Research response to "Stealing Reasoning Traces from Proprietary LLM APIs" (Panfilov et al., arXiv:2608.09867, August 10, 2026)
On August 10, 2026, researchers from ELLIS Institute Tübingen, MPI, and others disclosed a devastating attack on encrypted reasoning (chain-of-thought) in the APIs of Anthropic, OpenAI, and Google.
The core flaw: Encrypted reasoning blocks are fully interchangeable across sessions, users, and models within the same provider. A single global encryption key protects all reasoning for all users. By injecting an encrypted reasoning trace from a frontier model (e.g., Claude Opus 4.8) into a weaker model (e.g., Claude Haiku 4.5), the attacker forces the weaker model to decode and output the frontier model's reasoning verbatim — without ever jailbreaking the frontier model.
- Anti-Distillation Bypass — Extract proprietary reasoning from Opus/GPT-5.6/Gemini for model training
- Private Data Extraction — Decode 315,320 reasoning blocks from public repos, recovering 367 PII artifacts and 182 credentials
- Hidden Hazardous Information — Reasoning contains harmful info even when the visible response is safe
- Invisible Prompt Injection — Embed malicious payloads in encrypted blocks to poison agentic workflows
This paper proves that API-based reasoning encryption provides neither privacy nor security. The fundamental problem: any model that can decrypt and process reasoning tokens is also a potential decryption oracle for an attacker.
The only true protection is sovereignty — owning your model weights, your reasoning traces, and your encryption keys. No API middleman.
Sovereignty Chain (USPTO #64/104,760) was filed specifically to defend against this class of attacks — before this paper was published.
| Attack Vector | Sovereignty Chain Defense | Link |
|---|---|---|
| Cross-model trace injection | Per-model cryptographic binding — reasoning is signed with model-specific keys, not a global key | Link 2 |
| Cross-user/session replay | Session-bound AEAD envelopes — conversation hash chained into MAC | Link 2 |
| Weaker model as decryption oracle | Behavioral canary — detects unauthorized reasoning trace access and triggers alert | Link 3 |
| Anti-distillation extraction | Weight-level protection — abliteration detection via CAV probes on attn.o_proj layers | Link 2 |
| PII leakage in reasoning | Reasoning isolation — sovereign models don't send reasoning to external APIs | Link 1 (sovereign infrastructure) |
| Invisible prompt injection | Harness authentication — Link 4 validates all inputs before model processing | Link 4 |
| Paper's Mitigation (Appendix A) | Our Patent Claim |
|---|---|
| "Embed user_id in AEAD associated data" | Claim 13: Session-bound cryptographic envelope |
| "Hash-chain each envelope to session_id and predecessor" | Claim 14: Chained authentication with predecessor binding |
| "Cross-model isolation at API gateway" | Claim 15: Per-model key derivation (HMAC/PRF/KDF) |
| "Targeted refusal training for transcription prompts" | Claim 16: Behavioral canary detecting extraction attempts |
| "Server-side reasoning storage" | Link 1: Sovereign infrastructure (no external storage needed) |
We filed these claims before this paper existed. The paper independently validates our threat model.
Detailed analysis of the vulnerability with implications for:
- Open-weight model protection (our primary domain)
- API-served model reasoning
- Agentic workflow security
- Multi-model orchestration
Reference implementations of:
- Context-bound AEAD envelopes — per-session, per-user, per-model binding
- Chained reasoning hashes — each reasoning block authenticated against its predecessor
- Behavioral canary probes — detect unauthorized reasoning extraction attempts
- Model-specific key derivation — prevent cross-model decryption
Documentation establishing:
- Our patent claims predate this paper
- Independent validation of our threat model
- Prior art analysis (our filing vs their mitigations)
- Evidence for Petition to Make Special (cybersecurity urgency)
| Date | Event |
|---|---|
| July 2026 | RavenX files Sovereignty Chain provisional (#64/104,760) |
| August 2, 2026 | RavenX documents 7-layer defense architecture |
| August 5-7, 2026 | RavenX completes patent remediation (17 claims for Sovereignty Chain) |
| August 10, 2026 | Panfilov et al. publishes "Stealing Reasoning Traces" (arXiv:2608.09867) |
| August 10, 2026 | This repository created — mapping attacks to our defenses |
| September 4, 2026 | Target: Non-provisional filing with this paper as prior art evidence |
Our patent was filed BEFORE this attack was published. The paper validates our claims.
"These encrypted blocks are fully compatible and interchangeable across different sessions, users, and even different models within a provider's ecosystem."
Our defense: Per-model, per-session, per-user cryptographic binding (Sovereignty Chain Claims 13-15).
"An attacker circumvents the frontier model's alignment entirely, using the weaker, more compliant model as an unwitting decryption oracle."
Our defense: Behavioral canary on all models detects extraction attempts (Claim 16). Model-specific keys prevent cross-model decryption (Claim 15).
"315,320 reasoning blocks... 367 PII artifacts and 182 credentials."
Our defense: Sovereign infrastructure — reasoning never leaves your hardware (Link 1). No API, no encrypted blocks, no extraction surface.
"Whatever model is queried must, by necessity, decrypt and process the contents of prior reasoning tokens... encrypted reasoning blocks can never be more than semi-hidden."
Our defense: This is exactly why sovereignty matters. The paper admits the fundamental limit of API-based encryption. Our answer: own the model, own the reasoning, own the keys.
This paper should be cited in our non-provisional filing as:
- Independent validation of our threat model — researchers discovered the exact attack we designed our defense against
- Evidence of commercial urgency — $30,000 spent on API credits to execute the attack, demonstrating real economic threat
- Support for Petition to Make Special — cybersecurity vulnerability affecting all major AI providers
- Prior art context — our provisional filing predates this paper by 6 weeks
ravenx-stolen-thoughts/
├── README.md # This document
├── docs/
│ ├── ATTACK-DEFENSE-MAP.md # Detailed attack → patent claim mapping
│ ├── PATENT-EVIDENCE.md # Evidence for non-provisional filing
│ └── PAPER-SUMMARY.md # Key findings from the paper
├── defense/
│ ├── context_bound_aead.py # Reference implementation
│ ├── behavioral_canary.py # Extraction detection probes
│ └── key_derivation.py # Per-model key derivation
├── analysis/
│ ├── vulnerability_analysis.md
│ └── sovereign_vs_api.md # Why sovereignty solves this
└── scripts/
└── demo_defense.py # Interactive defense demo
Apache 2.0
Built by RavenX AI Labs
"The only true protection is sovereignty — owning your model weights, your reasoning traces, and your encryption keys."
Filed before the attack. Validated by the paper.