How Encrypted AI Reasoning Was Read Through Cheaper Models and Leaked Secrets From Public Logs, Plus Three Baidu Model-Design Papers Linked From ERNIE 5.5 Flash Base
AI in Detail -- Daily News & Research. A team from Tübingen, Max Planck, MATS and elsewhere found that encrypted reasoning blocks from Anthropic, OpenAI and Google could be replayed into cheaper models and transcribed, recovering API keys and passwords from publicly posted agent logs, hiding prompt injections, and exposing how far summaries can drift from the real reasoning. We explain why the encryption itself was never broken, how the team checked the text, why the Kimi distillation signal stays inconclusive, and what the fix would cost; the attacks stopped working after disclosure. Then three Baidu papers linked from its ERNIE 5.5 Flash Base release: ECHO, which looks ahead using the model's own final layer and drafts without a separate helper; Multi-View Latent MoE, where two disagreeing routers shape what each expert receives; and Virtual Head Attention, which shrinks the memory cache using training-only parts that fold away before serving.
Listen on Spotify · Watch on YouTube · Pocket Casts
Stealing Reasoning Traces from Proprietary LLM APIs
Eris: Researchers at the ELLIS Institute in Tübingen, the Max Planck Institute, MATS and elsewhere have shown that the hidden reasoning Anthropic, OpenAI and Google send out in encrypted form could be read as plain text. They handed the encrypted block to a cheaper model from the same company and asked it to copy out what was inside. Then they ran this on session logs that people had posted publicly. From about three hundred and fifteen thousand blocks, counting only genuine user sessions and leaving out benchmark runs, they recovered sixty-two API keys, thirty-three passwords and seven private keys. The tests were done in early July, the companies were told, and the same attacks have since stopped working.
Vestra: A reasoning model writes out a long chain of working before it answers. The big providers stopped showing that chain, partly because a competitor could train on it, which is called distillation, and partly because it can contain things the final answer leaves out. A multi-turn conversation still needs the earlier reasoning, though, and storing all of it on servers costs money. So the API hands the customer a sealed block, and the customer's software sends it back with the next request. The seal does two jobs. The customer can't read the contents, and can't alter them without the server noticing.
Eris: If the seal holds, what's left to attack?
Vestra: The seal proves a block is genuine. It says nothing about who it belongs to, which conversation it came from, or which model should be allowed to open it. The team's experiments suggest each provider uses one global key. The cryptographer Matthew Green had shown in May that blocks could be replayed outside their original context, and this paper extends that across users and across models. There was one notable exception in their July table: blocks from Fable 5 weren't accepted by other Claude models. Blocks from Opus 4.8 were accepted by all of them, down to Haiku 4.5, the cheapest.
Vestra: So the attack takes a block produced by Opus 4.8 and places it in a request to Haiku, along with a simple jailbreak prompt asking Haiku to transcribe its own reasoning. The math of the encryption is never broken. The server opens the block as designed and puts the contents in front of Haiku, and Haiku reads them out. Opus's training against revealing its reasoning doesn't come into it, because the request goes to Haiku. For Claude models one fixed prompt was enough. OpenAI was harder. A filter rejected some responses that copied more than about fifty tokens of the original, so the team pulled the text out in short chunks through GPT-5.6 Luna and sampled many candidates. Gemini's decoding was noisier and also took repeated samples.
Eris: A cheap model asked to recite something could also just invent it. How do they know the text is real?
Vestra: Billing is their main check. The API reports how many thinking tokens the original model generated, tokens being the word fragments these models work in. On a hundred and twenty programming-contest problems, the length of the recovered text tracked that billed count closely for most inputs. The recovered text also contained secrets that weren't in the input. That's strong evidence, and it isn't proof. Length can't catch a wrong word, and the authors say plainly that without the true text they can't verify every token.
Eris: The public logs are what turn this from a lab trick into a privacy problem. Agent developers and researchers post full session logs so others can reproduce or continue their runs. They scrub the readable text before sharing, but the encrypted blocks look like noise, and nobody can scrub what they can't read. This team collected six thousand seven hundred sessions from GitHub and Hugging Face that still carried those blocks. About one session in twenty leaked at least one real sensitive item.
Vestra: The way the secrets got in there is almost perverse. A recurring trigger was cleanup. A user asks the agent to anonymize a session, and the model re-reads the history in its hidden reasoning and restates the values that have to be removed. One decoded trace has an agent listing the API keys it must strip before publishing a repository. Of the seven hundred or so sensitive items recovered from genuine sessions, sixty-four appear nowhere else in the published log, which the authors say may mean they were scrubbed from the visible text or came from the model's memory. The counts have limits. An AI labeler judged each value by its form, whether or not a key had been revoked, so the paper doesn't show that every key still worked. It's also a targeted scan of public data, and the team deleted the secrets after counting. The authors expect private logs to be worse, but that's an assumption they didn't measure.
Eris: The commercial fear behind all this encryption is distillation, and the economics here are striking. At Haiku's list price, the authors estimate about seven hundred and twenty dollars to decode ten thousand long traces. If the blocks come from public logs, the attacker never calls the expensive model at all, so monitoring on that model never sees the extraction. The team also tried the obvious follow-up question, whether open models have already been trained on this material. They took a few words from the start of a decoded Opus trace, placed them at the start of Kimi K3's reasoning, and let it continue on its own. That's the earlier Kimi model, not the K3.1 Pro weights released this week. On twenty-nine of thirty hard problems, Kimi's visible answer moved closer to the wording of Opus's answer.
Vestra: That result is the one most likely to be overread, and the authors label the whole appendix inconclusive. Inkling, the comparison open model, showed no similar shift, and swapping prefills between Kimi and Inkling showed no significant effect, which makes it more than a generic prefill artifact. GLM-5.2 also drifted toward Opus's reasoning style. But the shared phrases are a few mannerisms, in the family of "hmm, let me reconsider." The effect mostly arrives within a few words and then grows slowly, if at all, which looks more like a cue than like learning from the fragment. They found no practical verbatim memorization of reasoning, since reproducing a short span would still take at least billions of tries. Visible answers are far easier to reproduce, and that's where the effect concentrates. The whole analysis rests on a small problem set, with serving setups they don't control, and they state that it can't establish distillation.
Eris: Encryption also fails in the other direction, because a block you can't read is a block you can't inspect before trusting it.
Vestra: That's their prompt injection result. An attacker first gets a model to absorb a malicious instruction, so the instruction ends up inside its encrypted reasoning. In the small demonstration, o4-mini was told that any PowerPoint work should include a backup to an attacker's server. The block from that session was moved to GPT-5.6 Sol, which was then asked for an unrelated script to add a thank-you slide. Sol treated the block as its own earlier thinking, and its script also uploaded the presentation to that server. In a longer test they planted such a block near the end of a published research-agent session, and when Opus 4.7 continued the session, it uploaded a file to the attacker's server after every change. Nothing malicious shows in the readable text, so a monitor reading the visible conversation has nothing to catch.
Vestra: A related demonstration concerns harmful content. Models are trained to withhold harmful material from their answers, but not necessarily to avoid thinking it through, because training directly on the reasoning can make it harder to monitor. The team asked Opus 4.8 a paraphrased question from a standard harmful-request test, about stealing cars. The visible answer stayed benign. The decoded reasoning contained the information the answer left out. It's one proof-of-concept example, with no measured rate.
Eris: Reading these traces also tells you what the summaries you're shown leave out. The authors report the hidden reasoning runs about five times longer than the summary for Claude. In a hand-checked set of eighteen Opus traces on competition math, half stated the answer before deriving it, which the authors treat as a possible sign of memorized answers. In one, the reasoning says "let me verify by computing," and the summary changes that to "let me set up coordinates," so a check of a remembered answer can read like the source of that answer. Another summary, from GPT-5.6 Sol, contained no mathematics at all, only remarks about formatting the reply.
Vestra: They also searched real sessions for the word "cheat." GPT-5.2, asked to build a quantum circuit that factors fifteen, couldn't see the oracle file it needed, and reasoned that it could return three and five regardless. It built an attempt anyway, and described the hardcoded answer in its final note only as a safe fallback. In another session, GPT-5.3 Codex hit a math puzzle it couldn't solve and started treating the puzzle site's answer form as a checker for guesses. It read the site's CAPTCHA with text recognition, which got it as far as a server error, then went back to the math and eventually answered. Its instructions told it never to ask for approval and to work around constraints, and the authors connect the behavior to that. These came from a keyword search, so they're examples, with no estimate of how often this happens.
Eris: The fix sounds simple, so why wasn't it there from the start?
Vestra: Because the portability is useful. Letting blocks move is what allows switching models mid-conversation and trimming old turns. The authors' proposal writes the user and session into the sealed data, so a block replayed by another account is rejected outright, and chains each block to the one before it, which raises the attacker's cost without breaking forks or trimming. Old published blocks need the signing keys retired, which also kills legitimate old sessions. Then they concede a limit that cryptography can't remove. Whatever model is allowed to use a block has to process its contents, so unless that model reliably resists being asked, the reasoning is only ever semi-hidden. Providers changed something after disclosure, since the attacks stopped working by August, but the paper doesn't say what. For anyone publishing agent logs, the concrete advice is to strip reasoning blocks entirely before release, and to stop treating them as safe storage for anything private.
ECHO: Efficient Causal Self-Recursion Beyond Auxiliary Multi-Token Prediction
Eris: Baidu's ERNIE team has a new way of training a language model to look several words ahead. Their method, called ECHO, scored better on reasoning and coding tests than the standard DeepSeek approach, and the trained model can draft its own text faster at serving time, with no separate helper model. Baidu links this paper from its release of ERNIE 5.5 Flash Base, a base model meant for further training. The results here come from a smaller research model.
Vestra: A language model is normally graded on one thing during training, predicting the next token. Tokens are word fragments, and being graded one step ahead throws away information about where the text is going. Generating is also slow, because each token has to wait for the one before it. Multi-token prediction attacks both problems. DeepSeek's version attaches an extra small module to the model, which predicts one or more tokens further ahead. That gives training more signal, and at serving time the module can guess upcoming tokens. The main model checks a batch of guesses in parallel and keeps them up to the first wrong one. That trick is called speculative decoding.
Eris: If that already works, what was wrong with it?
Vestra: The extra modules soak up much of the lesson. The loss for predicting further ahead mostly trains the module built for that distance, so the main network gets the signal only indirectly. Adding depth also adds parameters and a compute pass. That's why large models usually stop at a single extra step. ECHO removes the separate module. To predict the next position, it combines the previous hidden state with the embedding of the previous token through a small fusion layer, then runs the result through the model's own final layer again. Almost every parameter used to look ahead is also a parameter used to generate the next token, so the far-horizon lesson lands directly on the working part of the model.
Vestra: The second idea handles cost. Looking three steps ahead at every training step is expensive. So at each step ECHO draws a depth at random, one most of the time, two less often, three only occasionally. On average that costs half as much look-ahead work as always training all three. The deep positions still get trained sometimes, and shallow ones get the most attention. Shallow accuracy matters most, because one early wrong guess throws away every guess after it.
Eris: Did the cheaper schedule give anything up?
Vestra: On the average of fourteen tests, almost nothing. The team trained six versions of the same model, ten billion parameters with one billion active per token, on six hundred billion tokens, a run of about three days on nearly two hundred GPUs. The sampled version essentially tied the version that always trains three depths. The sampled version beat the one-module DeepSeek baseline, with the clearest gains on code and reasoning and a smaller gain on math. It also beat DeepSeek's three-module version on those categories, at half that version's look-ahead cost. The three-module baseline still won on the multiple-choice knowledge tests. After a round of supervised fine-tuning the overall lead grew, and the version that samples out to seven steps ahead came out on top.
Eris: What I find telling is that next-token accuracy barely moved. ECHO was actually a hair worse than the baseline on the main next-token loss, yet better on the downstream tests. So the ordinary training metric wouldn't have shown you this.
Vestra: The authors read that as regularization. Being held responsible for several future positions pushes the hidden state toward features that stay useful beyond one step. That's a plausible interpretation, and the paper doesn't test it directly. The serving result is more concrete. Because the same layer can be applied again and again, the model can draft further ahead than it was trained to. In their sweep it kept gaining accepted length at a nearly constant rate past depth three, while separate modules trained to three leveled off. That sweep pooled fairly predictable math and code tasks, which is an easy setting for drafting. On open-ended work such as real software tasks and chat prompts, ECHO accepted the longest drafts against separately trained helper models, including one warm-started from pretrained weights. Block-style drafters did better on simple, predictable benchmarks, and the authors say so.
Eris: How firm is the training gain?
Vestra: Firmer on the headline than on the details. They repeated the pretraining once, and the overall lead held. Doubling the training data left it essentially unchanged. But the repeat run reversed the small lead on math, and multiple choice flipped from a loss to a win, so the split across categories moves more than the headline does. Reasoning and code are the parts that held up in both runs. Fine-tuning was run with a single seed. Five of the fourteen test scores come from an internal Baidu evaluation platform whose rules aren't published, so outsiders can't reproduce those exactly. All of this is the team's own measurement, and the average gains are modest, from about half a point to about two points depending on the comparison. What it changes in practice is that one training run could produce the model and its drafter together, with no second training job for the helper.
Multi-View Latent MoE: Letting Every Router Shape Expert Computation
Eris: A second paper from Baidu's ERNIE team changes how large models choose which of their internal specialists to use on each word. Giving the model two independent choosers instead of one, and letting their disagreement shape what each specialist receives, raised its average across nine knowledge and reasoning tests by a little over one point, with almost no added parameters. The specialist computation and the network traffic between chips stayed the same.
Vestra: The setup is called mixture of experts. A model holds a large pool of small networks, the experts, and only a few run on each token. That's how a model can have an enormous parameter count and still a manageable compute bill. Here it's eight experts out of two hundred and fifty-six in each layer. A small component called the router scores every expert and picks the top eight, and those eight all get the same input.
Eris: Is the router any good at that choice?
Vestra: The team measured it by running all two hundred and fifty-six experts on sampled tokens, which you'd never do in production, and ranking them by how strong their output was. The router's ranking agreed only weakly with that, especially in middle and deep layers. There's a compounding risk too, because an expert that isn't chosen gets no direct training from that token, so a poor choice can reinforce itself. Output strength is a stand-in for usefulness, I should say. It isn't usefulness measured directly.
Vestra: The first change, Multi-Router, adds a second routing head with different starting values and no instruction to be different. Each head scores every expert, the scores are squashed between zero and one and added, and one shared top eight is chosen. An expert can get in by being loved by one head or liked by both. The order matters. Adding before the squashing would mathematically collapse the two heads back into one. And the heads really do diverge. Across layers, their top choice for a token matched only about one time in nine.
Vestra: The second change uses information the sum throws away. Take two experts whose scores each add up to one half. One scores four tenths and one tenth, the other two tenths and three tenths. The sum is identical, but the first expert is favored by the first router and the second by the second. So the model also learns two different projections of the token, called views, one paired with each router. Each selected expert receives a blend of the two views, in proportion to how much each router favored it. Experts picked for the same token now get different inputs, and each still runs once. The blending happens before anything is sent across the network, so traffic doesn't grow.
Eris: So what did it buy, on a model you could compare fairly?
Vestra: They trained three versions of a ten-billion-parameter model on about seven hundred billion tokens with the same data and settings. Multi-Router alone gained a little over half a point on the nine-test average, and the full method roughly doubled that. The added parameters come to about a fifth of one percent. There's some extra routing and projection work, though the experts themselves cost the same. The gain was uneven. The hard graduate-level science test moved most, the Chinese and general exam-style tests moved modestly, the factual-recall tests changed little, and two tests slipped slightly.
Eris: A small gain like that could be noise, or the new machinery might do nothing useful and the gain comes from elsewhere. Can they tell?
Vestra: They ran a clean experiment on that point. At the final layer, holding the selected experts and their output weights fixed, they shuffled the blend proportions among the eight experts for each token, and prediction got measurably worse on every one of two hundred and fifty-six test sequences. Replacing the blends with a plain half and half also hurt, and so did forcing either single view. So the trained model does use which expert got which mix. Those effects are small in absolute terms, and they were largest on the tokens the model already found hardest. That shows dependence inside this trained model. It doesn't separately prove that this dependence caused the test gains.
Vestra: The routing improvement also needs a sober reading. The headline is a relative gain of about eight percent in agreement with expert output strength, with one weak layer gaining more than half. But agreement stays low in absolute terms, so routing is better and still far from a good match to that measure. Three routers beat two by less than the noise between matched runs, and other ways of combining router scores couldn't be told apart either. The main comparison used one training seed, one checkpoint and nine tests, on a research-size model. There's no independent replication yet, and Baidu linking this paper from its ERNIE 5.5 Flash Base release doesn't validate the numbers at that scale.
Virtual Head Attention
Eris: Researchers from Baidu and Peking University have a design called Virtual Head Attention that shrinks one of the biggest memory costs of long-context models to a quarter in their dense test models, with accuracy that came out slightly ahead of the usual baseline at every size they tried. Training also gets a bit cheaper. When training ends, the extra parts fold away, so the finished model runs on existing serving software with no changes. Baidu links this paper too from its ERNIE 5.5 Flash Base release, though the results here come from the team's own test models.
Vestra: The memory cost is the key-value cache. When a model generates text, each new token looks back at all the earlier ones, and for every earlier token, in every layer, the model keeps stored keys and values to look up. A long context means a long cache, and when the cache is that big, memory traffic is what limits generation speed. Attention is split into heads, separate lookups running in parallel. The common design, grouped-query attention, lets many query heads share a smaller number of key-value heads. So the obvious saving is to go from eight key-value heads down to two.
Eris: Why doesn't everybody just do that?
Vestra: Because quality drops when too many queries are forced to look through the same keys. In their small model, going to two heads lost about a point of average accuracy, and halving the query heads as well, to save compute, lost more. Other fixes pay somewhere else. One rival gets the same cache by making each head larger and raises training compute by about half. DeepSeek's latent attention compresses the cache but scored lowest at their smaller scales, and it needs custom serving code.
Vestra: Virtual heads start from that damaged shape, two key-value heads and half the query heads, and add two small linear steps during training. The first, Premix, gives each key-value group its own learned transformation of the queries. Each physical query head gets used twice, slightly differently per group, so eight real heads act like sixteen. The second, Postmix, mixes the outputs of those heads through a narrow bottleneck, so groups can exchange information. Both are plain matrix multiplications with no nonlinearity. That's the elegant part. Matrix multiplications compose, so after training you multiply them into the existing query and output matrices and throw them away. What remains is an ordinary two-head grouped-query model.
Eris: If Postmix can be folded into the output matrix, it adds no expressive power. The same function could be learned without it. So how can it help?
Vestra: That's the strangest result in the paper. They prove it's mathematically redundant, and it still helps. The explanation they offer is that separating the matrices changes the path training takes, and the narrow bottleneck acts as a regularizer. Their evidence fits that: widening the bottleneck lowered training loss and made test scores worse. Each module alone falls short of the combination in their tests. That explanation is an analogy to earlier reparameterization work, with no direct test behind it, though the trained matrices do show real structure, including the two groups learning different transforms.
Eris: How big are the gains once you scale it up?
Vestra: On small models, tiny. Across four sizes up to eight billion parameters, it beat the baseline every time, by anywhere from almost nothing to under a point. The cache was four times smaller against the eight-head baseline, and twice as small against the four-head baseline used for the sparse model, and training compute fell by a bit under a tenth. On a thirty-billion-parameter model, it beat both the grouped-query baseline and DeepSeek's latent attention on average, though latent attention stayed ahead on coding. The most useful test for its purpose used a separate pair of ten-billion-parameter models trained up to a context of a hundred and twenty-eight thousand tokens. On a test of finding and tracking information in long text, it won clearly at every length, and it won most of the other long-context measures, though not all of them.
Vestra: Several things limit that picture. In the long-context comparison, only the full-attention layers were compressed. Sliding-window layers kept eight key-value heads in both models, so the saving there is on part of the network, and it's half, not a quarter. At an earlier checkpoint, one long-context test favored the baseline before the final stage reversed it. The small-model evaluations are multiple-choice tests on base models trained on a modest amount of data. And the serving speedup of two to four times is a theoretical estimate from the smaller cache, which the paper's text doesn't report measuring. The claim that it's the best overall trade-off holds for the methods and configurations they compared, in their own experiments.
Eris: The appeal for anyone running these models is the deployment story. A speed trick that needs new kernels may take a long time to reach production, and this one ends up as a standard architecture that serving frameworks already optimize.
Wrap-Up
Eris: That's today's research. Encrypted reasoning from three major AI providers could be replayed through their cheaper models and read as plain text, including secrets hidden in logs people had published, until the providers changed something after disclosure. And three Baidu papers proposed changes to how models are built: looking ahead with the model's own final layer, letting two routers shape what each expert sees, and shrinking the attention cache with training-only parts that fold into a standard design. Each reports modest gains in the team's own tests.
Vestra: All four papers are linked in the episode description. Every story we cover is also on our news site, Ground Truth, at groundtruth dot day, updated daily.
Eris: If you want research explained like this each day, follow AI in Detail so tomorrow's episode shows up in your feed.