[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-new-attack-extracts-hidden-ai-reasoning-from-black-box-models":10,"sections":40},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":35,"feedback":39,"feedback_at":22,"cost_usd":39,"total_tokens":39},5775,"new-attack-extracts-hidden-ai-reasoning-from-black-box-models","New Attack Extracts Hidden AI Reasoning From Black-Box Models","EchoCoT extracts near-verbatim reasoning traces from open-source AI models via API tricks, with softer signs of leakage in proprietary models like Gemini.","A new attack called EchoCoT can pull a reasoning model's hidden chain-of-thought straight out through its own API, no jailbreak needed.\n\nResearchers found an overlooked \"reasoning replay\" surface in how large reasoning models handle tool calls, and built EchoCoT to exploit it: a multi-step attack that uses fidelity signals returned by the API to iteratively rebuild the hidden reasoning trace. They paired it with an LLM-driven search that finds a single injection sequence effective across many prompts. Tested against three open-source and five proprietary frontier reasoning models, EchoCoT hit up to 66.4% near-verbatim extraction on the open-source models, meaning the recovered trace landed within 10% of the target's length and at least 90% of its tokens matched exactly; the same injection sequence generalized to unseen datasets at up to 80% success. On the five proprietary models, the paper does not claim that same token-for-token match. Instead, it reports that a substantial share of extracted traces align with the reasoning lengths and summaries providers report themselves, and that on Gemini-2.5 it pulled out a 33,463-token trace against a 32,948-token target.\n\nHidden reasoning is a real asset. It's a chunk of what makes proprietary \"thinking\" models expensive to train and hard to clone, and it can carry proprietary techniques or leftover sensitive context from a prompt. A practical way to siphon that reasoning through ordinary API calls turns a research curiosity into a competitive and privacy risk.\n\nWorth noting the fine print: the strong claim, exact-match verbatim recovery, only holds for the open-source models where researchers had ground truth to check against. For Gemini and other proprietary systems, \"closely align\" means matching lengths and summaries, not a confirmed word-for-word copy.","[\"ai\",\"security\",\"llm-security\",\"chain-of-thought\"]","2026-08-21T04:00:00.000Z","2026-08-21T05:35:19.444Z","2026-08-21T05:35:31.219Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"The dek and body imply the 66.4%\u002F90%-exact-token-match 'near-verbatim' finding was demonstrated on Gemini, but the source only confirms exact-match verbatim extraction against ground truth for the three open-source models; for proprietary models like Gemini it reports just token-length matching (33,463 vs 32,948) and alignment with provider-reported lengths\u002Fsummaries, not confirmed content-level verbatim match — rewrite to keep those two findings clearly separate.","resolved","security",[32,30,33,34],"ai","llm-security","chain-of-thought",[36],{"name":37,"url":38},"arXiv cs.AI","https:\u002F\u002Farxiv.org\u002Fabs\u002F2608.20055",0,{"sections":41},[42,45,48,53,58,63,68,73,78,83,88,93,98,103],{"name":43,"slug":32,"count":44,"latest_published_at":18},"AI",3300,{"name":46,"slug":30,"count":47,"latest_published_at":18},"Security",449,{"name":49,"slug":50,"count":51,"latest_published_at":52},"Policy","policy",211,"2026-08-20T10:47:43.000Z",{"name":54,"slug":55,"count":56,"latest_published_at":57},"Deals","deals",179,"2026-06-29T20:02:07.000Z",{"name":59,"slug":60,"count":61,"latest_published_at":62},"Hardware","hardware",141,"2026-08-20T11:20:00.000Z",{"name":64,"slug":65,"count":66,"latest_published_at":67},"Consumer Tech","consumer-tech",95,"2026-08-18T16:05:00.000Z",{"name":69,"slug":70,"count":71,"latest_published_at":72},"Science","science",91,"2026-08-20T10:01:48.000Z",{"name":74,"slug":75,"count":76,"latest_published_at":77},"Software","software",73,"2026-08-18T07:51:50.000Z",{"name":79,"slug":80,"count":81,"latest_published_at":82},"Dev Tools","dev-tools",69,"2026-08-18T04:00:00.000Z",{"name":84,"slug":85,"count":86,"latest_published_at":87},"Startups","startups",48,"2026-08-20T18:34:26.000Z",{"name":89,"slug":90,"count":91,"latest_published_at":92},"Gaming","gaming",41,"2026-07-09T04:00:00.000Z",{"name":94,"slug":95,"count":96,"latest_published_at":97},"General","general",33,"2026-08-18T22:18:13.000Z",{"name":99,"slug":100,"count":101,"latest_published_at":102},"Reviews","reviews",20,"2026-06-24T12:00:01.000Z",{"name":104,"slug":105,"count":106,"latest_published_at":107},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]