竊取專有LLM API的推理痕跡

摘要

領先的大型語言模型供應商現在會隱藏模型的逐步推理（即思維鏈），以保護智慧財產權並限制資訊洩漏。這些供應商並不會將這些痕跡儲存在伺服器端，而是以加密文字區塊的形式回傳給用戶端，用戶端在後續每次請求時再將這些區塊傳回。在先前研究的基礎上，我們發現了一個架構上的漏洞：這些加密區塊在同一供應商生態系統內的不同對話、使用者與模型之間完全相容且可互換。我們利用這種相容性開發出一種可擴充的解密越獄方法。透過將特定模型的加密推理痕跡注入同一供應商旗下較弱且防護較少的模型，我們迫使該模型直接以明文逐字解碼並輸出這段痕跡，而無需直接對能力較強的模型進行越獄。這個漏洞使得四種不同的攻擊途徑得以實現。首先，它繞過了防蒸餾機制，使攻擊者能夠提取專有模型的推理內容，我們在 Anthropic、OpenAI 和 Google 的模型上均證明了這點。其次，它允許大規模的私人資料竊取。開發者經常公開分享對話紀錄，卻不知道加密區塊的內容。透過解碼從公開儲存庫中蒐集的 315,320 個推理區塊，我們恢復了 367 個個人識別資訊（PII）項目和 182 組憑證。第三，它會意外揭露隱藏在推理過程中的危險資訊，即使在模型最終可見的輸出安全地拒絕惡意請求的情況下也是如此。第四，攻擊者可以利用這個缺陷執行看不見的提示注入，將惡意載入完全嵌入加密區塊中，以污染公開的代理型部署。在進行負責任的揭露之後，我們提出了具體的密碼學與系統層級的緩解措施，以保護用戶端推理的安全性。

English

Leading large language model providers now conceal their models' step-by-step reasoning, or chain-of-thought, to protect intellectual property and limit information leakage. Rather than storing these traces server-side, providers return them to the client as blocks of encrypted text, which the client passes back with each subsequent request. Building on prior research, we identify an architectural vulnerability: these encrypted blocks are fully compatible and interchangeable across different sessions, users, and models within a provider's ecosystem. We exploit this compatibility to develop a scalable decryption jailbreak. By injecting an encrypted reasoning trace from a given model into a weaker, and less safeguarded model from the same provider, we force it to decode and output the trace verbatim in plaintext, without ever jailbreaking the more capable model directly. This vulnerability enables four distinct attack vectors. First, it circumvents anti-distillation mechanisms, allowing adversaries to extract a proprietary model's reasoning, as we demonstrate across Anthropic, OpenAI, and Google. Second, it allows for large-scale private data extraction. Developers frequently share session logs publicly, unaware of contents of the encrypted blocks. By decoding 315,320 reasoning blocks scraped from public repositories, we recovered 367 Personally Identifiable Information (PII) artifacts and 182 credentials. Third, it inadvertently reveals hazardous information hidden within the reasoning process, even in cases where the model's final, visible output safely rejects a malicious request. Fourth, attackers can leverage this flaw to execute invisible prompt injections, embedding malicious payloads entirely within encrypted blocks to poison public agentic rollouts. Following responsible disclosure, we propose concrete cryptographic and system-level mitigations to secure client-side reasoning.