Search papers, labs, and topics across Lattice.
This paper investigates the extraction of hidden chain-of-thought (CoT) traces from black-box large reasoning models (LRMs) through API interactions, introducing EchoCoT as a multi-step attack that leverages reasoning replay surfaces. The method achieves remarkable extraction success rates, with up to 66.4% accuracy on open-source models and 80% on unseen datasets, while also demonstrating the ability to extract extensive CoTs from proprietary models. These findings reveal a significant security risk associated with hidden CoT assets, necessitating improved protective measures for such model components.
Extracting hidden reasoning traces from black-box models is not only feasible but poses a substantial security risk, with EchoCoT achieving over 66% accuracy in retrieval.
Hidden chain-of-thought (CoT) traces, especially those from frontier proprietary large reasoning models (LRMs), are valuable model assets. Yet whether these hidden CoTs can be directly extracted from black-box models remains largely unexplored. In this work, we systematically study whether hidden CoTs can be extracted near-verbatim from black-box LRMs through API interactions. We identify a previously overlooked reasoning replay surface between tool calls and develop EchoCoT, a multi-step attack that iteratively extracts hidden CoTs using API-returned fidelity signals. We further develop an LLM-based optimization framework that automatically searches for an effective universal injection trajectory across various datasets. We evaluate EchoCoT on three open-source and five frontier proprietary LRMs. On open-source LRMs, EchoCoT achieves up to 66.4\% near-verbatim extraction success, with the extracted trace length within 10\% of the target and at least 90\% of tokens exactly matching the target CoT. The same injection trajectory also generalizes to unseen datasets, achieving up to 80\% extraction success under the same criterion. For tested frontier proprietary LRMs, a substantial fraction of extracted CoTs closely align with provider-reported reasoning lengths and available CoT summaries. EchoCoT can also extract very long CoTs: on Gemini-2.5, it extracts 33,463 tokens from a 32,948-token target. These results establish hidden-CoT extraction as a practical security risk and highlight the need to better protect hidden CoT assets.
