Can cheaper models decrypt traces from stronger models?

The paper argues that hiding chain-of-thought behind encryption does not keep it hidden, because of how the hiding is built. Providers "conceal their models' step-by-step reasoning" to protect intellectual property, but rather than storing traces server-side they return them to the client as encrypted blocks, which the client passes back with each later request. The authors identify an "architectural vulnerability": these blocks are "fully compatible and interchangeable across different sessions, users, and models within a provider's ecosystem." That compatibility is the whole exploit.

The mechanism, as the abstract states it, is a "decryption jailbreak." An encrypted trace from a capable model is injected into a weaker, "less safeguarded" model from the same provider, which is forced "to decode and output the trace verbatim in plaintext, without ever jailbreaking the more capable model directly." The weak point is the cheapest model in the ecosystem, not the strongest one. The discussion frames the design choice as a cost trade: client-side blocks "mitigate server storage costs," and the "unintended decryption channels" are a side effect of letting any block travel anywhere. The abstract says the attack circumvents anti-distillation mechanisms and demonstrates this "across Anthropic, OpenAI, and Google," and that it allows large-scale private data extraction, since "developers frequently share session logs publicly, unaware of contents of the encrypted blocks."

Against the library, this is a different failure from Do reasoning traces actually expose private user data?. That note is about what a model recollects into its trace. This paper is about who can read the trace once it exists, even when it is deliberately unreadable. The two combine: the introduction says hidden traces hold "intermediate hypotheses, tool outputs, user data, and contextual secrets," so a decryption channel exposes whatever recollection put there. It also sits beside Can reasoning models be steered by injected context without detection? as a second case of planting reasoning-shaped content in a model's context. There the planted content steers behavior. Here it is a genuine trace from another model, planted to be read out. And Can chain-of-thought monitors detect reasoning that originates elsewhere? describes reasoning written elsewhere and re-voiced by the actor. Interchangeable blocks are a provider-level version of that: a trace authored by one model is accepted as context by another with no check on provenance.

The excerpt leaves a lot open. It names "four distinct attack vectors" but states only two, distillation circumvention and private-data extraction, so the other two are unknown here. It gives no success rates, no count of models or providers tested beyond the three named, no account of how the weaker model is induced to decode, and no mitigations. The discussion is forward-looking on transparency: as models process "personal information or API keys" inside a hidden chain of thought, "users lose visibility into how their information is being processed." What the evidence supports is narrow. Cross-compatibility of client-held encrypted traces is a design property that can turn a concealment scheme into a leak. Whether it can be closed without reintroducing server-side storage cost is not answered.