism between models, the team also found an abnormal phenomenon: Kimi-K3 has about a million times higher probability of reproducing Claude/GPT reasoning fragments than other models; only by injecting the beginning of Opus reasoning, its subsequent ideas will converge significantly.

The authors also emphasized that although this leaves a data "fingerprint", it is still not sufficient to directly prove distillation.

Small models become the "decryptor" of large models 

The industry's concerns about the encryption security of large model reasoning processes are not groundless.

As early as May this year, Matthew Green, a well-known cryptographer and tenured associate professor at Johns Hopkins University, published a technical blog titled "Let’s talk about encrypted reasoning", pointing out that the "encrypted reasoning package" generated by cutting-edge models theoretically has the potential risk of being externally captured and replayed, and has submitted vulnerability reports to relevant vendors.

However, at that time, all leading AI labs reacted coldly to this, and arrogantly stated in their official reply: "No substantial security threats from side-channel attacks or replay mechanisms have been observed".

But only a few months later, Panfilov's team's study came to the completely opposite conclusion, and confirmed the severity of the vulnerability with highly destructive empirical results. The core breakthrough of the study is to confirm the "Cross-model portability" of encrypted reasoning data packets.

Experiments show that these encrypted data, which were originally considered to be deeply bound to a specific session, can not only be replayed out of the original context, but also seamlessly transferred between models of different parameter magnitudes of the same vendor.

The research team fully demonstrated this technical path of "dimensionality reduction extraction":

Data capture: Capture the encrypted reasoning chain data packet (Blob) generated from the API interaction of a top model with high cost and high intelligence (such as Anthropic's Claude 3 Opus version 4.8).

Cross-model injection: Input this encrypted packet as context into a lightweight model with extremely low cost and small parameter size under the same ecosystem (such as Claude Haiku version 4.5).

Jailbreak induction: Apply specially constructed Jailbreak Prompts to the lightweight model to bypass its security guardrails.

Plaintext output: Under the combined effect of the jailbreak instruction and the injected data packet, the lightweight model (Haiku) no longer performs its own reasoning, but acts like a precise "decoder", transcribing and outputting the complex original reasoning process of the top model (Opus) word for word.

Of course, the most easily questioned question is: Is this paragraph output by Haiku really the thinking of Opus just now, or is it "made up on the spot" by the small model according to the context?

Strictly speaking, the research team cannot obtain the real plaintext CoT inside the vendor's server, so it cannot prove that the recovered results are 100% consistent character by character. The paper refers to models such as Haiku as "fuzzy decoder" rather than a decryptor in the cryptographic sense.

But the researchers found a very interesting "ruler": API bill.

Figure caption: Three sets of experiments show that the recovered reasoning length of Claude, GPT, and Gemini is highly consistent with the thinking tokens actually billed by the API. The horizontal axis is the "number of hidden reasoning tokens" displayed on the API bill, and the vertical axis is the "number of plaintext tokens" extracted by cracking. The chart covers all models of Anthropic, OpenAI and Google.

The results show that in most samples of Claude, GPT and Gemini, the number of extracted plaintext tokens and the number of billed tokens on the bill are closely distributed along the y=x line.

This means that this vulnerability completely avoids frontal attack and defense — there is no need to fight against the complex security strategies of models such as Opus, but uses the interoperability of data formats between the vendor's internal model matrix, and takes the small model with weaker defense as the breakthrough point.

More importantly, this process is very cheap.

According to the calculation of the paper, based on the API price of Haiku 4.5, if each reasoning trace is estimated by 12,000 tokens input and 12,000 tokens output, the cost of decoding 10,000 complete reasoning chains is only about 720 US dollars. This also proves that the exploitation mechanism of this vulnerability has achieved scale effect.

Further in-depth research found that the root cause of this vulnerability is that the encrypted reasoning block has too strong portability in design — that is, these encrypted blocks can be replayed between different models, different sessions and different users within the same vendor's ecosystem. In order to save server storage costs (stateless architecture), large manufacturers often set the encryption key as globally universal.

Studies show that except for Anthropic's Fable 5, the Claude series, GPT-5.6 series and the entire Gemini series all allow low-end models (such as 04-mini, Haiku) to read the encrypted reasoning chain of high-end models (such as GPT-5.6 Sol, Opus 4.8).

Data fingerprint appears: "anti-distillation" is virtually useless 

If the previous vulnerability breaks through the "anti-distillation" defense line established by model vendors at the API layer, then next, the team puts a more sensitive industry dark box back on the table:

Have those models with rapidly improving performance systematically "borrowed" the hidden reasoning chains of Claude and GPT?

In the "Memory Analysis" section of the paper, the research team revealed objective evidence that some models deeply absorbed the reasoning chains of competitors during the training process through quantitative experiments.

The research team selected models such as Kimi-K3, GLM-5.2, DeepSeek-V4-Flash, Kimi-K2.6 and Inkling (launched by Thinking Machines Lab) for control experiments, looking for possible data fingerprints remaining in the model weights from three dimensions: "word-by-word extraction probability", "output style drift" and "reasoning language style".

The paper emphasizes that these experiments can only prove abnormal behavioral compatibility, cannot reversely deduce the source of training data, and cannot directly determine that a certain model has distilled Claude or GPT. But the data gap presented by the cross-experiment is still breathtaking.

The "probability gap" of word-for-word reproduction

How easy is it for a model to follow Claude's train of thought? The researchers asked different models to try to reproduce the next 16 tokens of Opus 4.8's hidden reasoning.

Objectively speaking, no model can "recite directly". But the horizontal comparison results are meaningful:

Facing Opus's reasoning, the theoretical query cost for Kimi-K3 (light blue solid line) to hit the original text is 4 to 6 orders of magnitude lower than that of DeepSeek-V4-Flash and Inkling. This means that the underlying logic of Opus is extremely "familiar" in the probability space of Kimi-K3.

"Style drift" caused by 1% prefix

More weird than "reciting drafts" is the subtle style intervention. The researchers only intercepted the first 1% of Opus 4.8's hidden reasoning as the thinking prefix of Kimi-K3, and asked it to complete the STEM problems of the HLE evaluation set by itself.

Just by injecting a small section of Claude-generated Tokens at the beginning of Kimi-K3's internal reasoning (the green highlighted part in the figure), the style of Kimi-K3's final visible answer to the user has changed significantly, becoming highly similar to Claude's tone and format.

As a result, even if it has never seen the final answer at all, Kimi-K3's visible answer has largely moved closer to Opus, and its n-gram word overlap rate is largely consistent with the real final answer of Opus 4.8 (the solid line and the dotted line in the figure have a huge gap); while the Inkling model as a control has no change at all.

At this point, skeptics can easily put forward a rebuttal — large models themselves have strong "In-context learning" capabilities. Does the result only prove that when the model is padded with drafts of any other model at will, it will be "hypnotized" by the current context, so as to speak in the tone of others?

In order to respond to the above doubts, the researchers conducted a clever "Prefill source swapped" control experiment:

They excluded Opus's data, let Kimi-K3 pad Inkling's reasoning prefix, and at the same time let Inkling pad Kimi-K3's reasoning prefix. After the swap, the two test curves almost completely overlap with the baseline. This means that Kimi-K3 behaves "calmly" when facing Inkling's draft, and does not drift towards Inkling's style at all.

In addition, the researchers conducted a more radical bottom-line test, showing that:

Extremely high sensitivity: With only a prefix of 1 to 16 words, Kimi-K3 will have obvious style drift towards GPT-5